New Utility - CIFSSTAT

Dave Olker dave_olker at
Thu Jul 6 16:33:13 GMT 2000

Hello Samba Team,

I've written new tool for SAMBA servers which I believe system
administrators will find useful.  The tool is called CIFSSTAT.  It
provides roughly the same information as nfsstat does for NFS servers. 
A current copy of the tool is attached to this email message (in gzip
format) for your use and review.

For those of you unfamiliar with nfsstat, it provides statistical
information about what NFS clients and servers are doing at the RPC
level.  It shows the total number of RPC calls received by the server
and breaks down the total into individual numbers (i.e. how many reads,
writes, lookups, etc.)  This information is very useful when trying to
size or tune NFS servers as it tells what type of requests are coming
into the server, and thus what it is spending it's time doing.  Instead
of reporting on RPC transactions, CIFSSTAT reports on SMB transactions.  

Rather than modify the samba source code to collect and retrieve this
data, I decided to design the tool to retrieve the information it needs
from smbd log files.  I chose this method for several reasons:

1. It would allow us to collect data on the SAMBA server, which is
   normally the system that administrators have more control over
   because most CIFS clients are Windows PCs.

2. Since the server side logging is already built in to SAMBA, we 
   could collect the data without having to make any changes to the 
   SAMBA code.  This also means that this tool will run successfully
   on currently installed SAMBA servers without requiring a recompile
   of the server code.

3. SAMBA allows the administrator to configure the logging mechanism 
   to either create separate log files for each individual client or 
   log all information to a single log file.  This gives us the 
   flexibility of analyzing the SMB traffic specific to a single 
   client or to the server as a whole simply by changing a variable 
   in the smb.conf file.

The only requirement of the tool is that the "debug level" or "log
level" specified in the [globals] section of the smb.conf file must be
set to 3 or higher.  While this might add a bit of overhead to the
server, the SAMBA code will only log the necessary entries at level 3 or

I chose to implement this tool as a K-Shell script for portability
reasons.  Since maintains and distributes the source code
which most vendors port from, the logging subsystem should be the same
on most any SAMBA server.  So while I did the original development of
this tool on an HP 9000 system, it would probably run unmodified on any
other vendor platform that supports the Korn Shell.

Here is a sample output from the cifsstat tool when run against a log
file on my HP CIFS/9000 server:

ros87252(/var/opt/samba) -> cifsstat log.ros87252lap
CIFSSTAT (Version: 1.6)

SMB Call Statistics extracted from file: "log.ros87252lap"
Total number of SMB calls found in file: 2526
Total number of bytes from all READ calls in file: 37886
Total number of bytes from all WRITE calls in file: 20628

CORE Protocol: (985 calls)
negprot        tcon           tdis           exit           ioctl
27             0              433            0              0
echo           sesssetupX     tconX          ulogoffX       getatr
1              35             446            0              0
setatr         chkpth         search         open           create
0              0              0              0              0
mknew          unlink         read           write          close
0              3              0              2              37
mkdir          rmdir          dskattr        mv             lseek
0              0              0              1              0
flush          ctemp          splopen        splclose       splretq
0              0              0              0              0
splwr          lock           unlock
0              0              0

CORE+ Protocol: (0 calls)
readbraw       writebraw      writeclose     lockread       writeunlock
0              0              0              0              0

LANMAN 1.0 Protocol: (521 calls)
readBmpx       readBs         writeBmpx      writeBs        writec
0              0              0              0              0
setattrE       getattrE       trans          transs         ioctls
0              0              491            0              0
copy           move           openX          readX          writeX
0              0              0              16             10
lockingX       ffirst         funique        fclose
4              0              0              0

LANMAN 2.0 Protocol: (951 calls)
findnclose     findclose      trans2         transs2
0              0              951            0

NT Protocol: (69 calls)
ntcreateX      nttrans        nttranss       ntcancel
58             10             0              1

Messaging: (0 calls)
sends          sendstrt       sendend        sendtxt
0              0              0              0

The only parameter passed to the cifsstat command is the name of the
logfile.  After some quick sanity checks, the program will process the
logfile and print the results.  The output format is very similar to
nfsstat(1M), in that it tracks the total number of calls in the entire
logfile, the total number of calls on a per-subsystem basis, and the
number of each individual call type.

Additionally (unlike nfsstat) it keeps track of the number of bytes that
clients have either read from the server or written to the server.  This
information could be very useful, especially when comparing log files
from individual clients to see which systems are consuming more
resources on the server.

There are many more enhancements which could be added to this tool to
make it even more functional and usable.  Rather than try to think of
them myself, I thought the samba community would be a better sounding
board for ideas and future development.

I hope you find this tool useful enough to consider including with
future samba releases.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: cifsstat.gz
Type: application/x-gzip
Size: 3149 bytes
Desc: not available
Url :
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dave_olker.vcf
Type: text/x-vcard
Size: 376 bytes
Desc: Card for Dave Olker
Url :

More information about the samba-technical mailing list