Audit Jellyfin sign-ins locally: IP, device and location with GeoLite2

Why your Jellyfin server needs a sign-in audit

If you run Jellyfin for family or friends, you have probably handed out a few accounts and then stopped thinking about them. The problem is that an account can quietly be used by more people than you intended: a password shared with a neighbor, an old phone still logged in, or someone trying combinations on your login page at three in the morning.

Jellyfin does log activity, but a dedicated audit trail is easier to read and to act on. Access Log records every sign-in, every wrong password and every session with the user, IP address, app and device, and it adds country, city and internet provider from a local GeoLite2 database. The important part for self-hosters: IP addresses are never sent to an outside geolocation service. Lookups happen on your server, in the downloaded database.

This tutorial walks through installing the plugin, configuring the local location database, and reading the log so you can actually spot a shared password or an attack. It assumes you already run Jellyfin and know your way around the dashboard.

Prerequisites

• Jellyfin Server 12.2 or newer, on Linux, Windows or Docker.
• A MediaLab Works account with a license that covers the plugin (an active subscription, a lifetime license within its update window, the Jellyfin bundle, or the free 30-day trial).
• A free MaxMind account for the GeoLite2 City and ASN databases. Without it, events are still recorded, just without location.
• Admin access to your Jellyfin dashboard.

The plugin is open source (GPL-3.0), and the source code of every release is available in your account.

Step 1 — Install Access Log

The recommended route is your private plugin repository, because Jellyfin then installs and updates the plugin itself.

1. In your MediaLab Works account open Licenses → Jellyfin plugin repository and click Create address. Copy it. The address is private (it contains a token), so treat it like a password; you can regenerate or revoke it at any time.
2. In Jellyfin open Dashboard → Plugins → Repositories, click +, name it (for example MediaLab Works), paste the address and save.
3. Open Dashboard → Plugins → Catalog, find Access Log by MediaLab, click Install, then restart Jellyfin.

If you prefer the public catalog, https://medialab.works/jellyfin/manifest.json lists every released MediaLab Works plugin; you can add it the same way and activate the license or trial afterwards. A manual zip install is also documented in the guide if you need it.

Step 2 — Activate the license

1. Open Dashboard → Plugins → Access Log by MediaLab and click Open License page.
2. Paste your license key and click Activate with key. The plugin binds the key to this server and shows the license as Active.
3. No key yet? Enter your e-mail on the same page to start the 30-day free trial, or buy a license; the plugin activates itself when payment is done.

The license is checked once a day and at every Jellyfin start. Without internet the plugin keeps working for 7 days after the last successful check. Without a valid license it pauses and only the License page stays available; nothing is deleted.

Step 3 — Configure the local GeoLite2 database

This is where the location data comes from, and it is entirely optional and off by default.

1. Create a free account at MaxMind (GeoLite2), then go to Manage License Keys → Generate new license key.
2. In Jellyfin open Dashboard → Access Log → Settings. Enter the account id and the license key and save. The GeoLite2 City and ASN databases are downloaded at once and refreshed automatically (when older than 7 days, configurable).
3. On the same Settings page, choose how many days events are kept, whether playback starts and IP changes are recorded, and which alerts you want.

What leaves your server here is only the authenticated download request to download.maxmind.com. No IP addresses or user data are sent. Private and local addresses are not looked up at all.

Step 4 — Read the activity log

Open Dashboard → Access Log → Activity. Every event appears newest first: successful sign-ins, wrong passwords (the attempted password is never stored), sessions opened and closed, IP changes during a session, and optionally playback starts.

For each event you get the user, time, IP address, app and its version, device name and id, plus country, region, city and internet provider (ASN). That is the answer to "who is logging into my Jellyfin server?" — not just a username, but the whole context.

Use the filters by user, period, country and device to narrow things down, and CSV export when you want to look at the data in a spreadsheet or keep a record.

Two more views help:

• Devices: the known devices of each user, with first and last connection, number of sessions and latest addresses.
• Users and countries: a summary per user and per country, plus the addresses with wrong passwords.

Step 5 — Set alerts and retention

In Settings you can enable alerts that go to the Jellyfin activity log: a new device, a new country for a user, and repeated wrong passwords from the same address. During the first day after installation, devices and countries are learned without alerts, so you do not get a flood on day one.

Retention defaults to 365 days and is configurable. Whole monthly files are deleted, so up to roughly one extra month may remain on disk. The data lives in the plugin data folder as events/events-YYYY-MM.jsonl, events/known.json and geoip/*.mmdb. These are personal data (IP addresses, locations, devices): keep them only as long as you need and tell the users of your server that access is logged.

Tips and troubleshooting

• Every event shows the same address. That is your proxy or Cloudflare. Add the proxy to Jellyfin's Known proxies under Dashboard → Networking so Jellyfin passes on the real visitor address.
• No location in the events. Check the MaxMind account id and key in Settings.
• Red flags to look for. A burst of wrong passwords from one address, a sign-in from a country no user has ever connected from, or an unknown device appearing under a familiar user. The summary views and alerts are built exactly for these.
• Clients. Capture happens server-side, so it works with any client; the app and device name shown is what the client reports. Jellyfin Web is verified end-to-end, other apps are covered by design.
• Updates and rollback. Jellyfin can update the plugin from the repository; the License page also offers Install update and Roll back to x.y.z if something stops working after an update. Restart Jellyfin after either.

Conclusion

A login history is only useful if it is complete, readable and private. Access Log gives you every sign-in and failed attempt with IP, app, device and location, keeps the geolocation local through GeoLite2, and turns the noise into alerts you can act on. Install it, add your MaxMind key, and spend ten minutes in the Activity view — you may be surprised by what you find.

More details are on the product page, in the guide and the changelog. If something does not work, the knowledge base and FAQ are good next stops, or contact us.