For the past day, every half hour or so, /var/log/syslog gets this burst within one second:

CRON[23914]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime))
Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
CIFS VFS: Send error in SessSetup = -13
Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
CIFS VFS: Send error in SessSetup = -13

The script /etc/cron.d/php5 contains that first line, with a comment " Look for and purge old sessions every 30 minutes". A bit more investigation shows that it's tidying up /var/lib/php5 (which is quite bare; this host doesn't use php).

  1. Why could the 4 error messages have suddenly started to appear? Removing old files shouldn't cause anything to try to mount a CIFS share.
  2. What's a clean way to stop /etc/cron.d/php5 from running? Uninstall php completely? (Editing the script is like telling the roomba to keep mopping up the bathroom floor, instead of phoning the plumber.)

Possibly related:

  • I think the first line is indicating success from the php5 session cleaner and the rest is from another error. You could update that cron to output to a different log file to be sure though. If you don't need php5, why not uninstall it? – Grayson Kent Apr 18 '17 at 15:49
  • I now doubt that php causes the 4 errors, despite the suspiciously close timing. Nowhere in /etc/cron*/* does the string "mount" occur. – Camille Goudeseune Apr 18 '17 at 20:24

This is likely not caused by PHP5 and instead caused by a samba setup. Check to see if you have a share in your /etc/fstab which might be attempting an SMB mount to a windows volume/server on a 30min refresh. My guess is you are seeing two different errors. Session garbage collection on PHP would not cause the NT_STATUS_LOGON_FAILURE unless you moved your session storage to a Samba-mounted share.

You could determine your session path with this:

php -i|grep -i session.save_path

However, the error you outlined is coming from something else.

  • That command returned /var/lib/php5, supporting the idea that the error isn't caused by php. When I dug around /etc/fstab and commented out some old unneeded shares, then the errors stopped, and haven't come back in several hours. – Camille Goudeseune Apr 19 '17 at 15:49
  • beautiful, glad it worked! – Chris Schuld Apr 19 '17 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.