----- Original Message ----- 
From: "George Gambill" <ggambill@computer-guidance.com>
To: <plug-discuss@lists.plug.phoenix.az.us>
Sent: Tuesday, December 23, 2003 1:17 PM
Subject: Interesting Observation, RH 8.0, Samba 3.0


> I have a Linux server (RH 8.0) running Samba 3.0 as a service.  For the
most
> part, no one is ever logged into it except root when it is time to shut
> down.
>
> The valuable shares are restricted to myself and root (.  There is a guest
> share available to all.  I see no activity in it.
>
> Every now and then I notice intense disk activity.  The disk light is on
> solid and I can hear the disk drive working very hard for what seems like
> several minutes.  This is usually when I am doing nothing from my laptop
to
> cause such activity.  I do have a share allocated from the laptop but no
> activity at the moment.
>
> This is on my personal network (at the office),  The corporate network is
> available to it via an uplink (switch).  I am the only user account (with
> the exception the multitude created at install).
>
> I am the only user allowed (via valid users in smb.conf) to access the
> valuable shares.
>
> Unfortunately, before just now, hosts.allow permitted all (ALL: LOCAL).
> Don't know if that was a problem  8-(
>
> Now, my laptop is the only host allowed via hosts.allow.  8-)
>
> I have not noticed any problems, I am just paranoid.
>
> 1) Any suggestions as to why all the activity?
>
> 2) Any ideas as to how I can determine why all the disk activity?
>
> 3) Any ideas as to what I might do to reduce risk?
>
> Thnx,
>
> George

Most of Microsoft's desktop OS's periodically index available filesystems.
It is very possible that a Windows box (you laptop, if that's what it is
running) is just checking the contents of the shared filesystem.

Also, Linux itself does things like flushing filesystem cache pretty
regularly, which causes disk activity.

Are there any Samba or OS log entires during the activity time?  What does
netstat -a show you?  How about top?

Thomas