SAMBA-LOG-PARSER(1)

💖 SAMBA-LOG-PARSER 💖

okay bestie, welcome to samba-log-parser, which lives in section 1 of the manual pages (user commands, iykyk) 🎀 she's a Samba (winbind) trace parser, and she is so good at her job it's unreal.

and like, here's her whole little options menu up front, because that's just how the page does it:

• -h, --help — show this help message and exit
• --traceid ID — specify the traceid of the trace records
• --pid PID — specify the pid of winbind client
• --breakdown — breakdown the traces into per traceid files
• --merge-by-timestamp — merge logs by timestamp
• --flow — show the request/sub-request flow traces
• --flow-compact — show the request/sub-request flow traces without dcerpc details

---

✨ SYNOPSIS ✨

samba-log-parser {path} [--pid=PID] [--traceid=ID] [--breakdown]
 [--merge-by-timestamp] [--flow] [--flow-compact] [-h|--help]

🦋 DESCRIPTION 🦋

so this tool is part of the samba(7) suite, like she's got family, she's not out here alone 🫶

and what she does — the samba-log-parser program parses samba winbind logs. that's it. that's the whole vibe. parses samba winbind logs ✨

---

💅 OPTIONS 💅

The following options are available to the samba-log-parser program. (yes, all of them, we're not skipping a single one, periodt)

• --pid=PID — Display traces for winbind client with the matching PID. 🔍
• --traceid=ID — Display traces with matching traceid debug header field.
• --breakdown — Break down all traces to separate files in the current working directory. For each traceid, three files are created: traceid.full traceid.flow traceid.flowcompact — okay so that's THREE files per traceid, she's not doing half measures 💀
• --merge-by-timestamp — Sort the trace lines according to the timestamp. Works with log files without traceid header field as well. 👑
• --flow — Display the request/sub-request flow.
• --flow-compact — Display the request/sub-request flow without dcerpc call details.

---

🌸 EXAMPLES 🌸

not me about to give you four whole examples because we are learning today, bestie 💖

Show the flow traces for trace id 1234 from log file log.winbind:

# samba-log-parser --traceid 1234 --flow /var/log/samba/log.winbind

Show the full traces for winbind client with PID 999999 sorted using the timestamp for log files found in the samba log directory:

# samba-log-parser --pid 999999 --merge-by-timestamp /var/log/samba

Break down the traces into separate files according to traceid sorted using the timestamp for log files found in the samba log directory:

# samba-log-parser --breakdown --merge-by-timestamp /var/log/samba

Sort traces using the timestamp for log files found in the samba log directory. Traces do not need to contain the traceid header field.

# samba-log-parser --merge-by-timestamp /var/log/samba

---

⭐ VERSION ⭐

This man page is part of version 4.24.7-Ubuntu-4.24.7+dfsg-1ubuntu1 of the Samba suite.

👑 AUTHOR 👑

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. literal icons, no cap 🌈

---

okay that's the whole page bestie!! and for the cute lil sign-off: this whole thing comes from Samba 4.24.7-Ubuntu-4.24.7+dfsg-1ubuntu1 and it's dated 09/13/2026 — so go forth, parse those winbind logs, and slay 💅🦋🎀