Field name | By | When | Unit & length | Description | Sample value |
|---|
c-ip | Server | Begin | IP Address 50 chars | The source IP address of the connected socket. This may end up being the IP of a proxy server or firewall. | 157.100.200.300 (server) |
Date | Server | Begin | Date 10 chars | The server’s date when the client connected to the stream. This is either in UTC or local time depending upon the plug-in configuration. Refer to the log file’s headers to determine if this value is based on UTC or local time. | 1997-10-09 (server) |
Time | Server | Begin | Time 8 chars | The server’s time when the client connected to the stream. This is either in UTC or local time depending upon the plug-in configuration. | 15:30:30 (server) |
cs-uri-stem | Client | Begin | URL path 4096 chars | The path to what the client requested. This is the requested URL without the schema, host, port number, or query string. | /test/sample.asf |
x-duration | Client | End | Seconds 10 chars | Time (in seconds, no fractions) that the client has been rendering received data. Time buffering data is not included in this value. | 31 |
c-status | Client | Dynamic | HTTP Result 8 chars | Codes that describe the client's status. Mapped to http/rtsp status codes. Silverlight should always return 200. | 200 |
c-playerid | Client | Begin | GUID 38 chars | GUID for the client’s player. Silverlight always returns an anonymous GUID of the form {3300AD50-2C39-46c0-AE0A-xxxxxxxxxxxx}, where x is the server’s session id (refer to the s-sessionid field). | {3300AD50-2C39-46c0-AE0A-70B64F321A80} |
c-playerversion | Client | Begin | String 64 chars | The player version number. Silverlight will always return the version of NetSource being used. | 11.08.005.0000 or similar. |
cs(User-Agent) | Client | Begin | String 256 chars | If the player was embedded in a browser, this field refers to the browser type that was used, appended by the version of NetSource used, and the version of Silverlight installed on the system. | Mozilla/4.0_(compatible;_MSIE_4.01;_Windows_98)_NSPlayer/6.4.1.2_Silverlight/1.0.20926.0 |
cs(Referer) | Client | Begin | URL 4096 chars | URL to the Web page that the player was embedded within (if the player was embedded). | http://www.contoso.com/default.htm |
c-os | Client | Begin | String 64 chars | Client computer's operating system (for example, Windows 95, Windows NT/2000/XP, Apple Macintosh). | One of: Windows_2000, Windows_XP, Windows_Vista, MacOS. |
filelength | Server | Begin | Seconds 10 chars | Length of the ASF file (in seconds) for on-demand and broadcast streams sourced from a file. For a live broadcast stream, this value is undefined and represented as zero (0). | 60 |
filesize | Server | Begin | Bytes 10 chars | Size of the ASF file (in bytes) for on-demand and broadcast streams sourced from a file. For a live broadcast stream, this value is undefined and represented as zero (0). | 86000 |
Avgbandwidth | Server | End | Bits per second 10 chars | Average bandwidth (in bits/sec) at which the client was connected to the server. This is the average across the entire duration of the connection. | 102585 |
protocol | Server | Begin | String 16 chars | The protocol used to access the stream. Silverlight should always return http or https for this field, because it’s the only currently supported protocol. | http |
transport | Server | Begin | String 16 chars | The transport used to deliver the stream, either UDP, TCP, or multicast. Silverlight should always return TCP. | TCP |
sc-bytes | Server | End | Bytes | Total number of data bytes the server sent to the client. This does not include any TCP/IP or other overhead that is added by the network stack. | 1188557 |
c-bytes | Client | End | Bytes 10 chars | Number of bytes received by the client from the server. This does not include any TCP/IP or other overhead that is added by the network stack. | 28000 |
s-pkts-sent | Server | End | ASF Packets 10 chars | Number of packets sent by the server. This value represents the number of ASF data packets (not TCP or UDP packets). | 55 |
c-quality | Client | End | Percent (%) 3 chars | The measure of how well the stream was received by the client (on a scale from 0 to 100%). This is reported by NetSource. | 89 |
s-ip | Server | Begin | IP Address 35 chars | Upstream server IP address. This is the server that received the log. | 155.12.1.234 |
s-dns | Server | Begin | DSN addr. 255 chars | Upstream server DNS. This is the server that received the log. | wmt.contoso.com |
s-totalclients | Server | End | Connected clients 10 chars | Number of clients connected to the upstream server at the time of the logging event. | 201 |
s-cpu-util | Server | End | Percentage 3 chars | CPU load on the upstream server (0-100%) at the time of the logging event. | 40 |
cs-user-name | Server | Begin | String 256 chars | This is the user name that the client provides the server during authentication. | Empty |
s-session-id | Server | Begin | Session 10 chars | This is an internal session ID that the server uses to track a given client session. This is important to track multiple log entries to the same session. Using the client GUID to track a session across multiple log entries is not manageable because it is possible to have multiple instances of a client running on a machine at one time (the GUID for each log entry may be identical). | 123456 |
s-content-path | Server | Begin | URL 4096 chars | This is the actual content object that was streamed to the client. A plug-in may resolve a requested path to a path differently than what a client requested. | http://www.contoso.com/speech.wma |
cs-url | Client | Begin | URL 4096 chars | The actual URL requested by the client. | mms://contoso.com/some/content.asf |
cs-media-name | Client | End | String 256 chars | The name of the stream the client was playing, without the full path. | myVideoFile.wmv |
s-proxied | Server | End | Boolean 1 char | Indicates whether the connection was made through a cache/proxy server or not. This value is 0 if there was no cache/proxy server involved. The value is 1 if a cache/proxy server was involved. Even if a cache/proxy server downloads content into cache, this value will be 1 because a cache/proxy server was involved with the connection. This value is triggered by the existence of a "Via" protocol header. This enables HTTP based (non-streaming) proxy servers to be identified. Note that any remote client log will have a 1 value for this field. However a client that has locally cached content may propagate the remote log directly to the origin server without passing through a cache/proxy server. In this case, the value will be 0. | 0 |