Server Version#: 1.18.5.2309
I have noticed that someone is accessing my plex server and is downloading 2GB of data every hour. How do I find out who is accessing the server? I see no one streaming..
On the same page, Go down to “Play History” section & select “View Full History”. You’ll be able to see which user was active at that time.
That is the issue, I see no user active during that time…
Are you sure it’s PMS that is accessed?
Step 1: shot down PMS for 2 hours, and then check on your router, if it still happens…
Might be other SW on your Windows box that is accessed
If still happens after 2 hours, then not Plex. If not happening after 2 hours, upload a zip with PMS logs
I already did that. I first shut down the server, then the other applications, then remote access, and finally each user access. I will gather the PMS logs.
Which of the PMS logs should I look at for the remote access?
PMS logs itself, and if you need help digesting it, then what ever you do…
DO NOT upload a small snip you find has the clue, but a zip with all the PMS logs please 
1 Like
Besides you, all I see is user: saul@jacobs-XXXXXXX who is streaming a media from a device named: Device is tvOS (Family Room AppleTV) and is located in this area:
Source: whois.arin.netIP Address: 172.89.XX.XX Name: RRWE Handle: NET-172-88-0-0-1 Registration Date: 5/15/15 Range: 172.88.0.0-172.91.255.255 Org: Charter Communications Inc Org Handle: CC-3517 Address: 6399 S. Fiddler's Green Circle City: Greenwood VillageState/Province: CO Postal Code: 80111 Country: United States
Besides that, I sadly didn’t spot anything
Yeah, and he only streamed last night from 9-11pm. It doesnt explain the remote access from midnight until 7am…
does the bandwidth chart above only register PMS activity or any remote access to the PMS server?
Sadly, and I assume you mean on jan 28, the lasted entry in the logs are from:
Jan 28, 2020 21:26:54.462 aka jan 28 9:26 pm
Bandtwidth on your network interface
ahh!!!
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.
