en-US/about_SMBeat.help.txt
|
TOPIC
about_SMBeat SHORT DESCRIPTION Long-term SMB volume logging for Windows File Server 2016 and newer. LONG DESCRIPTION SMBeat runs a resident powershell.exe collector (scheduled task, SYSTEM) that enables TCP extended stats on local port 445 and flushes byte deltas as invariant JSONL every IntervalSec (default 60). NIC counters are stored as a control. Reports aggregate by hour, day, and ISO week. Retrieved volume is TCP 445 DataBytesOut (server to client). Written volume is DataBytesIn (client to server). Per-client rows use the remote IP. Per-share and per-user bytes come from a resident ETW session on Microsoft-Windows-SMBServer. Sessions already open when the collector started map to (unknown) until the client reconnects. Older JSONL without kind=tcp445 falls back to NIC Out. Show-SMBeat defaults to all samples still on disk (first _listen445 to now). Files go to Documents\SMBeat-Reports on the machine that runs Show-SMBeat. Show-SMBeat -PassThru returns the report object. HTML themes: health (default), pine, dark. The report lists coverage gaps and collector events (registered, started, stopped, error, reboot, crash, updated) from events.jsonl, not from collector.log. Reboots use LastBootUpTime (event time = boot time). Unexpected shutdown is System event 6008 (kind=crash). A module version change after Stop/Start is kind=updated. No extra mail. Everyday cmdlets: Start-SMBeat, Get-SMBeat, Show-SMBeat. Pause with Stop-SMBeat. Task only: Uninstall-SMBeat -KeepData. Task plus data: Uninstall-SMBeat. Fresh measurement: Reset-SMBeat -Force. Target runtime is Windows PowerShell 5.1. Do not use Get-Counter. The collector must run ON the file server so ESTATA stays enabled. Start-SMBeat with -MailTo and -SmtpServer for Send-MailMessage notices (not every flush). Mail success or failure is logged only. After a Gallery publish: new session, Get-Module SMBeat must show the new version. On the file server, report-only changes need Update-Module and Show-SMBeat. Collector changes need Stop-SMBeat / Start-SMBeat. From another computer, Start-SMBeat -ComputerName (copies the module if missing) or Reset-SMBeat -ComputerName -Force. Update-Module on the admin PC does not update the server. Reset-SMBeat keeps MailTo/SmtpServer. SEE ALSO Invoke-SMBeatSample Reset-SMBeat Start-SMBeat Stop-SMBeat Get-SMBeat Show-SMBeat Uninstall-SMBeat |