Wowza Community

Duplicated C-Client-ID Values in Logs

I am working on using Wowza logs to determine the amount of video watched on our web-server over a given period of time. In order to accomplish this, I am parsing the logs for play and stop events that have the same c-client-ID. The problem i’m running into is that I am, at times, seeing multiple play events / stop events with a duplicated or re-used c-client-ID value.

I correct in reasoning that for any connection to the server, the ID for that connection should be associated with a single play event and a single stop event. Is there any reason this c-client-ID value would be duplicated as described above?

Look for the x-event “destroy” row for a client-id. Or the last row in the log with a client-id. The cs-bytes (client to server bytes) and sc-bytes (server to client bytes) are cumulative, so that is the only row you really need for stats.


Yes it is for RTMP clients which uses a NetConnection that corresponds to a client in Wowza and could start and stop many Netstreams. There might be more than one at a time, and/or one after the other. This would most likely be a custom player. Most standard players connect then play, then stop play and disconnect


Whatever works best for you is okay. It take some experimenting to see what the log files produce. It is best to do short isolated tests and analyze the actual result.


If a RTMP client was shutdown after pingTimeout (set in Application.xml /Application /PingTimeout) there might not be a stop event, but there should be a destroy event.

You can have many NetStream instances in a Flash RTMP client using the same NetConnection. Or you can have one Netstream/NetConnection where the NetStream start and stops a stream repeatedly


Initially I was going to do this; however, I noticed that the destroy event can occur several seconds later than a stop event.

Specifically since I am attempting to gather information based on the amount of time the users watched video, I am attempting to gather the play and stop events for a specific c-client-ID since these events, have, in my testing, regularly correlated with video beginning to play and the user closing the video. The time in between the play and pause events differs from (generally is less than) the duration that is reported with the “destroy” events.

Given this difference, I would re-pose my original question: Is it possible to have multiple play events or multiple stop events with the same value for c-client-ID ?

I see, the question then arises, is the duration that is reported with the destroy event the most accurate value for determining the length of time during which a user played video?

As I mentioned above, I had found that the most accurate timing for determining amount of video played/watched was the timing between play/stop events as opposed to the duration event reported upon connection destroy which I believe, (correct me if I am wrong) reports the duration for the whole client - server connection whether or not video was playing.

I’ve been analyzing the results of some such tests and have found that there is some varying behavior. In some instances I see a very clean series of events that follows as such:

connect > create > play > stop > disconnect > destroy > disconnect

However, In other instances I see a similar chain of events wherein multiple play/ stop/ create events are generated. I understand from your former response that this is possible via RTMP connections; however, I am curious as to what is the cause of this?

Additionally with regard to additional play / stop events. As I have been researching this, I have looked through a large number of wowza logs and noticed that there are in some cases play events with no corresponding (with the same c-client ID) stop event within logs ranging weeks from that event’s occurrence. This occurs also with stop events. I am wondering what could be causing this kind of isolated event?