Access logs

Reading access logs

The access log records information about requests by Flash Player and Adobe Media Server application instances. Using these logs, you can find out about various events, such as when a user connected to the server, how much total bandwidth was consumed during the session, and which streams were accessed by the connection (and similar resource information). You can use the status codes associated with specific events to troubleshoot event failures. You can also use this information to determine which applications are used most.

The default access log is access.xx.log, which is located in the RootInstall/logs directory. The default configuration creates a single access log per server. You can also configure the server to create a separate file per virtual host. When logging is configured on a per-virtual-host basis, all logs for a particular virtual host are found in a subdirectory within the logs directory. The name of the subdirectory matches the virtual host name. Substitution strings can be found in the [] brackets, with YYYY, MM, DD, and NN representing year, month, date, and version, respectively. You can use the substitution string to customize the filename of the access log. (For example, access.[YYYYMMDDNN].log could be named access.2007052401.log.) To configure the server to create separate log files for each virtual host, set the value of the Scope tag in the Server.xml file to “vhost.” (This is a separate scope tag just for logging.)

Adobe Media Server defines event categories, and for each category, it defines events that can be recorded. Logging can be customized to record all events or only specific events by editing the <Events> and <Fields> elements in the Logger.xml file.

Logging events periodically for live and 24/7 applications

Many companies use statistics from the access log to bill customers. If your programming includes live events or 24/7 programming, the events you need to calculate billing might not occur within a billing cycle. To solve this problem, you can enable checkpoint events. Checkpoint events log bytes periodically from the start to the end of an event. You can configure how often the server logs checkpoint events. The following are available as checkpoint events: connect-continue, play-continue, and publish-continue. For information about configuring checkpoint events, see Enable checkpoint logging events.

Access events defined in access logs

Event	Category	Description
connect-pending	session	Client connects to the server, waiting for the client to be authenticated.
connect	session	Client connects to the server.
disconnect	session	Client disconnects.
connect-continue	session	A checkpoint event that provides updates of a corresponding connect event at intervals. Use the c-client-id field to find the corresponding connect event.
publish	stream	Client publishes a live stream.
unpublish	stream	Client unpublishes a live stream.
publish-continue	stream	A checkpoint event that provides updates of a corresponding publish event at intervals. Use the x-sid field (stream id) and the c-client-id field to find the corresponding publish event.
play	stream	Client plays a stream.
play-continue	stream	A checkpoint event that provides updates of a corresponding play event at intervals. Use the x-sid field (stream id) with the c-client-id field to find the corresponding play event.
pause	stream	Client pauses stream.
unpause	stream	Client resumes playing stream.
client-pause	stream	Client pauses a stream but the server still sends data to the client so the player has enough data to play when the client unpauses. This type of pause is called a “smart pause”. Smart pause requires Flash Player 9,0,115,0 and Adobe Media Server 3 and later. The stream position is logged in the “c-spos” field.
client-unpause	stream	Client smart unpauses a stream. The stream position is logged in the “c-spos” field.
seek	stream	Client seeks in a stream and NetStream.inBufferSeek=false. Also fires when NetStream.inBufferSeek=true and the client seeks outside the buffer.
client-seek	stream	The seek position when the client seeks within the buffer when NetStream.inBufferSeek=true (called a “smart seek”). If a client seeks outside the buffer, the client sends a “seek” event. The stream position is logged in the “c-spos” field.
stop	stream	Client stops playing or publishing a stream.
record	stream	Client begins recording a stream.
recordstop	stream	Client stops recording a stream.
server-start	sever	The server has started.
server-stop	server	The server has stopped.
vhost-start	server	A virtual host has started.
vhost-stop	server	A virtual host has stopped.
registry.start	registry	The registry has started.
registry.stop	registry	The registry has stopped.
service.start	registry	A service has started.
service.stop	registry	A service has stopped.
app-start	application	An application instance has started.
app-stop	application	An application instance has stopped.
service.request	registry	A service request has been made.
debug-pending	session	A debug request is pending.
debug-approved	session	A debug request has been approved.
filenametransform	authorization	A virtual stream path has been mapped to a physical location. This event occurs if an Authorization plug‑in is present to handle the event.
loadsegment	stream	A stream segment has loaded.
action	application	An action has occurred.
codec	stream	A codec has changed.
Authconnect	authorization	Client connects to server. This event occurs if an Authorization plug‑in is present to handle the event.
Authplay	authorization	Client plays a stream. This event occurs if an Authorization plug‑in is present to handle the event.
Authpublish	authorization	Client publishes a live stream. This event occurs if an Authorization plug‑in is present to handle the event.
Authseek	authorization	Client jumps to a new location within a recorded stream. This event occurs if an Authorization plug‑in is present to handle the event.
AuthRecord	authorization	Client begins recording a stream. This event occurs if an Authorization plug-in is present to handle the event.
start-transmit	stream	The server received a “startTransmit” command. This command asks the server to transmit more data because the buffer is running low.
stop-transmit	stream	The server received a “stopTransmit” command. This command asks the server to suspend transmission until the client sends a “startTransmit” event because there is enough data in the buffer.

Fields in access logs

Note:

When the data for this field contains a space or delimiter, the data is wrapped in double quotation marks. The double quotation marks surrounding the data are not part of the data, but are present for better parsing of the data. This applies to the tz, x-ctx, x-adaptor, x-vhost, s-uri, c-referrer, c-user-agent, cs-bytes, sc-bytes, and x-sname fields.

The following formats apply to the fields in the table below:

For date: YYYY-MM-DD

For time: hh:mm:ss

For time zone: string such as “UTC,” “Pacific Daylight Time,” or “Pacific Standard Time”

Field	Description
x-event	Type of event.
x-category	Event category.
date	Date of the event.
time	Time the event occurred.
tz	Time zone information.
x-ctx	Event-dependent context information.
s-ip	IP address or addresses of the server.
x-pid	Server process ID.
x-cpu-load	CPU load.
x-mem-load	Memory usage (as reported by the getServerStats() method).
x-adaptor	Adaptor name.
x-vhost	Virtual host name.
x-app	Application names.
x-appinst	Application instance name.
x-duration	Duration of a stream or session event. For a stream, this value is the number of seconds the stream has played. For a session, this value is the number of seconds the client has been connected.
x-status	For a complete description of the x-status codes and descriptions, see Event status codes in access logs.
c-ip	Client IP address.
c-proto	Connection protocol.
c-proto-ver	Connection protocol version.
s-uri	URI of the Adobe Media Server application.
cs-uri-stem	The stem portion of the s-uri field.
cs-uri-query	The query portion of the s-uri field.
c-referrer	URI of the referrer.
c-user-agent	User agent.
c-client-id	Client ID.
cs-bytes	This field shows the number of bytes transferred from the client to the server. This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract cs-bytes in the “connect” event from cs-bytes in the “disconnect” event.
sc-bytes	This field shows the number of bytes transferred from the server to the client. This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract sc-bytes in the “connect” event by sc-bytes in the “disconnect” event
c-connect-type	Type of connection received by the server: Normal: Connection from a client, such as Flash Player Group: Connection between an edge and an origin server Virtual: Client connection that goes through an edge server, using the group connection between the servers for transmission
x-sname	Stream name.
x-sname-query	Query portion of the stream URI specified in the call to play or publish.
x-suri-query	Same as x-sname-query.
x-suri-stem	This is a composite field: cs-uri-stem + x-sname + x-file-ext.
x-suri	This is a composite field: cs-uri-stem + x-sname + x-file-ext + x-sname-query.
x-file-name	Full path of the file representing the x-sname stream.
x-file-ext	Stream type (FLV, MP3, or MP4).
x-file-size	Stream size, in bytes.
x-file-length	Stream length, in seconds.
x-spos	Stream position, in milliseconds.
cs-stream-bytes	This field shows the number of bytes transferred from the client to the server per stream. To calculate the bandwidth usage per stream, subtract cs-stream-bytes in the “publish” event from cs-stream-bytes in the “unpublish” event.
sc-stream-bytes	This field shows the number of bytes transferred from the server to the client per stream. This value can be less than sc-bytes which is the total number of bytes transferred from the server to the client. When possible, use sc-bytes for billing. To calculate the bandwidth usage per stream, subtract sc-stream-bytes in the “play” event from sc-stream-bytes in the “stop” event. The value of sc-stream-bytes can be greater than x-file-size after streaming files not encoded in FLV format, such as MP3 files. Note: The value of sc-stream-bytes is not necessarily the same as the value of the QoS ByteCount property.
x-service-name	Name of the service providing the connection (only applicable to certain connection types).
x-sc-qos-bytes	Number of bytes sent to the client for quality of service.
x-comment	Comments.
x-sid	The ID of a stream. This ID is unique for the client session but not across sessions.
x-trans-sname	The name of the stream that the server transitions from (the original stream).
x-trans-sname-query	The query stream portion of the stream name for the stream that the server transitions from.
x-trans-file-ext	The file extension portion of the stream name for the stream that the server transitions from.
x-plugin	Name of the plug‑in. This field is only available in authorization (auth-) events.
x-page-url	The URL of the web page in which the client SWF file is embedded.
x-smax-rec-size	The maximum file size of a recorded stream.
x-smax-rec-duration	The maximum duration of a recorded stream.
x-trans-mode	The transition mode sent by the client in the NetStream.play2() call.
x-soffset	When a stream is reconnected, the offset value indicates where to resume streaming.
c-spos	The client stream position when a “client-pause” or “client-seek” event is logged.
c-proto-ver	The RTMPE version. For all other types of RTMP, this field is empty.
x-eid	An event ID received by Authorization plug-in. This event is visible only in the auth.log file. This field is empty in the access.log file.
x-codec-type	Codec type of the frame retrieved in the Authorization plug-in’s E_CODEC event. This event is visible only in the auth.log file. This field is empty in the access.log file.
x-codec-value	Codec value of the “x-codec-type” retrieved in the Authorization plug-in’s E_CODEC_CHANGE event. This event is visible only in the auth.log file. This field is empty in the access.log file.
x-forwarded-for	A string inserted by an HTTP proxy that usually contains the IP address of the originating client. This string can contain several IP address or other values. Adobe Media Server copies the string and reports it unchanged. For more information, see en.wikipedia.org/wiki/X-Forwarded-For.

Event status codes in access logs

The Event status codes are based on HTTP response codes.

Field	Symbol	Status Code	Description
connect pending	status_continue	100	Waiting for the application to authenticate.
disconnect	status_admin_command	102	Client disconnected due to admin command.
disconnect	status_shutdown	103	Client disconnected due to server shutdown (or application unloaded).
connect, publish, unpublish, play, record, record stop, stop	status_OK	200	Successful.
play, stop	status_transition	210	A transition between streams has occurred.
connect	status_unavailable	302	Application currently unavailable.
connect, publish, play	status_bad_request	400	Bad request; invalid parameter or client connected to server using an unknown protocol.
connect, play, publish	status_unauthorized	401	Connection rejected by application script or access denied by application.
connect	status_forbidden	403	Connection rejected by Authorization plug‑in or connection rejected due to invalid URI.
connect, play	object_not_found	404	Application or stream not found.
play	client_disconnect	408	Stream stopped because client disconnected.
connect, publish	status_conflict	409	Resource limit exceeded or stream is already being published. Can also mean that a change has been made by the Authorization plug‑in.
connect	status_lic_limit_exceeded	413	License limit exceeded.
play, publish	unsupported_type	415	Unsupported media type.
disconnect	data_exceeded	416	Message queue too large; disconnect the client.
connect	chunkstream_error	417	Unable to process unknown data type.
disconnect	cannot_broadcast	418	Client does not have privilege to broadcast.
disconnect	cannot_screenshare	419	License to receive screen sharing video failed.
disconnect	remote_link_closed	420	Close downstream connection.
connect	process_msg_failed	422	Unable to process message received when client connection was in pending or closed state.
disconnect	process_msg_exception	423	Error handling message.
disconnect	process_remote_msg_failed	424	Expected response not provided when command was issued.
disconnect	process_admin_msg_failed	425	Expected response not provided when issued an admin command.
disconnect	process_rtmp_S2S_msg_failed	426	Expected response not provided when command issued.
disconnect	write_error	427	Client is not connected or client terminated; unable to write data.
disconnect	invalid_session	428	Client connection invalid; closed due to inactive or idle status.
disconnect	gc_client	429	Unable to obtain ping response or client states not connected.
disconnect	remote_onstop	430	Upstream connection closed.
disconnect	remote_on_client_disconnect	431	Upstream connection closed because the last client disconnected.
disconnect	gc_idle_client	432	Adobe Media Server autoclose feature automatically closed the connection.
disconnect	swf_hash_fail	433	SWF verification failure.
disconnect	swf_hash_timeout	434	SWF verification timeout.
disconnect	encoding_mismatch_error	435	Client disconnected due to incompatibility with object encoding.
disconnect	invalid_client	437	Client connects and fails to perform the standard RTMP handshaking.
play	invalid_transition	438	Client attempted to play a non-existent file during dynamic streaming.
disconnect	swf_hash_wrong_version	439	This version of SWF Verification version is not allowed.
stop	live_stream_destroyed	440	A call to Stream.destroy() destroyed an instance of the server-side Stream class. Publishers are disconnected and recordings are stopped.
disconnect, play	server_internal_error	500	Server internal error.
connect	bad_gateway	502	Bad gateway.
connect	service_unavailable	503	Service unavailable; for instance, too many connections pending for authorization by access module.
disconnect	js_disconnect	600	Application disconnect.
disconnect	js_close_previous_client	601	Network connection was closed or reused.
disconnect	js_exception	602	An unknown exception is thrown from the JS engine.
disconnect	js_chunkstream_error	603	Bad application data.
disconnect	js_debug_forbidden	604	Application does not allow debug connections.
play	js_gc_object	605	~fcstreamjshook() clean up.

Access logs

Reading access logs

Logging events periodically for live and 24/7 applications

Access events defined in access logs

Fields in access logs

Event status codes in access logs

Get help faster and easier

Share this page

Ask the Community

Contact Us