Samba DNS 100% CPU

Support
1

My network has two domains and I use two DNS in the TCP/IP settings
DNS1 = 192.168.0.15 (AD1 SAMBA5 on NS8)
DNS2 = 192.168.0.17 (AD2 WINDOWS SERVER 2008)

On WINDOWS 10 computers, names from AD1 will no longer resolve, but names from AD2 will resolve.

PS C:\WINDOWS\system32> nslookup comp1.domain.local
: UnKnown
Address: 192.168.0.15

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
: comp1.domain.local
Address: 192.168.0.219

PS C:\WINDOWS\system32> ping comp1.domain.local
Ping failed to find host comp1.domain.local.
Check the host name and try again.

When I remove DNS2 and leave only DNS1 in TCP/IP settings, then computers in AD1 start resolving.
Most likely due to the long DNS1 response the system switches to DNS2. How can I increase the AD1 response speed on SAMBA5 NS8?

image
image1671×881 59.6 KB

2

To install htop, enable epel
yum --enablerepo=extras install epel-release
yum -y install htop

3

Hi @ansh

You are aware of the fact that in TCP/IP only the first functioning DNS server is used?
With the above settings, DNS2 is normally never queried if DNS1 is available and working.

My 2 cents
Andy

4

Sure. Have you seen the CPU load in htop and the long nslookup response?

5

on docker host

#cat /etc/resolv.conf
search domain.local
nameserver 127.0.0.1
nameserver 192.168.0.1

#netstat -nvuap|wc -l
28222

#netstat -nvuap|head -n 10
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
udp 0 0 192.168.0.15:58272 192.168.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 127.0.0.1:58273 127.0.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 192.168.0.15:58274 192.168.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 127.0.0.1:58275 127.0.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 192.168.0.15:58276 192.168.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 127.0.0.1:58277 127.0.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 127.0.0.1:58278 127.0.0.1:53 ESTABLISHED 12331/samba: task[d
udp 0 0 127.0.0.1:58279 127.0.0.1:53 ESTABLISHED 12331/samba: task[d

in container

#cat /etc/resolv.conf
search domain.local
nameserver 192.168.0.15

#netstat -nvuap|wc -l
28233

#netstat -nvuap|head -n 10
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
udp 0 0 127.0.0.1:58272 127.0.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 192.168.0.15:58273 192.168.0.1:53 ESTABLISHED -
udp 0 0 127.0.0.1:58275 127.0.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 192.168.0.15:58276 192.168.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 127.0.0.1:58279 127.0.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 192.168.0.15:58280 192.168.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 192.168.0.15:58281 192.168.0.1:53 ESTABLISHED 58/samba: task[dns]
udp 0 0 192.168.0.15:58282 192.168.0.1:53 ESTABLISHED 58/samba: task[dns]

Query time???

#dig @192.168.0.15 google.com
;; communications error to 192.168.0.15#53: timed out
;; communications error to 192.168.0.15#53: timed out

; <<>> DiG 9.18.24-0ubuntu0.23.10.1-Ubuntu <<>> @192.168.0.15 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25986
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 82 IN A 108.177.14.100
google.com. 82 IN A 108.177.14.113
google.com. 82 IN A 108.177.14.138
google.com. 82 IN A 108.177.14.139
google.com. 82 IN A 108.177.14.101
google.com. 82 IN A 108.177.14.102

;; Query time: 3161 msec
;; SERVER: 192.168.0.15#53(192.168.0.15) (UDP)
;; WHEN: Fri Nov 01 15:14:24 UTC 2024
;; MSG SIZE rcvd: 124

#dig @192.168.0.1 google.com
;; communications error to 192.168.0.1#53: timed out
;; communications error to 192.168.0.1#53: timed out

; <<>> DiG 9.18.24-0ubuntu0.23.10.1-Ubuntu <<>> @192.168.0.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6578
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 159 IN A 173.194.221.102
google.com. 159 IN A 173.194.221.138
google.com. 159 IN A 173.194.221.139
google.com. 159 IN A 173.194.221.113
google.com. 159 IN A 173.194.221.100
google.com. 159 IN A 173.194.221.101

;; Query time: 129 msec
;; SERVER: 192.168.0.1#53(192.168.0.1) (UDP)
;; WHEN: Fri Nov 01 15:11:34 UTC 2024
;; MSG SIZE rcvd: 135

Samba5 AD, DNS Nethserver8
6

Found it on the NS8 host
image

7

Resolved
192.168.0.1 - gateway
Removed on docker host nameserver 127.0.0.1

#cat /etc/resolv.conf
search domain.local
nameserver 192.168.0.1

1 Like
8

Not resolved
The NS8 server reboot field shows the line

nameserver 127.0.0.1

in /etc/resolv.conf
On server

#cat /etc/resolv.conf
search domain.local
nameserver 127.0.0.1
nameserver 192.168.0.1

After removing the line nameserver 127.0.0.1 and rebooting samba5
#runagent -m samba5 systemctl --user restart samba-dc
the processor load is normalized.

9

Updated Core apps, but the problem is still not solved. After rebooting NS8 Samba loads CPU at 100%.

image
image1561×770 37.2 KB

10

Are there relevant entries in the logs? You can find them on the logs page, see also System logs — NS8 documentation

Does a service restart help?

runagent -m samba5 systemctl --user restart samba-dc

Is there still the entry nameserver 127.0.0.1 in /etc/resolv.conf?

Let’s check the config:

runagent -m samba5 podman exec samba-dc testparm -s

To check DNS from a client device: Setting up Samba as a Domain Member - SambaWiki

11

Restarting doesn’t help.

#cat /etc/resolv.conf
search domain.local
nameserver 127.0.0.1
nameserver 192.168.0.1

#runagent -m samba5 podman exec samba-dc testparm -s
Load smb config files from /etc/samba/smb.conf
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

Server role: ROLE_ACTIVE_DIRECTORY_DC

# Global parameters
[global]
        bind interfaces only = Yes
        dns forwarder = 192.168.0.1
        interfaces = 127.0.0.1 192.168.0.15
        netbios aliases = NETDISK
        obey pam restrictions = Yes
        passdb backend = samba_dsdb
        realm = AD.DOMAIN.LOCAL
        registry shares = Yes
        server role = active directory domain controller
        template homedir = /srv/homes/%U
        workgroup = DOMAIN
        rpc_server:tcpip = no
        rpc_daemon:spoolssd = embedded
        rpc_server:spoolss = embedded
        rpc_server:winreg = embedded
        rpc_server:ntsvcs = embedded
        rpc_server:eventlog = embedded
        rpc_server:srvsvc = embedded
        rpc_server:svcctl = embedded
        rpc_server:default = external
        winbindd:use external pipes = true
        acl_xattr:ignore system acls = yes
        acl_xattr:security_acl_name = user.NTACL
        idmap config * : backend = tdb
        include = /etc/samba/include.conf
        inherit owner = windows and unix
        map archive = No
        vfs objects = dfs_samba4 acl_xattr


[sysvol]
        inherit owner = no
        path = /var/lib/samba/sysvol
        read only = No
        acl_xattr:ignore system acls = no


[netlogon]
        path = /var/lib/samba/sysvol/ad.domain.local/scripts
        read only = No


[homes]
        browseable = No
        comment = %u home directory
        read only = No

[test]
        comment = test
        path = /srv/shares/test
        read only = No
[root@ns8 etc]#

Query time: 3051 msec

# dig @192.168.0.15 google.com

; <<>> DiG 9.16.23-RH <<>> @192.168.0.15 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58893
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             64      IN      A       173.194.219.100
google.com.             64      IN      A       173.194.219.101
google.com.             64      IN      A       173.194.219.139
google.com.             64      IN      A       173.194.219.102
google.com.             64      IN      A       173.194.219.138
google.com.             64      IN      A       173.194.219.113

;; Query time: **3051** msec
;; SERVER: 192.168.0.15#53(192.168.0.15)
;; WHEN: Tue Mar 11 12:19:37 MSK 2025
;; MSG SIZE  rcvd: 135
12

Please remove the nameserver 127.0.0.1 line and restart the samba-dc service.

Did you setup a static IP for the NS8?

13

After removing the line nameserver 127.0.0.1 and rebooting samba5
#runagent -m samba5 systemctl --user restart samba-dc
the processor load is normalized.

image
image919×805 18.8 KB

1 Like
14

Please also remove 127.0.0.1 in nmtui, else it will reappear at next network restart.

1 Like
Samba error with cluster restore NS8