The following list identifies all of the fields that can be reported in all of the Windows Media log files, and whether they are used to report data from unicast clients, multicast clients, or both.
Description: The source Internet Protocol (IP) address of the connected socket. This may be the IP address of a proxy server or firewall.
Sample value: 157.56.219.146
Client data reported: Unicast, multicast
Description: Date when a client connected (in international date format).
Sample value: 2001-04-19
Client data reported: Unicast, multicast
Description: Time when the client connected. The time format is either in Coordinated Universal Time (UTC) or local time, depending on how the logging plug-in is configured.
Sample value: 15:30:30
Client data reported: Unicast, multicast
Description: Used when you want to use version 4.1 scripts to analyze Windows Media 9 Series logs.
Client data reported: Unicast, multicast
Description: The path (requested URL without the schema, host, port number, and question mark) to the content that was requested. See cs-url for the full URL. Note that this represents a change from Windows Media Services version 4.1, in which this field contained the full URL.
Sample value: /test/sample.wmv or /broadcast
Client data reported: Unicast, multicast
Description: Time stamp (in seconds, no fractions) indicating the point in the stream when the client started to render content. For live broadcasts, this field is set to 0.
Sample value: 39
Client data reported: Unicast, multicast
Description: Length of time (in seconds) of the data received by the client. For Player log entries, the value does not include buffered data. For distribution server log entries, the value includes all time spent receiving data, including any buffering.
Sample value: 31
Client data reported: Unicast, multicast
Description: The rate at which data is sent from the server to the client. Possible values are shown in the following table:
Value | Description |
---|---|
0.5 | Half the real-time rate. |
1 | Real-time rate. |
2 | Twice as fast as the real-time rate. |
5 | Fast forward. |
-5 | Fast rewind. |
If you are using Fast Streaming, these values could be considerably higher or lower depending on the content and the available bandwidth.
Sample value: 1
Client data reported: Unicast, multicast
Description: Codes that describe client status. Possible codes are shown in the following table:
Value | Description |
200 | The connection was successful. |
210 | The client reconnected (after first disconnecting). |
400 | The requested URL was invalid. |
401 | The client was denied access. |
404 | The requested content was not found. |
408 | The client failed to submit a log because the client disconnected. |
420 | The client was disconnected and attempted to reconnect, but failed. |
500 | The Windows Media server encountered an internal error and stopped streaming. |
For the code value of 420, the client will then connect again starting a new session. This code reflects the client’s statistics when it was originally disconnected. For each log entry with this code, there should be a 408 code that has the same session ID.
Sample value: 200
Client data reported: Unicast, multicast
Description: Globally unique identifier (GUID) of the client. For Player log entries, if the Player is configured to not send unique identification information to content providers, the value is: {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}, where xxxxxxxxxxxx is the session ID of the client. For distribution server log entries, this value is always a series of zeroes.
Sample value: {c579d042-cecc-11d1-bb31-00a0c9603954}
Client data reported: Unicast, multicast
Description: For Player log entries, this field represents the version number of the Player. For distribution server log entries, this field represents the version number of the distribution server.
Sample value: 6.2.5.415
Client data reported: Unicast, multicast
Description: Language and country/region code of the Player.
Sample value: en-US
Client data reported: Unicast, multicast
Description: Used to determine whether the embedded Player is a version 6.4 Player with a Windows Media 9 Series wrapper or a legacy 6.4 Player. The tag used to identify a Windows Media 9 Series wrapper is WMPDXM.
Sample value: Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98)
Client data reported: Unicast
Description: URL to the Web page in which the Player was embedded (if it was embedded). If this is unknown, this field is blank.
Sample value: http://www.example.microsoft.com
Client data reported: Unicast
Description: For Player log entries, the host program (.exe) that was run. For example, a Web page in a browser, a Microsoft Visual Basic-based application, or a standalone Player. For distribution server log entries, the name of the distribution server’s service program (.exe) that was run.
Sample value: iexplore.exe, vb.exe, mplayer2.exe, WMServer.exe
Client data reported: Unicast, multicast
Description: Host program (.exe) version number.
Sample value: 4.70.1215
Client data reported: Unicast, multicast
Description: Client operating system.
Sample value: Windows_NT
Client data reported: Unicast, multicast
Description: Version number of the client operating system.
Sample value: 4.0.0.1381
Client data reported: Unicast, multicast
Description: Client CPU type.
Sample value: Pentium
Client data reported: Unicast, multicast
Description: Length of the digital media file (in seconds). This value is 0 for a stream delivered from a broadcast publishing point.
Sample value: 60
Client data reported: Unicast
Description: Size of the digital media file (in bytes). This value is 0 for a stream delivered from a broadcast publishing point.
Sample value: 86000
Client data reported: Unicast
Description: Average bandwidth (in bits per second) at which the client was connected to the server. The value is calculated across the entire duration of the connection.
Sample value: 24300
Client data reported: Unicast, multicast
Description: Actual protocol used to access the content (may differ from the protocol requested by the client). A value of “Cache” indicates that a client played the content from its disk-based cache. A value of “asfm” indicates that the content was delivered using multicast transmission.
Sample value: MMST
Client data reported: Unicast, multicast
Description: Transport protocol used to stream content. Multicast content is always streamed using UDP.
Sample value: UDP, TCP
Client data reported: Unicast, multicast
Description: For Player log entries, the audio codecs used to encode the audio streams that the client accessed. If multiple codecs were used, the values are delimited by semicolons. This field contains a hyphen (-) in distribution server log entries.
Sample value: Microsoft_Audio_Codec
Client data reported: Unicast, multicast
Description: For Player log entries, the video codecs used to encode the video streams that the client accessed. If multiple codecs were used, the values are delimited by semicolons. This field contains a hyphen (-) in distribution server log entries.
Sample value: Microsoft_MPEG-4_Video_Codec_V2
Client data reported: Unicast, multicast
Description: URL to the multicast information file. This field contains a hyphen (-) in a client receiving content as a unicast stream unless the unicast stream is a result of a unicast rollover from a multicast stream.
Sample value: http://www.example.microsoft.com/channel.nsc
Client data reported: Unicast, multicast
Description: Total number of bytes that the server sent to the client. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed using different protocols may result in different values. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.
Sample value: 30000
Client data reported: Unicast
Description: Number of bytes received by the client from the server. The value does not include any overhead that is added by the network stack. However, protocols such as MMS, RTSP, and HTTP may introduce some overhead. Therefore, the same content streamed using different protocols may result in different values. If c-bytes and sc-bytes are not identical, packet loss occurred.
Sample value: 28583
Client data reported: Unicast, multicast
Description: Number of content packets sent by the server to a connected client. The value does not include TCP or UDP packets. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.
Sample value: 55
Client data reported: Unicast
Description: Number of packets from the server (s-pkts-sent) that are received correctly by the client on the first try. Packets that are not received correctly on the first try can be recovered if they are resent through the UDP protocol. Packets that are not recovered through UDP resend are considered lost. You can recover these packets if error correction is enabled. The value does not include TCP or UDP packets.
Sample value: 50
Client data reported: Unicast, multicast
Description: Packets lost during transmission from server to client that were not recovered at the client layer through error correction or at the network layer through UDP resends. These packets are sent by the Windows Media server, but never played by the client. The value does not include TCP or UDP packets.
Sample value: 5
Client data reported: Unicast, multicast
Description: Number of packets lost on the network layer. You can recover these packets if error correction is enabled. The value does not include TCP or UDP packets.
Sample value: 2
Client data reported: Unicast, multicast
Description: Maximum number of continuously lost packets on the network layer during transmission from server to client. If the value is high, the network conditions were bad, with long periods of time during which the client received no packets. The value does not include TCP or UDP packets.
Sample value: 2
Client data reported: Unicast, multicast
Description: Number of client requests to receive new packets. This field contains a 0 unless the client is using UDP resend.
Sample value: 5
Client data reported: Unicast, multicast
Description: Packets lost in the network (c-pkts-lost-net) that were repaired and recovered at the client layer because error correction was enabled. Error correction is the only means of packet recovery for multicast streams. Packets repaired and recovered at the client layer are equal to the difference between c-pkts-lost-net and c-pkts-lost-client. The value does not include TCP or UDP packets.
Sample value: 3
Client data reported: Unicast, multicast
Description: Number of packets recovered because they were resent through UDP. The value does not include TCP or UDP packets. This field contains a 0 unless the client is using UDP resend.
Sample value: 5
Client data reported: Unicast, multicast
Description: Number of times the client buffered while playing the stream.
Sample value: 4
Client data reported: Unicast, multicast
Description: Time (in seconds) the client used to buffer the stream. If the client buffers more than once before a log entry is generated, c-totalbuffertime is the total amount of time the client spent buffering.
Sample value: 6
Client data reported: Unicast, multicast
Description: The lowest level of stream quality reported by the Player during the playback of the stream.
Sample value: 96
Client data reported: Unicast, multicast
Description: IP address of the server that received the log file. For multicast log files, this value will be the IP address of the Web server on which Wmsiislog.dll is installed.
Sample value: 224.24.41.189
Client data reported: Unicast, multicast
Description: Domain Name System (DNS) name of the server that received the log file. This field contains a hyphen (-) in multicast log files.
Sample value: media.server.contoso.com
Client data reported: Unicast
Description: Number of clients connected to the server (but not necessarily streaming) at the time the event was logged. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.
Sample value: 20
Client data reported: Unicast
Description: Average load on the server processor (0 to 100 percent). If multiple processors exist, this value is the average for all processors. This field contains a hyphen (-) in propagated cache/proxy logs and in multicast log files.
Sample value: 40
Client data reported: Unicast
Description: The user name the client provided during authentication. This field contains a value only if authorization and authentication plug-ins are enabled. If an anonymous authentication method is used, this field will contain a hyphen (-).
Sample value: JSmith
Client data reported: Unicast
Description: A session identifier the server uses to track a stream session. This is important for tracking multiple log entries to the same session. Note that if Windows Media Player version 6.4 received content over HTTP, the s-sessionid value will change for each log entry, even if the entries are for the same session.
Sample value: 123456
Client data reported: Unicast
Description: The actual content that streamed. A plug-in may resolve a requested path to another path. If the client was redirected, this field represents the location to which the client was redirected.
Sample value: file://C:\WMPub\WMRoot\Encoder_ad.wmv or http://www.example.microsoft.com/speech.wma
Client data reported: Unicast
Description: The actual URL requested by the client. For multicast clients, this value is the multicast IP address and port. However, Windows Media Player 9 Series and the Windows Media Player 9 Series ActiveX control multicast clients submit the multicast IP address and port, followed by the IP address of the network interface from which the server broadcasts the multicast.
Sample value: mms://example.microsoft.com/mycontent.wmv, asfm://206.73.118.254:26502 or (for Windows Media Player 9 Series) asfm://multicast IP address:port/Server IP address
Client data reported: Unicast, multicast
Description: The media element the client was receiving if the client was receiving content from a playlist. The value is derived from the mediaName attribute of the playlist media element. If the mediaName attribute is not present, the value in this field is derived from the file name value. This field is blank if the client was not receiving content from a playlist.
Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.
Sample value: /ads/MyAd2.asf
Client data reported: Unicast
Description: The maximum bandwidth rate (in bits per second) of the client. This value can be used to determine whether clients have the capacity for higher-bandwidth content. The value recorded for this field can be of the following types:
A valid number of bits per second (bps) reported from the client, such as 38400.
An undetermined amount, logged as 0.
A very large amount that cannot be accurately measured, but is greater than 1,000,000 bps and less than 1,000,000,000 bps, logged as a hyphen (-).
A hyphen (-), when a file is being played from the local cache and no bandwidth is used.
Sample value: 384000
Client data reported: Unicast, multicast
Description: A user-defined value that identifies the role of a media element in a playlist. Typically, this field is used to enable advertisement logging. If the media element does not have a role attribute, or if the client was not receiving content from a playlist, this field is blank. Alternatively, this entry can be specified in the announcement file in order to classify logs according to user or content.
Sample value: Ad
Client data reported: Unicast
Description: Indicates whether the client connected through a cache/proxy server. A value of 0 indicates no cache/proxy server was involved. A value of 1 indicates a cache/proxy server was involved.
Sample value: 1
Client data reported: Unicast