server-side-copy: seems not to get used

At a customer we run Samba Version 4.22.6-Debian-4.22.6+dfsg-0+deb13u1 
on a Debian-13 server

The latest patches are missing (waiting for a maintenance window) but 
it's at around one month back in terms of debian-upgrades.

It's a domain member server/fileserver.

A user noticed that if he accesses a share via VPN and copies files 
within a share, that it's very slow: around 2MB/s ..

The same copy in LAN works with around 80-90MB/s.

The server is a bit outdated and only connected via a 1 GB/s NIC.

But aside from that it seems that the server-side-copy functionality of 
Samba does not work here, or isn't used.

Yes, he uses Windows File Explorer.

I am in the process of analyzing this and collect facts.

The underlying filesystem:

/dev/sdd1 on /mnt/MSA2040 type ext4 (rw,relatime,stripe=256)

It's located on a SAN, yes, but this shouldn't play a role in my A/B 
comparison with the copy.

The only "special" thing is that vfs_audit is enabled. But that's the 
same for LAN and VPN access, right?

The config is old and hasn't been touched for a few years. Back then 
Louis and Rowland helped to get it right: thanks once more.

# cat /etc/samba/smb.conf

[global]
unix charset = iso8859-15

security = ads
realm = DOM.INTRA
workgroup = DOM

dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab

winbind cache time = 10
winbind use default domain = yes
winbind refresh tickets = Yes

template homedir = /mnt/MSA2040/smb/Homes/%D/%U

domain master = no
local master = no
preferred master = no

idmap config * : range = 3000-7999
idmap config * : backend = tdb
idmap config DOM : range = 10000-20000
idmap config DOM : backend = rid

username map = /etc/samba/samba_usermapping

# For ACL support on domain member
vfs objects = acl_xattr full_audit
map acl inherit = Yes

# the next line is only required on Samba versions less than 4.9.0
#store dos attributes = Yes
inherit acls = yes

unix extensions = no
follow symlinks= yes
wide links= yes

load printers = no
printcap name = /dev/null

acl allow execute always = True

# Audit settings
full_audit:prefix = %u|%I|%m|%S
full_audit:failure = connect
full_audit:success = mkdirat read pread write pwrite renameat unlinkat
full_audit:facility = local5
full_audit:priority = notice

log level = 1

min domain uid=0

[homes]

[..]


Any thoughts on this, where to look and what to test/check/change?

Thanks!

ps: I asked another samba-customer to test such a copy via VPN this 
evening.


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba