Measure CIFS Read and Write Activity with cifsiostat

When a mounted CIFS share feels slow and nobody can prove it, cifsiostat gives you the read, write and file-operation rates that settle the argument. This walks through taking a bounded sample and telling the since-boot first report from a genuine live interval. The examples use cifsiostat from sysstat 12.6.1, installed on this host.

Allow about ten minutes. You need a shell, the sysstat package, and at least one mounted CIFS filesystem if you want data rows. Reading the statistics does not need elevated privileges. Mounting a share, changing its credentials or altering a service sits outside this guide and may need an administrator.

1. Confirm the installed command

Check the binary and version before you rely on an option in a script. These are ordinary, read-only commands:

$ command -v cifsiostat
/usr/bin/cifsiostat
$ cifsiostat -V
sysstat version 12.6.1
(C) Sebastien Godard (sysstat <at> orange.fr)

cifsiostat is part of sysstat, but the package revision varies between distributions. On Debian or Ubuntu, record it like this:

$ dpkg-query -W -f='${Package} ${Version}\n' sysstat
sysstat 12.6.1-2

Your package revision will differ. What matters is that cifsiostat runs and reports the version you are about to document.

2. Take one bounded report

Give cifsiostat an interval and a count when you want a command that ends on its own rather than one you have to interrupt. This asks for two reports, a second apart:

$ S_COLORS=never cifsiostat 1 2
Linux 6.8.0-139-generic (host.example)    09/22/26    _x86_64_    (8 CPU)

Filesystem                     rB/s         wB/s    rops/s    wops/s         fo/s         fc/s         fd/s
/mnt/share                    12.00         0.00      1.00      0.00         0.00         0.00         0.00

Average:      /mnt/share       8.00         0.00      1.00      0.00         0.00         0.00         0.00

Host details, spacing and values are machine-specific. What you're checking for is that the process exits after two reports and a row appears for each mounted CIFS filesystem. Setting the colour environment variable to never keeps captured output free of terminal colour codes; you don't need it for interactive use.

$ printf 'exit status: %s\n' "$?"
exit status: 0

3. Read the columns without guessing

The first column is the filesystem mount point. The rate columns are:

cifsiostat report fields:

The manual labels the size variants as kB and MB, but the program actually uses powers of 1024, so those values are kibibytes and mebibytes in precise terms. A high byte rate does not necessarily mean many operations: one large read and many small reads can land on very different combinations of rB/s and rops/s.

4. Separate the first report from current activity

Here's the trap: with an interval, the first report covers statistics accumulated since system boot, not since you started watching. Later reports cover only the preceding interval. That makes the first row useful for a broad historical view, but it can hide a burst that happened five minutes ago.

For a current one-minute sample, discard or label the first report and inspect the ones that follow:

$ S_COLORS=never cifsiostat -t 10 6
Linux 6.8.0-139-generic (host.example)    09/22/26    _x86_64_    (8 CPU)

09/22/26 14:10:00
Filesystem                     rB/s         wB/s    rops/s    wops/s         fo/s         fc/s         fd/s
/mnt/share                     0.00         4.00      0.00      1.00         0.00         0.00         0.00

09/22/26 14:10:10
Filesystem                     rB/s         wB/s    rops/s    wops/s         fo/s         fc/s         fd/s
/mnt/share                     0.00         0.00      0.00      0.00         0.00         0.00         0.00

The timestamps and values above are illustrative. -t prints a time for each report, and S_TIME_FORMAT=ISO makes the date use ISO 8601 formatting:

$ S_COLORS=never S_TIME_FORMAT=ISO cifsiostat -t 1 1
2026-09-22 14:10:00

Use a count in anything automated. Omit it and cifsiostat runs until you interrupt it with Ctrl-C, which is an easy way to leave a stray process behind in a terminal or job.

5. Choose units and readable output

Use -k or -m when a fixed unit makes comparisons easier. Use --human when the output is for a person rather than a parser. The short -h option combines human-readable units with the pretty layout:

$ S_COLORS=never cifsiostat -h 5 3
Linux 6.8.0-139-generic (host.example)    09/22/26    _x86_64_    (8 CPU)

Filesystem               rB/s   wB/s   rops/s   wops/s     fo/s     fc/s     fd/s
/mnt/share              12.0k    0.0   1.00     0.00       0.00     0.00     0.00

Do not parse a human-readable report as if it always held plain numbers. For scripts, prefer a fixed unit and stable delimiters, then test against the exact sysstat version deployed on your hosts.

--dec=0, --dec=1 and --dec=2 select zero, one or two decimal places; the default is two. Fewer decimals makes a dashboard shorter, but it can also turn a small non-zero rate into a displayed zero.

6. Diagnose an empty or surprising report

Header but no filesystem rows? Check whether the host has a CIFS mount at all first. This inspection changes nothing:

$ findmnt -t cifs
TARGET     SOURCE             FSTYPE OPTIONS
/mnt/share //server/share     cifs   rw,relatime

If findmnt returns no rows, cifsiostat has no mounted CIFS filesystem to report on. Do not treat an empty report as proof the network share is healthy or idle: it might just not be mounted here. If a mount should exist, investigate the mount and system logs through your normal administrative process. Mounting and unmounting are intentionally left out of this guide.

The command also needs the /proc filesystem and reads CIFS statistics exposed through /proc/fs/cifs/Stats. Check that path without editing it:

$ test -r /proc/fs/cifs/Stats && echo 'CIFS statistics are readable'
CIFS statistics are readable

If that check fails, stop troubleshooting the columns and fix the host's procfs or CIFS instrumentation with an administrator. Do not create or edit files under /proc.