Media server log content

General Discussions
1

Hi,
I have set up Splunk and are looking at the Plex Media Server logs to generate some interesting dashboards on usage, etc.

Looking in to this, I have a few questions that our men in black with big-toe shoes might be able to answer:-).

There is statistics being reported with the following format:

Apr 04, 2016 18:50:43:696 [3368] VERBOSE - Statistics: (My SM-G935F) Reporting 1007 bytes for account 4371812 on LAN: 0

Question 1: the “account 4371812”, is that the user account for PLEX centrally that is unique for the user, plex client or device used? Is there a relation to the x-plex-token?
Question 2: the “Reporting 1007 bytes”, is this really bytes or kbytes or megabytes, it does not represent the amount of data sent to the client, I have checked this against firewall logs and it does not compute
Question 3: the “LAN: 0” is whether the client has connected on the same LAN or not in the form of 0=false and 1=true I guess?
Question 4: is there a way to associate the x-plex-token to the actual user (seems that the token is actually plex client based)? I can find some usernames in the logs, but the token seems to be used quite a lot.

Best regards
/Micke

2

I don’t know the answers to your questions but,
if your primary interest is usage statistics of Plex, then you might wanna use this:
https://forums.plex.tv/discussion/169591/plexpy-another-plex-monitoring-program/p1#top

If you want to get it running with Splunk instead, you might gather some insights by reverse engineering PlexPy.

3

Hi Otto, thanks for the suggestion. I had a look at PlexPy a year back but had some problems getting it to work. The Splunk thing is a bit of a learning experience that I would like to pursue anyway, so I will keep looking, don´t know if I´m technical enough for the reverse engineering, but will give it a try.

Anyone else with some insight?

4

1 - The ID is the user
2 and 3, don’t know
4 - There is a setting in PMS to hide the token. Turn that off, restart PMS, and you should find in the log the tokens and the users they are assigned to.

5

@MovieFan.Plex said:
4 - There is a setting in PMS to hide the token. Turn that off, restart PMS, and you should find in the log the tokens and the users they are assigned to.

or follow this guide:
https://support.plex.tv/hc/en-us/articles/204059436-Finding-your-account-token-X-Plex-Token

6

That only gives you your token. The way I read it, the OP was looking to match tokens to different users not just their own.

7

@mwitt said:
Hi Otto, thanks for the suggestion. I had a look at PlexPy a year back but had some problems getting it to work. The Splunk thing is a bit of a learning experience that I would like to pursue anyway, so I will keep looking, don´t know if I´m technical enough for the reverse engineering, but will give it a try.

Anyone else with some insight?

Plexpy has massively improved over the past year, and I found it extremely easy to set up. It’s a great little tool so i’d give it another go if I were you.

8

@MovieFan.Plex said:
That only gives you your token. The way I read it, the OP was looking to match tokens to different users not just their own.

Right, I missed that.

9

Thanks for the feedback, I guess I have to look in to Plexpy as the log format makes it really hard to understand the relationship between Account, X-Plex-Token, X-Plex-Username and the X-Plex-Device. I would guess that Plexpy uses a combination of lookups in the local Plex server data and usage of the central Plex infrastructure.

Best regards
/Micke