1

For the past few weeks, every Monday morning between about 6:30 and 7:45, in a burst lasting less than a second, my Ubuntu 14.04.5 LTS fileserver logs a spate of errors from smbd.

../source3/param/loadparm.c:3259(process_usershare_file)
process_usershare_file: stat of /var/lib/samba/usershares/q.exe failed. Permission denied
process_usershare_file: stat of /var/lib/samba/usershares/q.exe failed. No such file or directory

This repeats with q.exe changed to q.dll, q.lnk, q.cmd, q.bat, q.com, and q.pif.

The directory /var/lib/samba/usershares is empty.

The irregular timestamps suggest that these errors don't stem from a cron job on the server itself.

The suffixes suggest that they relate to Windows.

The steady once-a-week timing makes malice unlikely.

So what causes them? Is some other host attempting to run Windows Defender on a mount point? (One of the fileserver's /etc/samba/smb.conf entries is [q].) More directly:

  • Can I prevent these errors from occuring in the first place?
  • Can I safely ignore these errors (by filtering them with logcheck)?
  • 1
    Can you monitor network traffic during the burst of traffic to identify whether a host on the network is the culprit? Perhaps there's a host with malware that's scanning all SMB shares on the network looking for particular files? – Dave Lucre Feb 21 '17 at 23:00
  • While thinking about how to do that next Monday, your note here sparked an idea, which worked. grep process_usershare_file /var/log/samba/* found such lines in only one host-specific file, /var/log/samba/log.stupidWin7Host. That host was mounting that [q] share, and running Microsoft Security Essentials at that time of week. Culprit found. So I've answered my own bounty. What's the etiquette now? – Camille Goudeseune Feb 22 '17 at 21:26
  • 1
    Glad you found the culprit. I think at this point you should Submit an answer to your question with how you solved it, and then mark it as the correct answer. I'm keen to know what configuration on the Win7 host caused this behavior. – Dave Lucre Feb 22 '17 at 21:27
  • MSE, fair enough :) Glad to have helped! – Dave Lucre Feb 22 '17 at 21:30
0

grep process_usershare_file /var/log/samba/* found such lines in only one host-specific file, /var/log/samba/log.stupidWin7Host. That host was mounting that [q] share, and running Microsoft Security Essentials at that time of week.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.