I would like to enable logging on my file sharing service. (It's crashing intermittently and I can't figure out why.)

When I inspect the plist for the file sharing service smbd on my Mac running Mojave, I see:

user@mac:~ $  plutil -p /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist

  "AclsEnabled" => 1
  "DOSCodePage" => "437"
  "LocalKerberosRealm" => "LKDC:SHA1..."
  "LogLevel" => 0
  "NetBIOSName" => "transom"
  "ServerDescription" => "Transom"
  "SigningRequired" => 0

So, it looks like logging is configured with the parameter "LogLevel". I've read the smbd man page, and it's not much help, with this parameter.

  • What are the allowed log levels?
  • Which level is best for debugging smbd crashes?
  • What's the preferred method for tweaking a value? (plutil can set, or...)
  • 1
    I have upgraded this machine to macOS Catalina 10.15.2, and things have got much much worse. The Apple smbd currently needs restarting ever couple of hours.
    – Matt
    Commented Dec 19, 2019 at 20:10
  • 1
    smbdiagnose may be helpful. Don't know when it arrived, but it's in Big Sur.
    – Mint
    Commented Sep 23, 2021 at 23:08

3 Answers 3


With macOS 10.15, the only diagnostic logging available for smbd is done by grabbing packets.

Apple Support told me the following:

To enable elevated logging;

sudo log config --mode level:debug 
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist LogLevel -int 1
sudo /usr/libexec/smb-sync-preferences

To begin packet capture;

sudo tcpdump -Pi BSDname -s 0 -K -w /Library/Logs/smb.pcap

To end packet capture; Control-C

Disable elevated Logging:

sudo log config --mode level:default 
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist LogLevel -int 0 
sudo /usr/libexec/smb-sync-preferences
  • Is the tcpdump command cut and pasteable, or is BSDname something that needs to be replaced with something else? Commented Feb 18, 2020 at 19:19

I'm not sure about questions 1 and 2, but the third question appears to be scutil.

man scutil tells you about how to do it. Apple uses it to edit that file in the following KB article- https://support.apple.com/en-us/HT204021

  • Just tried this. It worked for me - changed the value for key "LogLevel" in the plist.
    – Matt
    Commented Jul 18, 2019 at 19:14

I updated to 10.14.5 a few days ago on one of my clients servers and have been having the same problem since. Everyones connection to the server just randomly drops. I can go into activity monitor and quit the smbd process and it will kick right back in and start working again but I never know for how long.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .