en-US/about_SMBeat.help.txt
|
TOPIC
about_SMBeat SHORT DESCRIPTION Long-term SMB volume logging for Windows File Server 2016 and newer. LONG DESCRIPTION SMBeat runs a resident powershell.exe collector (scheduled task, SYSTEM) that enables TCP extended stats on local port 445 and flushes byte deltas as invariant JSONL every IntervalSec (default 60). NIC counters are stored as a control. Reports aggregate by hour, day, and ISO week. Retrieved volume is TCP 445 DataBytesOut (server to client). Written volume is DataBytesIn (client to server). Reports treat both directions equally. Per-client rows use the remote IP. Per-share and per-user bytes come from a resident ETW session on Microsoft-Windows-SMBServer (SMB2 Response Read/Write plus session auth). Sessions already open when the collector started map to (unknown) until the client reconnects. Reports also show the peak hour in each direction. Older JSONL without kind=tcp445 falls back to NIC Out. HTML reports use local wall-clock time and show the module version. Target runtime is Windows PowerShell 5.1. Do not use Get-Counter (localized PDH names). The collector must run ON the file server (SYSTEM) so ESTATA stays enabled between connections. Use Install-SMBeat and Register-SMBeatCollector from an admin PC via PSRemoting. After a Gallery publish: Update-Module SMBeat -Force once so Reset-SMBeat is available, then Reset-SMBeat -Force (updates the module, wipes samples, starts a fresh collector). After 0.1.x: Unregister-SMBeatCollector then Register-SMBeatCollector -Wait (the task is no longer a 60s one-shot). SEE ALSO Invoke-SMBeatSample Reset-SMBeat Register-SMBeatCollector Get-SMBeatStatus Get-SMBeatReport Export-SMBeatReport |