Reading access logs

The access log records information about requests by Flash Player and Adobe Media Server application instances. Using these logs, you can find out about various events, such as when a user connected to the server, how much total bandwidth was consumed during the session, and which streams were accessed by the connection (and similar resource information). You can use the status codes associated with specific events to troubleshoot event failures. You can also use this information to determine which applications are used most.

The default access log is access.xx.log, which is located in the RootInstall/logs directory. The default configuration creates a single access log per server. You can also configure the server to create a separate file per virtual host. When logging is configured on a per-virtual-host basis, all logs for a particular virtual host are found in a subdirectory within the logs directory. The name of the subdirectory matches the virtual host name. Substitution strings can be found in the [] brackets, with YYYY, MM, DD, and NN representing year, month, date, and version, respectively. You can use the substitution string to customize the filename of the access log. (For example, access.[YYYYMMDDNN].log could be named access.2007052401.log.) To configure the server to create separate log files for each virtual host, set the value of the Scope tag in the Server.xml file to “vhost.” (This is a separate scope tag just for logging.)

Adobe Media Server defines event categories, and for each category, it defines events that can be recorded. Logging can be customized to record all events or only specific events by editing the <Events> and <Fields> elements in the Logger.xml file.

Logging events periodically for live and 24/7 applications

Many companies use statistics from the access log to bill customers. If your programming includes live events or 24/7 programming, the events you need to calculate billing might not occur within a billing cycle. To solve this problem, you can enable checkpoint events. Checkpoint events log bytes periodically from the start to the end of an event. You can configure how often the server logs checkpoint events. The following are available as checkpoint events: connect-continue, play-continue, and publish-continue. For information about configuring checkpoint events, see Enable checkpoint logging events.

Access events defined in access logs

Event

Category

Description

connect-pending

session

Client connects to the server, waiting for the client to be authenticated.

connect

session

Client connects to the server.

disconnect

session

Client disconnects.

connect-continue

session

A checkpoint event that provides updates of a corresponding connect event at intervals. Use the c-client-id field to find the corresponding connect event.

publish

stream

Client publishes a live stream.

unpublish

stream

Client unpublishes a live stream.

publish-continue

stream

A checkpoint event that provides updates of a corresponding publish event at intervals. Use the x-sid field (stream id) and the c-client-id field to find the corresponding publish event.

play

stream

Client plays a stream.

play-continue

stream

A checkpoint event that provides updates of a corresponding play event at intervals. Use the x-sid field (stream id) with the c-client-id field to find the corresponding play event.

pause

stream

Client pauses stream.

unpause

stream

Client resumes playing stream.

client-pause

stream

Client pauses a stream but the server still sends data to the client so the player has enough data to play when the client unpauses. This type of pause is called a “smart pause”. Smart pause requires Flash Player 9,0,115,0 and Adobe Media Server 3 and later. The stream position is logged in the “c-spos” field.

client-unpause

stream

Client smart unpauses a stream. The stream position is logged in the “c-spos” field.

seek

stream

Client seeks in a stream and NetStream.inBufferSeek=false. Also fires when NetStream.inBufferSeek=true and the client seeks outside the buffer.

client-seek

stream

The seek position when the client seeks within the buffer when NetStream.inBufferSeek=true (called a “smart seek”). If a client seeks outside the buffer, the client sends a “seek” event. The stream position is logged in the “c-spos” field.

stop

stream

Client stops playing or publishing a stream.

record

stream

Client begins recording a stream.

recordstop

stream

Client stops recording a stream.

server-start

sever

The server has started.

server-stop

server

The server has stopped.

vhost-start

server

A virtual host has started.

vhost-stop

server

A virtual host has stopped.

registry.start

registry

The registry has started.

registry.stop

registry

The registry has stopped.

service.start

registry

A service has started.

service.stop

registry

A service has stopped.

app-start

application

An application instance has started.

app-stop

application

An application instance has stopped.

service.request

registry

A service request has been made.

debug-pending

session

A debug request is pending.

debug-approved

session

A debug request has been approved.

filenametransform

authorization

A virtual stream path has been mapped to a physical location. This event occurs if an Authorization plug‑in is present to handle the event.

loadsegment

stream

A stream segment has loaded.

action

application

An action has occurred.

codec

stream

A codec has changed.

Authconnect

authorization

Client connects to server. This event occurs if an Authorization plug‑in is present to handle the event.

Authplay

authorization

Client plays a stream. This event occurs if an Authorization plug‑in is present to handle the event.

Authpublish

authorization

Client publishes a live stream. This event occurs if an Authorization plug‑in is present to handle the event.

Authseek

authorization

Client jumps to a new location within a recorded stream. This event occurs if an Authorization plug‑in is present to handle the event.

AuthRecord

authorization

Client begins recording a stream. This event occurs if an Authorization plug-in is present to handle the event.

start-transmit

stream

The server received a “startTransmit” command. This command asks the server to transmit more data because the buffer is running low.

stop-transmit

stream

The server received a “stopTransmit” command. This command asks the server to suspend transmission until the client sends a “startTransmit” event because there is enough data in the buffer.

Fields in access logs

Note:

When the data for this field contains a space or delimiter, the data is wrapped in double quotation marks. The double quotation marks surrounding the data are not part of the data, but are present for better parsing of the data. This applies to the tz, x-ctx, x-adaptor, x-vhost, s-uri, c-referrer, c-user-agent, cs-bytes, sc-bytes, and x-sname fields.

The following formats apply to the fields in the table below:

For date: YYYY-MM-DD

For time: hh:mm:ss

For time zone: string such as “UTC,” “Pacific Daylight Time,” or “Pacific Standard Time”

Field

Description

x-event

Type of event.

x-category

Event category.

date

Date of the event.

time

Time the event occurred.

tz

Time zone information.

x-ctx

Event-dependent context information.

s-ip

IP address or addresses of the server.

x-pid

Server process ID.

x-cpu-load

CPU load.

x-mem-load

Memory usage (as reported by the getServerStats() method).

x-adaptor

Adaptor name.

x-vhost

Virtual host name.

x-app

Application names.

x-appinst

Application instance name.

x-duration

Duration of a stream or session event. For a stream, this value is the number of seconds the stream has played. For a session, this value is the number of seconds the client has been connected.

x-status

For a complete description of the x-status codes and descriptions, see Event status codes in access logs.

c-ip

Client IP address.

c-proto

Connection protocol.

c-proto-ver

Connection protocol version.

s-uri

URI of the Adobe Media Server application.

cs-uri-stem

The stem portion of the s-uri field.

cs-uri-query

The query portion of the s-uri field.

c-referrer

URI of the referrer.

c-user-agent

User agent.

c-client-id

Client ID.

cs-bytes

This field shows the number of bytes transferred from the client to the server.

This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract cs-bytes in the “connect” event from cs-bytes in the “disconnect” event.

sc-bytes

This field shows the number of bytes transferred from the server to the client.

This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract sc-bytes in the “connect” event by sc-bytes in the “disconnect” event

c-connect-type

Type of connection received by the server:

Normal: Connection from a client, such as Flash Player

Group: Connection between an edge and an origin server

Virtual: Client connection that goes through an edge server, using the group connection between the servers for transmission

x-sname

Stream name.

x-sname-query

Query portion of the stream URI specified in the call to play or publish.

x-suri-query

Same as x-sname-query.

x-suri-stem

This is a composite field: cs-uri-stem + x-sname + x-file-ext.

x-suri

This is a composite field: cs-uri-stem + x-sname + x-file-ext + x-sname-query.

x-file-name

Full path of the file representing the x-sname stream.

x-file-ext

Stream type (FLV, MP3, or MP4).

x-file-size

Stream size, in bytes.

x-file-length

Stream length, in seconds.

x-spos

Stream position, in milliseconds.

cs-stream-bytes

This field shows the number of bytes transferred from the client to the server per stream.

To calculate the bandwidth usage per stream, subtract cs-stream-bytes in the “publish” event from cs-stream-bytes in the “unpublish” event.

sc-stream-bytes

This field shows the number of bytes transferred from the server to the client per stream. This value can be less than sc-bytes which is the total number of bytes transferred from the server to the client. When possible, use sc-bytes for billing.

To calculate the bandwidth usage per stream, subtract sc-stream-bytes in the “play” event from sc-stream-bytes in the “stop” event.

The value of sc-stream-bytes can be greater than x-file-size after streaming files not encoded in FLV format, such as MP3 files.

Note: The value of sc-stream-bytes is not necessarily the same as the value of the QoS ByteCount property.

x-service-name

Name of the service providing the connection (only applicable to certain connection types).

x-sc-qos-bytes

Number of bytes sent to the client for quality of service.

x-comment

Comments.

x-sid

The ID of a stream. This ID is unique for the client session but not across sessions.

x-trans-sname

The name of the stream that the server transitions from (the original stream).

x-trans-sname-query

The query stream portion of the stream name for the stream that the server transitions from.

x-trans-file-ext

The file extension portion of the stream name for the stream that the server transitions from.

x-plugin

Name of the plug‑in. This field is only available in authorization (auth-) events.

x-page-url

The URL of the web page in which the client SWF file is embedded.

x-smax-rec-size

The maximum file size of a recorded stream.

x-smax-rec-duration

The maximum duration of a recorded stream.

x-trans-mode

The transition mode sent by the client in the NetStream.play2() call.

x-soffset

When a stream is reconnected, the offset value indicates where to resume streaming.

c-spos

The client stream position when a “client-pause” or “client-seek” event is logged.

c-proto-ver

The RTMPE version. For all other types of RTMP, this field is empty.

x-eid

An event ID received by Authorization plug-in. This event is visible only in the auth.log file. This field is empty in the access.log file.

x-codec-type

Codec type of the frame retrieved in the Authorization plug-in’s E_CODEC event. This event is visible only in the auth.log file. This field is empty in the access.log file.

x-codec-value

Codec value of the “x-codec-type” retrieved in the Authorization plug-in’s E_CODEC_CHANGE event. This event is visible only in the auth.log file. This field is empty in the access.log file.

x-forwarded-for

A string inserted by an HTTP proxy that usually contains the IP address of the originating client. This string can contain several IP address or other values. Adobe Media Server copies the string and reports it unchanged. For more information, see en.wikipedia.org/wiki/X-Forwarded-For.

Event status codes in access logs

The Event status codes are based on HTTP response codes.

Field

Symbol

Status Code

Description

connect pending

status_continue

100

Waiting for the application to authenticate.

disconnect

status_admin_command

102

Client disconnected due to admin command.

disconnect

status_shutdown

103

Client disconnected due to server shutdown (or application unloaded).

connect, publish, unpublish, play, record, record stop, stop

status_OK

200

Successful.

play, stop

status_transition

210

A transition between streams has occurred.

connect

status_unavailable

302

Application currently unavailable.

connect, publish, play

status_bad_request

400

Bad request; invalid parameter or client connected to server using an unknown protocol.

connect, play, publish

status_unauthorized

401

Connection rejected by application script or access denied by application.

connect

status_forbidden

403

Connection rejected by Authorization plug‑in or connection rejected due to invalid URI.

connect, play

object_not_found

404

Application or stream not found.

play

client_disconnect

408

Stream stopped because client disconnected.

connect, publish

status_conflict

409

Resource limit exceeded or stream is already being published. Can also mean that a change has been made by the Authorization plug‑in.

connect

status_lic_limit_exceeded

413

License limit exceeded.

play, publish

unsupported_type

415

Unsupported media type.

disconnect

data_exceeded

416

Message queue too large; disconnect the client.

connect

chunkstream_error

417

Unable to process unknown data type.

disconnect

cannot_broadcast

418

Client does not have privilege to broadcast.

disconnect

cannot_screenshare

419

License to receive screen sharing video failed.

disconnect

remote_link_closed

420

Close downstream connection.

connect

process_msg_failed

422

Unable to process message received when client connection was in pending or closed state.

disconnect

process_msg_exception

423

Error handling message.

disconnect

process_remote_msg_failed

424

Expected response not provided when command was issued.

disconnect

process_admin_msg_failed

425

Expected response not provided when issued an admin command.

disconnect

process_rtmp_S2S_msg_failed

426

Expected response not provided when command issued.

disconnect

write_error

427

Client is not connected or client terminated; unable to write data.

disconnect

invalid_session

428

Client connection invalid; closed due to inactive or idle status.

disconnect

gc_client

429

Unable to obtain ping response or client states not connected.

disconnect

remote_onstop

430

Upstream connection closed.

disconnect

remote_on_client_disconnect

431

Upstream connection closed because the last client disconnected.

disconnect

gc_idle_client

432

Adobe Media Server autoclose feature automatically closed the connection.

disconnect

swf_hash_fail

433

SWF verification failure.

disconnect

swf_hash_timeout

434

SWF verification timeout.

disconnect

encoding_mismatch_error

435

Client disconnected due to incompatibility with object encoding.

disconnect

invalid_client

437

Client connects and fails to perform the standard RTMP handshaking.

play

invalid_transition

438

Client attempted to play a non-existent file during dynamic streaming.

disconnect

swf_hash_wrong_version

439

This version of SWF Verification version is not allowed.

stop

live_stream_destroyed

440

A call to Stream.destroy() destroyed an instance of the server-side Stream class. Publishers are disconnected and recordings are stopped.

disconnect, play

server_internal_error

500

Server internal error.

connect

bad_gateway

502

Bad gateway.

connect

service_unavailable

503

Service unavailable; for instance, too many connections pending for authorization by access module.

disconnect

js_disconnect

600

Application disconnect.

disconnect

js_close_previous_client

601

Network connection was closed or reused.

disconnect

js_exception

602

An unknown exception is thrown from the JS engine.

disconnect

js_chunkstream_error

603

Bad application data.

disconnect

js_debug_forbidden

604

Application does not allow debug connections.

play

js_gc_object

605

~fcstreamjshook() clean up.

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License  Twitter™ and Facebook posts are not covered under the terms of Creative Commons.

Legal Notices   |   Online Privacy Policy