G'DayI found myself exposed to a problem that originated as a high load problem with the logging-server, that has been traced back to a samba-file-server, which floods its syslog with a certain log-error (which sums up to log files about some Gigabyte, what drives poor logrotate nuts).Anyway, that's what samba (according to dpkg it seems to be version 4.2.10, on a debian jessie) keeps logging (I think every time the most tiny ammount of request is incomming from someone accessing the files stored there):Jan 25 06:33:29 samba winbindd[25923]: [2017/01/25 06:33:29.551897,  0] ../source3/winbindd/idmap_ldap.c:95(get_credentials) Jan 25 06:33:29 samba winbindd[25923]:   get_credentials: Unable to fetch auth credentials for cn=sambaadmin,dc=secret-domain,dc=de in WORKGROUPI replaced the true domain with that secret-domain (and the second one at the very end wasn't WORKGROUP either). Expect for the numbers its always the same... always the sambaadmin. So... after seeing this being printed out over and over again, I began to fear that people could have problems accessing any files at the samba-store, but... no one even noticed before me. Looking inside log-files from the distant past (last week), I noticed that this appears to happen for quite a while now, but it does not affect any work after all. I think the nsswitch.conf file is okay, the smb.conf too, and the slapd.conf too. All processes are running, expect for nscd, which I stopped after reading about it ability to make like hard. I can ask that winbind using 'wbinfo -u' for users and get all users, or groups. Sadly my knowledge of samba is limited, and I run out of people to ask or people who know more than me at this point about this stuff. No, I didn't install this, I just happen to be inside the recognition range of my boss when the problem solving dude was designated... So I wonder if you can direct me in a direction I might miss as a samba-newbie.EDIT:So... did some more research today. by increasing the loglevel of... all up to 5 I found something more detailed inside the log.winbind-idmap, which look like this:child daemon request 59[2017/01/26 12:24:20.287296,  5] ../source3/lib/smbldap.c:1249(smbldap_search_ext)  smbldap_search_ext: base => [dc=secret-domain,dc=de], filter => [(&(uidNumber=10005)(objectClass=posixAccount)(objectClass=sambaSamAccount))], scope => [2][2017/01/26 12:24:20.287761,  3] ../source3/passdb/pdb_ldap.c:5039(ldapsam_uid_to_sid)  ERROR: Got 0 entries for uid 10005, expected one[2017/01/26 12:24:20.287869,  0] ../source3/winbindd/idmap_ldap.c:95(get_credentials)  get_credentials: Unable to fetch auth credentials for cn=sambaadmin,dc=secret-domain,dc=de in WORKGROUP[2017/01/26 12:24:20.287947,  1] ../source3/winbindd/idmap_ldap.c:485(idmap_ldap_db_init)  idmap_ldap_db_init: Failed to get connection credentials (NT_STATUS_ACCESS_DENIED)[2017/01/26 12:24:20.287971,  5] ../source3/lib/smbldap.c:1114(smbldap_close)  The connection to the LDAP server was closed  Finished processing child request 59After this I did search for these gid (somethimes its about an uid, I think, too) I did end up looking inside /var/cache/samba/gencache.tdb, which is a binary file but contains some plain-text... which happens to be the only source of that gid I can find. By the way, it not only the 10005, but 10000 and sometimes 10006 and others too.There is no linux user with one of these uid or gids in use, so I'm really puzzled about this.  At the moment I have no idea where this does keep comming from. I even removed this tdb file with services stopped, but as soon as someone dares to even look at something in a random samba share, the error pops up again.Still hoping for help...EDIT2:Today I found the tdbtool, which can be used to look inside .tdb databases located in the directory you are in while starting tdbtool... And there is tdbdump, which will enable you to put all the content inside a file (or pipe it to less). By doing so I was able to get back on track of my mysterious gid and uids; the random wrong id of the day is 10005, which happens to appear inside the gencache.tdb key(20) = IDMAP/UID2SID/10005\00data(15) =   1485506196/-\00At the moment I just can assume where this does come from, but the number in data(15) seems to be a windows user id or something like this. I wonder if there is some place inside windows (the registry?) where wrong information could be stored, or - even more interesting - who is providing windows with stuff like this. After all, I wont pull it out of thin air (well... its Windows, so this could be a valid option too) usually, so it must be offered by samba somehow. But where this does come from?Thanks
Samba Winbind unable to fetch auth_credentials
samba;ldap;winbind