Вот что получилось.
Код: Выделить всё
[2012/04/09 17:17:27.516405, 4] smbd/open.c:1990(open_file_ntcreate)
calling open_file with flags=0x0 flags2=0x0 mode=0660, access_mask = 0x20080, open_access_mask = 0x20080
[2012/04/09 17:17:27.516890, 3] smbd/process.c:1489(process_smb)
Transaction 47 of length 88 (0 toread)
[2012/04/09 17:17:27.516984, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:27.517022, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.517088, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:27.517152, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:27.517190, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:27.517453, 3] smbd/process.c:1489(process_smb)
Transaction 48 of length 88 (0 toread)
[2012/04/09 17:17:27.517505, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:27.517539, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.517585, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:27.517644, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:27.518013, 3] smbd/process.c:1489(process_smb)
Transaction 49 of length 45 (0 toread)
[2012/04/09 17:17:27.518066, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x231f218
[2012/04/09 17:17:27.518101, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.518146, 3] smbd/reply.c:4643(reply_close)
close directory fnum=14297
[2012/04/09 17:17:27.525876, 3] smbd/process.c:1489(process_smb)
Transaction 50 of length 104 (0 toread)
[2012/04/09 17:17:27.525958, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.526002, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.526048, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /tmp
[2012/04/09 17:17:27.526088, 4] smbd/nttrans.c:283(nt_open_pipe)
nt_open_pipe: Opening pipe \lsarpc.
[2012/04/09 17:17:27.526128, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p)
Create pipe requested \lsarpc
[2012/04/09 17:17:27.526175, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.526211, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.526240, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.526294, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.526342, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.526377, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.526406, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.526454, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.526495, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p)
Created internal pipe \lsarpc (pipes_open=0)
[2012/04/09 17:17:27.526857, 3] smbd/process.c:1489(process_smb)
Transaction 51 of length 104 (0 toread)
[2012/04/09 17:17:27.526908, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.526979, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.527016, 4] smbd/nttrans.c:283(nt_open_pipe)
nt_open_pipe: Opening pipe \lsarpc.
[2012/04/09 17:17:27.527055, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p)
Create pipe requested \lsarpc
[2012/04/09 17:17:27.527101, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.527137, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.527166, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.527232, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.527281, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.527316, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.527344, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.527394, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.527433, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p)
Created internal pipe \lsarpc (pipes_open=0)
[2012/04/09 17:17:27.527812, 3] smbd/process.c:1489(process_smb)
Transaction 52 of length 228 (0 toread)
[2012/04/09 17:17:27.527862, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.527892, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.527978, 3] rpc_server/srv_pipe.c:1668(api_pipe_bind_req)
api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
[2012/04/09 17:17:27.528020, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:27.528069, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=160
[2012/04/09 17:17:27.528370, 3] smbd/process.c:1489(process_smb)
Transaction 53 of length 63 (0 toread)
[2012/04/09 17:17:27.528418, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.528449, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.528492, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=68
[2012/04/09 17:17:27.528809, 3] smbd/process.c:1489(process_smb)
Transaction 54 of length 184 (0 toread)
[2012/04/09 17:17:27.528858, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.528889, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.528971, 3] rpc_server/srv_pipe.c:1668(api_pipe_bind_req)
api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
[2012/04/09 17:17:27.529013, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:27.529061, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=116
[2012/04/09 17:17:27.529167, 3] smbd/process.c:1489(process_smb)
Transaction 55 of length 176 (0 toread)
[2012/04/09 17:17:27.529213, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.529243, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.529312, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=88 params=0 setup=2
[2012/04/09 17:17:27.529350, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.529378, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37da)
[2012/04/09 17:17:27.529416, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 167
[2012/04/09 17:17:27.529450, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2012/04/09 17:17:27.529524, 4] rpc_server/srv_samr_nt.c:230(access_check_object)
_lsa_OpenPolicy2: access GRANTED (requested: 0x00000800, granted: 0x00000800)
[2012/04/09 17:17:27.529573, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal)
Opened policy hnd[1] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.529666, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 1052
[2012/04/09 17:17:27.529811, 3] smbd/process.c:1489(process_smb)
Transaction 56 of length 63 (0 toread)
[2012/04/09 17:17:27.529860, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.529890, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.529996, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=68
[2012/04/09 17:17:27.530111, 3] smbd/process.c:1489(process_smb)
Transaction 57 of length 228 (0 toread)
[2012/04/09 17:17:27.530157, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.530187, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.530220, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=140 params=0 setup=2
[2012/04/09 17:17:27.530288, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.530321, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37da)
[2012/04/09 17:17:27.530360, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.530392, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x39 - api_rpcTNP: rpc command: LSA_LOOKUPSIDS2
[2012/04/09 17:17:27.530449, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.531118, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 2980
[2012/04/09 17:17:27.531259, 3] smbd/process.c:1489(process_smb)
Transaction 58 of length 176 (0 toread)
[2012/04/09 17:17:27.531328, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.531362, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.531395, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=88 params=0 setup=2
[2012/04/09 17:17:27.531429, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.531458, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37db)
[2012/04/09 17:17:27.531496, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 119
[2012/04/09 17:17:27.531566, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2012/04/09 17:17:27.531619, 4] rpc_server/srv_samr_nt.c:230(access_check_object)
_lsa_OpenPolicy2: access GRANTED (requested: 0x00000001, granted: 0x00000001)
[2012/04/09 17:17:27.531654, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal)
Opened policy hnd[2] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.531734, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 1052
[2012/04/09 17:17:27.531867, 3] smbd/process.c:1489(process_smb)
Transaction 59 of length 184 (0 toread)
[2012/04/09 17:17:27.531915, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.532013, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.532072, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:27.532124, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=116
[2012/04/09 17:17:27.532228, 3] smbd/process.c:1489(process_smb)
Transaction 60 of length 134 (0 toread)
[2012/04/09 17:17:27.532273, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.532303, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.532376, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=46 params=0 setup=2
[2012/04/09 17:17:27.532418, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.532447, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37db)
[2012/04/09 17:17:27.532485, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.532516, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x7 - api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
[2012/04/09 17:17:27.532561, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.532653, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 44
[2012/04/09 17:17:27.532785, 3] smbd/process.c:1489(process_smb)
Transaction 61 of length 63 (0 toread)
[2012/04/09 17:17:27.532833, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.532863, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.532974, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=56
[2012/04/09 17:17:27.533087, 3] smbd/process.c:1489(process_smb)
Transaction 62 of length 132 (0 toread)
[2012/04/09 17:17:27.533133, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.533163, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.533228, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=44 params=0 setup=2
[2012/04/09 17:17:27.533267, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.533296, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37db)
[2012/04/09 17:17:27.533334, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.533366, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2012/04/09 17:17:27.533410, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.533490, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.533565, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd)
Closed policy
[2012/04/09 17:17:27.533601, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.533730, 3] smbd/process.c:1489(process_smb)
Transaction 63 of length 114 (0 toread)
[2012/04/09 17:17:27.533778, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.533808, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.533840, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=26 params=0 setup=2
[2012/04/09 17:17:27.533873, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.533902, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37da)
[2012/04/09 17:17:27.533986, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 96
[2012/04/09 17:17:27.534030, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: DSSETUP_DSROLEGETPRIMARYDOMAININFORMATION
[2012/04/09 17:17:27.534102, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 46
[2012/04/09 17:17:27.549189, 3] smbd/process.c:1489(process_smb)
Transaction 64 of length 132 (0 toread)
[2012/04/09 17:17:27.549264, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.549289, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.549318, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=44 params=0 setup=2
[2012/04/09 17:17:27.549342, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.549364, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37da)
[2012/04/09 17:17:27.549397, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.549421, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2012/04/09 17:17:27.549451, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.549509, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.549563, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd)
Closed policy
[2012/04/09 17:17:27.549587, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.549958, 3] smbd/process.c:1489(process_smb)
Transaction 65 of length 45 (0 toread)
[2012/04/09 17:17:27.549996, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.550017, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.550038, 3] smbd/reply.c:4653(reply_close)
close fd=-1 fnum=14299 (numopen=2)
[2012/04/09 17:17:27.550328, 3] smbd/process.c:1489(process_smb)
Transaction 66 of length 45 (0 toread)
[2012/04/09 17:17:27.550365, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.550386, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.550406, 3] smbd/reply.c:4653(reply_close)
close fd=-1 fnum=14298 (numopen=1)
[2012/04/09 17:17:27.551030, 3] smbd/process.c:1489(process_smb)
Transaction 67 of length 104 (0 toread)
[2012/04/09 17:17:27.551067, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.551088, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.551112, 4] smbd/nttrans.c:283(nt_open_pipe)
nt_open_pipe: Opening pipe \lsarpc.
[2012/04/09 17:17:27.551142, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p)
Create pipe requested \lsarpc
[2012/04/09 17:17:27.551180, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.551207, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.551228, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.551278, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.551317, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.551342, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:27.551362, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:27.551411, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:27.551442, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p)
Created internal pipe \lsarpc (pipes_open=0)
[2012/04/09 17:17:27.551746, 3] smbd/process.c:1489(process_smb)
Transaction 68 of length 228 (0 toread)
[2012/04/09 17:17:27.551782, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.551804, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.551838, 3] rpc_server/srv_pipe.c:1668(api_pipe_bind_req)
api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
[2012/04/09 17:17:27.551863, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:27.551898, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=160
[2012/04/09 17:17:27.552201, 3] smbd/process.c:1489(process_smb)
Transaction 69 of length 63 (0 toread)
[2012/04/09 17:17:27.552238, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.552260, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.552290, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=68
[2012/04/09 17:17:27.552544, 3] smbd/process.c:1489(process_smb)
Transaction 70 of length 176 (0 toread)
[2012/04/09 17:17:27.552580, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.552601, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.552624, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=88 params=0 setup=2
[2012/04/09 17:17:27.552648, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.552668, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37dc)
[2012/04/09 17:17:27.552697, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 167
[2012/04/09 17:17:27.552721, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2012/04/09 17:17:27.552758, 4] rpc_server/srv_samr_nt.c:230(access_check_object)
_lsa_OpenPolicy2: access GRANTED (requested: 0x00000800, granted: 0x00000800)
[2012/04/09 17:17:27.552785, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal)
Opened policy hnd[1] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.552842, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 1052
[2012/04/09 17:17:27.553162, 3] smbd/process.c:1489(process_smb)
Transaction 71 of length 192 (0 toread)
[2012/04/09 17:17:27.553199, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.553221, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.553244, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=104 params=0 setup=2
[2012/04/09 17:17:27.553267, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.553287, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37dc)
[2012/04/09 17:17:27.553314, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.553336, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x39 - api_rpcTNP: rpc command: LSA_LOOKUPSIDS2
[2012/04/09 17:17:27.553367, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.553519, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 2841
[2012/04/09 17:17:27.553978, 3] smbd/process.c:1489(process_smb)
Transaction 72 of length 184 (0 toread)
[2012/04/09 17:17:27.554016, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.554038, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.554071, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:27.554108, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=116
[2012/04/09 17:17:27.554375, 3] smbd/process.c:1489(process_smb)
Transaction 73 of length 63 (0 toread)
[2012/04/09 17:17:27.554410, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.554431, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.554462, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=56
[2012/04/09 17:17:27.554695, 3] smbd/process.c:1489(process_smb)
Transaction 74 of length 114 (0 toread)
[2012/04/09 17:17:27.554730, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.554751, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.554775, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=26 params=0 setup=2
[2012/04/09 17:17:27.554798, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.554818, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37dc)
[2012/04/09 17:17:27.554844, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 96
[2012/04/09 17:17:27.554867, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: DSSETUP_DSROLEGETPRIMARYDOMAININFORMATION
[2012/04/09 17:17:27.554916, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 46
[2012/04/09 17:17:27.555721, 3] smbd/process.c:1489(process_smb)
Transaction 75 of length 132 (0 toread)
[2012/04/09 17:17:27.555757, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.555778, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.555802, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=44 params=0 setup=2
[2012/04/09 17:17:27.555824, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:27.555844, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37dc)
[2012/04/09 17:17:27.555870, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.555893, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
[2012/04/09 17:17:27.555918, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.556008, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal)
Found policy hnd[0] [0000] 00 00 00 00 03 00 00 00 00 00 00 00 82 4F 67 E1 ........ .....Og.
[0010] AB 06 00 00 ....
[2012/04/09 17:17:27.556065, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd)
Closed policy
[2012/04/09 17:17:27.556089, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 0
[2012/04/09 17:17:27.556414, 3] smbd/process.c:1489(process_smb)
Transaction 76 of length 45 (0 toread)
[2012/04/09 17:17:27.556450, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:27.556479, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:27.556501, 3] smbd/reply.c:4653(reply_close)
close fd=-1 fnum=14300 (numopen=1)
[2012/04/09 17:17:28.234994, 3] smbd/process.c:1489(process_smb)
Transaction 77 of length 90 (0 toread)
[2012/04/09 17:17:28.235108, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x231f218
[2012/04/09 17:17:28.235152, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:28.235214, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /OLD/tools
[2012/04/09 17:17:28.235275, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:28.235317, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:28.235349, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:28.235382, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:28.235421, 2] smbd/dosmode.c:98(unix_mode)
unix_mode(.) inheriting from .
[2012/04/09 17:17:28.235455, 2] smbd/dosmode.c:121(unix_mode)
unix_mode(.) inherit mode 40770
[2012/04/09 17:17:28.235485, 3] smbd/dosmode.c:166(unix_mode)
unix_mode(.) returning 0660
[2012/04/09 17:17:28.235515, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:28.235548, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:28.235603, 4] smbd/open.c:1990(open_file_ntcreate)
calling open_file with flags=0x0 flags2=0x0 mode=0660, access_mask = 0x20080, open_access_mask = 0x20080
[2012/04/09 17:17:28.236088, 3] smbd/process.c:1489(process_smb)
Transaction 78 of length 88 (0 toread)
[2012/04/09 17:17:28.236143, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:28.236178, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:28.236227, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:28.236289, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:28.236323, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:28.236652, 3] smbd/process.c:1489(process_smb)
Transaction 79 of length 88 (0 toread)
[2012/04/09 17:17:28.236705, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:28.236739, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:28.236786, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:28.236845, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:28.237180, 3] smbd/process.c:1489(process_smb)
Transaction 80 of length 45 (0 toread)
[2012/04/09 17:17:28.237234, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x231f218
[2012/04/09 17:17:28.237268, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:28.237314, 3] smbd/reply.c:4643(reply_close)
close directory fnum=14302
[2012/04/09 17:17:29.161472, 3] smbd/process.c:1489(process_smb)
Transaction 81 of length 104 (0 toread)
[2012/04/09 17:17:29.161561, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.161604, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:29.161690, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /tmp
[2012/04/09 17:17:29.161740, 4] smbd/nttrans.c:283(nt_open_pipe)
nt_open_pipe: Opening pipe \lsarpc.
[2012/04/09 17:17:29.161787, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p)
Create pipe requested \lsarpc
[2012/04/09 17:17:29.161844, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.161881, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:29.161912, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.162018, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:29.162078, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.162115, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:29.162144, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.162194, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:29.162236, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p)
Created internal pipe \lsarpc (pipes_open=0)
[2012/04/09 17:17:29.162637, 3] smbd/process.c:1489(process_smb)
Transaction 82 of length 228 (0 toread)
[2012/04/09 17:17:29.162692, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.162723, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.162778, 3] rpc_server/srv_pipe.c:1668(api_pipe_bind_req)
api_pipe_bind_req: \PIPE\dssetup -> \PIPE\dssetup
[2012/04/09 17:17:29.162813, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \lsarpc
[2012/04/09 17:17:29.162865, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=160
[2012/04/09 17:17:29.163164, 3] smbd/process.c:1489(process_smb)
Transaction 83 of length 63 (0 toread)
[2012/04/09 17:17:29.163218, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.163249, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.163294, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=68
[2012/04/09 17:17:29.163605, 3] smbd/process.c:1489(process_smb)
Transaction 84 of length 114 (0 toread)
[2012/04/09 17:17:29.163658, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.163690, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.163724, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=26 params=0 setup=2
[2012/04/09 17:17:29.163758, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:29.163788, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "lsarpc" (pnum 37df)
[2012/04/09 17:17:29.163829, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 167
[2012/04/09 17:17:29.163864, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: DSSETUP_DSROLEGETPRIMARYDOMAININFORMATION
[2012/04/09 17:17:29.163976, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 46
[2012/04/09 17:17:29.164346, 3] smbd/process.c:1489(process_smb)
Transaction 85 of length 45 (0 toread)
[2012/04/09 17:17:29.164399, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.164431, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.164461, 3] smbd/reply.c:4653(reply_close)
close fd=-1 fnum=14303 (numopen=1)
[2012/04/09 17:17:29.165000, 3] smbd/process.c:1489(process_smb)
Transaction 86 of length 104 (0 toread)
[2012/04/09 17:17:29.165056, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.165086, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.165119, 4] smbd/nttrans.c:283(nt_open_pipe)
nt_open_pipe: Opening pipe \wkssvc.
[2012/04/09 17:17:29.165159, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p)
Create pipe requested \wkssvc
[2012/04/09 17:17:29.165217, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.165253, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:29.165282, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.165338, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:29.165387, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(10039, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.165422, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:29.165450, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:29.165500, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (10039, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:29.165539, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p)
Created internal pipe \wkssvc (pipes_open=0)
[2012/04/09 17:17:29.165869, 3] smbd/process.c:1489(process_smb)
Transaction 87 of length 228 (0 toread)
[2012/04/09 17:17:29.165922, 3] smbd/process.c:1298(switch_message)
switch message SMBwriteX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.165995, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.166046, 3] rpc_server/srv_pipe.c:1668(api_pipe_bind_req)
api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\wkssvc
[2012/04/09 17:17:29.166082, 3] rpc_server/srv_pipe.c:998(check_bind_req)
check_bind_req for \wkssvc
[2012/04/09 17:17:29.166131, 3] smbd/pipes.c:352(pipe_write_andx_done)
writeX-IPC nwritten=160
[2012/04/09 17:17:29.166476, 3] smbd/process.c:1489(process_smb)
Transaction 88 of length 63 (0 toread)
[2012/04/09 17:17:29.166529, 3] smbd/process.c:1298(switch_message)
switch message SMBreadX (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.166560, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.166604, 3] smbd/pipes.c:462(pipe_read_andx_done)
readX-IPC min=1024 max=1024 nread=68
[2012/04/09 17:17:29.166895, 3] smbd/process.c:1489(process_smb)
Transaction 89 of length 148 (0 toread)
[2012/04/09 17:17:29.166989, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.167025, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.167059, 3] smbd/ipc.c:545(handle_trans)
trans <\PIPE\> data=60 params=0 setup=2
[2012/04/09 17:17:29.167093, 3] smbd/ipc.c:496(named_pipe)
named pipe command on <> name
[2012/04/09 17:17:29.167122, 3] smbd/ipc.c:460(api_fd_reply)
Got API command 0x26 on pipe "wkssvc" (pnum 37e0)
[2012/04/09 17:17:29.167161, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 167
[2012/04/09 17:17:29.167195, 4] rpc_server/srv_pipe.c:2404(api_rpcTNP)
api_rpcTNP: \wkssvc op 0x0 - api_rpcTNP: rpc command: WKSSVC_NETWKSTAGETINFO
[2012/04/09 17:17:29.167270, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context)
free_pipe_context: destroying talloc pool of size 30
[2012/04/09 17:17:29.167634, 3] smbd/process.c:1489(process_smb)
Transaction 90 of length 45 (0 toread)
[2012/04/09 17:17:29.167686, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:29.167717, 4] smbd/uid.c:257(change_to_user)
change_to_user: Skipping user change - already user
[2012/04/09 17:17:29.167762, 3] smbd/reply.c:4653(reply_close)
close fd=-1 fnum=14304 (numopen=1)
[2012/04/09 17:17:34.328405, 3] smbd/process.c:1489(process_smb)
Transaction 91 of length 90 (0 toread)
[2012/04/09 17:17:34.328485, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.328527, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.328589, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /OLD/tools
[2012/04/09 17:17:34.328649, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:34.328691, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:34.328723, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:34.328756, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:34.328796, 2] smbd/dosmode.c:98(unix_mode)
unix_mode(.) inheriting from .
[2012/04/09 17:17:34.328830, 2] smbd/dosmode.c:121(unix_mode)
unix_mode(.) inherit mode 40770
[2012/04/09 17:17:34.328860, 3] smbd/dosmode.c:166(unix_mode)
unix_mode(.) returning 0660
[2012/04/09 17:17:34.328889, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:34.328923, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:34.329022, 4] smbd/open.c:1990(open_file_ntcreate)
calling open_file with flags=0x0 flags2=0x0 mode=0660, access_mask = 0x60080, open_access_mask = 0x60080
[2012/04/09 17:17:34.329507, 3] smbd/process.c:1489(process_smb)
Transaction 92 of length 88 (0 toread)
[2012/04/09 17:17:34.329586, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.329625, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.329674, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x80000004
[2012/04/09 17:17:34.329728, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 20.
[2012/04/09 17:17:34.329761, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:34.330031, 3] smbd/process.c:1489(process_smb)
Transaction 93 of length 88 (0 toread)
[2012/04/09 17:17:34.330083, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.330117, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.330163, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x80000004
[2012/04/09 17:17:34.330215, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 20.
[2012/04/09 17:17:34.330492, 3] smbd/process.c:1489(process_smb)
Transaction 94 of length 76 (0 toread)
[2012/04/09 17:17:34.330542, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans2 (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.330576, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.330623, 3] smbd/trans2.c:5013(call_trans2qfilepathinfo)
call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1004
[2012/04/09 17:17:34.330672, 3] smbd/trans2.c:5226(call_trans2qfilepathinfo)
call_trans2qfilepathinfo . (fnum = 14306) level=1004 call=7 total_data=0
[2012/04/09 17:17:34.330967, 3] smbd/process.c:1489(process_smb)
Transaction 95 of length 88 (0 toread)
[2012/04/09 17:17:34.331019, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.331069, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.331116, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x3
[2012/04/09 17:17:34.331169, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 64.
[2012/04/09 17:17:34.331202, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:34.331494, 3] smbd/process.c:1489(process_smb)
Transaction 96 of length 88 (0 toread)
[2012/04/09 17:17:34.331544, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.331577, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.331623, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x3
[2012/04/09 17:17:34.331676, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 64.
[2012/04/09 17:17:34.332108, 3] smbd/process.c:1489(process_smb)
Transaction 97 of length 90 (0 toread)
[2012/04/09 17:17:34.332160, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans2 (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.332194, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.332258, 3] smbd/trans2.c:2252(call_trans2findfirst)
call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, close_if_end = 1 requires_resume_key = 1 level = 0x101, max_data_bytes = 16384
[2012/04/09 17:17:34.332317, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [*] [/OLD/tools]
[2012/04/09 17:17:34.332366, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: * reduced to /OLD/tools/*
[2012/04/09 17:17:34.332406, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [./] [/OLD/tools]
[2012/04/09 17:17:34.332440, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: ./ reduced to /OLD/tools
[2012/04/09 17:17:34.332510, 3] smbd/dir.c:544(dptr_create)
creating new dirptr 256 for path ./, expect_close = 1
[2012/04/09 17:17:34.332544, 4] smbd/trans2.c:2400(call_trans2findfirst)
dptr_num is 256, wcard = *, attr = 22
[2012/04/09 17:17:34.332620, 3] smbd/dir.c:993(smbd_dirptr_get_entry)
smbd_dirptr_get_entry mask=[*] found ./. fname=. (.)
[2012/04/09 17:17:34.332690, 3] smbd/dir.c:993(smbd_dirptr_get_entry)
smbd_dirptr_get_entry mask=[*] found ./.. fname=.. (..)
[2012/04/09 17:17:34.332762, 4] smbd/dir.c:250(dptr_close_internal)
closing dptr key 256
[2012/04/09 17:17:34.332853, 4] smbd/trans2.c:2510(call_trans2findfirst)
SMBtrans2 mask=* directory=./ dirtype=22 numentries=2
[2012/04/09 17:17:34.333144, 3] smbd/process.c:1489(process_smb)
Transaction 98 of length 276 (0 toread)
[2012/04/09 17:17:34.333196, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:34.333230, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.333282, 3] smbd/nttrans.c:1991(call_nt_transact_set_security_desc)
call_nt_transact_set_security_desc: file = ., sent 0x80000004
[2012/04/09 17:17:34.333360, 3] smbd/dosmode.c:166(unix_mode)
unix_mode(.) returning 0660
[2012/04/09 17:17:34.333901, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(0, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.334004, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:34.334038, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.334098, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.334132, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(0, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.334180, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:34.334212, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.334305, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.335543, 3] smbd/sec_ctx.c:210(push_sec_ctx)
push_sec_ctx(0, 10005) : sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.335596, 3] smbd/uid.c:429(push_conn_ctx)
push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2012/04/09 17:17:34.335627, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2012/04/09 17:17:34.336106, 3] smbd/sec_ctx.c:418(pop_sec_ctx)
pop_sec_ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:34.336163, 3] lib/privileges.c:63(get_privileges)
get_privileges: No privileges assigned to SID [S-1-22-1-10039]
[2012/04/09 17:17:34.336209, 3] lib/privileges.c:63(get_privileges)
get_privileges: No privileges assigned to SID [S-1-5-21-926604562-1521242566-298935221-513]
[2012/04/09 17:17:34.336256, 3] lib/privileges.c:63(get_privileges)
get_privileges: No privileges assigned to SID [S-1-5-2]
[2012/04/09 17:17:34.336295, 3] lib/privileges.c:63(get_privileges)
get_privileges: No privileges assigned to SID [S-1-5-11]
[2012/04/09 17:17:34.336333, 3] lib/privileges.c:63(get_privileges)
get_privileges: No privileges assigned to SID [S-1-5-32-545]
[2012/04/09 17:17:34.336454, 2] smbd/posix_acls.c:2903(set_canon_ace_list)
set_canon_ace_list: sys_acl_set_file type file failed for file . (Неподдерживаемая операция).
[2012/04/09 17:17:34.336526, 3] smbd/posix_acls.c:3007(convert_canon_ace_to_posix_perms)
convert_canon_ace_to_posix_perms: Too many ACE entries for file . to convert to posix perms.
[2012/04/09 17:17:34.336560, 3] smbd/posix_acls.c:4109(set_nt_acl)
set_nt_acl: failed to convert file acl to posix permissions for file ..
[2012/04/09 17:17:34.336613, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(2001) cmd=160 (SMBnttrans) NT_STATUS_ACCESS_DENIED
[2012/04/09 17:17:36.329512, 3] smbd/process.c:1489(process_smb)
Transaction 99 of length 45 (0 toread)
[2012/04/09 17:17:36.331742, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x231f218
[2012/04/09 17:17:36.331794, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:36.331855, 3] smbd/reply.c:4643(reply_close)
close directory fnum=14306
[2012/04/09 17:17:37.367371, 3] smbd/process.c:1489(process_smb)
Transaction 100 of length 90 (0 toread)
[2012/04/09 17:17:37.367445, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x231f218
[2012/04/09 17:17:37.367487, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:37.367565, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:37.367610, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:37.367643, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:37.367675, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:37.367715, 2] smbd/dosmode.c:98(unix_mode)
unix_mode(.) inheriting from .
[2012/04/09 17:17:37.367750, 2] smbd/dosmode.c:121(unix_mode)
unix_mode(.) inherit mode 40770
[2012/04/09 17:17:37.367780, 3] smbd/dosmode.c:166(unix_mode)
unix_mode(.) returning 0660
[2012/04/09 17:17:37.367810, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:37.367843, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:37.367899, 4] smbd/open.c:1990(open_file_ntcreate)
calling open_file with flags=0x0 flags2=0x0 mode=0660, access_mask = 0x20080, open_access_mask = 0x20080
[2012/04/09 17:17:37.368394, 3] smbd/process.c:1489(process_smb)
Transaction 101 of length 76 (0 toread)
[2012/04/09 17:17:37.368474, 3] smbd/process.c:1298(switch_message)
switch message SMBtrans2 (pid 1707) conn 0x231f218
[2012/04/09 17:17:37.368511, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:37.368560, 3] smbd/trans2.c:5013(call_trans2qfilepathinfo)
call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1006
[2012/04/09 17:17:37.368620, 3] smbd/trans2.c:5226(call_trans2qfilepathinfo)
call_trans2qfilepathinfo . (fnum = 14308) level=1006 call=7 total_data=0
[2012/04/09 17:17:37.369005, 3] smbd/process.c:1489(process_smb)
Transaction 102 of length 88 (0 toread)
[2012/04/09 17:17:37.369062, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:37.369096, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:37.369145, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:37.369207, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:37.369241, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:37.369482, 3] smbd/process.c:1489(process_smb)
Transaction 103 of length 88 (0 toread)
[2012/04/09 17:17:37.369535, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:37.369568, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:37.369615, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:37.369673, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:37.370023, 3] smbd/process.c:1489(process_smb)
Transaction 104 of length 45 (0 toread)
[2012/04/09 17:17:37.370077, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x231f218
[2012/04/09 17:17:37.370111, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:37.370157, 3] smbd/reply.c:4643(reply_close)
close directory fnum=14308
[2012/04/09 17:17:41.998223, 3] smbd/process.c:1489(process_smb)
Transaction 105 of length 39 (0 toread)
[2012/04/09 17:17:41.998319, 3] smbd/process.c:1298(switch_message)
switch message SMBtdis (pid 1707) conn 0x232e6c8
[2012/04/09 17:17:41.998354, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:41.998404, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /tmp
[2012/04/09 17:17:41.998444, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:41.998478, 3] smbd/service.c:1251(close_cnum)
__ffff_192.168.3.4 (::ffff:192.168.3.4) closed connection to service IPC$
[2012/04/09 17:17:41.998518, 3] smbd/connection.c:31(yield_connection)
Yielding connection to IPC$
[2012/04/09 17:17:41.998592, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /
[2012/04/09 17:17:41.998628, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:44.456543, 3] smbd/process.c:1489(process_smb)
Transaction 106 of length 90 (0 toread)
[2012/04/09 17:17:44.456652, 3] smbd/process.c:1298(switch_message)
switch message SMBntcreateX (pid 1707) conn 0x231f218
[2012/04/09 17:17:44.456696, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:44.456754, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /OLD/tools
[2012/04/09 17:17:44.456811, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:44.456853, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:44.456910, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:44.456989, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:44.457034, 2] smbd/dosmode.c:98(unix_mode)
unix_mode(.) inheriting from .
[2012/04/09 17:17:44.457069, 2] smbd/dosmode.c:121(unix_mode)
unix_mode(.) inherit mode 40770
[2012/04/09 17:17:44.457098, 3] smbd/dosmode.c:166(unix_mode)
unix_mode(.) returning 0660
[2012/04/09 17:17:44.457127, 3] smbd/vfs.c:881(check_reduced_name)
check_reduced_name [.] [/OLD/tools]
[2012/04/09 17:17:44.457159, 3] smbd/vfs.c:1038(check_reduced_name)
check_reduced_name: . reduced to /OLD/tools
[2012/04/09 17:17:44.457214, 4] smbd/open.c:1990(open_file_ntcreate)
calling open_file with flags=0x0 flags2=0x0 mode=0660, access_mask = 0x20080, open_access_mask = 0x20080
[2012/04/09 17:17:44.457705, 3] smbd/process.c:1489(process_smb)
Transaction 107 of length 88 (0 toread)
[2012/04/09 17:17:44.457757, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:44.457791, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:44.457840, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:44.457900, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:44.457970, 3] smbd/error.c:80(error_packet_set)
error packet at smbd/nttrans.c(240) cmd=160 (SMBnttrans) NT_STATUS_BUFFER_TOO_SMALL
[2012/04/09 17:17:44.458263, 3] smbd/process.c:1489(process_smb)
Transaction 108 of length 88 (0 toread)
[2012/04/09 17:17:44.458313, 3] smbd/process.c:1298(switch_message)
switch message SMBnttrans (pid 1707) conn 0x231f218
[2012/04/09 17:17:44.458346, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:44.458393, 3] smbd/nttrans.c:1834(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: file = ., info_wanted = 0x4
[2012/04/09 17:17:44.458450, 3] smbd/nttrans.c:1912(call_nt_transact_query_security_desc)
call_nt_transact_query_security_desc: sd_size = 108.
[2012/04/09 17:17:44.458789, 3] smbd/process.c:1489(process_smb)
Transaction 109 of length 45 (0 toread)
[2012/04/09 17:17:44.458839, 3] smbd/process.c:1298(switch_message)
switch message SMBclose (pid 1707) conn 0x231f218
[2012/04/09 17:17:44.458875, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 10005) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:44.458921, 3] smbd/reply.c:4643(reply_close)
close directory fnum=14310
[2012/04/09 17:17:57.001976, 3] smbd/process.c:1489(process_smb)
Transaction 110 of length 39 (0 toread)
[2012/04/09 17:17:57.002080, 3] smbd/process.c:1298(switch_message)
switch message SMBtdis (pid 1707) conn 0x231f218
[2012/04/09 17:17:57.002117, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:57.002173, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:57.002212, 1] smbd/service.c:1251(close_cnum)
__ffff_192.168.3.4 (::ffff:192.168.3.4) closed connection to service tools
[2012/04/09 17:17:57.002272, 3] smbd/connection.c:31(yield_connection)
Yielding connection to tools
[2012/04/09 17:17:57.002376, 4] smbd/vfs.c:751(vfs_ChDir)
vfs_ChDir to /
[2012/04/09 17:17:57.002417, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:57.002779, 3] smbd/process.c:1489(process_smb)
Transaction 111 of length 43 (0 toread)
[2012/04/09 17:17:57.002833, 3] smbd/process.c:1298(switch_message)
switch message SMBulogoffX (pid 1707) conn 0x0
[2012/04/09 17:17:57.002865, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:57.003014, 3] smbd/reply.c:2074(reply_ulogoffX)
ulogoffX vuid=101
[2012/04/09 17:17:57.003415, 0] lib/util_sock.c:474(read_fd_with_timeout)
[2012/04/09 17:17:57.003616, 0] lib/util_sock.c:1441(get_peer_addr_internal)
getpeername failed. Error was Конечная точка передачи не подсоединена
read_fd_with_timeout: client 0.0.0.0 read error = Соединение сброшено другой стороной.
[2012/04/09 17:17:57.003896, 3] smbd/sec_ctx.c:310(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2012/04/09 17:17:57.003990, 3] smbd/connection.c:31(yield_connection)
Yielding connection to
[2012/04/09 17:17:57.004128, 3] smbd/server.c:923(exit_server_common)
Server exit (failed to receive smb request)