en-US/about_SMBeat.help.txt
|
TOPIC
about_SMBeat SHORT DESCRIPTION Long-term SMB volume logging for Windows File Server 2016 and newer. LONG DESCRIPTION SMBeat runs a resident powershell.exe collector (scheduled task, SYSTEM) that enables TCP extended stats on local port 445 and flushes byte deltas as invariant JSONL every IntervalSec (default 60). NIC counters are stored as a control. Reports aggregate by hour, day, and ISO week. Retrieved volume is TCP 445 DataBytesOut (server to client). Per-client rows use the remote IP. Per-share bytes are not collected in 0.2.0 (ETW Microsoft-Windows-SMBServer is a later TODO). Older JSONL without kind=tcp445 falls back to NIC Out. Target runtime is Windows PowerShell 5.1. Do not use Get-Counter (localized PDH names). The collector must run ON the file server (SYSTEM) so ESTATA stays enabled between connections. Use Install-SMBeat and Register-SMBeatCollector from an admin PC via PSRemoting. After updating from 0.1.x: Unregister-SMBeatCollector then Register-SMBeatCollector -Wait (the task is no longer a 60s one-shot). SEE ALSO Invoke-SMBeatSample Register-SMBeatCollector Get-SMBeatStatus Get-SMBeatReport Export-SMBeatReport |