Log file entries reference

Each client event in a log file is represented as a single line, or log entry. Each log entry contains a number of space-delimited fields. All spaces embedded in a field value are replaced by underscore (_) characters (for example, Windows NT appears as Windows_NT). If there is no value available for a given field, a single hyphen (-) character is used to indicate the value is either not available or not applicable. For example, there is no data available for server statistics fields in log files created by the Multicast and Advertisement Logging Agent, so those fields contain single hyphens.

The following table contains a list of each field (in the order in which the field appears in the log file), a description, and a sample value. It also identifies whether the data in the field is reported from unicast clients, multicast clients, or both.

Field name	Description	Sample value	Client data reported
c-ip	The source Internet Protocol (IP) address of the connected socket. This may be the IP address of a proxy server or firewall.	157.56.219.146	Unicast Multicast
date	Date when a client connected (in international date format).	2001-04-19	Unicast Multicast
time	Time when the client connected. The time format is either in Coordinated Universal Time or local time, depending on how the logging plug-in is configured.	15:30:30	Unicast Multicast
c-dns	This field is always blank.	-	Unicast Multicast
cs-uri-stem	The path (requested URL without the schema, host, port number, and question mark) to the content that was requested. See cs-url for the full URL. Note that this represents a change from Windows Media Services version 4.1, in which this field contained the full URL.	/test/sample.wmv or /broadcast	Unicast Multicast
c-starttime	Timestamp (in seconds, no fractions) indicating the point in the stream when the client started to render content. For live broadcasts, this field is set to 0.	39	Unicast Multicast
x-duration	Length of time (in seconds) of the data received by the client. For player log entries, the value does not include buffered data. For distribution server log entries, the value includes all time spent receiving data, including any buffering.	31	Unicast Multicast
c-rate	The rate at which data is sent from the server to the client. Possible values: 0.5: Half of the real-time rate. 1: Real-time rate 2: Twice as fast as real-time 5: fast forward -5: fast rewind If you are using Fast Streaming, these values could be considerably higher or lower depending on the content and the available bandwidth.	1	Unicast Multicast
c-status	Codes that describe client status. Possible codes: 200: The connection was successful. 210: The client reconnected (after first disconnecting). 400: The requested URL was invalid. 401: The client was denied access. 404: The requested content was not found. 408: The client failed to submit a log because the client disconnected. 420: The client was disconnected and attempted to reconnect but failed. The client will then connect again starting a new session. This code reflects the client's statistics when it was originally disconnected. For each log entry with this code there should be a 408 that has the same session ID. 500: The Windows Media server encountered an internal error and stopped streaming.	200	Unicast Multicast
c-playerid	Globally unique identifier (GUID) of the client. For player log entries, if the player is configured not to send unique player identification information to content providers, the value is: {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}, where x is the session ID of the client. For distribution server log entries, this value is always a series of zeroes.	{c579d042-cecc-11d1-bb31-00a0c9603954}	Unicast Multicast
c-playerversion	For player log entries, this field represents the version number of the player. For distribution server log entries, this field represents the version number of the distribution server.	6.2.5.415	Unicast Multicast
c-playerlanguage	Language and country/region code of the player.	en-US	Unicast Multicast
cs(User-Agent)	Browser type used if the player was embedded in a browser. If the player was not embedded, this field refers to the user agent of the client that generated the log.	Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98)	Unicast
cs(Referer)	URL to the Web page in which the player was embedded (if it was embedded). If this is unknown, this field is blank.	http://www.example.microsoft.com	Unicast
c-hostexe	For player log entries, the host program (.exe) that was run. For example, a Web page in a browser, a Microsoft Visual Basic applet, or a stand-alone player. For distribution server log entries, the name of the distribution server's service program (.exe) that was run.	iexplore.exe vb.exe mplayer2.exe WMServer.exe	Unicast Multicast
c-hostexever	Host program (.exe) version number.	4.70.1215	Unicast Multicast
c-os	Client operating system.	Windows_NT	Unicast Multicast
c-osversion	Version number of the client operating system.	4.0.0.1381	Unicast Multicast
c-cpu	Client CPU type.	Pentium	Unicast Multicast
filelength	Length of the digital media file (in seconds). This value is zero for a stream delivered from a broadcast publishing point.	60	Unicast
filesize	Size of the digital media file (in bytes). This value is zero for a stream delivered from a broadcast publishing point.	86000	Unicast
avgbandwidth	Average bandwidth (in bits per second) at which the client was connected to the server. The value is calculated across the entire duration of the connection.	24300	Unicast Multicast
protocol	Actual protocol used to access the content (may differ from the protocol requested by the client). A value of "Cache" indicates that a client played the content from its disk-based cache. A value of "asfm" indicates that the content was delivered using multicast transmission.	MMST	Unicast Multicast
transport	Transport protocol used to stream content. Multicast content is always streamed using UDP.	UDP TCP	Unicast Multicast
audiocodec	For player log entries, the audio codecs used to encode the audio streams the client accessed. If multiple codecs were used, the values are delimited by a semicolon. This field contains a hyphen (-) in distribution server log entries.	Microsoft_Audio_Codec	Unicast Multicast
videocodec	For player log entries, the video codecs used to encode the video streams the client accessed. If multiple codecs were used, the values are delimited by a semicolon. This field contains a hyphen (-) in distribution server log entries.	Microsoft_MPEG-4_Video_Codec_V2	Unicast Multicast
channelURL	URL to the multicast information file. This field contains a hyphen (-) in a client receiving content as a unicast stream unless the unicast stream is a result of a unicast rollover from a multicast stream.	http://www.example.microsoft.com/channel.nsc	Unicast Multicast
sc-bytes	Total number of bytes the server sent to the client. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.	30000	Unicast
c-bytes	Number of bytes received by the client from the server. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. If c-bytes and sc-bytes are not identical, packet loss occurred.	28583	Unicast Multicast
s-pkts-sent	Number of content packets sent by the server to a connected client. The value does not include TCP or UDP packets. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.	55	Unicast
c-pkts-received	Number of packets from the server (s-pkts-sent) that are received correctly by the client on the first try. Packets that are not received correctly on the first try can be recovered if they are resent through the UDP protocol. Packets that are not recovered through UDP resend are considered lost in the network. You can recover these packets if error correction is enabled. The value does not include TCP or UDP packets.	50	Unicast Multicast
c-pkts-lost-client	Packets lost that were not recovered at the client layer through error correction or at the network layer through UDP resends, during transmission from server to client. These packets are sent by the Windows Media server but never played by the client. The value does not include TCP or UDP packets.	5	Unicast Multicast
c-pkts-lost-net	Number of packets lost on the network layer. You can still recover these packets if error correction is enabled. The value does not include TCP or UDP packets.	2	Unicast Multicast
c-pkts-lost-cont-net	Maximum number of continuously lost packets on the network layer during transmission from server to client. If the value is high, the network conditions were bad, with long periods of time during which the client received no packets. The value does not include TCP or UDP packets.	2	Unicast Multicast
c-resendreqs	Number of client requests to receive new packets. This field contains a zero unless the client is using UDP resend.	5	Unicast Multicast
c-pkts-recovered-ECC	Packets lost in the network (c-pkts-lost-net) that were repaired and recovered at the client layer because error correction was enabled. Error correction is the only means of packet recovery for multicast streams. Packets repaired and recovered at the client layer are equal to the difference between c-pkts-lost-net and c-pkts-lost-client. The value does not include TCP or UDP packets.	3	Unicast Multicast
c-pkts-recovered-resent	Number of packets recovered because they were resent through UDP. The value does not include TCP or UDP packets. This field contains a zero unless the client is using UDP resend.	5	Unicast Multicast
c-buffercount	Number of times the client buffered while playing the stream.	4	Unicast Multicast
c-totalbuffertime	Time (in seconds) the client used to buffer the stream. If the client buffers more than once before a log entry is generated, c-totalbuffertime is the total amount of time the client spent buffering.	6	Unicast Multicast
c-quality	The lowest amount of stream quality reported by the Player during the playback of the stream.	96	Unicast Multicast
s-ip	IP address of the server that received the log file. For multicast log files, this value will be the IP address of the Web server on which Wmsiislog.dll is installed.	224.24.41.189	Unicast Multicast
s-dns	Domain Name System (DNS) name of the server that received the log file. This field contains a hyphen (-) in multicast log files.	media.server.company.com	Unicast
s-totalclients	Number of clients connected to the server (but not necessarily streaming) at the time the event was logged. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.	20	Unicast
s-cpu-util	Average load on the server processor (0 to 100 percent). If multiple processors exist, this value is the average for all processors. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.	40	Unicast
cs-username	The user name the client provided during authentication. This field contains a value only if authorization and authentication plug-ins are enabled. If an anonymous authentication method is used, this field will contain a hyphen (-).	JSmith	Unicast
s-sessionid	A session identifier the server uses to track a stream session. This is important for tracking multiple log entries to the same session. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session.	123456	Unicast
s-contentpath	The actual content that streamed. A plug-in may resolve a requested path to another path. If the client was redirected, this field represents the location to which the client was redirected.	file://C:\WMPub\WMRoot\Encoder_ad.wmv or http://www.example.microsoft.com/speech.wma	Unicast
cs-url	The actual URL requested by the client. For multicast clients, this value is the multicast IP address and port. However, Windows Media Player 9 Series or later and Windows Media Player 9 Series ActiveX control multicast clients submit the multicast IP address and port, followed by the IP address of the network interface from which the server broadcasts the multicast.	mms://microsoft.com/mycontent.wmv asfm://206.73.118.254:26502 -or- (for Windows Media Player 9 Series or later) asfm://multicast IP address:port/Server IP address	Unicast Multicast
cs-media-name	If the client was receiving content from a playlist, the media element the client was receiving. The value is derived from the mediaName attribute of the playlist media element. If the mediaName attribute is not present, the value in this field is derived from the file name value. This field is blank if the client was not receiving content from a playlist. Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.	/ads/MyAd2.asf	Unicast
c-max-bandwidth	The maximum bandwidth rate (in bits per second) of the client. This value can be used to determine whether clients have the capacity for higher bandwidth content. The value recorded for this field can have the following types of values: a) a valid number of bps reported from the client., such as 38400 b) an undetermined amount, logged as 0. c) a very large amount that cannot be accurately measured but is greater than 1000000 bps but less than 1000000000 bps, logged as a hyphen (-). d) a hyphen (-), when a file is being played from the local cache and no bandwidth is used.	`384000`	Unicast Multicast
cs-media-role	A user-defined value that identifies the role of a media element in a playlist. Typically, this field is used to enable advertisement logging. For more information, see Logging advertising data. If the media element does not have a role attribute, or if the client was not receiving content from a playlist, this field is blank. Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.	`Ad`	Unicast
s-proxied	Indicates whether the client connected through a cache/proxy server. A value of "0" indicates no cache/proxy server was involved. A value of "1" indicates a cache/proxy server was involved.	1	Unicast

Log file entries reference

Related topics