Nimbostratus

Mar 11, 2014

Configuration SMB Monitors

Hi, We are looking to load balance CIFS servers using the F5 - the idea is we have two servers, a primary and a secondary. I'd like to only use the secondary when the primary fails (using priority groups), but I'm having trouble getting the Monitor to work. We're running 11.4.1 on our LTM and I've set a health monitor up as follows:

ltm monitor smb /Common/cifs_monitor {
debug yes
defaults-from /Common/smb
destination *:*
get file.txt
interval 10
password mypassword
server longweb03sandbo
service share
time-until-up 0
timeout 31
username myuser

The basic check works, but as soon as I try to put in a "file" to check, the pool is marked as down. It's probably irrelevant, but I'm using Samba on a Linux box for this test - the service is "share" and there is a file called file.txt in the root folder of this share. Regardless of whether I name the file share/file.txt, \share\file.txt, file.txt, etc it won't recognise the file.

Is there something I am doing wrong? Thanks!

It seems as though the issue was due to a missing directory. The message below which was seen in the logs was due to the local directory not being present.

file.txt was not transferred: No such file or directory

The monitoring uses /var/run/monitors as a default directory. This appears to be hardcoded. The get commands are successful and the files are being placed in /var/run as indicated by the preceding lines in the logs.

smbclient //longweb03sandbo/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get file.txt file.txt.18261 -U myuser 
dirstring: Current directory is \
Domain=[LONGWEB03SANDBO] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
getting file \file.txt of size 2 as file.txt.18261 (0.5 kb/s) (average 0.5 kb/s)
Recvd: 'Current directory is \

Creating /var/run/monitors directory resolved the issue. We now get:

smbclient //longweb03sandbox/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get damian.txt damian.txt.24691 -U 101135 
dirstring: Current directory is \
Domain=[LONGWEB03SANDBO] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
getting file \damian.txt of size 6 as damian.txt.24691 (1.5 kb/s) (average 1.5 kb/s)
Recvd: 'Current directory is \
'
up

Cory_50405
Noctilucent
Mar 11, 2014
I'll ask an obvious question. Have you checked the permissions on the CIFS server for the LTM to be able to access the file?
- damian_19221
  Nimbostratus
  Mar 11, 2014
  Good call... I hadn't tested that, but I just mounted the share from another host with the same credentials I'm using on the LTM and can read the file ok. I've not seen it documented anywhere, but what is supposed to go in the "Path / Filename" field in the monitor? If my file is in the top level directory of my share, then it should just be the file name?
- Cory_50405
  Noctilucent
  Mar 11, 2014
  I believe so, because the location is relative to the service. If you are dropped into /share, then it should be right there. Have you tried capturing traffic on the LTM using tcpdump and saving to a file to view with Wireshark? I wonder if the capture would yield any useful information about the reason for failure.

damian_19221

Nimbostratus

Mar 12, 2014

I've tried that, but can't really see anything valuable in the capture SMB is nowhere near as easy to read as HTTP!)

T 10.200.11.44:49348 -> 10.200.8.28:445 [AP]
  ...b.SMBu.....................&.e............7..\.\.L.O.N.G.W.E.B.0.3.S.A.N.D.B.O.\.S.H.A.R.E...?????.                                                             

T 10.200.8.28:445 -> 10.200.11.44:49348 [AP]
  ...>.SMBu.....................&.e....................A:.N.T.F.S...                                                                                                 

T 10.200.11.44:49348 -> 10.200.8.28:445 [AP]
  ...V.SMB-.....................&.e..........@..........................\.f.i.l.e...t.x.t...

I can see a mention of my share name and the file I'm looking for.

Cory_50405
Noctilucent
Mar 12, 2014
So it looks like the monitor is trying to grab \longweb03sandbo\share\file.txt

Are those the only three data flows from the capture?

Are there any server logs that you can check?
damian_19221
Nimbostratus
Mar 12, 2014
There's not a whole lot of information in the Samba log file. It just says successful connection and successful close:

[2014/03/12 12:42:52, 1] smbd/service.c:make_connection_snum(1085) f5_device (10.200.11.44) connect to service share initially as user myuser (uid=1161, gid=1161) (pid 21728) [2014/03/12 12:42:52, 1] smbd/service.c:close_cnum(1282) f5_device (10.200.11.44) closed connection to service share

The path to the share is \longweb03sandbox\share and file.txt is just there. One thing I noticed when Samba starts is the Netbios name is truncated to "longweb03sandbo" but it doesn't seen to make a difference whether I name the server with or without the x in my monitor.
Cory_50405
Noctilucent
Mar 12, 2014
Can you change the log level to 3 in your smb.conf file? It should collect much more valuable information.

https://www.samba.org/samba/docs/using_samba/ch12.html

damian_19221

Nimbostratus

Mar 12, 2014

I've done that, and it looks like the file is being returned to the Monitor:

    [2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(821)
  reduce_name [file.txt] [/tmp/share]
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(922)
  reduce_name: file.txt reduced to /tmp/share/file.txt
[2014/03/12 13:15:12, 3] smbd/dosmode.c:unix_mode(142)
  unix_mode(file.txt) returning 0744
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(821)
  reduce_name [file.txt] [/tmp/share]
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(922)
  reduce_name: file.txt reduced to /tmp/share/file.txt
[2014/03/12 13:15:12, 2] smbd/open.c:open_file(391)
  101135 opened file file.txt read=Yes write=No (numopen=1)
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 8 of length 76
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBtrans2 (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] smbd/trans2.c:call_trans2qfilepathinfo(3254)
  call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 263
[2014/03/12 13:15:12, 3] smbd/trans2.c:call_trans2qfilepathinfo(3365)
  call_trans2qfilepathinfo file.txt (fnum = 11540) level=263 call=7 total_data=0
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 9 of length 59
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBreadX (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] lib/util.c:fcntl_getlock(2075)
  fcntl_getlock: fd 26 is returned info 2 pid 0
[2014/03/12 13:15:12, 3] smbd/reply.c:send_file_readX(2641)
  send_file_readX fnum=11540 max=64512 nread=2
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 10 of length 59
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBreadX (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] lib/util.c:fcntl_getlock(2075)
  fcntl_getlock: fd 26 is returned info 2 pid 0
[2014/03/12 13:15:12, 3] smbd/reply.c:send_file_readX(2641)
  send_file_readX fnum=11540 max=64512 nread=0
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 11 of length 45
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBclose (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] smbd/reply.c:reply_close(3338)
  close fd=26 fnum=11540 (numopen=1)
[2014/03/12 13:15:12, 2] smbd/close.c:close_normal_file(406)
  101135 closed file file.txt (numopen=0) NT_STATUS_OK

But it's still marked as down...

Cory_50405
Noctilucent
Mar 12, 2014
Have you tried enabling debug logging on the SMB monitor on the LTM? If not, please do so and post log entries here.

damian_19221

Nimbostratus

Mar 12, 2014

I had done that, but just noticed the debug output gets written to its own file rather than /var/log/ltm - here's the log:

********** Debugging session beginning at: Wed Mar 12 14:38:02 2014

Arguments 1-2:
::ffff:10.200.8.28
445

Environment variables:
DEBUG=yes
GET=file.txt
MON_TMPL_NAME=/Common/cifs_monitor
NODE_IP=::ffff:10.200.8.28
NODE_PORT=445
PASSWORD=mypassword
SERVER=longweb03sandbo
SERVICE=share
USERNAME=myuser
--
smbclient //longweb03sandbo/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get file.txt file.txt.18261 -U myuser 
dirstring: Current directory is \
Domain=[LONGWEB03SANDBO] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
getting file \file.txt of size 2 as file.txt.18261 (0.5 kb/s) (average 0.5 kb/s)
Recvd: 'Current directory is \
'
file.txt was not transferred: No such file or directory

Is the line smbclient //longweb03sandbo/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get file.txt file.txt.18261 -U myuser literally what the LTM will run to verify this connectivity? I can't see how this would work - it isn't passing a user to connect as in the initial connection, "get" isn't a valid shell command, etc...

Cory_50405
Noctilucent
Mar 12, 2014
The part that really concerns me is the 'No such file or directory' message. This would indicate either the service is incorrect or the path/filename is incorrect.

damian_19221

Nimbostratus

Mar 12, 2014

Yeah, it does look like the file is missing, but using a similar smbclient command I can see the file:

smbclient //longweb03sandbox/share mypassword -I 10.200.8.28 -p 445 -c ls -U myuser
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
  .                                   D        0  Wed Mar 12 15:02:37 2014
  ..                                  D        0  Wed Mar 12 15:01:52 2014
  damian.txt                          N        0  Wed Mar 12 15:02:37 2014
  file.txt                            N        2  Tue Mar 11 15:36:32 2014

        63481 blocks of size 16384. 61314 blocks available

I've tried the same command from a random Linux host, and from the LTM, both can see the file.

Also getting the file as below:

smbclient //longweb03sandbox/share mypassword -I 10.200.8.28 -p 445  -U 101135
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
smb: \> get file.txt
getting file file.txt of size 2 as file.txt (0.7 KiloBytes/sec) (average 0.7 KiloBytes/sec)

...also works

Forum Discussion

Configuration SMB Monitors

Recent Discussions

ip x-forwarding

ports are showing open on online scanning tool

Upgrade F5 BIGIP

DNS HM Probe issue

Is XFF a must for ASM WAF DoS

Related Content

Windows File Share Monitor SMB CIFS

Regarding SMB/CIFS Monitor

Multiple Ways to Configure Usage Reporting in NGINX

Certificate Expiry Email alert configuration

F5 Distributed Cloud, from manual configuration to Terraform automation

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS