samba-log-parser - Samba (winbind) trace parser.

       The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed
       by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

Samba 4.21.4-Ubuntu-4.21.4+dfs                     06/19/2025                                SAMBA-LOG-PARSER(1)

       This tool is part of the samba(7) suite.

       The samba-log-parser program parses samba winbind logs.

       Show the flow traces for trace id 1234 from log file log.winbind:

                # samba-log-parser --traceid 1234 --flow /var/log/samba/log.winbind

       Show the full traces for winbind client with PID 999999 sorted using the timestamp for log files found in
       the samba log directory:

                # samba-log-parser --pid 999999 --merge-by-timestamp /var/log/samba

       Break down the traces into separate files according to traceid sorted using the timestamp for log files
       found in the samba log directory:

                # samba-log-parser --breakdown --merge-by-timestamp /var/log/samba

       Sort traces using the timestamp for log files found in the samba log directory. Traces do not need to
       contain the traceid header field.

                # samba-log-parser --merge-by-timestamp /var/log/samba

       samba-log-parser - Samba (winbind) trace parser.

       options:
         -h, --help     show this help message and exit
         --traceid ID   specify the traceid of the trace records
         --pid PID      specify the pid of winbind client
         --breakdown    breakdown the traces into per traceid files
         --merge-by-timestamp   merge logs by timestamp
         --flow         show the request/sub-request flow traces
         --flow-compact show the request/sub-request flow traces without dcerpc details

       The following options are available to the samba-log-parser program.

       --pid=PID
           Display traces for winbind client with the matching PID.

       --traceid=ID
           Display traces with matching traceid debug header field.

       --breakdown
           Break down all traces to separate files in the current working directory. For each traceid, three
           files are created: traceid.full traceid.flow traceid.flowcompact

       --merge-by-timestamp
           Sort the trace lines according to the timestamp. Works with log files without traceid header field as
           well.

       --flow
           Display the request/sub-request flow.

       --flow-compact
           Display the request/sub-request flow without dcerpc call details.

       samba-log-parser {path} [--pid=PID] [--traceid=ID] [--breakdown] [--merge-by-timestamp] [--flow]
        [--flow-compact] [-h|--help]

       This man page is part of version 4.21.4-Ubuntu-4.21.4+dfsg-1ubuntu3.3 of the Samba suite.