For the past few weeks, every Monday morning between about 6:30 and 7:45, in a burst lasting less than a second, my Ubuntu 14.04.5 LTS fileserver logs a spate of errors from smbd.
../source3/param/loadparm.c:3259(process_usershare_file) process_usershare_file: stat of /var/lib/samba/usershares/q.exe failed. Permission denied process_usershare_file: stat of /var/lib/samba/usershares/q.exe failed. No such file or directory
This repeats with
q.exe changed to
/var/lib/samba/usershares is empty.
The irregular timestamps suggest that these errors don't stem from a cron job on the server itself.
The suffixes suggest that they relate to Windows.
The steady once-a-week timing makes malice unlikely.
So what causes them? Is some other host attempting to run Windows Defender on a mount point? (One of the fileserver's /etc/samba/smb.conf entries is
[q].) More directly:
- Can I prevent these errors from occuring in the first place?
- Can I safely ignore these errors (by filtering them with logcheck)?