How to enable logging for smbd on macOS?

I would like to enable logging on my file sharing service. (It's crashing intermittently and I can't figure out why.)

When I inspect the plist for the file sharing service smbd on my Mac running Mojave, I see:

user@mac:~ $  plutil -p /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist

{
  "AclsEnabled" => 1
  "DOSCodePage" => "437"
  "LocalKerberosRealm" => "LKDC:SHA1..."
  "LogLevel" => 0
  "NetBIOSName" => "transom"
  "ServerDescription" => "Transom"
  "SigningRequired" => 0
}

So, it looks like logging is configured with the parameter "LogLevel". I've read the smbd man page, and it's not much help, with this parameter.

  • What are the allowed log levels?
  • Which level is best for debugging smbd crashes?
  • What's the preferred method for tweaking a value? (plutil can set, or...)

With macOS 10.15, the only diagnostic logging available for smbd is done by grabbing packets.

Apple Support told me the following:

To enable elevated logging;

sudo log config --mode level:debug 
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist LogLevel -int 1
sudo /usr/libexec/smb-sync-preferences

To begin packet capture;

sudo tcpdump -Pi BSDname -s 0 -K -w /Library/Logs/smb.pcap

To end packet capture; Control-C

Disable elevated Logging:

sudo log config --mode level:default 
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist LogLevel -int 0 
sudo /usr/libexec/smb-sync-preferences

I'm not sure about questions 1 and 2, but the third question appears to be scutil.

man scutil tells you about how to do it. Apple uses it to edit that file in the following KB article- https://support.apple.com/en-us/HT204021


I updated to 10.14.5 a few days ago on one of my clients servers and have been having the same problem since. Everyones connection to the server just randomly drops. I can go into activity monitor and quit the smbd process and it will kick right back in and start working again but I never know for how long.