Distribution Server Logs
If the client is a Windows Media server acting as a distribution server, it sends a distribution log upstream when it stops receiving content. The following table contains the fields that make up a server distribution log. The fields are listed in the order in which they are logged.
Note
Note The MMS protocol is mentioned in some of the descriptions in the following table. However, the MMS protocol is not supported in Windows Server 2008 operating systems.
Field name |
Generated by |
When generated |
Description |
Sample value |
|---|---|---|---|---|
c-ip |
Server |
Start |
IP address of the connected socket. This can be the IP of a proxy server or firewall. In previous versions of the server, the client supplied this field. The server now supplies it to respect the client's privacy. |
157.100.200.300 or 3ffe:2900:d005:f28b:0000:5efe:157.55.145.142 |
Date |
Server |
Start |
Date the distribution server connected, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time. |
1997-10-09 |
Time |
Server |
Start |
Time the distribution server connected to the stream, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time. |
15:30:30 |
c-dns |
Client |
Start |
DNS name of the distribution server. This field is always empty. In previous versions of Windows Media Services, the distribution server supplied this field. This has changed to respect client privacy. |
|
cs-uri-stem |
Client |
Start |
Path to the content requested by the distribution server, without the schema, host, and port number. |
/test/sample.wmv or /livebroadcast |
c-starttime |
Client |
End |
Time stamp (in seconds) indicating when the distribution server began to stream content. For live broadcasts, this field is zero (0). |
39 |
x-duration |
Client |
End |
Amount of time (in seconds) during which the distribution server received data, including any time spent buffering. Unlike the duration value represented in player logs, for a distribution server this value represents only the amount of time it took to receive the data. This is not affected by the rate at which the content was streamed. |
31 |
c-rate |
Client |
Dynamic |
The last command event sent. Three events are possible (1= play, -5=rewind, +5= fast forward). |
1 |
c-status |
Client |
Dynamic |
Code describing the status of the distribution server. 200 = Success. 210 = Client reconnected. 401 = Access denied. 400 = URL is not valid. 404 = Content not found. 408 = Request timeout. 420 = Reconnect failed. 500 = The server encountered an internal error and stopped streaming. |
200 |
c-playerid |
Client |
Start |
For a distribution server, this must be a unique, valid GUID. |
{c579d042-cecc-11d1-bb31-00a0c9603954} |
c-playerversion |
Client |
Start |
Version number of the distribution server. |
7.0.1024 |
c-playerlanguage |
Client |
Start |
Language and country/region code of the distribution server. |
en-US |
cs(User-Agent) |
Client |
Start |
User agent of the distribution server. |
WMServer/9.0.0.3187 |
cs(Referer) |
Client |
Start |
This field contains a hyphen (-) or the name of the playlist file for which the content was streamed. |
- or c:\playlist.wsx |
c-hostexe |
Client |
Start |
The name of the distribution server's host application. |
WMServer.exe |
c-hostexever |
Client |
Start |
Version number of the host application. The host application is the .exe file identified by c-hostexe. |
9.0.1234 |
c-os |
Client |
Start |
Operating system on the distribution server. |
Windows_98 |
c-osversion |
Client |
Start |
Version number of the operating system on the distribution server. |
4.10.0.1998 |
c-cpu |
Client |
Start |
CPU on the distribution server. |
Pentium |
filelength |
Server |
Start |
File duration (in seconds). For a live stream this value is 0. |
60 |
filesize |
Server |
Start |
Size of the file (in bytes). For a live broadcast stream, this value is 0. |
86000 |
Avgbandwidth |
Server |
End |
Average bandwidth (in bits per second) at which the distribution server is connected to the server. This is the average value for the duration of the connection. |
102585 |
protocol |
Server |
Start |
Protocol used to access the stream. This may differ from the protocol requested by the distribution server. For example, the distribution server could request MMS but the server uses RTSP. A value of "asfm" indicates that the content was delivered using multicast transmission. |
RTSP |
transport |
Server |
Start |
Transport protocol used to deliver the stream. This must be either UDP or TCP. Multicast content is streamed by using the UDP protocol. |
UDP TCP |
audiocodec |
Client |
End |
This field contains a hyphen (-). |
- |
videocodec |
Client |
End |
This field contains a hyphen (-). |
- |
ChannelURL |
Client |
Start |
URL to the multicast information (.nsc) file. This field contains a hyphen (-) for a unicast stream unless the stream is the result of a unicast rollover from a multicast stream. |
https://server/channel.nsc |
sc-bytes |
Server |
End |
Total number of bytes sent to the distribution server. This does not include TCP/IP or other overhead added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. This field contains a hyphen (-) in multicast logs. |
1188557 |
c-bytes |
Client |
End |
Number of bytes received by the distribution server. This does not include TCP/IP or other overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. |
28000 |
s-pkts-sent |
Server |
End |
Number of data packets sent to the distribution server. This does not include TCP or UDP packets. This field contains a hyphen (-) in multicast logs. |
55 |
c-pkts-received |
Client |
End |
Number of data packets received by the distribution server. This does not include TCP or UDP packets. |
50 |
c-pkts-lost-client |
Client |
End |
Number of packets lost during transmission to the distribution server. This value does not include TCP or UDP packets. |
5 |
c-pkts-lost-net |
Client |
End |
Number of packets lost on the network layer. This value does not include TCP or UDP packets. |
2 |
c-pkts-lost-cont-net |
Client |
End |
Number of continuously lost packets during transmission to the distribution server on the network layer. This value does not include TCP or UDP packets. |
2 |
c-resendreqs |
Client |
End |
The number of requests made by the distribution server to receive new packets. This value does not include TCP or UDP packets. |
5 |
c-pkts-recovered-ECC |
Client |
End |
Number of packets repaired and recovered on the client layer. This value does not include TCP or UDP packets. |
1 |
c-pkts-recovered-resent |
Client |
End |
Number of packets recovered because they were resent using UDP. This includes packets that were sent out of order but does not include TCP or UDP packets. |
5 |
c-buffercount |
Client |
End |
Number of times the distribution server buffered when playing the stream. |
1 |
c-totalbuffertime |
Client |
End |
Total time (in seconds) that the distribution server used to buffer the stream. |
20 |
c-quality |
Client |
End |
The lowest quality of stream reception reported by the distribution server on a scale from 0 to 100. |
89 |
s-ip |
Server |
Begin |
IP address of the server that received the distribution server log. For multicast logs, this value will be the IP address of the Web server on which Wmsiislog.dll is installed. |
155.12.1.234 |
s-dns |
Server |
Begin |
Domain Name System (DNS) name of the server that received the distribution server log. This field contains a hyphen (-) in multicast logs. |
media.server.company.com |
s-totalclients |
Server |
End |
Number of clients connected to the server when a logging event is sent. |
20 |
s-cpu-util |
Server |
End |
Average load on the server cpu(s) on a scale from 0 to 100. This field contains a hyphen (-) in propagated cache proxy logs and in multicast logs. |
40 |
cs-user-name |
Server |
Begin |
User name provided by the distribution server during authentication. This field is populated only if the client was authenticated. If an anonymous authentication method is used, this field will contain a hyphen (-). |
JSmith |
s-session-id |
Server |
Begin |
Internal session ID used by the server to track a given client session. You can use this to track multiple log entries to the same session. It is not recommended that you use the client GUID (c-playerid) to track a session across multiple log entries. Because it is possible to have multiple instances of a client running on a computer, the GUID for each log entry can be identical. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session. |
123456 |
s-content-path |
Server |
Begin |
URL identifying the content streamed to a distribution server. Because this represents the location from which the content was actually sourced, the value can be different than the URL requested by the distribution server. If the client was redirected, this field represents the location to which it was redirected. |
file://C:\WMPub\WMRoot\Encoder_ad.wmv or http://www.example.microsoft.com/speech.wma |
cs-url |
Client |
Begin |
URL requested by the distribution server. For multicast clients, this value is the multicast IP address and port. |
mms://microsoft.com/content.wmv asfm://206.73.118.254:26502 |
cs-media-name |
Client |
End |
Name of the stream rendered by the distribution server. This can be the name of the current element in a playlist. If the distribution server received content from a playlist, the value is derived from the mediaName attribute of the media element. If the mediaName attribute is not present, the value in this field is the name of the file that was streamed. |
/ads/MyAd2.wmv |
c-max-bandwidth |
Client |
End |
Maximum distribution server bandwidth, in bits per second. You can use this to determine whether the distribution server has the capacity for higher bandwidth content. This field can have the following values: a) the number of bits per second reported from the distribution server. b) an undetermined amount, logged as 0. c) a very large number of bits per second that cannot be accurately measured but is greater than one million and less than one billion, logged as a hyphen (-). d) a hyphen (-) when a file is being played from the local cache and no bandwidth is used. |
384000 |
cs-media-role |
Client |
End |
The value assigned to the role attribute for a media element in a playlist. This value indicates the role that the playlist entry performs, such as an advertisement. If the media element did not have a role attribute, or if the distribution server did not receive content from a playlist, this field contains a hyphen (-). |
ADVERTISEMENT |
s-proxied |
Server |
End |
If this field is one (1), the client connection was made through a cache proxy server. Otherwise, it is zero (0). |
1 |