diff --git a/docs-xml/smbdotconf/logging/loglevel.xml b/docs-xml/smbdotconf/logging/loglevel.xml
index 533ba3d4a34..1a3767d1472 100644
--- a/docs-xml/smbdotconf/logging/loglevel.xml
+++ b/docs-xml/smbdotconf/logging/loglevel.xml
@@ -43,6 +43,7 @@
         <listitem><para><parameter moreinfo="none">tevent</parameter></para></listitem>
         <listitem><para><parameter moreinfo="none">auth_audit</parameter></para></listitem>
         <listitem><para><parameter moreinfo="none">auth_json_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">kerberos</parameter></para></listitem>
     </itemizedlist>
 
     <para>Authentication and authorization audit information is logged
diff --git a/lib/util/debug.c b/lib/util/debug.c
index 5abca41d534..d30b1a9fae5 100644
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -539,6 +539,7 @@ static const char *default_classname_table[] = {
 	[DBGC_TEVENT] =		"tevent",
 	[DBGC_AUTH_AUDIT] =	"auth_audit",
 	[DBGC_AUTH_AUDIT_JSON] = "auth_json_audit",
+	[DBGC_KERBEROS] =       "kerberos",
 };
 
 /*
diff --git a/lib/util/debug.h b/lib/util/debug.h
index 9d5f438255d..71d8ed69a42 100644
--- a/lib/util/debug.h
+++ b/lib/util/debug.h
@@ -91,6 +91,8 @@ bool dbghdr( int level, const char *location, const char *func);
 #define DBGC_TEVENT		23
 #define DBGC_AUTH_AUDIT		24
 #define DBGC_AUTH_AUDIT_JSON	25
+#define DBGC_KERBEROS           26
+
 /* So you can define DBGC_CLASS before including debug.h */
 #ifndef DBGC_CLASS
 #define DBGC_CLASS            0     /* override as shown above */
diff --git a/source4/auth/kerberos/krb5_init_context.c b/source4/auth/kerberos/krb5_init_context.c
index 7fcc8a6048d..e2c837abdce 100644
--- a/source4/auth/kerberos/krb5_init_context.c
+++ b/source4/auth/kerberos/krb5_init_context.c
@@ -77,7 +77,7 @@ static void smb_krb5_debug_close(void *private_data) {
 #ifdef SAMBA4_USES_HEIMDAL
 static void smb_krb5_debug_wrapper(const char *timestr, const char *msg, void *private_data)
 {
-	DEBUG(3, ("Kerberos: %s\n", msg));
+	DEBUGC(DBGC_KERBEROS, 3, ("Kerberos: %s\n", msg));
 }
 #endif