SMB Read
partial
1x weight
estimate
SMB Read partial. scoring engine got the file but the content is wrong
22 files have incorrect content
Events
378
Pts per check
1.4
Pts missed
525
Teams hit
3/13
Authority mappings
Which work roles, knowledge units, and EWU courses this error pattern touches. Hover for context, click to drill in.
DCWF roles:
CE-463 Host Analyst
CS-462 Control Systems Security Specialist
CS-521 Cyber Defense Infrastructure Support Specialist
CS-531 Cyber Defense Incident Responder
IT-411 Technical Support Specialist
IT-451 System Administrator
What the message means
The scoring engine fetched files from the `files` share but their contents don't match expected reference data. Typically means the share has the right filenames but either the files are empty, were modified, or are the wrong versions. This is 'partial'. give it priority if you see it along with SMB Login working.
Why the service is down
- Files exist but are empty (e.g., created with touch during hardening).
- Red team modified file contents.
- Wrong file version deployed (backup restored from before the competition).
- File system encoding mismatch (rare. CRLF vs LF etc).
Commands in order
-
1. 1. Locate the share path
testparm -s 2>/dev/null | awk '/^\[files\]/,/^\[/' | awk '/path = /{print $3; exit}'Expecte.g., /srv/samba/filesInterpret and nextSave as $SHARE for the next steps. -
2. 2. Inventory the files the engine expects
ls -la $SHARE | head -30ExpectA set of .data files including addict_with_a_pen.dataInterpret and nextAny zero-byte files are suspicious. Any missing files = create. -
3. 3. Find zero-byte files
find $SHARE -size 0 -type f -lsExpectEither no output or a list of empty filesInterpret and nextEmpty files = content lost. Restore from `/root/competition-backups/` if you backed up the share. Otherwise accept partial credit from Login + Attribute checks. -
4. 4. Check for red-team modifications
find $SHARE -type f -mmin -30 -lsExpectFiles modified in the last 30 minInterpret and nextIf anything was modified recently and it wasn't you, red team touched it. Restore from backup. -
5. 5. Restore from golden backup if present
rsync -av --delete /root/competition-backups/files/ $SHARE/ExpectFile count matches pre-competition baselineInterpret and nextIf no backup exists, build one NOW for future competitions.
Decision tree
Answer each question to route to the right fix.
Q: Did you back up the share contents at T+5?
Yes:
rsync restore from backup.
No:
Create any empty files with placeholder content; accept partial score this time.
External references
Other patterns on this service
- 4,415.3 failure SMB operation failed: [Errno 111] Connection refused
- 1,705.6 partial SMB operation failed: Failed to get attributes for addict_with_a_pen.data on files: Unabl.
- 1,197.2 failure SMB operation failed: [Errno 113] Host is unreachable
- 279.2 failure SMB connection failed: protocol error
- 262.5 partial SMB operation failed: Failed to get attributes for cottonwood.data on files: Unable to op.
- 105.6 partial SMB operation failed: Failed to retrieve before_you_start_your_day.data on files: Unable .
- 68.1 partial SMB operation failed: Failed to get attributes for .choker.data on files: Unable to open .
- 63.9 partial SMB operation failed: Failed to get attributes for air_catcher.data on files: Unable to o.
- 63.9 failure Failed to connect to host: IP
- 56.9 partial SMB operation failed: Failed to get attributes for addict_with_a_pen.data on files: Unabl.