proc: table is full, tons of 'smbd' processes starting by themselves

Question

Level 1

0 points

proc: table is full, tons of 'smbd' processes starting by themselves

Yesterday my iiMac began exhibiting unusual behaviour. Apps would not start, things started to slow down... a restart seemed to clean it up a bit but after awhile the same problems would creep back up.

After some investigation I found that NO new process could be created... already running process and apps continued to work as expected, but nothing new would get started. (already running apps would fail to spawn/fork new processes too)

System.log would list literally hundreds of lines with kernel[0]:proc: table is full. There is a bit of it at the end of this post.

ps -AL listed pages of a "smbd" process, many copies of the exact same process. So it seems something is forking all those "smbd" processes till the proc table gets full and then nothing else starts up.

Can anyone shed some light on what might be spawning those duplicate processes?

TIA
Julio

system log snapshot
May 23 14:02:53 iMacJulio kernel[0]: proc: table is full
May 23 14:03:00 iMacJulio kernel[0]: proc: table is full
May 23 14:03:11 iMacJulio kernel[0]: proc: table is full
May 23 14:03:15 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:04:21 iMacJulio kernel[0]: proc: table is full
May 23 14:06:37 iMacJulio kernel[0]: proc: table is full
May 23 14:06:37 iMacJulio WindowServer[93]: CGXFork() failed with errno=35 in pid=93 euid=0, app to launch=Mach-O/shell /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal\n
May 23 14:06:41 iMacJulio kernel[0]: proc: table is full
May 23 14:20:27 iMacJulio kernel[0]: proc: table is full

Intel iMAC Mac OS X (10.4.6) SU 003-006 installed May 11th

Intel iMAC, Mac OS X (10.4.6)

Posted on May 23, 2006 10:41 AM

Reply

Answer 1

May 23, 2006 12:08 PM in response to JCarneiro

SMB stands for Server Message Block. It's a lightweight protocol designed to allow the sharing of files and printers in a small network. It lets you share with Windows, or any machine running Samba.

I don't know what's causing your problems but file sharing seems like a good place to start.

Reply

Answer 2

simschla

Level 1

4 points

Jun 1, 2006 11:59 AM in response to JCarneiro

Hey Julio

I see the very same behaviour here on my intel imac 20", SU 3 installed. I was able to kill all smbd processes using "sudo killall smbd" on the command line.

This whole problem started about 3 days ago. I don't know what causes it.

What apps are you running, did you update any software recently (or did some software automatically update itself recently)?

Do you think the newly available update for Quicktime (7.1.1) has something to do with this problem? (I did not yet install it..) The description states "QuickTime 7.1.1 addresses an issue with 3rd party start-up items on Intel Macs. "

Simon

Reply

Answer 3

JCarneiro Author

Level 1

0 points

Jun 1, 2006 3:32 PM in response to simschla

It started after I updated Parallels to MC1 and installed Security Update 2006-003.

I did install QT 7.1.1 to see if it'd fix the problem, but nope it did not.

I suspect Parallels to be the problem. I cannot pinpoint exactly when that started to happen but for sure it was after both events.

I've since uninstalled Parallels but the problem persists.

When OS X runs out of space in the proc table nothing can start, so unless terminal is already up and running there's no way to kill those processes. And I believe they will rise from the dead...

I was able to identify what causes those smbd to start. It starts when I open my PC laptop which is on the same network and try to view a shared folder from my iMac. Samba (smbd) is supposed to get started at that point to serve my shared directory. For some still unknown reason instead of spawning one process it keeps spawning smbd's till OS X's proc table fills up.

Only alternative is to restart and nothing else can get started.

One thing I tried was to remove smbd from /usr/sbin, actually rename it so it never gets started. That prevents me from seeing the iMac from any Win machine on the network. So far that's my temporary solution, but I'm still looking for clues...

Please let me know if you are using Parallels as well, or not and I can eliminate it from the guilty list 🙂

cheers,
julio

Reply

Answer 4

Jun 1, 2006 5:21 PM in response to JCarneiro

I've been chasing this problem for a couple of days. Lots of posts but nothing conclusive. I have a local network with Windows PCs attached but I still get the problem when all PCs are off. My current thinking is that it's related to CUPS and the Internet Printing Protocol. The smbd processes seem to spawn at about the same frequency as ipp messages being transmitted. I've got tcpdump, console and activity monitor running at the moment in the hope of catching it in the act. I'll keep you posted.

iMac 20" Intel Mac OS X (10.4.6)

Reply

Answer 5

JCarneiro Author

Level 1

0 points

Jun 1, 2006 6:00 PM in response to barracuda

That's a possibility.
After I posted my previous message I noticed that smbd creep was back. All PCs were off, but exactly at the time the first smbd process started another OS X machine was turned on which uses a shared printer connected to the iMac.

Looking at the logs I noticed that cups.access.log had nothing but localhost - - [01/Jun/2006:18:26:43 -0300] "POST / HTTP/1.1" 200 195. Pages and pages of it. In fact the whole log was that same line.

I guess you're on the right track. Keep me posted.

cheers,
julio

Reply

Answer 6

Jun 1, 2006 6:25 PM in response to JCarneiro

i have wondered too why this happens. i guess the process becomes corrupt, and when a corresponding apple event fails, it tries to establish itself over and over again. it's kind of ironic in that way. it's failing, but it is succeeding so well at the same time, infesting like a virus. but the event never happens. 8)

Reply

Answer 7

Jun 1, 2006 6:28 PM in response to JCarneiro

I smell success (somewhere)! Same here - immediately after my last post, a Windows PC started up on the network and the smbd creep started again. I restarted the iMac then tested the theory by starting up another PC and, sure enough... So I can bring up the problem on cue now, though I know it's not the only way it can happen because yesterday the iMac was the only machine turned on all day, and it still got the smbd creep.

However, your tip about cups.access.log was right on the money. Posts to it are exactly synchronised with the "proc table full" messages on system.log, so I think we are on to something.

iMac 20" Intel Mac OS X (10.4.6)

Reply

Answer 8

Jun 1, 2006 6:34 PM in response to JCarneiro

yes, certain it's relational:) it keeps trying to do something it can't. so to speak, it's stuck at the terminal, but the bus never arrives, and no one even comes to the stop to keep you company.:)

Reply

Answer 9

JCarneiro Author

Level 1

0 points

Jun 1, 2006 7:31 PM in response to sherry johnson

Well... it seems I solved my problem!!

Still do not know what was wrong but it is all good now.
Here is what I did:
- System Preferences/Sharing
- turn off Printer Sharing and Windows Sharing
- restart to get rid of any runaway smbd
- System Preferences/Sharing
- turn Windows & Printer sharing back on

That did it...

I had tried tweaking /etc/smb.conf with a new line:
max smbd processes = 10

I did that and the off/on above so to be sure what really solved the problem I restored /etc/smb.conf to its original configuration and everything is still nice & dandy.

Now I have PCs & OS X machines sharing folder & printers on my machine with only 1 single smbd process.

It was definitely something in some config file and turning sharing off/on somehow reset it to a 'good' state.

Hope it helps others having a similar problem.

cheers,
julio

off to bed now after a long day 🙂

Reply

Answer 10

Jun 1, 2006 8:06 PM in response to JCarneiro

i'm glad you got it all solved julio:)

i'll be happy to go off to bed this evening too. last night i dreamed i was flying with a roman soldier in a golden chariot across the sky!!! you can just imagine how happy we were User uploaded file

B)

Reply

Answer 11

JCarneiro Author

Level 1

0 points

Jun 1, 2006 8:45 PM in response to JCarneiro

See my last post to find how I solved my issue.
Setting Windows Sharing off/on reset whatever was wrong with smbd.

Reply

Answer 12

JCarneiro Author

Level 1

0 points

Jun 1, 2006 8:47 PM in response to sherry johnson

Hope it solves others' smbd problems as well.

At least it was an easy fix... I struggled with it for more than a week and should have tried the simple Windows Sharing reset first...

oh well, all is good for now, till the next one 🙂

Reply

Answer 13

Jun 1, 2006 10:05 PM in response to JCarneiro

I'm pleased for you. (No really!)

I observed something similar earlier when I turned off Windows Sharing and Printer Sharing then turned them back on again (without intervening Restart) and the problem seemed cured. ie those HTTP/1.1 200 195 messages arrived in pairs but never went bezerk, and smbd disposed of itself after a few seconds.

But the problem returned after a Restart. So when I read your post I got all excited that the intervening Restart would lock the fix in place. However after starting up a couple of PCs on the network, the messages came flooding in and filled up the proc table in no time. So back to square one for me.

If any Apple guys are reading this, please help. I've run out of ideas.

iMac 20" Intel Mac OS X (10.4.6)

Reply

Answer 14

Jun 2, 2006 12:14 PM in response to JCarneiro

Yes, I have this problem as well. I have my iMac and a PC laptop on the network. The proc table fills up with smbd processes when the laptop is off or on, and I am unable to open apps (get -10810 error) and the computer hangs when I try to logout.

I turned off Windows Sharing b/c I don't really use it much, will see how things go. Interestingly, this problem just cropped up recently, seemingly after updating to 10.4.6 from 10.4.5.

Reply

Answer 15

ALP

Level 1

35 points

Jul 30, 2006 3:55 PM in response to Slappytron

Same problem!

Thanks for the tip - shut off Windows Sharing and Printer Sharing and now no SMBD processes.

I called AppleCare and let them know about it and about this thread. They said they hadn't heard much about this problem, but it could be associated with the latest 10.4.7 update. For now, if you don't need windows and printer sharing, shutting off those features seems to stop the problem.

BTW - Parallels now seems to run fine with this configuration.

Reply