Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[JustinChase]

This has been happening for a long time, but I finally decided to ask about it.

I keep all my media files on my unRAID server.  The server has a feature that let's me see any "active streams" on the server.  When I play or open any file on the server, this plugin will show the file playing/opened.  I'm currently writing on my laptop, with MC open, but not actually playing anything.  However, when I look on the server, it's showing this file active on my laptop...

User   Share   Type     Stream                                                         Duration   Size
Chris Laptop   video      Movie • Beyond the Edge • Beyond The Edge   0:12:14   7.04 GB

I have seen lots of different movies or shows in this list over the last several months.  I suspect this is MC 'analyzing' my video files, but it's been going on for months, and I assumed any analysis would have been completed by now.

So, why is MC 'playing' video files in the background?

[HTPC4ME]

just a shot in the dark, but could it be that a client, or server is going through a view/video files via theaterview/eos, jremote etc, and because clients no longer store thumbs, loads them on each connection, and when scrolling through the library?

[JustinChase]

Unlikely, no one else in the house connects to my laptop library.  My phone is currently connected to the HTPC via gizmo, so it's not connected to this library either.  I'm looking at the player in another window, and it's definitely not playing anything right now.

I can see the video playing on the HTPC and also another video playing on another computer on the network, and the video 'playing' on my laptop is now at the 30 minute mark.  It seems to be playing in real time, which is pretty odd also.

[JustinChase]

I just looked again, and see a different video 'playing' on my laptop, and dozens of songs 'playing' on another laptop on the network.  Screenshot attached.

[jmone]

If you close MC does it stop?

[JustinChase]

Yes.  It takes about 20-30 seconds for MC to actually close, but as soon as I see it close in task manager, the active stream disappears.

[jmone]

In Windows Resouce Monitor --> Disk --> Disk Activity do you see the corresponding files being accessed my MC, JRHelper, System etc?

[JustinChase]

I can't tell just now.  I opened resource monitor, then restarted MC, but it has not started playing a file yet, so I can't check.  I'll be up for a bit longer tonight, but may have to report back tomorrow.

*Okay, yeah it did show some files briefly (see screenshot), but when I tried to get a better screenshot, there were no mediacenter activities any longer.  I checked, and the file is still 'playing' but there are now no more activities in resource monitor.

[jmone]

If you sort by "File" you should then see what "Image" on your PC is then accessing them Vs just the PC on that the File Server is reporting.

[RoderickGI]

MC -> Help -> System Info -> Background Tools Running.

That will show you what MC is doing. No doubt it is running some background task. That is why activity stopped when you started using MC trying to get that last screenshot. MC is using idle time to do something.

Obviously it isn't playing the files. It is just accessing them. Then if they are accessed, that may kick off your virus scanner to check them, which would show ongoing access.

Also that last screenshot was of MC library files being updated, and with that .tmp extension, maybe it was a synchronisation of some sort. Are you sure there are no clients running that could be connected to that library? Not playing stuff, just running.

[JustinChase]

Sorry, I'm not following.

when you say "what "Image" on your PC is then accessing them", I'm not sure what you mean by "them".

What file do you suggest I use to get the image it relates to?  I suspect you mean find the image accessing the file related to the active stream.  But, the active stream is referring to a file playing from the server.  The unRAID server is reporting which IP address is accessing that active stream, which is the IP address for my laptop.  Nothing is actually 'playing' on my laptop.  i only assume it's MC that's accessing/playing the file because it stops as soon as MC is stopped.

If you still want me to get the image from a certain file, please let me know with a bit more detail what I'm looking for.

[JustinChase]

MC -> Help -> System Info -> Background Tools Running.

That will show you what MC is doing. No doubt it is running some background task. That is why activity stopped when you started using MC trying to get that last screenshot. MC is using idle time to do something.

Obviously it isn't playing the files. It is just accessing them. Then if they are accessed, that may kick off your virus scanner to check them, which would show ongoing access.

Also that last screenshot was of MC library files being updated, and with that .tmp extension, maybe it was a synchronisation of some sort. Are you sure there are no clients running that could be connected to that library? Not playing stuff, just running.

see screenshot for results of Background Tools Running (hint: nothing)

I'm baffled as to what is actually 'playing' these files, as it seems from this evidence it's not MC, but why does the stream stop when I close MC?

There are no other computers or systems accessing the MC running on my laptop.  The server is only reporting that the IP address of my laptop is accessing the stream, not what program is actually accessing it.  But, the stream does stop as soon as I close MC, so they have to be linked somehow.

The server shows "Chris Laptop" because that's the name I have assigned to that IP address.

[HTPC4ME]

any activity in tree\services & plugins\media network? (all recognizable ips?)

[JustinChase]

lots of activity, seemingly none lasting very long, all from DLNA devices and IP's internal to my network.

[glynor]

It is me. I owned your network long ago, and I'm messing with you.  

More seriously... This is almost certainly background analysis, tagging, or thumbnail building. MC will list itself what background tasks are currently active in the Reporter function. You can also check what handles to files MC has open relatively easily in Process Explorer. Download and unzip Process Explorer and run it. Select Media Center's executable in the list of processes, and open the lower pane by going to View > Lower Pane. Then choose to view Handles in the lower pane under View > Lower Pane View > Handles. You can sort the open handles by clicking on the Name or Type columns.

It is also entirely possible that one of these background processes causes an Anti-Virus application to "interfere" and make MC hold the files open for far longer than is required to update the thumbnail cache (or whatever it is doing with the files in the background). If it is updating a thumbnail cache, then this operation can be triggered by simply viewing the files within a list in MC, alongside perhaps a hundred others.

If you can see Media Center retaining a handle on an file for far longer than is required to update a thumbnail (and you've checked it isn't running background analysis or whatever), then it is worth uninstalling or disabling your Anti-Virus software to see if the issues go away.

When Jim et all tells users to "check their AV software" here, it is often exactly this happening underneath the covers. MC tries to access a set of files for an operation which should take milliseconds, but then an AV application interferes and locks threads up with their (often buggy) "intercept system filesystem access calls" hooks (which ends up in a race condition that never solves itself). Basically, MC is trying to use the file, but the AV application won't let it until it can scan the file and declare it is clean, but their hooks don't always "catch" all system calls before MC is actually given a handle on the file by the OS (which doesn't care about the AV application's shenanigans). This means the AV application now cannot scan the file until MC lets it go. It keeps trying and trying but can't get a "lock" on the file, but the code injected hooks they've put in your system also won't let the filesystem give MC access to the file. MC is just trying to access the file and doesn't know why it is taking so long. The OS never errors (as far as it is concerned, it gave MC the file it asked for), and MC is just told "wait" while the AV application tries over and over in vain to get an exclusive handle for the file. It is a classic race condition. In these cases, closing MC will release the handle, which allows the AV application's service to complete the scan, and then the file is freed up milliseconds later.

If this happens with a media file, it isn't the world's biggest deal unless it is happening to a ton of them, or you happen to be trying to play the file (which, since a foreground and not background task, will often "unstick" the race condition, as MC will error if it can't fill its buffer). But when it happens to a bunch of files, or interferes with MC's ability to access its own Library files or registry keys, then hell breaks loose.

[JustinChase]

It's a very strange situation; for sure.

I posted screenshots of the MC reporting information; which shows nothing going on.

These active streams will last as long as the movies; i.e. The Untouchables showed as an active stream for at least an hour and a half, and I suspect it lasted for the full 2 hours of that movie.  Now, A Bug's Life is the active stream for half an hour.  I find it difficult to believe this is just thumbnailing or audio analysis, but I can't explain it any other way either, so I remain stumped.

If there is anything else i can/should check, or other places i can look for hints as to what's going on?

[glynor]

You can watch media network accesses live under Services & Plugins > Media Network. It is also possible that someone you don't realize has access to your Library Server, in fact, does have access to your Library Server, and is watching movies.

It could be someone at your home. But, it could be someone offsite too if you have port forwarding open on your box so that you can stream files to JRemote or Gizmo or whatever when away from home. MC's connections back to the Library Server are all done in plain old HTTP, in the clear. If someone cares enough to do so, capturing your login information for MC from your machine while on a wireless network and using it to connect back to your server is a trivial exercise. Of course, it would probably be even more trivial to just look at your Access Key in Options when you're in the bathroom or drunk or something.

If you came to my house, and used MC to access your files, and refused to give me details, I could easily get them from your network traffic, and then connect to your server and mess with you (or, just watch some movies). I probably wouldn't, because it is against the law, and I have plenty of movies of my own I never have time to watch (thanks), but I could. If you have a buddy who is more bored and less ethical, and he or she knows about MC and knows you have access to it remotely, well then...

[jmone]

Have a look at the pic attached for Resource Monitor.  The "Image" col shows the "Process" that is accessing the File.  Sort by File, and find the ones that the server is reporting and the Image col will show what Process is accessing the File.

[JustinChase]

I understand what you're saying, and that it could be an outside computer accessing my movies, but all indications are that this is not what is happening.  I've scrolled thru the list of Sources, and they all appear to be from my internal network IP's.

Also, this "Active Streams" simply shows what IP address is accessing a file located on the server.  if it was coming from outside my network, I would expect a different IP address to be shown.  in addition, i wouldn't expect the active stream to go way when I shut down MC on the IP which Active Streams shows.

The file that is being 'played' is on the server, which has an IP address of 192.168.20.150, and my laptop is .134  if the file was being accessed from outside the network, i would expect to see either 192.168.20.150 or the router IP address to be shown; not my laptop.

it's all very weird.  i've posted in the unRAID forums about it, buy have not gotten a response yet.

[JustinChase]

Have a look at the pic attached for Resource Monitor.  The "Image" col shows the "Process" that is accessing the File.  Sort by File, and find the ones that the server is reporting and the Image col will show what Process is accessing the File.

That's the thing, there is no file which relates to the active stream file.  the active stream is on the server, not my laptop.  My laptop resource monitor only shows files on my laptop, so nothing relates to the active stream file.

[RoderickGI]

In addition to exploring Process Explorer and Resource Monitor:

I see that you have 44303 files of 44321 that have had their audio analysed. So there are still a few files to analyse. Take a look at the file that is currently being accessing by your laptop, A Bug's Life or whatever it is now, and check in MC to see if it has had its audio analysed. Or set up a smartlist to see what hasn't been analysed, and see if the files being accessed are on that list.

Also, has the number changed from 44303?

[jmone]

On mine, it shows all files being access from any process on that PC regardless of if it is a local or server based file.  So if nothing is appearing in resource monitor then .....

[RoderickGI]

.... unRAID is doing something with the file. Or is misreporting.

[jmone]

On mine, it shows all files being access from any process on that PC regardless of if it is a local or server based file.  So if nothing is appearing in resource monitor then .....

Nah ignore me - I'm a fool.  Of course it only reports what is on your Drives (or pools) mapped on that PC - else it just shows up as network activity not disk activity.

[jmone]

So in Resource Monitor --> Network Tools --> sort by Image and have a look at what Media Center is accessing and the vol of the Total I/O for each.  It may give a clue.  Or sort by Address and see what process on that PC is hitting your unraid server.

[JimH]

Turn off other equipment.  See if it changes.

[JustinChase]

In addition to exploring Process Explorer and Resource Monitor:

I see that you have 44303 files of 44321 that have had their audio analysed. So there are still a few files to analyse. Take a look at the file that is currently being accessing by your laptop, A Bug's Life or whatever it is now, and check in MC to see if it has had its audio analysed. Or set up a smartlist to see what hasn't been analysed, and see if the files being accessed are on that list.

Also, has the number changed from 44321?

I suspect this is what's happening.  It now shows 44305 of 44321 files.  I recently finished A Bugs Life, and is now showing Superman as the active stream.  That means it finished 2 files since I first posted, which is consistent with the increased number.

I've had these particular files in my library for a long time, so I'm surprised they havent' been analyzed yet, but whatever.  i've left my laptop running all night LOTS of times, so Im still surprised that all my files aren't already analyzed, but since it seems to take the full movie duration for analysis, that is a long time.

I'll check in these places again in a few more days and see if this is still happening.

[jmone]

So in Resource Monitor --> Network Tools --> sort by Image and have a look at what Media Center is accessing and the vol of the Total I/O for each.  It may give a clue.  Or sort by Address and see what process on that PC is hitting your unraid server.

Nah even that does not help - Just checked on my setup and when playing a file of my Server it just shows up as "System" with the activity.

[glynor]

I understand what you're saying, and that it could be an outside computer accessing my movies, but all indications are that this is not what is happening.  I've scrolled thru the list of Sources, and they all appear to be from my internal network IP's.

To unRAID, it would always look like it is coming from an internal IP. The copy of MC running the server is the one accessing the file, not the remote user, when streaming the files. unRAID only sees the server copy(s) of MC, and clients with direct access to the network shares. It cannot see my computer's IP (if I had your address, port, and login credentials).

[JustinChase]

So in Resource Monitor --> Network Tools --> sort by Image and have a look at what Media Center is accessing and the vol of the Total I/O for each.  It may give a clue.  Or sort by Address and see what process on that PC is hitting your unraid server.

Media Center 20.exe shows being connected to my laptop, the HTPC and 239.255.255.250

That last IP looks much like a gateway IP, but maybe it's an actual IP and someone outside really does have access.

Turn off other equipment.  See if it changes.

Everything else is turned off now; it's 2am here.

[RoderickGI]

It now shows 44305 of 44321 files.  I recently finished A Bugs Life, and is now showing Superman as the active stream.  

So A Bugs Life should have new data in the audio analysis tags, and Superman shouldn't yet (if still being accessed).

Wasn't there a change to the way R128 was calculated not so long ago, which meant that media files would be reanalysed? That could be why there are still some to finish. Or it could just be that 44321 files take a long time to analyse!

[glynor]

239.255.255.250

That is a multicast address. It is not publicly routable (it did not come from the Internet).

In fact, that particular address is commonly used (by a wide variety of applications) for DLNA media discovery on the LAN. I'm not sure where you found the address reference, but if you're seeing it in MC's Media Network logs, or in a network log on the server computer, it is very likely normal behavior if you have DLNA devices or applications running on the LAN (and you do, because they're everywhere, including in browsers and all over the place). But NetBIOS and other common system services will also do multicast calls using that address, so it could be from a variety of locations.

It is an indicator of nothing, other than that maybe you have MC's DLNA server enabled.

[JustinChase]

To unRAID, it would always look like it is coming from an internal IP. The copy of MC running the server is the one accessing the file, not the remote user, when streaming the files. unRAID only sees the server copy(s) of MC, and clients with direct access to the network shares. It cannot see my computer's IP (if I had your address, port, and login credentials).

Well, if I can't see any traffic or connection from within my copy of MC statistics, that either means MC doesn't show internal/background processes, like audio analysis; or an outside computer has connected to my machine, and is circumventing MC's ability to log their process/connection.

My best guess is that MC just doesn't 'log' the background analysis, and once it's done with all my files, this will go away.

[jmone]

Good point, do you have a DLNA client connected in the house.  It could be polling your media via the MC DLNA Server.

[glynor]

The file that is being 'played' is on the server, which has an IP address of 192.168.20.150, and my laptop is .134  if the file was being accessed from outside the network, i would expect to see either 192.168.20.150 or the router IP address to be shown; not my laptop.

This is, again, incorrect. unRAID would only ever see the computer acting as the Server (which is the machine asking for the files via SMB or however unRAID serves the files to MC). The router would see the external access on MC's port, in its logs, if it provides them (but if it is a dumb consumer one, it probably doesn't), and MC would see the external address and/or the internal gateway address in the Media Network activity log.

But unRAID would never see these. It would only see MC's server, and any clients on the LAN with direct access to the files in question via a network share. If someone is outside the LAN, then unRAID wouldn't see them at all (even if they're using MC to access them) because they wouldn't have direct access to the unRAID's file share (unless you are crazy or dumb and have Windows File Sharing forwarded through your router too, and if so you have all sorts of problems and all bets are off).

[glynor]

My best guess is that MC just doesn't 'log' the background analysis, and once it's done with all my files, this will go away.

It would log it in the log file. I don't know where you're looking.

Though, I agree. As I said from the outset, this is almost certainly just background processes in MC. They might be stuck (or slowed to an absurd degree) due to anti-virus, though. Or you could have some "bad" files in there that are generating errors and making MC take forever to do analysis or whatever.

Analyzing audio on movies is slow, though, and can take a long time for some file formats when done in a low-priority background thread. I can see it being real-time or slower, depending on the file format. It does have to analyze the entire audio track to calculate loudness values and whatnot.

[JustinChase]

This is, again, incorrect. unRAID would only ever see the computer acting as the Server (which is the machine asking for the files via SMB or however unRAID serves the files to MC). The router would see the external access on MC's port, in its logs, if it provides them (but if it is a dumb consumer one, it probably doesn't), and MC would see the external address and/or the internal gateway address in the Media Network activity log.

But unRAID would never see these. It would only see MC's server, and any clients on the LAN with direct access to the files in question via a network share. If someone is outside the LAN, then unRAID wouldn't see them at all (even if they're using MC to access them) because they wouldn't have direct access to the unRAID's file share (unless you are crazy or dumb and have Windows File Sharing forwarded through your router too, and if so you have all sorts of problems and all bets are off).

yeah, I follow.  I'm just saying that if something other than my laptop was 'playing' that file, I'd expect unRAID to show that IP that was playing it, so, since unRAID was showing the IP of my laptop, then that's what unRAID saw as the point of access.  meaning, if the file access was coming from outside the network, unRAID would show that IP, otherwise, the outside access had to have direct access to my laptop, which then was playing the file; which is just unlikely and weird.

It would log it in the log file. I don't know where you're looking.

Though, I agree. As I said from the outset, this is almost certainly just background processes in MC. They might be stuck (or slowed to an absurd degree) due to anti-virus, though. Or you could have some "bad" files in there that are generating errors and making MC take forever to do analysis or whatever.

Analyzing audio on movies is slow, though, and can take a long time for some file formats when done in a low-priority background thread. I can see it being real-time or slower, depending on the file format. It does have to analyze the entire audio track to calculate loudness values and whatnot.

I didn't look in any actual "log" file, per se, just the services > Media Network reporting stuff and help > system Info.  Neither of which reported streaming the file that unRAID shows.

Anyway, I think we're all in agreement that it must be MC analyzing files in the background, which it doesn't 'report' in any of the places I looked during this thread.

If I see that MC reports all files as processed, but still shows 'fantom' streams, I'll come back here with details at that time.

Thanks for all the help everyone

[glynor]

yeah, I follow.  I'm just saying that if something other than my laptop was 'playing' that file, I'd expect unRAID to show that IP that was playing it, so, since unRAID was showing the IP of my laptop, then that's what unRAID saw as the point of access.  meaning, if the file access was coming from outside the network, unRAID would show that IP, otherwise, the outside access had to have direct access to my laptop, which then was playing the file; which is just unlikely and weird.

It is not unlikely or weird at all if Media Network is enabled on your laptop. Even if you use MC on you laptop as a client, if Media Network is enabled in options, and someone outside your LAN was connected to it via MCWS, this would be exactly the expected behavior.  The laptop is the device "playing" the file, in order to stream it to the remote client.

MC can be both a client and a server at the same time. If Media Network is enabled (so you can remote control the laptop, perhaps), it can still serve files even if it is itself connected to another Library Server.

unRAID cannot, ever, see file accesses from outside your LAN or by the router itself (unless the router is running a DLNA server).  unRAID will only ever see the LAN addresses.

But, I still think this is an esoteric and very unlikely explanation, mostly done for amusement value.

Still good to understand what your logs are showing you, though.

[JimH]

Everything else is turned off now; it's 2am here.

Unplug things, not just turn them off.  Even a smart router could be doing something unexpected.  A TV in low power state, etc.

[JustinChase]

I don't think I'd be as confused by all this if MC showed the analyze process in the reporting of background processes (which I believe is what is actually happening). I'm not sure if this is a bug, but is it unexpected that MC doesn't report all background processes, IMO.

Either way, MC shows I only have a dozen or so files left, so I assume this behavior will stop soon enough

[HiFiTubes]

My LG TV, when on the network draws requests from MC constantly. I had forgotten to disable wifi after an LG update. Doesn't look like data flowing in either direction, maybe just a DLNA handshake?

[glynor]

Thanks for the update, Justin. I'll make sure to wait a couple weeks before I start messing with you again.