As the title and image suggest, this isn’t me, yet it is logged in using my account.
In what log file will I find this?
That just means they authorized a new device. This authorization does not show up in any logs. However, once the authentication finishes, it will check if your servers are online, so your server logs should show a request for the list of libraries around the time of that notification. Search for
GET /library/sections
There should be an IP at the front to show where the request came from.
Ok, I looked and starting 2 minutes before this notification, the logs appear to show that the system involved is my plex server.
May 16, 2022 18:56:28.906 [5248] DEBUG - Request: [192.168.1.5:59400 (Subnet)] GET /library/sections (13 live) GZIP Signed-in Token (Uh Oh) (HomeServ3)
May 16, 2022 18:56:28.910 [1948] DEBUG - Completed: [192.168.1.5:59400] 200 GET /library/sections (13 live) GZIP 3ms 1971 bytes (pipelined: 1)
May 16, 2022 18:56:28.914 [5248] DEBUG - Request: [192.168.1.5:59400 (Subnet)] GET /library/sections/1/all?type=1 (13 live) Page 0-0 GZIP Signed-in Token (Uh Oh) (HomeServ3)
I just checked. I don’t have any unknown hidden profiles or profile folders. I don’t have Chrome installed on my system.
So…
What device is assigned that IP? Keep in mind that “Chrome” refers to the platform not necessarily the Chrome browser. Other Web based apps could also appear as Chrome.
What device? That is my Plex server. Server 2019 running bare metal.
Would Tautuili cause this? I do have that running on here as well.
I tried logging into Tautulli from a Chrome browser and it shows up in my authorized device list as “Chrome (Tautulli)”.
So now what are we looking at? I wasn’t doing anything on my server. It runs without interaction except for when I choose to do library file management. I was watching a video using PLEX HTPC on a different system.
I don’t have anything else authorized in Plex.
Is is possible that this is a very old event? Do you have the Android app in daily use? Or only sporadically?
The last new device in your account which identifies itself as “Chrome” was signed in over 2 weeks ago.
It was on an IP address from the largest city on your state. Were you travelling around that time?
There appears to be another Plex HTPC instance in your account which appears to be located in the same region.
I have the Android App on my phone, as well as my spouse’s phone. It gets used in some manner at least every other day.
I’m going to guess that the ‘Chrome’ that you’re seeing is Samsung’s proprietary web browser which I have signed into to authorize devices via Link | Plex That isn’t used often at all.
If it was an old event, why the heck is it ‘notifying’ me of it so late? Logs indicate this was on the 16th.
I do travel from time to time but nothing using a client other than Android should show different addresses (recently at least) and those should show up as a completely different ISP (Comcast / Xfinity vs T-Mobile), and it is possible that my IP address is associated with the largest city in the state as I’m mere miles from it in one of the tiniest cities in the state. I also was assigned a new WAN DHCP address by my provider recently when I shut down my cable modem for 8 hours as I brought in new office furniture to my office space.
Indeed, Samsung Internet appears to identify as Crome. But it was not in use at that point.
Mozilla/5.0 (Linux; Android 12; SAMSUNG SM-N986U) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/17.0 Chrome/96.0.4664.104 Mobile Safari/537.36
And that would have shown up in the logs as a different device, not my server’s ip address as the one causing the notification.
Right?
Correct.
It was suggested to me that you might be able to find something about this in your server logs. Provided you had “debug” logging enabled when it happened.
I just confirmed - debug was enabled. I have the set of logs I downloaded on the 17th, which contains the events from the 16th in zip format.
At the time of 8:58PM Central Time, my server was polling libraries with the string MovieFan.Plex said to look for. Other events in that time period were another LAN address of 192.168.1.11 playing a movie on Plex HTPC.
I’m not seeing anything else going on in the Plex Media Server.log file.
My guess was based on the log snippet you provided. I would need to see the full logs myself to check what happened.
You mentioned Tautulli. Do you have it enabled for remote access and have a password set?
Thanks for the additional info. I can send the logs to you, just let me know how you’d like to get them.
Tautulli is not enabled for remote access. LAN only.
Click on my avatar and then select message. That is a PM. Send me the .log file for the time period in question.
Log file sent. I appreciate both of you looking into this with me. 
MovieFan.Plex confirmed an erroneous notification and a fix request is being sent up the ranks.
Thank you to all that helped research and work toward resolution of this issue.
