Topic: read error = NT_STATUS_END_OF_FILE

[michelandre]

Hi all,

192.168.1.7 - Windows 7
192.168.1.129 - Windows XP
192.168.1.81 - Windows 8.1
All in the same workgroup


I have a persistent problem. I have those messages repeating every 4-5 minutes:

...
Jun 14 09:43:44 dorgee proftpd[7664]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 14 09:43:45 dorgee proftpd[7664]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 14 09:43:52 dorgee smbd[7668]: [2015/06/14 09:43:52.733802,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:43:52 dorgee smbd[7668]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 14 09:44:40 dorgee proftpd[7672]: 192.168.1.1 (192.168.1.129[192.168.1.129]) - FTP session opened.
Jun 14 09:44:41 dorgee proftpd[7672]: 192.168.1.1 (192.168.1.129[192.168.1.129]) - FTP session closed.
Jun 14 09:44:49 dorgee smbd[7676]: [2015/06/14 09:44:49.003997,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:44:49 dorgee smbd[7676]:   read_fd_with_timeout failed for client 192.168.1.129 read error = NT_STATUS_END_OF_FILE.
Jun 14 09:44:55 dorgee proftpd[7677]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 14 09:44:56 dorgee proftpd[7677]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 14 09:45:04 dorgee smbd[7690]: [2015/06/14 09:45:04.517562,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:45:04 dorgee smbd[7690]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
...

The problem started in SME-8/32. I backup, get a new machine, installed SME-9/64, update and restore.
Same problem.

Small problem after restoration:
2 users were not able to log to webmail. I changed passwords and it was OK after.

I looked all over the web and found nothing to resolve that issue for those messages.

Any help appreciated,

Michel-André

[guest22]

Can you pls test this http://www.linuxquestions.org/questions/linux-newbie-8/unable-to-access-samba-share-on-debian-jessie-4175487863/

[michelandre]

Thank you RequestedDeletion for your reply.

My /tmp is 777

I added an extra file in /etc/e-smith/templates/etc/smb.conf to have more info from Samba:

FILENAME:  11loglevel_MAR_2015-06-15

CONTENT:

{
# Ajout par MAR le 2015-06-15 14h41 pour voir les erreurs
}
log level = 10

Now /var/log/samba/log.smbd is quite volubile:

Code: [Select]

[2015/06/15 16:15:18.035373,  5] lib/util_sock.c:165(print_socket_options)
  Socket options:
  SO_KEEPALIVE = 1
  SO_REUSEADDR = 1
  SO_BROADCAST = 0
  TCP_NODELAY = 1
  TCP_KEEPCNT = 9
  TCP_KEEPIDLE = 300
  TCP_KEEPINTVL = 75
  IPTOS_LOWDELAY = 0
  IPTOS_THROUGHPUT = 0
  SO_REUSEPORT = 1
  SO_SNDBUF = 19800
  SO_RCVBUF = 87380
  SO_SNDLOWAT = 1
  SO_RCVLOWAT = 1
  SO_SNDTIMEO = 0
  SO_RCVTIMEO = 0
  TCP_QUICKACK = 1
[2015/06/15 16:15:19.081260, 10] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
  Locking key 110A0000FFFFFFFF
[2015/06/15 16:15:19.081361, 10] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
  Allocated locked data 0x0x7f37d27ebb20
[2015/06/15 16:15:19.081416, 10] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
  Unlocking key 110A0000FFFFFFFF
[2015/06/15 16:15:43.798898, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee360
[2015/06/15 16:15:43.798999, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:15:43.799032,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:15:43.799066, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:16:43.859151, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee560
[2015/06/15 16:16:43.859240, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:16:43.859277,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:16:43.859309, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:17:43.919386, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee760
[2015/06/15 16:17:43.919525, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:17:43.919559,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:17:43.919588, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:18:43.979663, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee960
[2015/06/15 16:18:43.979761, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:18:43.979796,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:18:43.979829, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:19:44.039914, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27eeb60
[2015/06/15 16:19:44.040011, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:19:44.040044,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:19:44.040078, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
I checked all words in Google and found nothing.

Once after a reboot I had lot of this line, now it is no more there.

Code: [Select]

Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87
In my original SME-8, I had "smeserver-remoteuseraccess" so I installed it on the new SME-9; nothing changed...

Any help will be very appreciated,

Michel-André

[Daniel B.]

I'd first suspect a network problem. Have you checked your cable and switches ? Also look in /var/log/messages if you have any message regarding your network cards

[michelandre]

Hi all,

Thank you Daniel for your hint.

I apologize for this long file.

Yesterday:
- I made a new backup of the old SME 8
- Re-installed SME 9 on the new server
- Updated SME 9
- Restored the new backup to SME 9
- Re-installed "smeserver-remoteuseraccess" and "Awstats"
- Did the same "FILENAME:  11loglevel_MAR_2015-06-15" for smb.conf
*** Exactly the same problem

Another problem:
The server is a Compaq D5850M/AP96 with 8 GB RAM
- When I install a new SME 9, the server boot OK
- After I update SME 9, the first lines on the boot says:

Jun 15 04:05:41 dorgee kernel: ATOM BIOS: HP_UnderDog
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: VRAM: 128M 0x00000000C0000000 - 0x00000000C7FFFFFF (128M used)
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: GTT: 512M 0x00000000A0000000 - 0x00000000BFFFFFFF
Jun 15 04:05:41 dorgee kernel: [drm] Detected VRAM RAM=128M, BAR=128M
Jun 15 04:05:41 dorgee kernel: [drm] RAM width 32bits DDR
Jun 15 04:05:41 dorgee kernel: [TTM] Zone  kernel: Available graphics memory: 3957070 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Zone   dma32: Available graphics memory: 2097152 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Initializing pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Initializing DMA pool allocator
Jun 15 04:05:41 dorgee kernel: [drm] radeon: 128M of VRAM memory ready
Jun 15 04:05:41 dorgee kernel: [drm] radeon: 512M of GTT memory ready.
Jun 15 04:05:41 dorgee kernel: [drm] Loading RS780 Microcode
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/RS780_pfp.bin
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/RS780_me.bin
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/R600_rlc.bin
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: New USB device found, idVendor=10d5, idProduct=55a4
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: Product: 4 Port KVMSwicther
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: Manufacturer: No brand
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: SerialNumber: 1t²
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: configuration #1 chosen from 1 choice
Jun 15 04:05:41 dorgee kernel: r600_cp: Failed to load firmware "radeon/R600_rlc.bin"
Jun 15 04:05:41 dorgee kernel: [drm:r600_init] *ERROR* Failed to load firmware!
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: Fatal error during GPU init
Jun 15 04:05:41 dorgee kernel: [drm] radeon: finishing device.
Jun 15 04:05:41 dorgee kernel: [TTM] Finalizing pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Finalizing DMA pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Zone  kernel: Used memory at exit: 0 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Zone   dma32: Used memory at exit: 0 kiB
Jun 15 04:05:41 dorgee kernel: [drm] radeon: ttm finalized
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: PCI INT A disabled
Jun 15 04:05:41 dorgee kernel: radeon: probe of 0000:01:05.0 failed with error -2

Originally, after installation the screen is 1600x900.
After update the screen look like a standard DOS, around 800x600
I looked for the file "radeon/R600_rlc.bin" and it is not in the system. I found one on Internet but I don't know if it is safe to install.
I saw a video rompaq file for Linux from HP but it requires gcc and X that SME don't have.
I updated the BIOS to the latest version and restore the default settings.

Is this a SME bug?

******************************************************

Today after reading Daniel post:
- changed the ADSL modem for another one
- Changed the connecting switch
- changed all cables
*** Exactly the same problem

Today plan:
Wait a few hours for any hint from the forum just in case the following scenario is not possible and there is a better one
- Create a virtal machine with VirtualBox
- Install SM 9 with same name-1, domain-1 as original SME 8
- Update SME 9
- Create all the same: users, i-bays, domain name etc... on the VM
- Tar the users folders, all i-bays, awstats folders on original; backup the 3 DBs of MySql for my 3 web sites on SME-8. The tar will preserve properties
- Disconnect SME 8
- Rename SME 9 ti the same name and same primary domain as on SME 8
- Extract  in their same folders for the TARs with "--same-owner" to preserver owners in SME 9
- Restore the 3 DBs of MySql
- Hoping for the best...

Questions:
- Is it OK to tar and restore the users folder as the users will have the same name but won't have the same UID in the new SME 9 VM?
- Is there another way to restore only the users; mainly for the emails?
- I have the same problem "read error = NT_STATUS_END_OF_FILE" on SME 8 and now on SME 9 on different hardware. I think it is related to something in SME?

For the i-bay, they all use WordPress and all have XCloner so I can use it for the backup and restore for the content of the i-bay and MySQL DBs.

- I have quite some traffic on my main web site and sometime when I browse the web, I have to wait some time for the a web page or google to appear.  Sometime I receive a invalid address and the led on the switch is flashing quite a bit and I presume it is because of the traffic, the leds on the switch is blinking for the ADSL and the server. I refresh a couple of times and the page is received.
- Also, it seems like there is a lot of broadcasts because all the leds on the switch blink every two three seconds.
*** Question: Is this in relation with my problem?

I am thinking of going to 15Mb VDSL.

Any help will be very very appreciated,

Michel-André
*****************************

[michelandre]

Hi all,

Some developments.

I really think this is a bug in SME 9 and also in SME 8 at least since the middle of April 2015.

I create a new machine not a VM.

MAIN SME: (My main SME with the problem NT_STATUS_END_OF_FILE)
Name: dorgee
Domain: micronator.org
Local IP: 192.168.1.1/255.255.255.0 connected to SWITCH-A
External IP: static from ISP

WORKSTATION:
Windows-8.1
IP: 192.168.1.81/255.255.255.0
Remote backup folder for SME: Sauvegarde
Backup user: toto/password

NEW MACHINE:
1) I connect the LOCAL card to SWITCH-B so SME 9 will think that it is connected to a real network. Nothing else is connected to SWITCH-B.
2) I connect the EXTERNAL card to my network SWITCH-A so I can update after installation.
3) I install SME 9:
   - Name: dorgee-1
   - Domain: micronator-1.org
   - LOCAL: 10.10.100.38
   - Server & Gateway
   - EXTERNAL: receiving IP (192.168.1.189) by DHCP from my main SME 9 (dorgee.micronator.org) through SWITCH-A
3) I update SME 9
4) I install lynx to be able to navigate on the server console in Server-Manager
   - I allow Networks: 192.168.1.0/255.255.255.0 and 10.10.100.0/255.255.255.0 to access remote Server-Manager.
5) I configure remote backup to Windows-81.

RECONFIGURATION OF NEW SME:
6) I stop the new server
7) I connect LOCAL to WORKSTATION (Nothing else is connected to the WORKSTATION; WiFi is off)
8- I connect EXTERNAL to SWITCH-B so SME 9 will think that it is connected to a real network. Nothing else is connected to SWITCH-B.
9) Power on new SME.
10) RECONFIGURE same as original MAIN SME (because I want to restore from remote backup)
   - Name: dorgee
   - Domain: micronator.org
   - LOCAL: IP: 192.168.1.1/255.255.255.0 (connected directly to WORKSTATION)
   - Server &  Gateway
   - EXTERNAL: PPPoE (connected to SWITCH-B, it will try to connect to ISP... forever...)

11) Now I am ready to restore.

12) Before I restore, I check the log messages.

TOTAL HORROR THE FAULT IS THERE ALSO

Code: [Select]

Jun 18 05:54:39 dorgee proftpd[2327]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 18 05:54:40 dorgee proftpd[2327]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 18 05:54:46 dorgee smbd[2329]: [2015/06/18 05:54:46.577454,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 05:54:46 dorgee smbd[2329]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
...
Jun 18 05:57:52 dorgee proftpd[2429]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 18 05:57:53 dorgee proftpd[2429]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 18 05:57:57 dorgee pppd[2417]: LCP: timeout sending Config-Requests
Jun 18 05:57:57 dorgee pppd[2417]: Connection terminated.
Jun 18 05:57:57 dorgee pppd[2417]: Modem hangup
Jun 18 05:57:59 dorgee smbd[2434]: [2015/06/18 05:57:59.531050,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 05:57:59 dorgee smbd[2434]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Impossible, there is something wrong with the Windows-8.1 Wokstation

13) I replace the Workstation with a portable WindowsPro-7
13) I give a static IP to WindowsPro-7: 192.168.1.66/255.255.255.0
    - Create a shared folder: Sauvegarde
15) Connect to the new SME 9.

AGAIN: TOTAL HORROR THE FAULT IS THERE ALSO

Code: [Select]

Jun 18 06:06:18 dorgee proftpd[2688]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session opened.
Jun 18 06:06:19 dorgee proftpd[2688]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session closed.
Jun 18 06:06:25 dorgee smbd[2690]: [2015/06/18 06:06:25.935246,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 06:06:25 dorgee smbd[2690]:   read_fd_with_timeout failed for client 192.168.1.66 read error = NT_STATUS_END_OF_FILE.
...
Jun 18 06:12:27 dorgee proftpd[2863]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session opened.
Jun 18 06:12:28 dorgee proftpd[2863]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session closed.
Jun 18 06:12:34 dorgee smbd[2865]: [2015/06/18 06:12:34.765626,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 06:12:34 dorgee smbd[2865]:   read_fd_with_timeout failed for client 192.168.1.66 read error = NT_STATUS_END_OF_FILE.
Now, I really think this is a bug in SME

- Is it because I changed the name and domain?
  The name and domain of my original SME 8 was never changed
- I never had this problem before.
- The only thing new in my network is a new Windows-8.1 since April 20th 2015.
- I updated: 8/3, 10/4.
- I noticed it at the end of April 2015.

I hope I am wrong but I have doubts...

Michel-André

[michelandre]

Hi again,

I just noticed that the message ...NT_STATUS_END_OF_FILE is exactly every 10:00  minutes.

Michel-André

[guest22]

Hi again,

I just noticed that the message ...NT_STATUS_END_OF_FILE is exactly every 10:00  minutes.

Michel-André

Maybe unrelated, but sysstat has a cron job that runs every 10 minutes....

[michelandre]

Hi all,

Thank you RequestedDeletion for your comment.
I looked at cron log from Server-Manager and found nothing that runs every 10 minutes.
Can you explain a little what you mean by sysstat.

- Backup the original SME 9 to remote Windows-8.1 desktop
- I tried a new hardware. Nothing was tied to this machine except the two network card hooked up to a stand alone switch.
- Installed from CD
- Same domain as original server.
- Server name as original but with "-1" appended to it.
- The rest of the config is the same as the original SME 9; Server & Gateway, PPPoE, etc...

I used server console (su - admin) to look at the messages log. No error.
- I do not update just in case the error was from the update.

I kooked up the Windows-8.1 to restore the backup.
- All went fine.
- Again, I used server console to look at the messages log, no error; I waited 25 minutes to make sure there will be none.

I though I had it made. I connected the new machine in place of the original SME 9.
Right away the error appeared...

** Maybe it is something on my network...
I connect the Windows-8.1 card directly to the local card of the server to elimate all my network.
Error appeared...

Jun 19 21:06:47 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 21:06:52 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 1000 Mbps, full duplex
Jun 19 21:06:52 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is on for TX and on for RX
Jun 19 21:14:02 dorgee proftpd[3317]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 21:14:03 dorgee proftpd[3317]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 21:14:11 dorgee smbd[3321]: [2015/06/19 21:14:11.280816,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:14:11 dorgee smbd[3321]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 19 21:23:03 dorgee HORDE[3064]: [imp] FAILED LOGIN for toto [xxx.xxx.xxx.xxx] to {localhost:143 [imap/notls]} [pid 3064 on line 139 of "/home/httpd/html/horde/imp/lib/Auth/imp.php"]
Jun 19 21:24:14 dorgee proftpd[3347]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 21:24:15 dorgee proftpd[3347]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 21:24:23 dorgee smbd[3351]: [2015/06/19 21:24:23.213455,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:24:23 dorgee smbd[3351]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

FAILED LOGIN for toto [xxx.xxx.xxx.xxx]
This error appeared since I changed SME-8/32 to SME-9/64.
This user remote logins to webmail.
Every day the login fails and I have to change his password and it works for a few times then again fails.
Is that related to my problem or vice versa?

** I have this "read error = NT_STATUS_END_OF_FILE" since around April 20th.
That is when I got the new Windows-8.1 station...
- I plug the local card of the server directly in my old Windows-7.
Error appeared...

Jun 19 21:34:50 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 21:35:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 1000 Mbps, full duplex
Jun 19 21:35:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is off for TX and off for RX
Jun 19 21:43:24 dorgee proftpd[3457]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 21:43:25 dorgee proftpd[3457]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 21:43:32 dorgee smbd[3461]: [2015/06/19 21:43:32.727908,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:43:32 dorgee smbd[3461]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 21:53:24 dorgee proftpd[3484]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 21:53:25 dorgee proftpd[3484]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 21:53:33 dorgee smbd[3489]: [2015/06/19 21:53:33.216301,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:53:33 dorgee smbd[3489]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.

Connect everything back to original:
Errors appeared...

Jun 19 22:01:04 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 22:01:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 100 Mbps, full duplex
Jun 19 22:01:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is on for TX and on for RX
Jun 19 22:03:19 dorgee proftpd[3529]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 22:03:20 dorgee proftpd[3529]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 22:03:24 dorgee proftpd[3532]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 22:03:25 dorgee proftpd[3532]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 22:03:28 dorgee smbd[3534]: [2015/06/19 22:03:28.007463,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:03:28 dorgee smbd[3534]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:03:32 dorgee smbd[3538]: [2015/06/19 22:03:32.757091,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:03:32 dorgee smbd[3538]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:13:24 dorgee proftpd[3610]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 22:13:25 dorgee proftpd[3610]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 22:13:32 dorgee smbd[3614]: [2015/06/19 22:13:32.777791,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:13:32 dorgee smbd[3614]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:13:57 dorgee proftpd[3618]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 22:13:58 dorgee proftpd[3618]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 22:14:06 dorgee smbd[3623]: [2015/06/19 22:14:06.799565,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:14:06 dorgee smbd[3623]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Is it the ADSL modem?

Any help will be very very very appreciated,

Michel-André
*****************************

[michelandre]

Hi all,

Now I am investigating what can cause Win-8/7 to use FTP to connect every 10 minutes to the SME Server: Email, Workgroup, shared folder, NTP ???

I closed my mail (Thunderbird), I changed the workgroup for the Sations to be different from the workgroup of the server, the stations use NTP from the Internet... what else can I check ???

Jun 24 11:23:39 dorgee proftpd[2360]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 11:23:40 dorgee proftpd[2360]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 11:23:48 dorgee smbd[2364]: [2015/06/24 11:23:48.511901,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:23:48 dorgee smbd[2364]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:23:58 dorgee proftpd[2365]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 11:23:59 dorgee proftpd[2365]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 11:24:07 dorgee smbd[2372]: [2015/06/24 11:24:07.699641,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:24:07 dorgee smbd[2372]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:33:39 dorgee proftpd[2401]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 11:33:40 dorgee proftpd[2401]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 11:33:48 dorgee smbd[2405]: [2015/06/24 11:33:48.204704,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:33:48 dorgee smbd[2405]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:34:01 dorgee proftpd[2408]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 11:34:02 dorgee proftpd[2408]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 11:34:10 dorgee smbd[2414]: [2015/06/24 11:34:10.403446,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:34:10 dorgee smbd[2414]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Any help will be very very very very appreciated,

Michel-André
*****************************

[Stefano]

SME in server & gateway mode?
is there anything in proftpd logs?

to make a test, shutdown/disconnet (phisically) all clients from LAN but one..
on this client, shutdown one software/service at once..

I see there are many clients so, not only one.. think about a sw running on the clients.. AV, $whatever..

keep us informed and good luck

[michelandre]

Thank you very much Stefano for your fast reply.

Server & Gateway

/var/log/ftp/current at the time of the previous post.

2015-06-24 11:23:39.717512500 tcpsvd: info: status 1/40
2015-06-24 11:23:39.717629500 tcpsvd: info: pid 2360 from 192.168.1.7
2015-06-24 11:23:39.717659500 tcpsvd: info: concurrency 2360 192.168.1.7 1/4
2015-06-24 11:23:39.717660500 tcpsvd: info: start 2360 0:192.168.1.1 ::192.168.1.7:56983 ./peers/192.168.1
2015-06-24 11:23:40.744295500 tcpsvd: info: end 2360 exit 0
2015-06-24 11:23:40.744296500 tcpsvd: info: status 0/40
2015-06-24 11:23:58.883974500 tcpsvd: info: status 1/40
2015-06-24 11:23:58.884075500 tcpsvd: info: pid 2365 from 192.168.1.81
2015-06-24 11:23:58.884109500 tcpsvd: info: concurrency 2365 192.168.1.81 1/4
2015-06-24 11:23:58.884110500 tcpsvd: info: start 2365 0:192.168.1.1 ::192.168.1.81:54242 ./peers/192.168.1
2015-06-24 11:23:59.897370500 tcpsvd: info: end 2365 exit 0
2015-06-24 11:23:59.897372500 tcpsvd: info: status 0/40
2015-06-24 11:33:39.516242500 tcpsvd: info: status 1/40
2015-06-24 11:33:39.516366500 tcpsvd: info: pid 2401 from 192.168.1.7
2015-06-24 11:33:39.516400500 tcpsvd: info: concurrency 2401 192.168.1.7 1/4
2015-06-24 11:33:39.516400500 tcpsvd: info: start 2401 0:192.168.1.1 ::192.168.1.7:57286 ./peers/192.168.1
2015-06-24 11:33:40.530408500 tcpsvd: info: end 2401 exit 0
2015-06-24 11:33:40.530410500 tcpsvd: info: status 0/40
2015-06-24 11:34:01.676721500 tcpsvd: info: status 1/40
2015-06-24 11:34:01.676832500 tcpsvd: info: pid 2408 from 192.168.1.81
2015-06-24 11:34:01.676873500 tcpsvd: info: concurrency 2408 192.168.1.81 1/4
2015-06-24 11:34:01.676874500 tcpsvd: info: start 2408 0:192.168.1.1 ::192.168.1.81:54456 ./peers/192.168.1
2015-06-24 11:34:02.691818500 tcpsvd: info: end 2408 exit 0
2015-06-24 11:34:02.691819500 tcpsvd: info: status 0/40

I disconnected the only other station (Win-7) from the switch.

Avast and Skybot running on Win-8

Waiting 10 minutes to see the results.

Jun 24 12:13:39 dorgee proftpd[2623]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 12:13:40 dorgee proftpd[2623]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 12:13:48 dorgee smbd[2627]: [2015/06/24 12:13:48.441103,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:13:48 dorgee smbd[2627]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:14:02 dorgee proftpd[2630]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:14:03 dorgee proftpd[2630]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:14:10 dorgee smbd[2646]: [2015/06/24 12:14:10.825614,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:14:10 dorgee smbd[2646]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:23:58 dorgee proftpd[2704]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:23:59 dorgee proftpd[2704]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:24:07 dorgee smbd[2708]: [2015/06/24 12:24:07.369033,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:24:07 dorgee smbd[2708]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:33:58 dorgee proftpd[2761]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:33:59 dorgee proftpd[2761]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:34:07 dorgee smbd[2766]: [2015/06/24 12:34:07.636637,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:34:07 dorgee smbd[2766]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Win-7 is disconnected.

Couple of days ago, I deeply scanned for virus and rootkit both stations 2 times.

I have a HP printer connected to Win-8 and it is shared.

- One test I did was to build a brand new SME-9, only Win-8 connected,  no update to SME-9, wait 25 minutes and all was OK. As soon as I connect to the ADSL the problem came back.
- After this post, I will disconnect the ADSL from the telephone line and see what will happen...

Any help will be very very very very very appreciated,

Michel-André
*****************************

[Daniel B.]

You have two clients (192.168.1.81 and 192.168.1.7) who are connecting to the FTP server. You have to identify them, then, check for running process which sounds suspect

[michelandre]

Merci Daniel pour ta réponse.

Now, I have only Win-8 at 192.168.1.81 connected to the switch.

I disconnected the ADSL from the phone line. Still the error.

Now I will take the switch out, connect the server external connection directly to the ADSL and Win-8 directly to the local connection of the server and see what will happen.

Results back in a few minutes.

Michel-André
*************************

[Stefano]

ok.. you have 2 windows machines starting a ftp session directed to their GW every 10 min, but only when wan link/access is on..

I don't think is a evil sw acting so.. IMHO it's likely a windoze c**p agent/sw..

I'd install sysinternal's tool suit on a client and debug lan traffic.. there's a tool (I don't remember tha name, sorry) that can display which software/process is accessing the network interface..

again, good luck.. "windows, how do you want to get crazy today?" (Cit.)

[michelandre]

Thank you Stefano for you comment.

I have only the ADSL and Win-8 and the problem is still there. So maybe it is Win-8 causing the problem.

I have a Win-XP, Win-7 and Win-8. They all have the same problem.
If I connect a portable with Win-7, I have the same problem.
The only things they have in common is Avast and Spybot and the SME Server.

I have an old Win-7 Virtual Machine (VirtualBox) on my Win-7 Station that I did not touch since a long time. I started it and same problem. I uninstalled Avast & Spybot, reboot and still the problem. I tried with and without getting the address with DHCP and still the problem is on the old machine. It was not there before...

There is a law in the technical world: "You can not have the exact same problem on two different machines at the same time.."
In all my years of technical work, this law never prooved wrong...

I do not know what else I can do...

Any help will be very very very very very very appreciated,

Michel-André
*******************

[guest22]

Could it be 'windows update' that is checking MS repositories, or any other 'phone home' mechanism?

[CharlieBrady]

I have a persistent problem. I have those messages repeating every 4-5 minutes:

Is your only problem that you see log messages (every 10:00 minutes)?

[michelandre]

Hi all,

Thank you RequestedDeletion for your suggestions.
I checked all the config for all the cards on Win-7 & Win-8.1; all the virtual cards also. I took out all the the IP-v6. Same problem.

Hi CharlieBrady,

- I had another problem. One user was loging on Webmail from remote. He was OK for one or two logins then impossible to login again. I had to change his password then it was OK for one or two times and again impossible to login.
- Finally yesterday I tar his Maildir. Delete user. Wait a few minutes. Recreate exactly the same user with the same password. I untar back his Maildir, changed the owner and group to his own name.
- He connected 4-5 times today and so far so good.

When I first restored the backup from SME-8 to SME-9, in Thunderbird (on Win-8.1) I had an account that it was not possible to login to the server. All my other 5 accounts from the server were OK. I deleted the faulty account in Thunderbird, recreate the exact same account in Thunderbird and all was OK after that.

Beside that, when I am googling, it is taking quite some time to get the page. Sometime it was "Page not found", refresh and it was OK. Also it was taking 4-5 seconds before I see in the left bottom line of Firefox that is was looking for the URL.

Three days ago, I decided  to change from ADSL to VDSL.

- I noticed since 2-3 days that the ADSL is loosing the line every 2-3 hours and sometime every 10-15 minutes.
- Yesterday, I phoned Teksavvy support to ask them to check my line but since I am in the process of going to VDSL, it is the "nice good Bell" that is controlling my line in the interim and Teksavvy cannot check it for now. I have to wait until July 8th for the switch. Until then, I think there is no time to loose talking to "nice good Bell"...
- The technician suggested I change the ADSL for the new VDSL modem. I did that last night. Loosing the line is always there but it seems googling is better.

This morning I changed all the cables for CAT-6, just in case...

Any help will be very very very very very very very appreciated,

Michel-André
*******************

[guest22]

For sure I appreciate your determination and provided details!

[michelandre]

Hi all,

Just a question: what is that "smbd/process.c" in the log messages?

Jun 27 12:52:21 dorgee proftpd[10910]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 27 12:52:22 dorgee proftpd[10910]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 27 12:52:31 dorgee smbd[10915]: [2015/06/27 12:52:31.139899,  0] smbd/process.c:244(read_packet_remainder)
Jun 27 12:52:31 dorgee smbd[10915]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

I can not find a file "process.c" on the server or on the station...

Thank you for any suggestions,

Michel-André
*******************

[michelandre]

Hi all,

I installed Wireshark on Win-81 to check the communication.

- Power off Win-81
- Reboot server
- Power on Win-81
- Sync the time of Win-81 with the same NTP server as SME-9
- Running only Wireshark on Win-81

From messages log:
Jun 29 14:56:20 dorgee proftpd[2378]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 29 14:56:20 dorgee proftpd[2378]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 29 14:56:28 dorgee smbd[2382]: [2015/06/29 14:56:28.824473,  0] smbd/process.c:244(read_packet_remainder)
Jun 29 14:56:28 dorgee smbd[2382]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

From Wireshark:
After the FTP i.e after "14:56:20":
- the station make a SMTP query
- there is a Client Hello
- an exchange of keys
- some packets with TLSv1.2 protocols
- Another Hello
- another exchange of keys
- then the station is asking for the main web page in Primary i-bay
- when the web page is finished, the station is asking a lot of pages from the cgi directory. The server always responds with 404.
I compared the time (14:56:28) to the last 404 and this is the time of the message "...NT_STATUS_END_OF_FILE..."

Why is the station asking for the main page of the Primary i-bay?
Why the station is asking files from the cgi folder?

Thank you for any suggestions,

Michel-André
*******************

[michelandre]

Hi all

FOUND THE CULPRIT

If I uninstall AVAST antivirus, there is no more message END_OF_FILE

Now I would like to configure AVAST or SME to get rid of the problem.

Any suggestions...

Michel-André

[guest22]

Congrats! and sorry you had such a long and lonely journey... Well done.

[janet]

michelandre

Now I would like to configure AVAST or SME to get rid of the problem.
Any suggestions...

With Avast installed on Windows, you could look at the Windows running processes & disable the culprit (if found & if possible/practical).

You should really be asking on an Avast forum.

[guest22]

Hi all

FOUND THE CULPRIT

If I uninstall AVAST antivirus, there is no more message END_OF_FILE

Now I would like to configure AVAST or SME to get rid of the problem.

Any suggestions...

Michel-André

I'm guessing AVAST is 'phoning home' to look for any updates. Maybe it configurable in AVAST?


So what we have: FTP, IP, Application, Type of traffic... Maybe there is something in the mix?

[michelandre]

Hi all,

TOTAL VICTORY

- I created a new user in SME
- I created a new account at Avast with the credentials of the new user from SME
- I downloaded a new "avast_free_antivirus_setup_online.exe"
- I downloaded the uninstaller "avastclear.exe"
- I uninstalled with the uninstaller "avastclear.exe"
- Clean all the data in "C:\Users\...\AppData..."
- I Installed a new Avast with "avast_free_antivirus_setup_online.exe"
- I configured Avast
- I registered directly from Avast panel "Settings | Registration" with the new user from SME email address

A real miracle, everything worked fine with no message "error...END_OF_FILE..."

After 2 months, it's about time...

Can someone explain why so many entries so often from DHCP

...
Jul  3 19:34:14 dorgee dhcpd: DHCPINFORM from 192.168.1.151 via eth0
Jul  3 19:34:14 dorgee dhcpd: DHCPACK to 192.168.1.151 (00:1f:16:a7:32:f6) via eth0
Jul  3 19:36:08 dorgee dhcpd: DHCPINFORM from 192.168.1.151 via eth0
Jul  3 19:36:08 dorgee dhcpd: DHCPACK to 192.168.1.151 (00:1f:16:a7:32:f6) via eth0
Jul  3 19:44:31 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 19:44:31 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
Jul  3 19:54:32 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 19:54:32 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
Jul  3 19:59:31 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 19:59:31 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
Jul  3 20:04:15 dorgee dhcpd: DHCPINFORM from 192.168.1.151 via eth0
Jul  3 20:04:15 dorgee dhcpd: DHCPACK to 192.168.1.151 (00:1f:16:a7:32:f6) via eth0
Jul  3 20:10:34 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 20:10:34 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
Jul  3 20:14:31 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 20:14:31 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
Jul  3 20:26:06 dorgee dhcpd: DHCPINFORM from 192.168.1.152 via eth0
Jul  3 20:26:06 dorgee dhcpd: DHCPACK to 192.168.1.152 (d8:d3:85:30:12:6e) via eth0
...

I hope it's not related to Avast - it is almost again every 10 minutes  .

Again, thank you all for your suggestions.

Michel-André

PS: Avast forum is nothing compared to the quality of SME forum.