How to increase Samba log level

SMB access failures can leave only a short authentication, share, or mount error on the client. Increasing the Samba log level during a troubleshooting window adds server-side detail for the same request, so the administrator can separate authentication problems from share lookup, protocol negotiation, and file-system permission failures.

Samba reads server logging settings from the [global] section of /etc/samba/smb.conf. The log level value controls how much debug information smbd records, and smbcontrol can ask running Samba daemons to reload the file without waiting for a package service restart.

Use a raised level only while collecting the failing event. Level 3 gives more request detail than the normal service setting, while levels above 3 are intended for developer-level tracing and can fill log storage quickly on busy file servers.

1. Back up the current Samba configuration.

   $ sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.before-log-level

2. Open the Samba configuration file.

   $ sudo vi /etc/samba/smb.conf

3. Add or update log level in the [global] section.

   [global]
      log level = 3

   Do not leave elevated logging enabled after the troubleshooting window. Higher levels increase disk usage and can expose more authentication and path detail in the log files.

4. Test the Samba configuration syntax.

   $ sudo testparm -s
   Load smb config files from /etc/samba/smb.conf
   Loaded services file OK.
   
   Server role: ROLE_STANDALONE
   
   ##### snipped #####

   Related: How to validate Samba configuration with testparm

5. Reload the running Samba daemons.

   $ sudo smbcontrol all reload-config

   The command exits without output when the reload request is delivered successfully.

6. Confirm smbd is running with the raised debug level.

   $ sudo smbcontrol smbd debuglevel
   PID 1242: all:3 tdb:3 printdrivers:3 lanman:3 smb:3 rpc_parse:3 rpc_srv:3 rpc_cli:3
   ##### snipped #####

7. Reproduce the SMB action that needs more detail.

   $ smbclient -L //fileserver.example.com -U sguser
   Password for [WORKGROUP\sguser]:
   
   	Sharename       Type      Comment
   	---------       ----      -------
   	print$          Disk      Printer Drivers
   	IPC$            IPC       IPC Service (fileserver server (Samba, Ubuntu))
   SMB1 disabled -- no workgroup available

   Reconnect the affected client if it already had an open SMB session before the reload. Running clients may keep settings read before the log-level change.

8. Review the Samba log for the reproduced request.

   $ sudo less /var/log/samba/log.smbd

   Some package configurations also write per-client files such as /var/log/samba/log.192.0.2.45 or /var/log/samba/log.WORKSTATION.