banner art

Log file entries reference

Each client event in a log file is represented as a single line, or log entry. Each log entry contains a number of space-delimited fields. All spaces embedded in a field value are replaced by underscore (_) characters (for example, Windows NT appears as Windows_NT). If there is no value available for a given field, a single hyphen (-) character is used to indicate the value is either not available or not applicable. For example, there is no data available for server statistics fields in log files created by the Multicast and Advertisement Logging Agent, so those fields contain single hyphens.

The following table contains a list of each field (in the order in which the field appears in the log file), a description, and a sample value. It also identifies whether the data in the field is reported from unicast clients, multicast clients, or both.

Field name Description Sample value Client data reported
c-ip The source Internet Protocol (IP) address of the connected socket. This may be the IP address of a proxy server or firewall. 157.56.219.146 Unicast

Multicast

date Date when a client connected (in international date format). 2001-04-19 Unicast

Multicast

time Time when the client connected. The time format is either in Coordinated Universal Time or local time, depending on how the logging plug-in is configured. 15:30:30 Unicast

Multicast

c-dns This field is always blank. - Unicast

Multicast

cs-uri-stem The path (requested URL without the schema, host, port number, and question mark) to the content that was requested. See cs-url for the full URL. Note that this represents a change from Windows Media Services version 4.1, in which this field contained the full URL. /test/sample.wmv
or
/broadcast
Unicast

Multicast

c-starttime Timestamp (in seconds, no fractions) indicating the point in the stream when the client started to render content. For live broadcasts, this field is set to 0. 39 Unicast

Multicast

x-duration Length of time (in seconds) of the data received by the client. For player log entries, the value does not include buffered data. For distribution server log entries, the value includes all time spent receiving data, including any buffering. 31 Unicast

Multicast

c-rate The rate at which data is sent from the server to the client. Possible values:
0.5: Half of the real-time rate.

1: Real-time rate

2: Twice as fast as real-time

5: fast forward

-5: fast rewind

If you are using Fast Streaming, these values could be considerably higher or lower depending on the content and the available bandwidth.

1 Unicast

Multicast

c-status Codes that describe client status. Possible codes:
200: The connection was successful.
210: The client reconnected (after first disconnecting).
400: The requested URL was invalid.

401: The client was denied access.
404: The requested content was not found.
408: The client failed to submit a log because the client disconnected.
420: The client was disconnected and attempted to reconnect but failed. The client will then connect again starting a new session. This code reflects the client's statistics when it was originally disconnected. For each log entry with this code there should be a 408 that has the same session ID.

500: The Windows Media server encountered an internal error and stopped streaming.

200 Unicast

Multicast

c-playerid Globally unique identifier (GUID) of the client. For player log entries, if the player is configured not to send unique player identification information to content providers, the value is: {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}, where x is the session ID of the client. For distribution server log entries, this value is always a series of zeroes. {c579d042-cecc-11d1-bb31-00a0c9603954} Unicast

Multicast

c-playerversion For player log entries, this field represents the version number of the player. For distribution server log entries, this field represents the version number of the distribution server. 6.2.5.415 Unicast

Multicast

c-playerlanguage Language and country/region code of the player. en-US Unicast

Multicast

cs(User-Agent) Browser type used if the player was embedded in a browser. If the player was not embedded, this field refers to the user agent of the client that generated the log. Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98) Unicast
cs(Referer) URL to the Web page in which the player was embedded (if it was embedded). If this is unknown, this field is blank. http://www.example.microsoft.com Unicast
c-hostexe For player log entries, the host program (.exe) that was run. For example, a Web page in a browser, a Microsoft Visual Basic applet, or a stand-alone player. For distribution server log entries, the name of the distribution server's service program (.exe) that was run. iexplore.exe
vb.exe
mplayer2.exe
WMServer.exe
Unicast

Multicast

c-hostexever Host program (.exe) version number. 4.70.1215 Unicast

Multicast

c-os Client operating system. Windows_NT Unicast

Multicast

c-osversion Version number of the client operating system. 4.0.0.1381 Unicast

Multicast

c-cpu Client CPU type. Pentium Unicast

Multicast

filelength Length of the digital media file (in seconds). This value is zero for a stream delivered from a broadcast publishing point. 60 Unicast
filesize Size of the digital media file (in bytes). This value is zero for a stream delivered from a broadcast publishing point. 86000 Unicast
avgbandwidth Average bandwidth (in bits per second) at which the client was connected to the server. The value is calculated across the entire duration of the connection. 24300 Unicast

Multicast

protocol Actual protocol used to access the content (may differ from the protocol requested by the client). A value of "Cache" indicates that a client played the content from its disk-based cache. A value of "asfm" indicates that the content was delivered using multicast transmission. MMST Unicast

Multicast

transport Transport protocol used to stream content. Multicast content is always streamed using UDP. UDP
TCP
Unicast

Multicast

audiocodec For player log entries, the audio codecs used to encode the audio streams the client accessed. If multiple codecs were used, the values are delimited by a semicolon. This field contains a hyphen (-) in distribution server log entries. Microsoft_Audio_Codec Unicast

Multicast

videocodec For player log entries, the video codecs used to encode the video streams the client accessed. If multiple codecs were used, the values are delimited by a semicolon. This field contains a hyphen (-) in distribution server log entries. Microsoft_MPEG-4_Video_Codec_V2 Unicast

Multicast

channelURL URL to the multicast information file. This field contains a hyphen (-) in a client receiving content as a unicast stream unless the unicast stream is a result of a unicast rollover from a multicast stream. http://www.example.microsoft.com/channel.nsc Unicast

Multicast

sc-bytes Total number of bytes the server sent to the client. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values.

This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.

30000 Unicast
c-bytes Number of bytes received by the client from the server. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. If c-bytes and sc-bytes are not identical, packet loss occurred. 28583 Unicast

Multicast

s-pkts-sent Number of content packets sent by the server to a connected client. The value does not include TCP or UDP packets. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files. 55 Unicast
c-pkts-received Number of packets from the server (s-pkts-sent) that are received correctly by the client on the first try. Packets that are not received correctly on the first try can be recovered if they are resent through the UDP protocol. Packets that are not recovered through UDP resend are considered lost in the network. You can recover these packets if error correction is enabled. The value does not include TCP or UDP packets. 50 Unicast

Multicast

c-pkts-lost-client Packets lost that were not recovered at the client layer through error correction or at the network layer through UDP resends, during transmission from server to client. These packets are sent by the Windows Media server but never played by the client. The value does not include TCP or UDP packets. 5 Unicast

Multicast

c-pkts-lost-net Number of packets lost on the network layer. You can still recover these packets if error correction is enabled. The value does not include TCP or UDP packets. 2 Unicast

Multicast

c-pkts-lost-cont-net Maximum number of continuously lost packets on the network layer during transmission from server to client. If the value is high, the network conditions were bad, with long periods of time during which the client received no packets. The value does not include TCP or UDP packets. 2 Unicast

Multicast

c-resendreqs Number of client requests to receive new packets. This field contains a zero unless the client is using UDP resend. 5 Unicast

Multicast

c-pkts-recovered-ECC Packets lost in the network (c-pkts-lost-net) that were repaired and recovered at the client layer because error correction was enabled. Error correction is the only means of packet recovery for multicast streams. Packets repaired and recovered at the client layer are equal to the difference between c-pkts-lost-net and c-pkts-lost-client. The value does not include TCP or UDP packets. 3 Unicast

Multicast

c-pkts-recovered-resent Number of packets recovered because they were resent through UDP. The value does not include TCP or UDP packets. This field contains a zero unless the client is using UDP resend. 5 Unicast

Multicast

c-buffercount Number of times the client buffered while playing the stream. 4 Unicast

Multicast

c-totalbuffertime Time (in seconds) the client used to buffer the stream. If the client buffers more than once before a log entry is generated, c-totalbuffertime is the total amount of time the client spent buffering. 6 Unicast

Multicast

c-quality The lowest amount of stream quality reported by the Player during the playback of the stream. 96 Unicast

Multicast

s-ip IP address of the server that received the log file. For multicast log files, this value will be the IP address of the Web server on which Wmsiislog.dll is installed. 224.24.41.189 Unicast

Multicast

s-dns Domain Name System (DNS) name of the server that received the log file. This field contains a hyphen (-) in multicast log files. media.server.company.com Unicast
s-totalclients Number of clients connected to the server (but not necessarily streaming) at the time the event was logged. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files. 20 Unicast
s-cpu-util Average load on the server processor (0 to 100 percent). If multiple processors exist, this value is the average for all processors. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files. 40 Unicast
cs-username The user name the client provided during authentication. This field contains a value only if authorization and authentication plug-ins are enabled. If an anonymous authentication method is used, this field will contain a hyphen (-). JSmith Unicast
s-sessionid A session identifier the server uses to track a stream session. This is important for tracking multiple log entries to the same session. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session. 123456 Unicast
s-contentpath The actual content that streamed. A plug-in may resolve a requested path to another path. If the client was redirected, this field represents the location to which the client was redirected. file://C:\WMPub\WMRoot\Encoder_ad.wmv

or

http://www.example.microsoft.com/speech.wma

Unicast
cs-url The actual URL requested by the client.

For multicast clients, this value is the multicast IP address and port. However, Windows Media Player 9 Series or later and Windows Media Player 9 Series ActiveX control multicast clients submit the multicast IP address and port, followed by the IP address of the network interface from which the server broadcasts the multicast.

mms://microsoft.com/mycontent.wmv

asfm://206.73.118.254:26502

-or- (for Windows Media Player 9 Series or later)

asfm://multicast IP address:port/Server IP address

Unicast

Multicast

cs-media-name If the client was receiving content from a playlist, the media element the client was receiving. The value is derived from the mediaName attribute of the playlist media element. If the mediaName attribute is not present, the value in this field is derived from the file name value. This field is blank if the client was not receiving content from a playlist.

Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.

/ads/MyAd2.asf Unicast
c-max-bandwidth The maximum bandwidth rate (in bits per second) of the client. This value can be used to determine whether clients have the capacity for higher bandwidth content. The value recorded for this field can have the following types of values:
a) a valid number of bps reported from the client., such as 38400

b) an undetermined amount, logged as 0.

c) a very large amount that cannot be accurately measured but is greater than 1000000 bps but less than 1000000000 bps, logged as a hyphen (-).

d) a hyphen (-), when a file is being played from the local cache and no bandwidth is used.

384000 Unicast

Multicast

cs-media-role A user-defined value that identifies the role of a media element in a playlist. Typically, this field is used to enable advertisement logging. For more information, see Logging advertising data.

If the media element does not have a role attribute, or if the client was not receiving content from a playlist, this field is blank.

Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.

Ad Unicast
s-proxied Indicates whether the client connected through a cache/proxy server. A value of "0" indicates no cache/proxy server was involved. A value of "1" indicates a cache/proxy server was involved. 1 Unicast

Related topics


© 2005 Microsoft Corporation. All rights reserved.