Client Receive Logs
Windows Media Player 9 Series and Windows Media Services 9 Series support fast caching to a local file on the client. The client can play the content from the local cache. This process generates both a client render log and a client receive log. The client receive log indicates how the client received the digital content but not how it rendered that data.
Note
If the content has already been cached from a previous download, the receive log is not sent again.
The following table contains the fields that make up a client receive log. The fields are listed in the order in which they are logged.
Note
Note The MMS protocol is mentioned in some of the descriptions in the following table. However, the MMS protocol is not supported in Windows Server 2008 operating systems.
Field name |
Generated by |
When generated |
Description |
Sample value |
|---|---|---|---|---|
c-ip |
Server |
Start |
IP address of the connected socket. This can be the IP of a proxy server or firewall. In previous versions of the server, the client supplied this field. The server now supplies it to respect the client's privacy. |
157.100.200.300 or 3ffe:2900:d005:f28b:0000:5efe:157.55.145.142 |
Date |
Server |
Start |
Date the client connected, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time. |
1997-10-09 |
Time |
Server |
Start |
Time the client connected to the stream, in either UTC or local time, depending upon the plug-in configuration. Refer to the log file header to determine whether this value is UTC or local time. |
15:30:30 |
c-dns |
Client |
Start |
DNS name of the client. This field is always empty. In previous versions of the server, the client supplied this field. This has changed to respect the privacy of the client. |
|
cs-uri-stem |
Client |
Start |
Path to the content requested by the client, without the schema, host, and port number. |
/test/sample.wmv or /livebroadcast |
c-starttime |
Client |
End |
Time stamp (in seconds) indicating when the client began to play content. For live broadcasts, this field is zero (0). |
39 |
x-duration |
Client |
End |
Amount of time (in seconds) during which the client received data, including any time spent buffering. This differs from the value reported for a client render log. |
31 |
c-rate |
Client |
Dynamic |
The rate at which data is sent. For example, a value of 1 indicates real time, and a value of 2 indicates twice as fast as real time. Fractional values are rounded up. |
1 |
c-status |
Client |
Dynamic |
Code describing the status of the client. 200 = Success. 210 = Client reconnected. 401 = Access denied. 400 = URL is not valid. 404 = Content not found. 408 = Request timeout. 420 = Reconnect failed. 500 = The server encountered an internal error and stopped streaming. |
200 |
c-playerid |
Client |
Start |
Client GUID. This can be a unique GUID if the user has not disabled unique identification. If the client is configured for anonymity, the GUID is reported as {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}) where x is the client's session ID (refer to the s-sessionid field). If the client is a distribution server, the GUID is filled with a series of zeros. |
{c579d042-cecc-11d1-bb31-00a0c9603954} or anonymous:{3300AD50-2C39-46c0-AE0A-70B64F321A80} |
c-playerversion |
Client |
Start |
Version number of the player. |
7.0.1024 |
c-playerlanguage |
Client |
Start |
Language and country/region code of the player. |
en-US |
cs(User-Agent) |
Client |
Start |
Browser type, if any, in which a player was embedded. If the player was not embedded, this field refers to the user agent of the client. Players based on the Windows Media Format 9 Series SDK include a parenthetical SDK version number. If a compatibility layer is used to map Windows Media Player version 6.4 to later versions, a WMPDXM tag is also appended. |
Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98) or NSPlayer/6.4.1.2 or PlayerApp(WMFSDK/9.0.1234) or Mozilla/4.0_(compatible;_MSIE_6.0;_Windows_NT_5.1)_(WMFSDK/9.0.0.2793)_WMPlayer/9.0.0.2793(WMPDXM) |
cs(Referer) |
Client |
Start |
Web page URL in which the player was embedded. If unknown, this field contains a hyphen (-). |
http://www.xxx.yyy or c:\asfroot\test.wmv or \\server\share\welcome.asx |
c-hostexe |
Client |
Start |
Host application. For example, this can be a Web page in a browser (iexplore.exe), a Visual Basic applet (vb.exe), or stand-alone Windows Media Player (mplayer2.exe). This is the .exe file that the user executed. This cannot be a .dll, ocx or other file. |
MPLAYER2.EXE |
c-hostexever |
Client |
Start |
Version number of the host application. The host application is the .exe file identified by c-hostexe. |
6.2.5.323 |
c-os |
Client |
Start |
Operating system on the client computer. |
Windows_98 |
c-osversion |
Client |
Start |
Version number of the operating system on the client computer. |
4.10.0.1998 |
c-cpu |
Client |
Start |
CPU on the client computer. |
Pentium |
filelength |
Server |
Start |
File duration (in seconds). For a live stream this value is 0. |
60 |
filesize |
Server |
Start |
Size of the file (in bytes). For a live broadcast stream, this value is 0. |
86000 |
Avgbandwidth |
Server |
End |
Average bandwidth (in bits per second) at which the client is connected to the server. This is the average value for the duration of the connection. |
102585 |
protocol |
Server |
Start |
Protocol used to access the stream. This may differ from the protocol requested by the client. For example, the client could request MMS but the server uses RTSP. A value of "asfm" indicates that the content was delivered using multicast transmission. |
RTSP |
transport |
Server |
Start |
Transport protocol used to deliver the stream. This must be either UDP or TCP. Multicast content is streamed by using the UDP protocol. |
UDP TCP |
audiocodec |
Client |
End |
This field contains a hyphen (-) for a client receive log. |
- |
videocodec |
Client |
End |
This field contains a hyphen (-) for a client receive log. |
- |
ChannelURL |
Client |
Start |
URL to the multicast information (.nsc) file. This field contains a hyphen (-) for a unicast stream unless the stream is the result of a unicast rollover from a multicast stream. |
https://server/channel.nsc |
sc-bytes |
Server |
End |
Total number of bytes sent by the server to the client. This does not include TCP/IP or other overhead added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. This field contains a hyphen (-) in multicast logs. |
1188557 |
c-bytes |
Client |
End |
Number of bytes received by the client from the server. This does not include TCP/IP or other overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed by using different protocols may result in different values. |
28000 |
s-pkts-sent |
Server |
End |
Number of data packets sent by the server. This does not include TCP or UDP packets. This field contains a hyphen (-) in multicast logs. |
55 |
c-pkts-received |
Client |
End |
Number of data packets received by the client. This does not include TCP or UDP packets. |
50 |
c-pkts-lost-client |
Client |
End |
Number of packets lost during transmission from server to client. This value does not include TCP or UDP packets. |
5 |
c-pkts-lost-net |
Client |
End |
Number of packets lost on the network layer. This value does not include TCP or UDP packets. |
2 |
c-pkts-lost-cont-net |
Client |
End |
Number of continuously lost packets during transmission from the server to a client on the network layer. This value does not include TCP or UDP packets. |
2 |
c-resendreqs |
Client |
End |
The number of requests made by the client to receive new packets. This value does not include TCP or UDP packets. |
5 |
c-pkts-recovered-ECC |
Client |
End |
Number of packets repaired and recovered on the client layer. This value does not include TCP or UDP packets. |
1 |
c-pkts-recovered-resent |
Client |
End |
Number of packets recovered because they were resent using UDP. This includes packets that were sent out of order but does not include TCP or UDP packets. |
5 |
c-buffercount |
Client |
End |
Number of times the client buffered when playing the stream. |
1 |
c-totalbuffertime |
Client |
End |
Total time (in seconds) that the client used to buffer the stream. |
20 |
c-quality |
Client |
End |
The lowest quality of stream reception reported by the player on a scale from 0 to 100. |
89 |
s-ip |
Server |
Begin |
IP address of the server that received the client log. For multicast logs, this value will be the IP address of the Web server on which Wmsiislog.dll is installed. |
155.12.1.234 |
s-dns |
Server |
Begin |
Domain Name System (DNS) name of the server that received the client log. This field contains a hyphen (-) in multicast logs. |
media.server.company.com |
s-totalclients |
Server |
End |
Number of clients connected to the server when a logging event is sent. |
20 |
s-cpu-util |
Server |
End |
Average load on the server cpu(s) on a scale from 0 to 100. This field contains a hyphen (-) in propagated cache proxy logs and in multicast logs. |
40 |
cs-user-name |
Server |
Begin |
User name provided by the client to the server during authentication. This field is populated only if the client was authenticated. If an anonymous authentication method is used, this field will contain a hyphen (-). |
JSmith |
s-session-id |
Server |
Begin |
Internal session ID used by the server to track a particular client session. You can use this to track multiple log entries for the same session. It is not recommended that you use the client GUID (c-playerid) to track a session across multiple log entries. Because it is possible to have multiple instances of a client running on a computer, the GUID for each log entry can be identical. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session. |
123456 |
s-content-path |
Server |
Begin |
URL identifying the content streamed to a client. Because this represents the location from which the content was actually sourced, the value can be different than the URL requested by the client. If the client was redirected, this field represents the location to which it was redirected. |
file://C:\WMPub\WMRoot\Encoder_ad.wmv or http://www.example.microsoft.com/speech.wma |
cs-url |
Client |
Begin |
URL requested by the client. For multicast clients, this value is the multicast IP address and port. |
mms://microsoft.com/content.wmv asfm://206.73.118.254:26502 |
cs-media-name |
Client |
End |
Name of the stream rendered by the client. This can be the name of the current element in a playlist. If the client received content from a playlist, the value is derived from the mediaName attribute of the media element. If the mediaName attribute is not present, the value in this field is the name of the file that was streamed. Only Windows Media Player 9 Series supports this field. |
/ads/MyAd2.wmv |
c-max-bandwidth |
Client |
End |
Maximum client bandwidth, in bits per second. You can use this to determine whether clients have the capacity for higher bandwidth content. This field can have the following values: a) the number of bits per second reported from the client. b) an undetermined amount, logged as 0. c) a very large number of bits per second that cannot be accurately measured but is greater than one million and less than one billion, logged as a hyphen (-). d) a hyphen (-) when a file is being played from the local cache and no bandwidth is used. |
384000 |
cs-media-role |
Client |
End |
The value assigned to the role attribute for a media element in a playlist. This value indicates the role that the playlist entry performs, such as an advertisement. If the media element did not have a role attribute, or if the client did not receive content from a playlist, this field contains a hyphen (-). |
ADVERTISEMENT |
s-proxied |
Server |
End |
If this field is one (1), the client connection was made through a cache proxy server. Otherwise, it is zero (0). |
1 |