SAWMILLFORUM

stream play 2009-09-29 16:42:31 174.17.107.97 3221 3456 ake/sc_promo_f8_384k-300x169 rtmp://flash.takeoneweb.com/vod//ake/sc_promo_f8_384k-300x169.flv http://www.andykushner.com/andykushner/ 0 363133056.555000 0 rtmp 200 0 MAC 9,0,246,0 http://www.andykushner.com/flowplayer/flowplayer.commercial-3.1.1.swf?0.8287617093883455 - -

stream stop 2009-09-29 16:43:16 174.17.107.97 3256 2851032 ake/sc_promo_f8_384k-300x169 rtmp://flash.takeoneweb.com/vod//ake/sc_promo_f8_384k-300x169.flv http://www.andykushner.com/andykushner/ 3086136 363133056.555000 45 rtmp 408 0 MAC 9,0,246,0 http://www.andykushner.com/flowplayer/flowplayer.commercial-3.1.1.swf?0.8287617093883455 - -

Is there something missing?

In most Flash media server logs there's something like:

#Software: Macromedia Flash Media Server

or

#Software: Adobe Flash Media Server

as one of the first few lines. There's also going to be a list of fields. IF this is not there then Sawmill will probably run into trouble parsing the log file.

Here's a sample header file from a log file that was successfully processed by Sawmill. What version of Flash media server are you running?

#Version: 1.0
#Start-Date: 2006-11-06 13:19:09
#Software: Macromedia Flash Media Server
#Date: 2006-11-06
#Fields: x-category x-event date time x-pid c-ip cs-bytes sc-bytes x-sname sc-str
eam-bytes x-file-size x-file-length x-comment

We just installed v 8.5.9 Enterprise and created a profile for our Adoble FMS server. Logs span multiple versions since v 3.0, and all have the same fields:

oldest version
#Software: Adobe Flash Media Server 3.0.2 r217
#Fields: x-category x-event date time x-pid c-ip c-user-agent cs-bytes sc-bytes x-sname sc-stream-bytes x-file-size x-file-length x-file-name x-suri-stem x-comment

newest version
#Software: Adobe Flash Media Server 4.5.0 r297 x86
#Fields: x-category x-event date time x-pid c-ip c-user-agent cs-bytes sc-bytes x-sname sc-stream-bytes x-file-size x-file-length x-file-name x-suri-stem x-comment

Running the default reports on these logs creates tables with a lot of empty values (zeros) and some totally meaningless values (e.g. file length in years???)

Here are two example table:

and

looking at this report, I have to say that file size is meaningless, file length is meaningless and doesn't compute taking known bitrate of the video and comparing that to server-client bytes delivered. Maybe I just don't understand the meaning of those columns.

However, stream duration, session duration and the pretty valuable concurrent client data are blank. Meanhile, when analyzing Flash streaming data from our Wowza server, I do get these values in my reports. Even focusing on live streams only, which is what we do on Wowza, FMS live stream log data does not give me concurrent connection values in a report that clearly had concurrent streams. Am I missing some sort of pre processing filter? We intentionally left out pre FMS 3.0 logs to not mix the old log format with the current type.

To clarify in the last section of what you wrote, did you run the latest Adobe FMS files in a separate profile, or did you include all versions of the files v3, etc and still see the results posted in images?

I've done small samples of just one month of v4.5 log data and got the same results. When setting up the profile, I picked "W3C / Web server Adobe Flash Media Server/ Macromedia Flash Media Server" and then I left everyting else at default, selected all fields available -
Events
Visitors
Unique client IPs
Server-to-client bytes
Client-to-server bytes
Server-to-client stream bytes
Client-to-server stream bytes
File size
File length
Stream duration
Session duration
Stream duration per event
Stream duration per visitor
Stream position
Stream position (client)

then before building the database, I went to the config and turned on DNS lookup before processing. No other changes.

Same result.

During the database creation, there is a moment when the detail shows "writing tables" and each of them goes by with a single field name, until it suddenly writes a few with really long field names, including this one for "domains" which I grabbed with a screen shot as it flew by really fast:

Note that the report for domains returns 100% "unkown domain", even though in the client table, almost all of them have resolved names and you would expect to see wisc.edu and a few others to be listed in this table.

http://webstreamer.doit.wisc.edu/doit-nms/fms_log_sample.zip

I downloaded the file, I take a look and let you know form there.

I ran the files you sent, as well as enabled DNS look-up.

I checked the client IPs report without DNS lookup enabled, and then with DNS look up and saw resolution of domains within the client-IP field.

I think the confusion is that you are expecting the domain field to be populated?

If it is not to be populated, why is there even a "Domains" report?

However, that is besides the main issue, though. See above FMS report screen shots with columns of zeros. Wowza and Windows Media logs generate usuable data, but not FMS. Did you get proper values for

stream duration
session duration
stream duration per visitor
concurrent connections

when you used my logs?

I passed this one along to Greg in development for feedback.

wondering if this has been resolved, or will be any time soon.

I will check with development on this one.

-
Greg Ferrar
Sawmill Support