Koozali.org: home of the SME Server

read error = NT_STATUS_END_OF_FILE

Offline michelandre

  • *
  • 261
  • +0/-0
read error = NT_STATUS_END_OF_FILE
« on: June 14, 2015, 04:05:03 PM »
Hi all,

192.168.1.7 - Windows 7
192.168.1.129 - Windows XP
192.168.1.81 - Windows 8.1
All in the same workgroup


I have a persistent problem. I have those messages repeating every 4-5 minutes:

Quote
...
Jun 14 09:43:44 dorgee proftpd[7664]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 14 09:43:45 dorgee proftpd[7664]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 14 09:43:52 dorgee smbd[7668]: [2015/06/14 09:43:52.733802,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:43:52 dorgee smbd[7668]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 14 09:44:40 dorgee proftpd[7672]: 192.168.1.1 (192.168.1.129[192.168.1.129]) - FTP session opened.
Jun 14 09:44:41 dorgee proftpd[7672]: 192.168.1.1 (192.168.1.129[192.168.1.129]) - FTP session closed.
Jun 14 09:44:49 dorgee smbd[7676]: [2015/06/14 09:44:49.003997,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:44:49 dorgee smbd[7676]:   read_fd_with_timeout failed for client 192.168.1.129 read error = NT_STATUS_END_OF_FILE.
Jun 14 09:44:55 dorgee proftpd[7677]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 14 09:44:56 dorgee proftpd[7677]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 14 09:45:04 dorgee smbd[7690]: [2015/06/14 09:45:04.517562,  0] smbd/process.c:244(read_packet_remainder)
Jun 14 09:45:04 dorgee smbd[7690]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
...

The problem started in SME-8/32. I backup, get a new machine, installed SME-9/64, update and restore.
Same problem.

Small problem after restoration:
2 users were not able to log to webmail. I changed passwords and it was OK after.

I looked all over the web and found nothing to resolve that issue for those messages.

Any help appreciated,

Michel-André


Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #2 on: June 15, 2015, 10:55:43 PM »
Thank you RequestedDeletion for your reply.

My /tmp is 777

I added an extra file in /etc/e-smith/templates/etc/smb.conf to have more info from Samba:

FILENAME:  11loglevel_MAR_2015-06-15

CONTENT:
Quote
{
# Ajout par MAR le 2015-06-15 14h41 pour voir les erreurs
}
log level = 10

Now /var/log/samba/log.smbd is quite volubile:

Code: [Select]
[2015/06/15 16:15:18.035373,  5] lib/util_sock.c:165(print_socket_options)
  Socket options:
  SO_KEEPALIVE = 1
  SO_REUSEADDR = 1
  SO_BROADCAST = 0
  TCP_NODELAY = 1
  TCP_KEEPCNT = 9
  TCP_KEEPIDLE = 300
  TCP_KEEPINTVL = 75
  IPTOS_LOWDELAY = 0
  IPTOS_THROUGHPUT = 0
  SO_REUSEPORT = 1
  SO_SNDBUF = 19800
  SO_RCVBUF = 87380
  SO_SNDLOWAT = 1
  SO_RCVLOWAT = 1
  SO_SNDTIMEO = 0
  SO_RCVTIMEO = 0
  TCP_QUICKACK = 1
[2015/06/15 16:15:19.081260, 10] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
  Locking key 110A0000FFFFFFFF
[2015/06/15 16:15:19.081361, 10] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
  Allocated locked data 0x0x7f37d27ebb20
[2015/06/15 16:15:19.081416, 10] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
  Unlocking key 110A0000FFFFFFFF
[2015/06/15 16:15:43.798898, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee360
[2015/06/15 16:15:43.798999, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:15:43.799032,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:15:43.799066, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:16:43.859151, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee560
[2015/06/15 16:16:43.859240, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:16:43.859277,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:16:43.859309, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:17:43.919386, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee760
[2015/06/15 16:17:43.919525, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:17:43.919559,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:17:43.919588, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:18:43.979663, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27ee960
[2015/06/15 16:18:43.979761, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:18:43.979796,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:18:43.979829, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled
[2015/06/15 16:19:44.039914, 10] lib/events.c:221(run_events_poll)
  Running timed event "smbd_idle_event_handler" 0x7f37d27eeb60
[2015/06/15 16:19:44.040011, 10] smbd/process.c:863(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) called
[2015/06/15 16:19:44.040044,  5] printing/printing.c:1684(printer_housekeeping_fn)
  printer housekeeping
[2015/06/15 16:19:44.040078, 10] smbd/process.c:874(smbd_idle_event_handler)
  smbd_idle_event_handler: idle_evt(printer_housekeeping) (nil) rescheduled

I checked all words in Google and found nothing.

Once after a reboot I had lot of this line, now it is no more there.
Code: [Select]
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $nt_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87.
Jun 15 15:03:56 dorgee esmith::event[1751]: Use of uninitialized value $lanman_hash in string eq at /etc/e-smith/events/bootstrap-ldap-save/S15user-lock-passwd line 87

In my original SME-8, I had "smeserver-remoteuseraccess" so I installed it on the new SME-9; nothing changed...

Any help will be very appreciated,

Michel-André



Offline Daniel B.

  • *
  • 1,699
  • +0/-0
    • Firewall Services, la sécurité des réseaux
Re: read error = NT_STATUS_END_OF_FILE
« Reply #3 on: June 16, 2015, 09:13:37 AM »
I'd first suspect a network problem. Have you checked your cable and switches ? Also look in /var/log/messages if you have any message regarding your network cards
C'est la fin du monde !!! :lol:

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #4 on: June 16, 2015, 05:10:57 PM »
Hi all,

Thank you Daniel for your hint.

I apologize for this long file.

Yesterday:
- I made a new backup of the old SME 8
- Re-installed SME 9 on the new server
- Updated SME 9
- Restored the new backup to SME 9
- Re-installed "smeserver-remoteuseraccess" and "Awstats"
- Did the same "FILENAME:  11loglevel_MAR_2015-06-15" for smb.conf
*** Exactly the same problem

Another problem:
The server is a Compaq D5850M/AP96 with 8 GB RAM
- When I install a new SME 9, the server boot OK
- After I update SME 9, the first lines on the boot says:
Quote
Jun 15 04:05:41 dorgee kernel: ATOM BIOS: HP_UnderDog
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: VRAM: 128M 0x00000000C0000000 - 0x00000000C7FFFFFF (128M used)
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: GTT: 512M 0x00000000A0000000 - 0x00000000BFFFFFFF
Jun 15 04:05:41 dorgee kernel: [drm] Detected VRAM RAM=128M, BAR=128M
Jun 15 04:05:41 dorgee kernel: [drm] RAM width 32bits DDR
Jun 15 04:05:41 dorgee kernel: [TTM] Zone  kernel: Available graphics memory: 3957070 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Zone   dma32: Available graphics memory: 2097152 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Initializing pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Initializing DMA pool allocator
Jun 15 04:05:41 dorgee kernel: [drm] radeon: 128M of VRAM memory ready
Jun 15 04:05:41 dorgee kernel: [drm] radeon: 512M of GTT memory ready.
Jun 15 04:05:41 dorgee kernel: [drm] Loading RS780 Microcode
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/RS780_pfp.bin
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/RS780_me.bin
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: firmware: requesting radeon/R600_rlc.bin
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: New USB device found, idVendor=10d5, idProduct=55a4
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: Product: 4 Port KVMSwicther
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: Manufacturer: No brand
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: SerialNumber: 1t²
Jun 15 04:05:41 dorgee kernel: usb 3-2.3: configuration #1 chosen from 1 choice
Jun 15 04:05:41 dorgee kernel: r600_cp: Failed to load firmware "radeon/R600_rlc.bin"
Jun 15 04:05:41 dorgee kernel: [drm:r600_init] *ERROR* Failed to load firmware!
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: Fatal error during GPU init

Jun 15 04:05:41 dorgee kernel: [drm] radeon: finishing device.
Jun 15 04:05:41 dorgee kernel: [TTM] Finalizing pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Finalizing DMA pool allocator
Jun 15 04:05:41 dorgee kernel: [TTM] Zone  kernel: Used memory at exit: 0 kiB
Jun 15 04:05:41 dorgee kernel: [TTM] Zone   dma32: Used memory at exit: 0 kiB
Jun 15 04:05:41 dorgee kernel: [drm] radeon: ttm finalized
Jun 15 04:05:41 dorgee kernel: radeon 0000:01:05.0: PCI INT A disabled
Jun 15 04:05:41 dorgee kernel: radeon: probe of 0000:01:05.0 failed with error -2

Originally, after installation the screen is 1600x900.
After update the screen look like a standard DOS, around 800x600
I looked for the file "radeon/R600_rlc.bin" and it is not in the system. I found one on Internet but I don't know if it is safe to install.
I saw a video rompaq file for Linux from HP but it requires gcc and X that SME don't have.
I updated the BIOS to the latest version and restore the default settings.

Is this a SME bug?

******************************************************

Today after reading Daniel post:
- changed the ADSL modem for another one
- Changed the connecting switch
- changed all cables
*** Exactly the same problem

Today plan:
Wait a few hours for any hint from the forum just in case the following scenario is not possible and there is a better one
- Create a virtal machine with VirtualBox
- Install SM 9 with same name-1, domain-1 as original SME 8
- Update SME 9
- Create all the same: users, i-bays, domain name etc... on the VM
- Tar the users folders, all i-bays, awstats folders on original; backup the 3 DBs of MySql for my 3 web sites on SME-8. The tar will preserve properties
- Disconnect SME 8
- Rename SME 9 ti the same name and same primary domain as on SME 8
- Extract  in their same folders for the TARs with "--same-owner" to preserver owners in SME 9
- Restore the 3 DBs of MySql
- Hoping for the best...

Questions:
- Is it OK to tar and restore the users folder as the users will have the same name but won't have the same UID in the new SME 9 VM?
- Is there another way to restore only the users; mainly for the emails?
- I have the same problem "read error = NT_STATUS_END_OF_FILE" on SME 8 and now on SME 9 on different hardware. I think it is related to something in SME?

For the i-bay, they all use WordPress and all have XCloner so I can use it for the backup and restore for the content of the i-bay and MySQL DBs.

- I have quite some traffic on my main web site and sometime when I browse the web, I have to wait some time for the a web page or google to appear.  Sometime I receive a invalid address and the led on the switch is flashing quite a bit and I presume it is because of the traffic, the leds on the switch is blinking for the ADSL and the server. I refresh a couple of times and the page is received.
- Also, it seems like there is a lot of broadcasts because all the leds on the switch blink every two three seconds.
*** Question: Is this in relation with my problem?

I am thinking of going to 15Mb VDSL.

Any help will be very very appreciated,

Michel-André
*****************************

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #5 on: June 18, 2015, 06:05:46 AM »
Hi all,

Some developments.

I really think this is a bug in SME 9 and also in SME 8 at least since the middle of April 2015.

I create a new machine not a VM.

MAIN SME: (My main SME with the problem NT_STATUS_END_OF_FILE)
Name: dorgee
Domain: micronator.org
Local IP: 192.168.1.1/255.255.255.0 connected to SWITCH-A
External IP: static from ISP

WORKSTATION:
Windows-8.1
IP: 192.168.1.81/255.255.255.0
Remote backup folder for SME: Sauvegarde
Backup user: toto/password

NEW MACHINE:
1) I connect the LOCAL card to SWITCH-B so SME 9 will think that it is connected to a real network. Nothing else is connected to SWITCH-B.
2) I connect the EXTERNAL card to my network SWITCH-A so I can update after installation.
3) I install SME 9:
   - Name: dorgee-1
   - Domain: micronator-1.org
   - LOCAL: 10.10.100.38
   - Server & Gateway
   - EXTERNAL: receiving IP (192.168.1.189) by DHCP from my main SME 9 (dorgee.micronator.org) through SWITCH-A
3) I update SME 9
4) I install lynx to be able to navigate on the server console in Server-Manager
   - I allow Networks: 192.168.1.0/255.255.255.0 and 10.10.100.0/255.255.255.0 to access remote Server-Manager.
5) I configure remote backup to Windows-81.

RECONFIGURATION OF NEW SME:
6) I stop the new server
7) I connect LOCAL to WORKSTATION (Nothing else is connected to the WORKSTATION; WiFi is off)
8- I connect EXTERNAL to SWITCH-B so SME 9 will think that it is connected to a real network. Nothing else is connected to SWITCH-B.
9) Power on new SME.
10) RECONFIGURE same as original MAIN SME (because I want to restore from remote backup)
   - Name: dorgee
   - Domain: micronator.org
   - LOCAL: IP: 192.168.1.1/255.255.255.0 (connected directly to WORKSTATION)
   - Server &  Gateway
   - EXTERNAL: PPPoE (connected to SWITCH-B, it will try to connect to ISP... forever...)

11) Now I am ready to restore.

12) Before I restore, I check the log messages.

TOTAL HORROR THE FAULT IS THERE ALSO

Code: [Select]
Jun 18 05:54:39 dorgee proftpd[2327]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 18 05:54:40 dorgee proftpd[2327]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 18 05:54:46 dorgee smbd[2329]: [2015/06/18 05:54:46.577454,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 05:54:46 dorgee smbd[2329]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
...
Jun 18 05:57:52 dorgee proftpd[2429]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 18 05:57:53 dorgee proftpd[2429]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 18 05:57:57 dorgee pppd[2417]: LCP: timeout sending Config-Requests
Jun 18 05:57:57 dorgee pppd[2417]: Connection terminated.
Jun 18 05:57:57 dorgee pppd[2417]: Modem hangup
Jun 18 05:57:59 dorgee smbd[2434]: [2015/06/18 05:57:59.531050,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 05:57:59 dorgee smbd[2434]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Impossible, there is something wrong with the Windows-8.1 Wokstation

13) I replace the Workstation with a portable WindowsPro-7
13) I give a static IP to WindowsPro-7: 192.168.1.66/255.255.255.0
    - Create a shared folder: Sauvegarde
15) Connect to the new SME 9.

AGAIN: TOTAL HORROR THE FAULT IS THERE ALSO

Code: [Select]
Jun 18 06:06:18 dorgee proftpd[2688]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session opened.
Jun 18 06:06:19 dorgee proftpd[2688]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session closed.
Jun 18 06:06:25 dorgee smbd[2690]: [2015/06/18 06:06:25.935246,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 06:06:25 dorgee smbd[2690]:   read_fd_with_timeout failed for client 192.168.1.66 read error = NT_STATUS_END_OF_FILE.
...
Jun 18 06:12:27 dorgee proftpd[2863]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session opened.
Jun 18 06:12:28 dorgee proftpd[2863]: 192.168.1.1 (192.168.1.66[192.168.1.66]) - FTP session closed.
Jun 18 06:12:34 dorgee smbd[2865]: [2015/06/18 06:12:34.765626,  0] smbd/process.c:244(read_packet_remainder)
Jun 18 06:12:34 dorgee smbd[2865]:   read_fd_with_timeout failed for client 192.168.1.66 read error = NT_STATUS_END_OF_FILE.

Now, I really think this is a bug in SME

- Is it because I changed the name and domain?
  The name and domain of my original SME 8 was never changed
- I never had this problem before.
- The only thing new in my network is a new Windows-8.1 since April 20th 2015.
- I updated: 8/3, 10/4.
- I noticed it at the end of April 2015.

I hope I am wrong but I have doubts...

Michel-André

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #6 on: June 18, 2015, 06:15:57 AM »
Hi again,

I just noticed that the message ...NT_STATUS_END_OF_FILE is exactly every 10:00  minutes.

Michel-André

guest22

Re: read error = NT_STATUS_END_OF_FILE
« Reply #7 on: June 18, 2015, 08:46:00 AM »
Hi again,

I just noticed that the message ...NT_STATUS_END_OF_FILE is exactly every 10:00  minutes.

Michel-André


Maybe unrelated, but sysstat has a cron job that runs every 10 minutes....

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #8 on: June 20, 2015, 05:25:27 AM »
Hi all,

Thank you RequestedDeletion for your comment.
I looked at cron log from Server-Manager and found nothing that runs every 10 minutes.
Can you explain a little what you mean by sysstat.

- Backup the original SME 9 to remote Windows-8.1 desktop
- I tried a new hardware. Nothing was tied to this machine except the two network card hooked up to a stand alone switch.
- Installed from CD
- Same domain as original server.
- Server name as original but with "-1" appended to it.
- The rest of the config is the same as the original SME 9; Server & Gateway, PPPoE, etc...

I used server console (su - admin) to look at the messages log. No error.
- I do not update just in case the error was from the update.

I kooked up the Windows-8.1 to restore the backup.
- All went fine.
- Again, I used server console to look at the messages log, no error; I waited 25 minutes to make sure there will be none.

I though I had it made. I connected the new machine in place of the original SME 9.
Right away the error appeared...

** Maybe it is something on my network...
I connect the Windows-8.1 card directly to the local card of the server to elimate all my network.
Error appeared...
Quote
Jun 19 21:06:47 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 21:06:52 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 1000 Mbps, full duplex
Jun 19 21:06:52 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is on for TX and on for RX
Jun 19 21:14:02 dorgee proftpd[3317]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 21:14:03 dorgee proftpd[3317]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 21:14:11 dorgee smbd[3321]: [2015/06/19 21:14:11.280816,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:14:11 dorgee smbd[3321]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 19 21:23:03 dorgee HORDE[3064]: [imp] FAILED LOGIN for toto [xxx.xxx.xxx.xxx] to {localhost:143 [imap/notls]} [pid 3064 on line 139 of "/home/httpd/html/horde/imp/lib/Auth/imp.php"]
Jun 19 21:24:14 dorgee proftpd[3347]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 21:24:15 dorgee proftpd[3347]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 21:24:23 dorgee smbd[3351]: [2015/06/19 21:24:23.213455,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:24:23 dorgee smbd[3351]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

FAILED LOGIN for toto [xxx.xxx.xxx.xxx]
This error appeared since I changed SME-8/32 to SME-9/64.
This user remote logins to webmail.
Every day the login fails and I have to change his password and it works for a few times then again fails.
Is that related to my problem or vice versa?

** I have this "read error = NT_STATUS_END_OF_FILE" since around April 20th.
That is when I got the new Windows-8.1 station...
- I plug the local card of the server directly in my old Windows-7.
Error appeared...
Quote
Jun 19 21:34:50 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 21:35:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 1000 Mbps, full duplex
Jun 19 21:35:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is off for TX and off for RX
Jun 19 21:43:24 dorgee proftpd[3457]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 21:43:25 dorgee proftpd[3457]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 21:43:32 dorgee smbd[3461]: [2015/06/19 21:43:32.727908,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:43:32 dorgee smbd[3461]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 21:53:24 dorgee proftpd[3484]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 21:53:25 dorgee proftpd[3484]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 21:53:33 dorgee smbd[3489]: [2015/06/19 21:53:33.216301,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 21:53:33 dorgee smbd[3489]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.

Connect everything back to original:
Errors appeared...
Quote
Jun 19 22:01:04 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is down
Jun 19 22:01:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Link is up at 100 Mbps, full duplex
Jun 19 22:01:25 dorgee kernel: tg3 0000:3f:00.0: eth0: Flow control is on for TX and on for RX
Jun 19 22:03:19 dorgee proftpd[3529]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 22:03:20 dorgee proftpd[3529]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 22:03:24 dorgee proftpd[3532]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 22:03:25 dorgee proftpd[3532]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 22:03:28 dorgee smbd[3534]: [2015/06/19 22:03:28.007463,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:03:28 dorgee smbd[3534]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:03:32 dorgee smbd[3538]: [2015/06/19 22:03:32.757091,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:03:32 dorgee smbd[3538]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:13:24 dorgee proftpd[3610]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 19 22:13:25 dorgee proftpd[3610]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 19 22:13:32 dorgee smbd[3614]: [2015/06/19 22:13:32.777791,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:13:32 dorgee smbd[3614]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 19 22:13:57 dorgee proftpd[3618]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 19 22:13:58 dorgee proftpd[3618]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 19 22:14:06 dorgee smbd[3623]: [2015/06/19 22:14:06.799565,  0] smbd/process.c:244(read_packet_remainder)
Jun 19 22:14:06 dorgee smbd[3623]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Is it the ADSL modem?

Any help will be very very very appreciated,

Michel-André
*****************************

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #9 on: June 24, 2015, 05:51:17 PM »
Hi all,

Now I am investigating what can cause Win-8/7 to use FTP to connect every 10 minutes to the SME Server: Email, Workgroup, shared folder, NTP ???

I closed my mail (Thunderbird), I changed the workgroup for the Sations to be different from the workgroup of the server, the stations use NTP from the Internet... what else can I check ???

Quote
Jun 24 11:23:39 dorgee proftpd[2360]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 11:23:40 dorgee proftpd[2360]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 11:23:48 dorgee smbd[2364]: [2015/06/24 11:23:48.511901,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:23:48 dorgee smbd[2364]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:23:58 dorgee proftpd[2365]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 11:23:59 dorgee proftpd[2365]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 11:24:07 dorgee smbd[2372]: [2015/06/24 11:24:07.699641,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:24:07 dorgee smbd[2372]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:33:39 dorgee proftpd[2401]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 11:33:40 dorgee proftpd[2401]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 11:33:48 dorgee smbd[2405]: [2015/06/24 11:33:48.204704,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:33:48 dorgee smbd[2405]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 11:34:01 dorgee proftpd[2408]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 11:34:02 dorgee proftpd[2408]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 11:34:10 dorgee smbd[2414]: [2015/06/24 11:34:10.403446,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 11:34:10 dorgee smbd[2414]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Any help will be very very very very appreciated,

Michel-André
*****************************

Offline Stefano

  • *
  • 10,836
  • +2/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #10 on: June 24, 2015, 06:12:54 PM »
SME in server & gateway mode?
is there anything in proftpd logs?

to make a test, shutdown/disconnet (phisically) all clients from LAN but one..
on this client, shutdown one software/service at once..

I see there are many clients so, not only one.. think about a sw running on the clients.. AV, $whatever..

keep us informed and good luck

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #11 on: June 24, 2015, 06:49:30 PM »
Thank you very much Stefano for your fast reply.

Server & Gateway

/var/log/ftp/current at the time of the previous post.

Quote
2015-06-24 11:23:39.717512500 tcpsvd: info: status 1/40
2015-06-24 11:23:39.717629500 tcpsvd: info: pid 2360 from 192.168.1.7
2015-06-24 11:23:39.717659500 tcpsvd: info: concurrency 2360 192.168.1.7 1/4
2015-06-24 11:23:39.717660500 tcpsvd: info: start 2360 0:192.168.1.1 ::192.168.1.7:56983 ./peers/192.168.1
2015-06-24 11:23:40.744295500 tcpsvd: info: end 2360 exit 0
2015-06-24 11:23:40.744296500 tcpsvd: info: status 0/40
2015-06-24 11:23:58.883974500 tcpsvd: info: status 1/40
2015-06-24 11:23:58.884075500 tcpsvd: info: pid 2365 from 192.168.1.81
2015-06-24 11:23:58.884109500 tcpsvd: info: concurrency 2365 192.168.1.81 1/4
2015-06-24 11:23:58.884110500 tcpsvd: info: start 2365 0:192.168.1.1 ::192.168.1.81:54242 ./peers/192.168.1
2015-06-24 11:23:59.897370500 tcpsvd: info: end 2365 exit 0
2015-06-24 11:23:59.897372500 tcpsvd: info: status 0/40
2015-06-24 11:33:39.516242500 tcpsvd: info: status 1/40
2015-06-24 11:33:39.516366500 tcpsvd: info: pid 2401 from 192.168.1.7
2015-06-24 11:33:39.516400500 tcpsvd: info: concurrency 2401 192.168.1.7 1/4
2015-06-24 11:33:39.516400500 tcpsvd: info: start 2401 0:192.168.1.1 ::192.168.1.7:57286 ./peers/192.168.1
2015-06-24 11:33:40.530408500 tcpsvd: info: end 2401 exit 0
2015-06-24 11:33:40.530410500 tcpsvd: info: status 0/40
2015-06-24 11:34:01.676721500 tcpsvd: info: status 1/40
2015-06-24 11:34:01.676832500 tcpsvd: info: pid 2408 from 192.168.1.81
2015-06-24 11:34:01.676873500 tcpsvd: info: concurrency 2408 192.168.1.81 1/4
2015-06-24 11:34:01.676874500 tcpsvd: info: start 2408 0:192.168.1.1 ::192.168.1.81:54456 ./peers/192.168.1
2015-06-24 11:34:02.691818500 tcpsvd: info: end 2408 exit 0
2015-06-24 11:34:02.691819500 tcpsvd: info: status 0/40

I disconnected the only other station (Win-7) from the switch.

Avast and Skybot running on Win-8

Waiting 10 minutes to see the results.

Quote
Jun 24 12:13:39 dorgee proftpd[2623]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session opened.
Jun 24 12:13:40 dorgee proftpd[2623]: 192.168.1.1 (192.168.1.7[192.168.1.7]) - FTP session closed.
Jun 24 12:13:48 dorgee smbd[2627]: [2015/06/24 12:13:48.441103,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:13:48 dorgee smbd[2627]:   read_fd_with_timeout failed for client 192.168.1.7 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:14:02 dorgee proftpd[2630]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:14:03 dorgee proftpd[2630]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:14:10 dorgee smbd[2646]: [2015/06/24 12:14:10.825614,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:14:10 dorgee smbd[2646]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:23:58 dorgee proftpd[2704]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:23:59 dorgee proftpd[2704]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:24:07 dorgee smbd[2708]: [2015/06/24 12:24:07.369033,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:24:07 dorgee smbd[2708]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.
Jun 24 12:33:58 dorgee proftpd[2761]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session opened.
Jun 24 12:33:59 dorgee proftpd[2761]: 192.168.1.1 (192.168.1.81[192.168.1.81]) - FTP session closed.
Jun 24 12:34:07 dorgee smbd[2766]: [2015/06/24 12:34:07.636637,  0] smbd/process.c:244(read_packet_remainder)
Jun 24 12:34:07 dorgee smbd[2766]:   read_fd_with_timeout failed for client 192.168.1.81 read error = NT_STATUS_END_OF_FILE.

Win-7 is disconnected.

Couple of days ago, I deeply scanned for virus and rootkit both stations 2 times.

I have a HP printer connected to Win-8 and it is shared.

- One test I did was to build a brand new SME-9, only Win-8 connected,  no update to SME-9, wait 25 minutes and all was OK. As soon as I connect to the ADSL the problem came back.
- After this post, I will disconnect the ADSL from the telephone line and see what will happen...

Any help will be very very very very very appreciated,

Michel-André
*****************************

Offline Daniel B.

  • *
  • 1,699
  • +0/-0
    • Firewall Services, la sécurité des réseaux
Re: read error = NT_STATUS_END_OF_FILE
« Reply #12 on: June 24, 2015, 06:56:39 PM »
You have two clients (192.168.1.81 and 192.168.1.7) who are connecting to the FTP server. You have to identify them, then, check for running process which sounds suspect
C'est la fin du monde !!! :lol:

Offline michelandre

  • *
  • 261
  • +0/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #13 on: June 24, 2015, 07:10:01 PM »
Merci Daniel pour ta réponse.

Now, I have only Win-8 at 192.168.1.81 connected to the switch.

I disconnected the ADSL from the phone line. Still the error.

Now I will take the switch out, connect the server external connection directly to the ADSL and Win-8 directly to the local connection of the server and see what will happen.

Results back in a few minutes.

Michel-André
*************************

Offline Stefano

  • *
  • 10,836
  • +2/-0
Re: read error = NT_STATUS_END_OF_FILE
« Reply #14 on: June 24, 2015, 07:17:57 PM »
ok.. you have 2 windows machines starting a ftp session directed to their GW every 10 min, but only when wan link/access is on..

I don't think is a evil sw acting so.. IMHO it's likely a windoze c**p agent/sw..

I'd install sysinternal's tool suit on a client and debug lan traffic.. there's a tool (I don't remember tha name, sorry) that can display which software/process is accessing the network interface..

again, good luck.. "windows, how do you want to get crazy today?" (Cit.)