Emby tells you who is watching, but not much about who is knocking. If you run a server for family, friends or a small community, the question that matters sooner or later is simple: who signed in, from where, with which app and device, and did anyone try to guess a password? Access Log answers that from inside your own server, with no external geolocation service in the loop.
Access Log is a plugin that keeps the login history of your Emby server. It records every authentication and failed attempt and shows it in a table: user, time, IP address, device, app, and the approximate country and city from a local GeoLite2 database. That last part is the point of this tutorial: the lookup happens on your machine, so IP addresses never leave it.
What Emby shows and what it misses
Emby has its own activity views, and they are fine for day-to-day use. What they are not built for is auditing. You cannot easily filter by country, you do not get a stable per-user history with device and app version side by side, and failed attempts are hard to review as a pattern over time.
Access Log fills that gap without changing how anyone uses the server. Capture is server-side (the server's sign-in and session events), so it works with any client: Emby Web, native apps on Android, iOS, Android TV, Samsung, LG, Roku, Apple TV, and TV browsers. The app and device name shown is whatever the client reports. The plugin also reads the local embyserver.txt log for request headers, so it can tell whether a session came in directly or via Cloudflare.
Prerequisites
- Emby Server 4.10.1 or newer.
- A MediaLab Works account with a license (monthly, yearly, lifetime, or the Emby bundle) or the free 30-day trial.
- Optional but recommended: a free MaxMind account, for the GeoLite2 City and ASN databases. Without it, no database is downloaded and you get no location data.
- Access to your Emby plugins folder and permission to restart the server.
Step 1: Install the plugin
- Sign in to your MediaLab Works account, open Licenses and download the plugin DLL.
- Copy the DLL into the Emby plugins folder and restart Emby Server:
- Linux (package):
/var/lib/emby/plugins/ - Docker: the
pluginsfolder inside your Emby config volume - Windows:
%AppData%\Emby-Server\programdata\plugins\
- Linux (package):
- Open Emby Dashboard → Plugins, click the plugin, paste your license key and save. The plugin contacts the license server, binds the key to this Emby server and shows the license as Active.
The license is checked once a day and at every Emby start. Without internet the plugin keeps working for 7 days after the last successful check; after that it is stopped until it can check again. While stopped, no new sign-ins are recorded, but the existing log is kept and everything resumes once the license is valid again.
Step 2: Add the GeoLite2 database
Open Dashboard → Plugins → Access Log.
Under GeoLite2, enter your MaxMind license key (free account) so the plugin downloads and updates the City database, or upload the .mmdb file manually. The MaxMind Account ID goes in the plugin configuration; the license key is encrypted at rest in secrets.enc.json in the plugin data folder and is never sent to the browser — the page only shows "set ✓".
The download is optional and off by default. If you enable it, the plugin fetches the GeoLite2 City and ASN databases from download.maxmind.com, authenticated with your own account. No IP addresses or user data are sent. The databases are refreshed when older than 7 days (configurable). After that, geolocation happens locally in the downloaded database; private and local addresses are not looked up.
Step 3: Set retention and failed-attempt handling
Still under Dashboard → Plugins → Access Log:
- Retention: how many days to keep entries. The default is 365. Whole monthly files are deleted, so up to about one extra month may remain on disk.
- Failed attempts: recorded by default. You can optionally be notified after N failures from one IP. Alerts go only to the server's local activity log.
Think about retention before you collect months of data. A year is a sensible default for a home server; trim it if disk space or your own privacy expectations call for it.
Step 4: Read the log
The plugin page lists sign-ins newest first. Each row gives you the user, time, IP address, app, device name and version, and the approximate location from GeoLite2. Click a user to see only their history.
Use the filters — by user, period, country and device — to narrow things down. Filtering by country is the quickest way to spot logins from places you do not expect. When you need a record outside the UI, export to CSV; the export is admin-initiated.
Under the hood, everything is stored in the plugin data folder:
events/events-YYYY-MM.jsonl: every sign-in, failure, playback and address change, with time, user, IP, location (country, region, city, approximate coordinates, ASN/ISP), access path (direct or via Cloudflare, Host, User-Agent, X-Forwarded-For chain), app, version, device and session. The attempted password is never stored.events/known.json: known devices and countries per user, with no expiry.geoip/*.mmdb: the MaxMind databases.
Step 5: Look for red flags
With a few weeks of history, patterns become visible:
- Failed-login bursts from one IP. A run of failures against one or several users is the classic guessing pattern. If you enabled the notification, the activity log tells you when the threshold is crossed.
- New countries. A user who normally signs in from one country and suddenly appears in another deserves a friendly question. The known-countries file per user makes this easy to review.
- Unknown devices. A device name you have never seen attached to an account can mean a shared password or a leaked one.
- Shared passwords. The same password passed around shows up as one user signing in from several unrelated countries and devices in a short window. The per-user view and the country filter make this visible without guesswork.
- Spoofed headers. Emby accepts
X-Forwarded-Forfrom anyone; the plugin flags spoofed headers, so a faked "via Cloudflare" line does not fool you.
Tips and troubleshooting
- No locations? Check that the GeoLite2 database was downloaded or uploaded. Without a MaxMind account and without a manual
.mmdb, the plugin has nothing to look up. - Private addresses show no location. That is by design; local and private IPs are not looked up.
- Wrong app or device name. The plugin shows what the client reports. Capture itself does not depend on the client.
- Cloudflare detection looks off. "Via Cloudflare / direct" depends on the lines Emby writes to
embyserver.txt. If your reverse proxy setup changes, re-check a few recent entries. - Plugin stopped. Its pages and API answer with the reason, and only the License page keeps working. Fix the license there; nothing is deleted.
- Disk usage. Monthly files plus retention mean predictable growth. Export to CSV and lower retention if you want a smaller footprint.
Privacy in one paragraph
Location comes from the GeoLite2 database stored on your server. IP addresses are never sent to any external service. Alerts go only to the server's local activity log. The pages load no CDN scripts or external fonts. The only outbound traffic is the optional MaxMind download with your own account and the licensing client shared by all our plugins; see Licensing and privacy in our plugins.
Conclusion
Access Log turns Emby's sign-in stream into an audit trail you actually own: every authentication and failed attempt, with IP, app, device and a local GeoLite2 location, filterable by user, period, country and device, and exportable to CSV. Install it, point it at a free MaxMind database, set retention, and check the red flags once in a while. For setup details and the full reference, see the product page and the user guide; the changelog tracks what changed, and the knowledge base and FAQ cover the rest.