[Samba] debugging

[Michael Tokarev]

Hi!

I'm, once again, trying to debug an awfully working samba
in our network.  It is a domain member, with as standard
config as possible, joined to a windows server 2012R2 domain.
It has a read-only share, from which it serves files - it's
an application which is run from that share.

The problem I'm faced with right now is that I don't see how
to attack this from the debugging/tracing side.  No matter
how I tried, I weren't able to see file transactions which
are being performed - besides the successful ones, like
"client opened file.." "client closed file".  Unsuccessful
opens are really difficult to catch: either a higher debug
level is needed - in which case the amount of logs becomes
huge, and there's no way to find log entries belonging to
a single session (most clients are large terminal servers,
where multiple users are working at the same time).  Or
nothing of interest is logged.

It is more, - I removed `debug level=` setting from smb.conf,
I increase it dynamically (smbcontrol smbd debug xxx), - things
starts flowing in the logs, but in a few minutes the logging
stops, like if someone turned it off, while the server
continues to serve requests.  Another `smbcontrol debug` brings
up another cycle, which stops in a few minutes again.

Sometimes I try to enable debug for a single process, - but
`smbcontrol $pid debug XXX` is being ignored, - at least,
there's nothing in the logs from that pid at all.

I've set `log file = /var/log/samba/log.%I` - this somewhat
helps (not for multi-user machines still), but it also makes,
say, winbindd logs to appear as log.0.0.0.0, which is kinda
wrong - it looks like `log file` setting should be different
for smbd and others, say, `smbd log file =` etc.

Now, in the logs, I see things like this:

[2025/11/11 14:54:42.221984,  3, pid=4026463] 
source3/smbd/smb2_server.c:4052(smbd_smb2_request_error_ex)
   smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] 
status[NT_STATUS_OBJECT_NAME_NOT_FOUND] || at source3/smbd/smb2_create.c:362
[2025/11/11 14:54:42.222407,  3, pid=4060945] 
source3/smbd/smb2_server.c:4052(smbd_smb2_request_error_ex)
   smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] 
status[NT_STATUS_ACCESS_DENIED] || at source3/smbd/smb2_getinfo.c:159
[2025/11/11 14:54:42.462298,  3, pid=4060978] 
source3/smbd/smb2_server.c:4052(smbd_smb2_request_error_ex)
   smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] 
status[NT_STATUS_NOT_SUPPORTED] || at source3/smbd/smb2_getinfo.c:159
[2025/11/11 14:54:42.494356,  3, pid=4027463] 
source3/smbd/smb2_server.c:4052(smbd_smb2_request_error_ex)
   smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[5] 
status[NT_STATUS_INFO_LENGTH_MISMATCH] || at 
source3/smbd/smb2_query_directory.c:161

and so on (there's a large amount of this in logs), and increasing
debug level does not make them clearer.  Which object(s) they refer to,
how to find out?  Should I worry about these messages?
(this is samba 4.21, last version which works here *somehow*).

I tried enabling auditing.  But this was even more "fun" -
vfs_extd_audit logs to syslog even if extd_audit channel
is configured in `log level` to be logged to a file, and
global `logging` is set to `file`.  This fills up systemd journal
quite fast (several gigs at least), and the system dies due to
out of free space in /var.  Turning off auditing at runtime
doesn't seem to work - I set `vfs modules = (empty)` explicitly
in smb.conf, do `smbcontrol all reload-config`, but numerous
smbds keep logging audit actions anyway.

For next attempts, I'll try to enable logging/auditing on a per-client
basis at least, by including client-specific smb.conf.%I.  Unfortunately
I can't predict which client I'll have to debug, since the problems are
all intermittent and can occur on any client from many.  And reloading
stuff at runtime doesn't seem to work (as per above).


How one can debug such stuff, any suggestions?

Thanks,

/mjt