Server statistics

Fusion SMB exposes always-on diagnostic metrics that provide visibility into server activity, user sessions, network connections, etc. These metrics are maintained within the server and can be queried on demand using the tsmb-status tool which retrieves this information in JSON format.

This tool is primarily intended for:

• System administrators, to monitor current load and active users.
• Support engineers, to trace protocol activity and verify security settings.
• Monitoring pipelines, to feed telemetry into dashboards or alerting systems.

The output is designed to be machine readable and can also be interpreted manually when troubleshooting.

Understanding the metrics JSON output

The JSON output from tsmb-status is organized into two primary top-level array of objects:

• session[] — Represents authenticated user sessions. Each session includes identity (username, SID, UID), security attributes, and a list of associated connection IDs.
• connection[] — Represents active network connections. Each connection includes socket endpoints, protocol negotiation parameters, counters for bytes/packets, and per-operation statistics.

Field descriptions can be found in section Statistics Field Descriptions.

---

Data overview

• A Session = a user’s authenticated context on the server.
• A Connection = a transport channel (socket pair) that carries protocol traffic.
• Each session may reference one or more connection IDs.
• Each connection may service one or more sessions.
• The linking key between them is the Conn ID, which appears in both session[].Connections[] and connection[]."Conn ID".

This organization allows administrators to traverse from who (sessions) to how (connections) and vice-versa.

---

Representative example (full JSON output)

{
    "connection": [
        {
            "Node ID": 0,
            "Key": 12884901890,
            "Conn ID": 2,
            "Time of Connection": "2025-09-19T02:51:19",
            "Online": true,
            "Transport": "DIRECT_TCP",
            "Src Address": "192.168.4.18",
            "Src Port": 39691,
            "Dst Address": "192.168.4.18",
            "Dst Port": 445,
            "Dialect": "SMB 3.1.1",
            "Signing required": false,
            "Signing Alg": "aes-cmac",
            "Cipher Alg": "aes-128-gcm",
            "Opens": 0,
            "Sessions": 1,
            "SMB2 Credits": 900,
            "RX bytes": 7212,
            "TX bytes": 3418,
            "RX packets": 21,
            "TX packets": 21,
            "Outstanding ops": 0,
            "Operations": [
                { "Name": "SMB Open", "Count": 5, "Total duration": "0.114998391", "Data bytes": 0 },
                { "Name": "SMB Close", "Count": 4, "Total duration": "0.057723521", "Data bytes": 0 },
                { "Name": "SMB Read", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Write", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Flush", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Lock", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB SetInfo", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB QueryDirectory", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB QueryInfo", "Count": 5, "Total duration": "0.055097164", "Data bytes": 0 },
                { "Name": "Unclassified", "Count": 7, "Total duration": "0.301359034", "Data bytes": 0 }
            ]
        },
        {
            "Node ID": 0,
            "Key": 12884901889,
            "Conn ID": 1,
            "Time of Connection": "2025-09-19T02:51:17",
            "Online": true,
            "Transport": "DIRECT_TCP",
            "Src Address": "192.168.4.18",
            "Src Port": 39690,
            "Dst Address": "192.168.4.18",
            "Dst Port": 445,
            "Dialect": "SMB 3.1.1",
            "Signing required": false,
            "Signing Alg": "aes-cmac",
            "Cipher Alg": "aes-128-gcm",
            "Opens": 0,
            "Sessions": 1,
            "SMB2 Credits": 529,
            "RX bytes": 5727,
            "TX bytes": 2988,
            "RX packets": 18,
            "TX packets": 18,
            "Outstanding ops": 0,
            "Operations": [
                { "Name": "SMB Open", "Count": 4, "Total duration": "0.114998391", "Data bytes": 0 },
                { "Name": "SMB Close", "Count": 4, "Total duration": "0.057723521", "Data bytes": 0 },
                { "Name": "SMB Read", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Write", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Flush", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB Lock", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB SetInfo", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB QueryDirectory", "Count": 0, "Total duration": "0.000000000", "Data bytes": 0 },
                { "Name": "SMB QueryInfo", "Count": 5, "Total duration": "0.055097164", "Data bytes": 0 },
                { "Name": "Unclassified", "Count": 7, "Total duration": "0.301359034", "Data bytes": 0 }
            ]
        }
    ],
    "session": [
        {
            "Node ID": 0,
            "Key": 12901679105,
            "Session ID": 1,
            "Time of Session": "2025-09-19T02:51:17",
            "SID": "S-1-5-21-643297281-1366601880-3535958494-30003",
            "Username": "sdcuser1",
            "UID": 30003,
            "Signing required": false,
            "Encryption required": false,
            "Guest": false,
            "Opens": 0,
            "Rx plain pkts": 33,
            "Rx encrypted pkts": 0,
            "Rx signed pkts": 2,
            "Connections": [1,2]
        }
    ]
}

---

Scaling to large deployments

In large environments:

• Hundreds or even thousands of sessions may be active simultaneously.
• Each session can own multiple connections (e.g., on Windows 2019 server a client identified by its IP is allowed 32 multichannel connections per session).
• The total number of connection objects can reach into the thousands.

To associate a specific session (for example, identified by a username) with a connection:

1. Locate the session in the session[] list by matching its Username.
2. In the session object identify all the Conn IDs in the array Connections[].
3. Locate the connection in the connection[] list by matching its Conn ID.

---

Navigation tips: Listing connections by Username

To list all connection objects associated with a session, you can filter by Username.

By Username

jq --arg user "sdcuser1" '
  . as $root
  | $root.session[]
  | select(.Username == $user)
  | . + {
      connections: [
        .Connections[] as $cid
        | $root.connection[]
        | select(."Conn ID" == $cid)
      ]
    }
' metrics.json

Statistics field descriptions

Field classes

This section defines the categories used to classify fields in the metrics output (IDs, timestamps, gauges, counters, flags, etc.). It serves as a legend to quickly understand the role of each field in the tables that follow.

1. ↕︎ Gauge — snapshot metric that can go up/down.
2. ↺ Counter[w] — monotonic counter that wraps at 2^w−1 (use wrap-aware deltas).
3. TS — ISO 8601 formatted timestamp (event/establish time).
4. ID — unique identifier key.
5. FLG — boolean flag.
6. ENUM — categorical value from a known set.
7. ADDR — endpoint address/port.
8. REF — reference to another object/ID.
9. COLL — collection (array/object list).
10. INFO — informational string.

Special metric symbols

This section explains how to interpret numeric metrics that either represent instantaneous values (gauges) or cumulative totals (counters). It also introduces the wrap-aware delta formula for converting counters into useful rates like throughput and IOPS.

1. ↕︎ Gauge — snapshot value at sample time.
   1. Can rise or fall.
   2. Plot raw values (no rate calculation).
2. ↺ Counter[w] — cumulative counter that increases until it wraps at 2^w − 1 (where w is bit width, usually 32 or 64).
   1. Use wrap-aware deltas to calculate throughput/IOPS.
   2. Formula

      if (new >= old)
      	delta = new - old;
      else
      	delta = (2^w - old) + new;   // wrap correction
      
      rate = delta / Δt;
      Δt (delta t) — the elapsed time between two samples, in any unit of time (often seconds).
      E.g. if RX bytes = 1000 at t=0s and RX bytes = 6000 at t=10s, then
      • delta = 6000 − 1000 = 5000 bytes
      • Δt = 10 seconds
      • rate = 5000 / 10 = 500 bytes/sec

---

connection[] entries

This section documents all fields reported for each active connection in the server. It includes identifiers, transport details, security settings, activity counts, and per-operation statistics.

Field	Type	Class	Description	Units / Format	Example
Node ID	integer	ID	Collector/cluster node identifier.	—	0
Key	integer	ID	Unique key for this connection record.	—	12884901889
Conn ID	integer	ID	Connection identifier within the node.	—	1
Time of Connection	string	TS	Time the connection was established.	YYYY-MM-DDTHH:MM:SS	"2025-09-19T02:51:17"
Online	boolean	FLG	Whether the connection is currently online.	—	true
Transport	string	ENUM	Transport type.	e.g., DIRECT_TCP	"DIRECT_TCP"
Src Address	string	ADDR	Source IP address.	IPv4/IPv6	"192.168.4.18"
Src Port	integer	ADDR	Source TCP port.	0–65535	39690
Dst Address	string	ADDR	Destination IP address.	IPv4/IPv6	"192.168.4.18"
Dst Port	integer	ADDR	Destination TCP port.	0–65535	445
Dialect	string	ENUM	SMB protocol dialect negotiated.	e.g., SMB 3.1.1	"SMB 3.1.1"
Signing required	boolean	FLG	Whether SMB signing is required.	—	false
Signing Alg	string	ENUM	Negotiated signing algorithm.	e.g., aes-cmac	"aes-cmac"
Cipher Alg	string	ENUM	Negotiated encryption cipher.	e.g., aes-128-gcm	"aes-128-gcm"
Opens	integer	↕︎ Gauge	Current open handles on this connection.	count	0
Sessions	integer	↕︎ Gauge	Current SMB sessions on the connection.	count	1
SMB2 Credits	integer	↕︎ Gauge	SMB2 credits granted at sample time.	credits	529
RX bytes	integer	↺ Counter[64]	Bytes received since reset; wraps.	bytes	5727
TX bytes	integer	↺ Counter[64]	Bytes sent since reset; wraps.	bytes	2988
RX packets	integer	↺ Counter[64]	Packets received since reset; wraps.	packets	18
TX packets	integer	↺ Counter[64]	Packets sent since reset; wraps.	packets	18
Outstanding ops	integer	↕︎ Gauge	In-flight SMB operations now.	count	0
Operations	array[object]	COLL	Per-operation tallies (see below).	—	—

connection[].Operations[] items

This subsection details the breakdown of operations observed on a connection, including counts, total durations, and bytes processed for each SMB/protocol operation class.

Field	Type	Class	Description	Units / Format	Example
Name	string	ENUM	SMB operation class.	e.g., SMB Open, Unclassified	"SMB Open"
Count	integer	↺ Counter[64]	Requests observed for this op; wraps.	ops	4
Total duration	string/number	↺ Counter[64]	Cumulative seconds across requests; wraps.	seconds	"0.114998391"
Data bytes	integer	↺ Counter[64]	Cumulative payload bytes for this op; wraps.	bytes	0

---

session[] entries

This section covers all fields reported for each session, including user identity, security flags, and packet counters. It also shows how sessions reference one or more underlying connections.

Field	Type	Class	Description	Units / Format	Example
Node ID	integer	ID	Collector/cluster node identifier.	—	0
Key	integer	ID	Unique key for this session record.	—	12901679105
Session ID	integer	ID	SMB session identifier within the node.	—	1
Time of Session	string	TS	Time the session was established.	YYYY-MM-DDTHH:MM:SS	"2025-09-19T02:51:17"
SID	string	ID	Windows Security Identifier.	SID string	"S-1-5-21-...-30003"
Username	string	INFO	Authenticated username.	—	"Windowsuser1"
UID	integer	ID	Local user ID mapping.	—	30003
Signing required	boolean	FLG	Whether SMB signing is required.	—	false
Encryption required	boolean	FLG	Whether SMB encryption is required.	—	false
Guest	boolean	FLG	Guest authentication indicator.	—	false
Opens	integer	↕︎ Gauge	Current open handles under this session.	count	0
Rx plain pkts	integer	↺ Counter[64]	Plain packets received; wraps.	packets	13
Rx encrypted pkts	integer	↺ Counter[64]	Encrypted packets received; wraps.	packets	0
Rx signed pkts	integer	↺ Counter[64]	Signed packets received; wraps.	packets	2
Connections	array[integer]	REF	Conn IDs associated with this session (refs Conn ID).	list of IDs	[1]