samba-winbind 100% CPU utilisation

This document (7019036) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)
SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)
SUSE Linux Enterprise Server 11 Service Pack 3 (SLES 11 SP3)
SUSE Linux Enterprise Server 11 Service Pack 2 (SLES 11 SP2)
SUSE Linux Enterprise Server 11 Service Pack 1 (SLES 11 SP1)
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 11 Service Pack 4 (SLED 11 SP4)
SUSE Linux Enterprise Desktop 11 Service Pack 3 (SLED 11 SP3)
SUSE Linux Enterprise Desktop 11 Service Pack 2 (SLED 11 SP2)
SUSE Linux Enterprise Desktop 11 Service Pack 1 (SLED 11 SP1)

Situation

After successful join of an AD domain you notice that winbind processes does utilize the CPU to 100%
The AD setup is with multiple domains, however the SLES system is located in a network section that blocks access to all "sub" DCs, so winbind can not reach some DCs in the network, but gets the information about this DCs from AD. This results in winbind constantly trying to connect to the not reachable DCs, but it fails. In the logs (with debug enabled) you can find messages like this:

find_new_dc: smbsock_any_connect failed for domain XXX address a.b.c.d. Error was NT_STATUS_IO_TIMEOUT

an strace or tcpdump will show excessive connect attempts to the not reachable DCs

Resolution

List all not reachable domains in /etc/samba/smb.conf

winbind:ignore domains = DOMAIN1,DOMAIN2,DOMAIN3

afterward restart winbind.

Cause

winbind does try to contact all DCs where he got information about from the main DC, as access to some of these DCs is blocked this results in winbind constantly try to contact the DCs, which results in high CPU utilization.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.