Can anyone explain me smbstatus output? What do the 2 sections (pid-username-group-machine and service-pid-machine-connected at) mean?

Example output

Samba version 4.5.12-Debian
PID     Username     Group        Machine                                   Protocol Version  Encryption           Signing              
1620    -1           -1           tonne (ipv4:         NT1               -                    -                    
1621    -1           -1           tonne (ipv4:         NT1               -                    -                    
1621    nobody       nogroup      tonne (ipv4:         NT1               -                    -                    
1620    nobody       nogroup      tonne (ipv4:         NT1               -                    -                    

Service      pid     Machine       Connected at                     Encryption   Signing     
IPC$         1621    tonne         Di Dez  4 22:30:13 2018 CET      -            -           
IPC$         1620    tonne         Di Dez  4 22:30:09 2018 CET      -            -           

No locked files

The first listing is a listing of samba processes. But you can also view it as a listing of users that have active connections to the server. The information is Process ID (PID), Username of the account that's being accessed, Primary Group of the account that's being accessed, and the Machine/IP address that this is happening from.

If this is all you want you can use smbstatus -p

The 2nd group is a listings of shares that are currently being accessed. This will also includes hidden shares and printers. Because it's possible that a listing of current users who have connections can be accessing more than one service. So the information here is Service name, Process ID, Machine name who's accessing the service, and the time that the connection was established. You can use the PID to cross reference the service records with the users.

If this is all you want to see you can use smbstatus -S

The rest of the output is the file locking status for the files that are being accessed.

smbstatus -L will show you only this information.

  • Thank you. Beside the machine IP there's the same IP in brackets: ( What's that? – Spaffo Jun 3 '11 at 16:24
  • Normally the DNS name for the machine if it has one is outside and the IP address is inside the ()'s. But with being the localhost I'm not surprised that it doesn't resolve to a name. – 3dinfluence Jun 3 '11 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.