Log spam after blocking/removing user

[Symen_4ab 9]

Hi there,

I was having an issue where a windows client was sending multiple play/stop events to the server per second. I sent the user a message to try and fix this, but no response.

So, first I tried to block his ip in the Remote IP address field, the logs were now filled with

Quote

2026-07-03 14:04:12.192 Error UserService-0HNMOQEPPSA10:00003081: Forbidden
2026-07-03 14:04:12.192 Info UserService-0HNMOQEPPSA10:00003081: http/1.1 Response 403 to host2. Time: 0ms. GET http://host1:8096/emby/Users/8bd49f0a32b74f48bc0b2e49db866931?X-Emby-Client=Emby Windows&X-Emby-Device-Name=DESKTOP-J34UL42&X-Emby-Device-Id=cc614a24-04dd-f065-34c5-84f2f9ab5e2e&X-Emby-Client-Version=2.310.2.0&X-Emby-Token=x_secret2_x&X-Emby-Language=fr. 

I then tried to remove the block and completely delete the user from the server, the spam changed to 

Quote

2026-07-03 14:06:28.913 Warn UserService-0HNMOQEPPSAKR:00000D6D: AUTH-ERROR: 178.197.223.63 - Access token is invalid or expired. 
2026-07-03 14:06:28.913 Error UserService-0HNMOQEPPSAKR:00000D6D: Access token is invalid or expired. 
2026-07-03 14:06:28.913 Info UserService-0HNMOQEPPSAKR:00000D6D: http/1.1 Response 401 to host2. Time: 0ms. GET http://host1:8096/emby/Users/8bd49f0a32b74f48bc0b2e49db866931?X-Emby-Client=Emby Windows&X-Emby-Device-Name=DESKTOP-J34UL42&X-Emby-Device-Id=cc614a24-04dd-f065-34c5-84f2f9ab5e2e&X-Emby-Client-Version=2.310.2.0&X-Emby-Token=x_secret2_x&X-Emby-Language=fr. 

I'm getting about 50 of these message per second... I'm currently rotating the log every 15 minutes, they are about 25MB in size each, which is not ideal 

I will block his ip upstream when I'm able to (waiting for some hardware), but will it then spam the firewall forever?

Is there a way to stop the server from logging this ? It's been doing this for a bit more than one day now nonstop.

Thanks,

[ebr 16464]

Hi.  I would not call this "spam".  You have an actual event occurring and the server is reporting it.  What if it were someone you didn't know and the server just stopped reporting it after a while?  You might never see what was happening.

[Symen_4ab 9]

Yeah, spam is not the correct word, I see your point, "flood" is more appropriate.
Still, it would be preferable to have something like "last message repeated x times" like syslog if they always are the exact same event for the same client.

I guess, then, the issue is "Why does the client, when receiving a 401 or 403, retries as fast as possible forever?"

Edited 1 hour ago by Symen_4ab

[ebr 16464]

Not sure what process it could be in that would cause that.

@softworkz

[softworkz 5264]

It sounds to me like a bug under some very specific and rare conditions.

If the user with the client cannot be contacted, then I think that blocking it at the firewall level is the best option for the moment.

[Symen_4ab 9]

For now I logrotate every 15 minutes and remove old logs via a cronjob so it's under control and I'll block on the firewall when able to do so.

I'll probably hear from him sometime in the near future, I'll then try to get a better idea on how he managed to do this.
Knowing him, he opened 20 clients at the same time when it didn't start playing immediately and then clicked everywhere as fast as possible, he's very good at creating/finding bugs 
Fingers crossed that a reboot will fix this.

Thanks,