Configuration SMB Monitors

I'll ask an obvious question. Have you checked the permissions on the CIFS server for the LTM to be able to access the file?

I've tried that, but can't really see anything valuable in the capture SMB is nowhere near as easy to read as HTTP!)

T 10.200.11.44:49348 -> 10.200.8.28:445 [AP]
  ...b.SMBu.....................&.e............7..\.\.L.O.N.G.W.E.B.0.3.S.A.N.D.B.O.\.S.H.A.R.E...?????.                                                             

T 10.200.8.28:445 -> 10.200.11.44:49348 [AP]
  ...>.SMBu.....................&.e....................A:.N.T.F.S...                                                                                                 

T 10.200.11.44:49348 -> 10.200.8.28:445 [AP]
  ...V.SMB-.....................&.e..........@..........................\.f.i.l.e...t.x.t...                                                                         

I can see a mention of my share name and the file I'm looking for.

So it looks like the monitor is trying to grab \longweb03sandbo\share\file.txt

Are those the only three data flows from the capture?

Are there any server logs that you can check?

There's not a whole lot of information in the Samba log file. It just says successful connection and successful close:

    [2014/03/12 12:42:52, 1] smbd/service.c:make_connection_snum(1085)
  f5_device (10.200.11.44) connect to service share initially as user myuser (uid=1161, gid=1161) (pid 21728)
[2014/03/12 12:42:52, 1] smbd/service.c:close_cnum(1282)
  f5_device (10.200.11.44) closed connection to service share

The path to the share is \longweb03sandbox\share and file.txt is just there. One thing I noticed when Samba starts is the Netbios name is truncated to "longweb03sandbo" but it doesn't seen to make a difference whether I name the server with or without the x in my monitor.

Can you change the log level to 3 in your smb.conf file? It should collect much more valuable information.

https://www.samba.org/samba/docs/using_samba/ch12.html

I've done that, and it looks like the file is being returned to the Monitor:

    [2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(821)
  reduce_name [file.txt] [/tmp/share]
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(922)
  reduce_name: file.txt reduced to /tmp/share/file.txt
[2014/03/12 13:15:12, 3] smbd/dosmode.c:unix_mode(142)
  unix_mode(file.txt) returning 0744
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(821)
  reduce_name [file.txt] [/tmp/share]
[2014/03/12 13:15:12, 3] smbd/vfs.c:reduce_name(922)
  reduce_name: file.txt reduced to /tmp/share/file.txt
[2014/03/12 13:15:12, 2] smbd/open.c:open_file(391)
  101135 opened file file.txt read=Yes write=No (numopen=1)
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 8 of length 76
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBtrans2 (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] smbd/trans2.c:call_trans2qfilepathinfo(3254)
  call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 263
[2014/03/12 13:15:12, 3] smbd/trans2.c:call_trans2qfilepathinfo(3365)
  call_trans2qfilepathinfo file.txt (fnum = 11540) level=263 call=7 total_data=0
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 9 of length 59
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBreadX (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] lib/util.c:fcntl_getlock(2075)
  fcntl_getlock: fd 26 is returned info 2 pid 0
[2014/03/12 13:15:12, 3] smbd/reply.c:send_file_readX(2641)
  send_file_readX fnum=11540 max=64512 nread=2
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 10 of length 59
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBreadX (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] lib/util.c:fcntl_getlock(2075)
  fcntl_getlock: fd 26 is returned info 2 pid 0
[2014/03/12 13:15:12, 3] smbd/reply.c:send_file_readX(2641)
  send_file_readX fnum=11540 max=64512 nread=0
[2014/03/12 13:15:12, 3] smbd/process.c:process_smb(1101)
  Transaction 11 of length 45
[2014/03/12 13:15:12, 3] smbd/process.c:switch_message(932)
  switch message SMBclose (pid 22708) conn 0x2b3e488478b0
[2014/03/12 13:15:12, 3] smbd/reply.c:reply_close(3338)
  close fd=26 fnum=11540 (numopen=1)
[2014/03/12 13:15:12, 2] smbd/close.c:close_normal_file(406)
  101135 closed file file.txt (numopen=0) NT_STATUS_OK

But it's still marked as down...

Have you tried enabling debug logging on the SMB monitor on the LTM? If not, please do so and post log entries here.

I had done that, but just noticed the debug output gets written to its own file rather than /var/log/ltm - here's the log:

********** Debugging session beginning at: Wed Mar 12 14:38:02 2014

Arguments 1-2:
::ffff:10.200.8.28
445

Environment variables:
DEBUG=yes
GET=file.txt
MON_TMPL_NAME=/Common/cifs_monitor
NODE_IP=::ffff:10.200.8.28
NODE_PORT=445
PASSWORD=mypassword
SERVER=longweb03sandbo
SERVICE=share
USERNAME=myuser
--
smbclient //longweb03sandbo/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get file.txt file.txt.18261 -U myuser 
dirstring: Current directory is \
Domain=[LONGWEB03SANDBO] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
getting file \file.txt of size 2 as file.txt.18261 (0.5 kb/s) (average 0.5 kb/s)
Recvd: 'Current directory is \
'
file.txt was not transferred: No such file or directory

Is the line smbclient //longweb03sandbo/share mypassword -I 10.200.8.28 -p 445 -c cd .; cd; get file.txt file.txt.18261 -U myuser literally what the LTM will run to verify this connectivity? I can't see how this would work - it isn't passing a user to connect as in the initial connection, "get" isn't a valid shell command, etc...

The part that really concerns me is the 'No such file or directory' message. This would indicate either the service is incorrect or the path/filename is incorrect.

Yeah, it does look like the file is missing, but using a similar smbclient command I can see the file:

smbclient //longweb03sandbox/share mypassword -I 10.200.8.28 -p 445 -c ls -U myuser
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
  .                                   D        0  Wed Mar 12 15:02:37 2014
  ..                                  D        0  Wed Mar 12 15:01:52 2014
  damian.txt                          N        0  Wed Mar 12 15:02:37 2014
  file.txt                            N        2  Tue Mar 11 15:36:32 2014

        63481 blocks of size 16384. 61314 blocks available

I've tried the same command from a random Linux host, and from the LTM, both can see the file.

Also getting the file as below:

smbclient //longweb03sandbox/share mypassword -I 10.200.8.28 -p 445  -U 101135
Domain=[MYGROUP] OS=[Unix] Server=[Samba 3.0.33-3.39.el5_8]
smb: \> get file.txt
getting file file.txt of size 2 as file.txt (0.7 KiloBytes/sec) (average 0.7 KiloBytes/sec)

...also works