How to check active Samba connections with smbstatus

Active SMB sessions matter before restarting Samba, changing share permissions, or asking a user to close a file. smbstatus shows the clients currently attached to smbd so maintenance can wait for the right user, share, or workstation instead of interrupting an unknown connection.

The command reads Samba runtime status data and normally needs root privileges. --shares shows tree connections by share name, --processes shows the client session process with the authenticated username and SMB dialect, and --user narrows both views to one account.

An empty table can mean no clients are connected, but it can also mean the check ran on the wrong server or smbd is not running. Use the service state and the client-reported server name when the expected session is missing, and use the locks view before a restart or permission change that could affect open files.

1. List the shares that currently have connected clients.

   $ sudo smbstatus --shares
   
   Service      pid     Machine       Connected at                     Encryption   Signing
   ---------------------------------------------------------------------------------------------
   team         1842    192.0.2.25    Tue Jun 16 09:18:42 2026 UTC     -            partial

   No rows below the header means Samba has no active tree connections for the status database on that server.

2. List the active smbd sessions behind those share connections.

   $ sudo smbstatus --processes
   
   Samba version 4.23.6-Ubuntu-4.23.6+dfsg-1ubuntu2.1
   PID     Username     Group        Machine                                   Protocol Version  Encryption           Signing
   ----------------------------------------------------------------------------------------------------------------------------------------
   1842    sguser       sguser       192.0.2.25 (ipv4:192.0.2.25:55424)        SMB3_11           -                    partial(AES-128-GMAC)

   The Username and Machine columns identify the authenticated account and client address. The Protocol Version column confirms the negotiated SMB dialect for that session.

3. Filter the status output to one Samba account.

   $ sudo smbstatus --user=sguser
   No locked files
   
   Samba version 4.23.6-Ubuntu-4.23.6+dfsg-1ubuntu2.1
   PID     Username     Group        Machine                                   Protocol Version  Encryption           Signing
   ----------------------------------------------------------------------------------------------------------------------------------------
   1842    sguser       sguser       192.0.2.25 (ipv4:192.0.2.25:55424)        SMB3_11           -                    partial(AES-128-GMAC)
   
   Service      pid     Machine       Connected at                     Encryption   Signing
   ---------------------------------------------------------------------------------------------
   team         1842    192.0.2.25    Tue Jun 16 09:18:42 2026 UTC     -            partial

   Use the exact Samba account name, not the Windows display name, when filtering with --user.

4. Check for locked or open files before maintenance.

   $ sudo smbstatus --locks
   No locked files

   Restarting smbd or changing permissions while a client has open files can interrupt writes or leave the client with stale file handles.

5. Export machine-readable status when another script or ticket needs structured evidence.

   $ sudo smbstatus --json
   {
     "timestamp": "2026-06-16T09:19:05+0000",
     "version": "4.23.6-Ubuntu-4.23.6+dfsg-1ubuntu2.1",
     "sessions": {
   ##### snipped #####
         "username": "sguser",
         "remote_machine": "192.0.2.25",
         "session_dialect": "SMB3_11"
     },
     "tcons": {
   ##### snipped #####
         "service": "team",
         "machine": "192.0.2.25"
     },
     "open_files": {}
   }

   --json is best for saved evidence or automation. Use the human-readable tables first during an interactive maintenance check.