Flash Media Server Resources

Access logs

Contents [Hide]

Reading access logs
Logging events periodically for live and 24/7 applications
Access events defined in access logs
Fields in access logs
Event status codes in access logs

Reading access logs

The access log records information about requests by Flash Player and Flash Media Server application instances. Using these logs, you can find out about various events, such as when a user connected to the server, how much total bandwidth was consumed during the session, and which streams were accessed by the connection (and similar resource information). You can use the status codes associated with specific events to troubleshoot event failures. You can also use this information to determine which applications are used most.

The default access log is access.xx.log, which is located in the RootInstall/logs directory. The default configuration creates a single access log per server. You can also configure the server to create a separate file per virtual host. When logging is configured on a per-virtual-host basis, all logs for a particular virtual host are found in a subdirectory within the logs directory. The name of the subdirectory matches the virtual host name. Substitution strings can be found in the [] brackets, with YYYY, MM, DD, and NN representing year, month, date, and version, respectively. You can use the substitution string to customize the filename of the access log. (For example, access.[YYYYMMDDNN].log could be named access.2007052401.log.) To configure the server to create separate log files for each virtual host, set the value of the Scope tag in the Server.xml file to “vhost.” (This is a separate scope tag just for logging.)

Flash Media Server defines event categories, and for each category, it defines events that can be recorded. Logging can be customized to record all events or only specific events by editing the <Events> and <Fields> elements in the Logger.xml file.

Logging events periodically for live and 24/7 applications

Many companies use statistics from the access log to bill customers. If your programming includes live events or 24/7 programming, the events you need to calculate billing might not occur within a billing cycle. To solve this problem, you can enable checkpoint events. Checkpoint events log bytes periodically from the start to the end of an event. You can configure how often the server logs checkpoint events. The following are available as checkpoint events: connect-continue, play-continue, and publish-continue. For information about configuring checkpoint events, see Enable checkpoint logging events.

Access events defined in access logs

Event	Category	Description
connect-pending	session	Client connects to the server, waiting for the client to be authenticated.
connect	session	Client connects to the server.
connect-continue	session	A checkpoint event that provides updates of a corresponding connect event at intervals. Use the c-client-id field to find the corresponding connect event.
disconnect	session	Client disconnects.
publish	stream	Client publishes a live stream.
unpublish	stream	Client unpublishes a live stream.
publish-continue	stream	A checkpoint event that provides updates of a corresponding publish event at intervals. Use the x-sid field (stream id) and the c-client-id field to find the corresponding publish event.
play	stream	Client plays a stream.
play-continue	stream	A checkpoint event that provides updates of a corresponding play event at intervals. Use the x-sid field (stream id) with the c-client-id field to find the corresponding play event.
pause	stream	Client pauses stream.
unpause	stream	Client resumes playing stream.
client-pause	stream	Client smart pauses a stream. The stream is paused but the server still sends data to the client so the player has enough data to play when the client unpauses.
client-unpause	stream	Client smart unpauses a stream.
seek	stream	Client seeks in a stream.
stop	stream	Client stops playing or publishing a stream.
record	stream	Client begins recording a stream.
recordstop	stream	Client stops recording a stream.
server-start	server	Server has started.
server-stop	server	Server has stopped.
vhost-start	vhost	A virtual host has started.
vhost-stop	vhost	A virtual host has stopped
app-start	application	An application instance has started.
app-stop	application	An application instance has stopped.
auth-connect	authorization	Client connects to server. This event occurs if an Authorization plug‑in is present to handle the event.
auth-play	authorization	Client plays a stream. This event occurs if an Authorization plug‑in is present to handle the event.
auth-publish	authorization	Client publishes a live stream. This event occurs if an Authorization plug‑in is present to handle the event.
auth-seek	authorization	Client jumps to a new location within a recorded stream. This event occurs if an Authorization plug‑in is present to handle the event.
filenametransform	authorization	A virtual stream path has been mapped to a physical location. This event occurs if an Authorization plug‑in is present to handle the event.
auth-record	authorization	Client begins recording a stream. This event occurs if an Authorization plug-in is present to handle the event.

Fields in access logs

Note: When the data for this field contains a space or delimiter, the data is wrapped in double quotation marks. The double quotation marks surrounding the data are not part of the data, but are present for better parsing of the data. This applies to the tz, x-ctx, x-adaptor, x-vhost, s-uri, c-referrer, c-user-agent, cs-bytes, sc-bytes, and x-sname fields.

The following formats apply to the fields in the table below:

For date: YYYY-MM-DD

For time: hh:mm:ss

For time zone: string such as “UTC,” “Pacific Daylight Time,” or “Pacific Standard Time”

Field	Description
x-event	Type of event.
x-category	Event category.
date	Date of the event.
time	Time the event occurred.
tz	Time zone information.
x-ctx	Event-dependent context information.
s-ip	IP address or addresses of the server.
x-pid	Server process ID.
x-cpu-load	CPU load.
x-mem-load	Memory usage (as reported by the `getServerStats()` method).
x-adaptor	Adaptor name.
x-vhost	Virtual host name.
x-app	Application names.
x-appinst	Application instance names.
x-duration	Duration of a stream or session event.
x-status	For a complete description of the x-status codes and descriptions, see Fields in diagnostic logs.
c-ip	Client IP address.
c-proto	Connection protocol: RTMP or RTMPT.
s-uri	URI of the Flash Media Server application.
cs-uri-stem	The stem portion of the s-uri field.
cs-uri-query	The query portion of s-uri.
c-referrer	URI of the referrer.
c-user-agent	User agent.
c-client-id	Client ID.
cs-bytes	This field shows the number of bytes transferred from the client to the server. This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract cs-bytes in the “connect” event from cs-bytes in the “disconnect” event.
sc-bytes	This field shows the number of bytes transferred from the server to the client. This information can be used to bill customers per session. To calculate the bandwidth usage per session, subtract sc-bytes in the “connect” event by sc-bytes in the “disconnect” event
c-connect-type	Type of connection received by the server: Normal: Connection from a client, such as Flash Player Group: Connection between an edge and an origin server Virtual: Client connection that goes through an edge server, using the group connection between the servers for transmission
x-sname	Stream name.
x-sname-query	Query portion of the stream URI specified in play or publish.
x-suri-query	Same as x-sname-query.
x-suri-stem	This is a composite field: cs-uri-stem + x-sname + x-file-ext.
x-suri	This is a composite field: cs-uri-stem + x-sname + x-file-ext + x-sname-query.
x-file-name	Full path of the file representing the x-sname stream.
x-file-ext	Stream type (currently, this can be FLV or MP3).
x-file-size	Stream size, in bytes.
x-file-length	Stream length, in seconds.
x-spos	Stream position.
cs-stream-bytes	This field shows the number of bytes transferred from the client to the server per stream. To calculate the bandwidth usage per stream, subtract cs-stream-bytes in the “publish” event from cs-stream-bytes in the “unpublish” event.
sc-stream-bytes	This field shows the number of bytes transferred from the server to the client per stream. To calculate the bandwidth usage per stream, subtract sc-stream-bytes in the “play” event from sc-stream-bytes in the “stop” event. The value of sc-stream-bytes can be greater than x-file-size after streaming files not encoded in FLV format, such as MP3 files. Note: The value of sc-stream-bytes is not necessarily the same as the value of the QoS ByteCount property.
x-service-name	Name of the service providing the connection (only applicable to certain connection types).
x-sc-qos-bytes	Number of bytes sent to the client for quality of service.
x-comment	Comments.
x-sid	The ID of a stream. This ID is unique for the client session but not across sessions.
x-trans-sname	The name of the stream that the server transitions from (the original stream).
x-trans-sname-query	The query stream portion of the stream name for the stream that the server transitions from.
x-trans-file-ext	The file extension portion of the stream name for the stream that the server transitions from.
x-plugin	Name of the plug‑in. This field is only available in authorization (auth-) events.
x-page-url	The URL of the web page in which the client SWF file is embedded.
x-smax-rec-size	The maximum file size of a recorded stream.
x-smax-rec-duration	The maximum duration of a recorded stream.

Event status codes in access logs

The Event status codes are based on HTTP response codes.

Field	Symbol	Status Code	Description
connect pending	status_continue	100	Waiting for the application to authenticate.
disconnect	status_admin_command	102	Client disconnected due to admin command.
disconnect	status_shutdown	103	Client disconnected due to server shutdown (or application unloaded).
connect, publish, unpublish, play, record, record stop, stop	status_OK	200	Successful.
play, stop	status_transition	210	A transition between streams has occurred.
connect	status_unavailable	302	Application currently unavailable.
connect, publish, play	status_bad_request	400	Bad request; invalid parameter or client connected to server using an unknown protocol.
connect, play, publish	status_unauthorized	401	Connection rejected by application script or access denied by application.
connect	status_forbidden	403	Connection rejected by Authorization plug‑in or connection rejected due to invalid URI.
connect, play	object_not_found	404	Application or stream not found.
play	client_disconnect	408	Stream stopped because client disconnected.
connect, publish	status_conflict	409	Resource limit exceeded or stream is already being published. Can also mean that a change has been made by the Authorization plug‑in.
connect	status_lic_limit_exceeded	413	License limit exceeded.
play, publish	unsupported_type	415	Unsupported media type.
disconnect	data_exceeded	416	Message queue too large; disconnect the client.
connect	chunkstream_error	417	Unable to process unknown data type.
disconnect	cannot_broadcast	418	Client does not have privilege to broadcast.
disconnect	cannot_screenshare	419	License to receive screen sharing video failed.
disconnect	remote_link_closed	420	Close downstream connection.
connect	process_msg_failed	422	Unable to process message received when client connection was in pending or closed state.
disconnect	process_msg_exception	423	Error handling message.
disconnect	process_remote_msg_failed	424	Expected response not provided when command was issued.
disconnect	process_admin_msg_failed	425	Expected response not provided when issued an admin command.
disconnect	process_rtmp_S2S_msg_failed	426	Expected response not provided when command issued.
disconnect	write_error	427	Client is not connected or client terminated; unable to write data.
disconnect	invalid_session	428	Client connection invalid; closed due to inactive or idle status.
disconnect	gc_client	429	Unable to obtain ping response or client states not connected.
disconnect	remote_onstop	430	Upstream connection closed.
disconnect	remote_on_client_disconnect	431	Upstream connection closed because the last client disconnected.
disconnect	gc_idle_client	432	Flash Media Server autoclose feature automatically closed the connection.
disconnect	swf_hash_fail	433	SWF verification failure.
disconnect	swf_hash_timeout	434	SWF verification timeout.
disconnect	encoding_mismatch_error	435	Client disconnected due to incompatibility with object encoding.
disconnect, play	server_internal_error	500	Server internal error.
connect	bad_gateway	502	Bad gateway.
connect	service_unavailable	503	Service unavailable; for instance, too many connections pending for authorization by access module.
disconnect	js_disconnect	600	Application disconnect.
disconnect	js_close_previous_client	601	Network connection was closed or reused.
disconnect	js_exception	602	An unknown exception is thrown from the JS engine.
disconnect	js_chunkstream_error	603	Bad application data.
disconnect	js_debug_forbidden	604	Application does not allow debug connections.
play	js_gc_object	605	~fcstreamjshook() clean up.