en-US/about_SMBeat.help.txt
|
TOPIC
about_SMBeat SHORT DESCRIPTION Long-term SMB volume logging for Windows File Server 2016 and newer. LONG DESCRIPTION SMBeat runs a resident powershell.exe collector (scheduled task, SYSTEM) that enables TCP extended stats on local port 445 and flushes byte deltas as invariant JSONL every IntervalSec (default 60). NIC counters are stored as a control. Reports aggregate by hour, day, and ISO week. Retrieved volume is TCP 445 DataBytesOut (server to client). Written volume is DataBytesIn (client to server). Per-client rows use the remote IP. Per-share and per-user bytes come from a resident ETW session on Microsoft-Windows-SMBServer. Sessions already open when the collector started map to (unknown) until the client reconnects. Older JSONL without kind=tcp445 falls back to NIC Out. Show-SMBeat / Get-SMBeatReport default to all samples still on disk (first _listen445 to now). HTML themes: health (default), pine, dark. The report lists coverage gaps and collector events (registered, started, stopped, error, reboot, crash, updated) from events.jsonl, not from collector.log. Reboots use LastBootUpTime (event time = boot time). Unexpected shutdown is System event 6008 (kind=crash). A module version change after Stop/Start is kind=updated. No extra mail. Target runtime is Windows PowerShell 5.1. Do not use Get-Counter. The collector must run ON the file server so ESTATA stays enabled. Register with -MailTo and -SmtpServer for Send-MailMessage notices (not every flush). Mail success or failure is logged only. After a Gallery publish: new session, Get-Module SMBeat must show the new version. On the file server, report-only changes need Update-Module and Show-SMBeat. Collector changes need Stop-SMBeat / Start-SMBeat. From another computer, Install-SMBeat -ComputerName first (or Reset-SMBeat -ComputerName -Force). Update-Module on the admin PC does not update the server. Reset-SMBeat keeps MailTo/SmtpServer. SEE ALSO Invoke-SMBeatSample Reset-SMBeat Register-SMBeatCollector Start-SMBeat Stop-SMBeat Get-SMBeatStatus Get-SMBeatReport Export-SMBeatReport Show-SMBeat |