Rules

Rules let you automate how Tracearr responds to what’s happening on your media servers. You define the conditions to watch for, and the actions to take when those conditions are met.

Common uses:

• Limit how many streams a user can have at once
• Get notified when someone streams from an unusual country
• Detect account sharing by tracking impossible travel patterns
• Automatically terminate streams that violate your policies

Rules are evaluated in real-time as sessions start and change. When a rule’s conditions match, Tracearr automatically creates a violation and executes any additional actions you’ve configured — whether that’s logging the event, sending a notification, adjusting a user’s trust score, or terminating the stream.

Building a Rule

Every rule has four parts:

1. Name and description — How you’ll identify the rule in your list
2. Severity — How serious a violation from this rule is: Low, Warning, or High
3. Conditions — What to look for (e.g., “more than 3 concurrent streams”)
4. Actions (optional) — Additional side-effects when conditions match (e.g., “send a notification”)

To create a rule, go to Configuration → Rules and click New Rule.

Conditions

Conditions define what triggers your rule. Each condition has three parts:

• Field — What you’re checking (like “concurrent streams” or “country”)
• Operator — How to compare (like “greater than” or “equals”)
• Value — What to compare against (like “3” or “United States”)

For example: Concurrent Streams is greater than 3

Combining Conditions

You can add multiple conditions to a rule using AND/OR logic:

• Conditions in the same group use OR logic — any one of them can trigger the rule
• Different groups use AND logic — all groups must have at least one matching condition

Example: You want to detect users streaming from outside the US, but only if they’re also on a mobile device:

This triggers when the country isn’t US AND the device is mobile OR tablet.

Available Fields

Here are all the fields you can use in conditions, grouped by category.

Session Behavior

Concurrent Streams Options

The Concurrent Streams field has two modifier checkboxes:

For example, if a user has 3 active sessions — 2 from the same home IP and 1 from a mobile network:

• With Unique IPs off: Concurrent Streams = 3
• With Unique IPs on: Concurrent Streams = 2 (only counts distinct IPs)

Stream Quality

User Attributes

Device & Client

Network & Location

Scope

Operators

Operators determine how the field is compared to your value. The available operators depend on the field type.

Comparison Operators

Used with numeric fields like concurrent streams, trust score, or travel speed.

Selection Operators

Used with dropdown fields like country, device type, or platform.

Text Operators

Used with text fields like client name.

Severity

Every rule has a severity level that determines how the resulting violations are classified. Set this in the rule builder alongside the name and description.

Severity affects how prominently violations are displayed and can help you prioritize which issues to investigate first.

Actions

When a rule’s conditions are met, Tracearr automatically creates a violation with the rule’s severity level. You don’t need to configure this — it happens for every rule.

Actions are optional side-effects you can add on top of the automatic violation. You can add multiple actions to a single rule — they all execute when the rule triggers.

Send Notification

Sends an alert through your configured notification channels.

Log Only

Records the event in the system log without taking any other action. Useful for testing rules before enabling more impactful actions.

Adjust Trust Score

Increases or decreases the user’s trust score by a specific amount.

Set Trust Score

Sets the user’s trust score to a specific value, regardless of their current score.

Reset Trust Score

Resets the user’s trust score back to the default value of 100. No configuration needed.

Terminate Stream

Immediately stops the user’s active stream.

Target options:

Send Message to Client

Displays a message on the user’s media player. Useful for warnings before taking stronger action.

Multiple Actions

You can combine actions in a single rule. For example, you might want to:

1. Send a Discord notification
2. Send a message to the client
3. Adjust the user’s trust score

All actions execute when the rule triggers, in addition to the automatic violation creation.

Managing Rules

Viewing Your Rules

The Rules page shows all your rules in a list. Each rule displays:

• Name and description
• Severity — the violation severity level (Low, Warning, High)
• Status — whether the rule is active or disabled
• Summary — a quick overview of conditions and actions
• Violation count — how many times the rule has triggered

Enabling and Disabling Rules

You can toggle rules on and off without deleting them. This is useful for:

• Testing a new rule before fully enabling it
• Temporarily disabling a rule during maintenance
• Keeping rules you might want to use again later

To toggle a rule, click the switch next to it in the rules list. You can also select multiple rules and use Bulk Actions → Enable or Disable.

Editing Rules

Click on any rule to open the editor. You can change the name, description, severity, conditions, and actions. Changes take effect immediately after saving.

Deleting Rules

To delete a rule, open it and click Delete, or select multiple rules and use Bulk Actions → Delete.

Rule Scope

By default, rules apply to all your servers. To limit a rule to a specific server, use the Server condition field in your rule’s conditions.

Classic Rules

If you used Tracearr before version 1.4.13, you may have had Classic Rules — predefined rule types with fixed logic:

• Impossible Travel — Detects physically impossible movement between sessions
• Simultaneous Locations — Flags concurrent sessions from distant locations
• Device Velocity — Watches for excessive IP changes in a time window
• Concurrent Streams — Limits how many streams a user can have at once
• Geo Restriction — Blocks or allows streaming from specific countries
• Account Inactivity — Detects accounts that haven’t streamed recently

Classic rules were automatically migrated to the V2 format when you upgraded to version 1.4.13. Your existing rules continue to work with the same behavior, but you can now edit and customize them using the full V2 rule builder.

Examples

Here are some common rules to get you started.

Limit Concurrent Streams

Prevent users from streaming on more than 2 devices at once.

Severity: Warning

Detect Account Sharing

Flag users streaming from multiple distant locations at the same time.

Severity: High

Block Streaming From Specific Countries

Restrict streaming to only your allowed countries.

Severity: High

Warn New Users About Quality

Send a message to new accounts if they’re causing transcoding.

Severity: Low

Detect Suspicious New Accounts

Flag new accounts showing multiple signs of potential abuse — streaming from an unusual country AND using multiple devices or IPs quickly.

Group 1 (AND)

Group 2 (AND)

Group 3 (AND)

Severity: Warning

Actions: Send Notification (Discord), Adjust Trust Score (-10)

This triggers when: Account is new AND country is unusual AND (too many IPs OR too many devices).

Restrict Heavy Transcoding for Remote Users

Limit resource-heavy transcoding to local network or trusted users only.

Severity: High

Group 1 (AND)

Group 2 (AND)

Group 3 (AND)

Actions: Send Message to Client: “Please try a lower quality or direct play”, Terminate Stream

This triggers when: (Transcoding OR downgrading) AND remote user AND not highly trusted.

Violation Evidence

When a rule triggers, Tracearr records detailed condition evidence on the violation. This shows exactly what values were evaluated and whether each condition matched, making it easy to understand why a rule fired.

You can view the evidence on any violation’s detail page under the Condition Evidence section. Each condition group shows:

• Whether the group as a whole matched
• Each individual condition with its actual value, the operator and threshold, and whether it matched
• How many related sessions contributed to the result (for conditions like concurrent streams or session distance)

The violation detail page also shows all related sessions in a table — for example, if a concurrent streams rule triggers at 5 streams, you’ll see the triggering session plus the 4 other active sessions that caused the match. Conditions like travel speed and session distance also link to the sessions involved, along with extra details like calculated distance or location data.

This is especially useful for:

• Debugging rules — Understanding why a rule triggered (or didn’t) for a specific session
• Reviewing violations — Seeing the exact values and related sessions before taking action
• Tuning thresholds — Checking actual values to decide if your thresholds are set appropriately

Troubleshooting

Rule isn’t triggering

• Check if the rule is enabled — Look for the toggle switch in the rules list
• Verify your conditions — Make sure the field, operator, and value match what you expect. For example, “greater than 3” won’t trigger when the value is exactly 3
• Check condition grouping — Remember that groups use AND logic. All groups must have at least one matching condition
• Review the cooldown — If you set a cooldown on an action, it won’t trigger again until the cooldown expires
• Check the evidence — If the rule has triggered before, look at the violation’s condition evidence to see what actual values were evaluated

Rule is triggering too often

• Add more conditions — Narrow down when the rule applies by adding additional condition groups
• Increase cooldown — Add or increase the cooldown on actions like notifications to reduce noise
• Exclude local network — Add “Is Local Network is No” to ignore activity from your home network

Country detection seems wrong

IP-based geolocation isn’t perfect. It can be inaccurate when users are on:

• VPNs or proxy services
• Mobile networks (especially while traveling)
• Corporate networks that route traffic through another location