Client Combination Logs

A client can submit a log that contains fields from both the receive and render log formats. This occurs if:

• The client is a version of Windows Media Player earlier than Windows Media Player 9 Series.

• The client is a third-party player built by using a version of the Windows Media Format SDK earlier than the Windows Media Format 9 Series SDK.

• The client is Windows Media Player 9 Series but the server has not enabled fast caching.

The following table contains the fields that make up a combination or legacy log. The fields are listed in the order in which they are logged.

Note

Note   The MMS protocol is mentioned in some of the descriptions in the following table. However, the MMS protocol is not supported in Windows Server 2008 operating systems.

Field name	Generated by	When generated	Description	Sample value
c-ip	Server	Start	IP address of the connected socket. This can be the IP of a proxy server or firewall. In previous versions of the server, the client supplied this field. The server now supplies it to respect the client's privacy.	157.100.200.300 or 3ffe:2900:d005:f28b:0000:5efe:157.55.145.142
Date	Server	Start	Date the client connected, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time.	1997-10-09
Time	Server	Start	Time the client connected to the stream, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time.	15:30:30
c-dns	Client	Start	DNS name of the client. This field is always empty. In previous versions of the server, the client supplied this field. This has changed to respect the privacy of the client.
cs-uri-stem	Client	Start	Path to the content requested by the client, without the schema, host, and port number.	/test/sample.wmv or /livebroadcast
c-starttime	Client	End	Time stamp (in seconds) indicating when the client began to play content. For live broadcasts, this field is zero (0).	39
x-duration	Client	End	Amount of time (in seconds) that the client has been playing content. Buffered data is not included. This value represents how much of the content the user receives, even if the content is fast forwarded.	31
c-rate	Client	Dynamic	The last command event sent. Three events are possible (1= play, -5=rewind, +5= fast forward).	1
c-status	Client	Dynamic	Code describing the status of the client. 200 = Success. 210 = Client reconnected. 401 = Access denied. 400 = URL is not valid. 404 = Content not found. 408 = Request timeout. 420 = Reconnect failed. 500 = The server encountered an internal error and stopped streaming.	200
c-playerid	Client	Start	Client GUID. This can be a unique GUID if the user has not disabled unique identification. If the client is configured for anonymity, the GUID is reported as {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}) where x is the client's session ID (refer to the s-sessionid field). If the client is a distribution server, the GUID is filled with a series of zeros.	{c579d042-cecc-11d1-bb31-00a0c9603954} or anonymous:{3300AD50-2C39-46c0-AE0A-70B64F321A80}
c-playerversion	Client	Start	Version number of the player.	7.0.1024
c-playerlanguage	Client	Start	Language and country/region code of the player.	en-US
cs(User-Agent)	Client	Start	Browser type, if any, in which a player was embedded. If the player was not embedded, this field refers to the user agent of the client. Players based on the Windows Media Format 9 Series SDK include a parenthetical SDK version number. If a compatibility layer is used to map Windows Media Player version 6.4 to later versions, a WMPDXM tag is also appended.	Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98) or NSPlayer/6.4.1.2 or PlayerApp(WMFSDK/9.0.1234) or Mozilla/4.0_(compatible;_MSIE_6.0;_Windows_NT_5.1)_(WMFSDK/9.0.0.2793)_WMPlayer/9.0.0.2793(WMPDXM)
cs(Referer)	Client	Start	Web page URL in which the player was embedded. If unknown, this field contains a hyphen (-).	http://www.xxx.yyy or c:\asfroot\test.wmv or \\server\share\welcome.asx
c-hostexe	Client	Start	Host application. For example, this can be a Web page in a browser (iexplore.exe), a Visual Basic applet (vb.exe), or stand-alone Windows Media Player (mplayer2.exe). This is the .exe file that the user executed. This cannot be a .dll, ocx or other file.	MPLAYER2.EXE
c-hostexever	Client	Start	Version number of the host application. The host application is the .exe file identified by c-hostexe.	6.2.5.323
c-os	Client	Start	Operating system on the client computer.	Windows_98
c-osversion	Client	Start	Version number of the operating system on the client computer.	4.10.0.1998
c-cpu	Client	Start	CPU on the client computer.	Pentium
filelength	Server	Start	File duration (in seconds). For a live stream this value is 0.	60
filesize	Server	Start	Size of the file (in bytes). For a live broadcast stream, this value is 0.	86000
Avgbandwidth	Server	End	Average bandwidth (in bits per second) at which the client is connected to the server. This is the average value for the duration of the connection.	102585
protocol	Server	Start	Protocol used to access the stream. This may differ from the protocol requested by the client. For example, the client could request MMS but the server uses RTSP. A value of "Cache" indicates that a client played the content from its cache. A value of "asfm" indicates that the content was delivered using multicast transmission.	RTSP
transport	Server	Start	Transport protocol used to deliver the stream. This must be either UDP or TCP. Multicast content is streamed by using the UDP protocol.	UDP TCP
audiocodec	Client	End	A semicolon-delimited list of audio codecs that encoded the audio streams that the client accessed. Each codec is only listed once, even if more than one stream was encoded using it.	Microsoft_Audio_Codec or Microsoft_Audio_Codec;Generic_MP3_Codec.
videocodec	Client	End	A semicolon-delimited list of video codecs that encoded the video streams that the client accessed. Each codec is only listed once, even if more than one stream was encoded using it.	Microsoft_MPEG-4_Video_Codec_V2
ChannelURL	Client	Start	URL to the multicast information (.nsc) file. This field contains a hyphen (-) for a unicast stream unless the stream is the result of a unicast rollover from a multicast stream.	https://server/channel.nsc
sc-bytes	Server	End	Total number of bytes sent by the server to the client. This does not include TCP/IP or other overhead added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. This field contains a hyphen (-) in multicast logs.	1188557
c-bytes	Client	End	Number of bytes received by the client from the server. This does not include TCP/IP or other overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values.	28000
s-pkts-sent	Server	End	Number of data packets sent by the server. This does not include TCP or UDP packets. This field contains a hyphen (-) in multicast logs.	55
c-pkts-received	Client	End	Number of data packets received by the client. This does not include TCP or UDP packets.	50
c-pkts-lost-client	Client	End	Number of packets lost during transmission from server to client. This value does not include TCP or UDP packets.	5
c-pkts-lost-net	Client	End	Number of packets lost on the network layer. This value does not include TCP or UDP packets.	2
c-pkts-lost-cont-net	Client	End	Number of continuously lost packets during transmission from the server to a client on the network layer. This value does not include TCP or UDP packets.	2
c-resendreqs	Client	End	The number of requests made by the client to receive new packets. This value does not include TCP or UDP packets.	5
c-pkts-recovered-ECC	Client	End	Number of packets repaired and recovered on the client layer. This value does not include TCP or UDP packets.	1
c-pkts-recovered-resent	Client	End	Number of packets recovered because they were resent using UDP. This includes packets that were sent out of order but does not include TCP or UDP packets.	5
c-buffercount	Client	End	Number of times the client buffered when playing the stream.	1
c-totalbuffertime	Client	End	Total time (in seconds) that the client used to buffer the stream.	20
c-quality	Client	End	The lowest quality of stream reception reported by the player on a scale from 0 to 100.	89
s-ip	Server	Begin	IP address of the server that received the client log. For multicast logs, this value will be the IP address of the Web server on which Wmsiislog.dll is installed.	155.12.1.234
s-dns	Server	Begin	Domain Name System (DNS) name of the server that received the client log. This field contains a hyphen (-) in multicast logs.	media.server.company.com
s-totalclients	Server	End	Number of clients connected to the server when a logging event is sent.	20
s-cpu-util	Server	End	Average load on the server cpu(s) on a scale from 0 to 100. This field contains a hyphen (-) in propagated cache proxy logs and in multicast logs.	40
cs-user-name	Server	Begin	User name provided by the client to the server during authentication. This field is populated only if the client was authenticated. If an anonymous authentication method is used, this field will contain a hyphen (-).	JSmith
s-session-id	Server	Begin	Internal session ID used by the server to track a given client session. You can use this to track multiple log entries for the same session. It is not recommended that you use the client GUID (c-playerid) to track a session across multiple log entries. Because it is possible to have multiple instances of a client running on a computer, the GUID for each log entry can be identical. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session.	123456
s-content-path	Server	Begin	URL identifying the content streamed to a client. Because this represents the location from which the content was actually sourced, the value can be different than the URL requested by the client. If the client was redirected, this field represents the location to which it was redirected.	file://C:\WMPub\WMRoot\Encoder_ad.wmv or http://www.example.microsoft.com/speech.wma
cs-url	Client	Begin	URL requested by the client. For multicast clients, this value is the multicast IP address and port.	mms://microsoft.com/content.wmv asfm://206.73.118.254:26502
cs-media-name	Client	End	Name of the stream rendered by the client. This can be the name of the current element in a playlist. If the client received content from a playlist, the value is derived from the mediaName attribute of the media element. If the mediaName attribute is not present, the value in this field is the name of the file that was streamed. Only Windows Media Player 9 Series supports this field.	/ads/MyAd2.wmv
c-max-bandwidth	Client	End	Maximum client bandwidth, in bits per second. You can use this to determine whether clients have the capacity for higher bandwidth content. This field can have the following values: a) the number of bits per second reported from the client. b) an undetermined amount, logged as 0. c) a very large number of bits per second that cannot be accurately measured but is greater than one million and less than one billion, logged as a hyphen (-). d) a hyphen (-) when a file is being played from the local cache and no bandwidth is used.	384000
cs-media-role	Client	End	The value assigned to the role attribute for a media element in a playlist. This value indicates the role that the playlist entry performs, such as an advertisement. If the media element did not have a role attribute, or if the client did not receive content from a playlist, this field contains a hyphen (-).	ADVERTISEMENT
s-proxied	Server	End	If this field is one (1), the client connection was made through a cache proxy server. Otherwise, it is zero (0).	1

See Also

Concepts

Log Types