Plex Media Server Logs FORMAT

Plex Media Server
1

Hello -

I just installed SPLUNK (docker) and I would like to forward all the Plex logs to there.

During the setup, I am asked to select a SOURCE TYPE … what format are the log in, so Splunk knows how to intelligently format them.

My options are: (table source)

Category Source Types
Application servers log4j, log4php, weblogic_stdout, websphere_activity, websphere_core, websphere_trlog, catalina, ruby_on_rails
Databases db2_diag, mysqld, mysqld_error, mysqld_bin, mysql_slow
E-mail exim_main, exim_reject, postfix_syslog, sendmail_syslog, procmail
Operating systems linux_messages_syslog, linux_secure, linux_audit, linux_bootlog, anaconda, anaconda_syslog, osx_asl, osx_crashreporter, osx_crash_log, osx_install, osx_secure, osx_daily, osx_weekly, osx_monthly, osx_window_server, windows_snare_syslog, dmesg, ftp, ssl_error, syslog, sar, rpmpkgs
Metrics collectd_http, metrics_csv, statsd
Network novell_groupwise, tcp
Printers cups_access, cups_error, spooler
Routers and firewalls cisco_cdr, cisco:asa, cisco_syslog, clavister
VoIP asterisk_cdr, asterisk_event, asterisk_messages, asterisk_queue
Web servers access_combined, access_combined_wcookie, access_common, apache_error, iis*
Splunk software splunk_com_php_error, splunkd, splunkd_crash_log, splunkd_misc, splunkd_stderr, splunk-blocksignature, splunk_directory_monitor, splunk_directory_monitor_misc, splunk_search_history, splunkd_remote_searches, splunkd_access, splunkd_ui_access, splunk_web_access, splunk_web_service, splunkd_conf*, django_access, splunk_help, mongod
Non-log files csv*, psv*, tsv*, _json*, json_no_timestamp, fs_notification, exchange*, generic_single_line
Miscellaneous snort, splunk_disk_objects*, splunk_resource_usage*, kvstore*

I appreciate the help, as I could not find any documentation about the logging format.

2

If you put your Plex logs into any format other than the ZIP file which PMS generates, we will not be able to help you should you have difficulties.

Our tools are geared for handling that ZIP file as generated by PMS.

You will not find any information about the logfile format.
Most of that information requires internal knowledge of how PMS works.

3

Correct, splunk is for my own dashboard and internal metrics.

Oh, well that sucks. I think its silly to both not publicize it and to not follow a well documented standard, but that’s just me screaming in a barrel nobody cares about.

￣＼＿（ツ）＿／￣

4

I understand your point very well.

There is the other side of that argument as well .

PMS, internally, changes with each update.
Log content changes to reflect this.

Without the NDA knowledge of the internals, what you’re seeing is largely mysterious to you.

Additionally, it would be a logistics nightmare to update documentation on Logfiles with every update and maintain that across all the supported platforms and versions.

5

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.