Frop

These came from the new setpos.txt. A lot of people either died or disconnected short after and all our vehicles were gone too (hugging the ocean floor I guess). Wouldn't it make sense to kick for every entry in this filter? 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:185 [10108,2813,43] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:196 [10111,2807,42] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:176 [10111,2798,41] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:170 [10062,2838,54] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:171 [10133,2829,36] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:172 [10124,2786,39] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:173 [10105,2802,43] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:174 [10098,2836,44] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:175 [10098,2816,44] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:177 [10079,2805,49] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:178 [10068,2794,51] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:179 [10118,2801,39] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:180 [10086,2836,46] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:181 [10118,2784,40] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:182 [10081,2804,49] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:183 [10068,2793,52] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:184 [10075,2803,51] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:187 [10087,2813,47] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:188 [10129,2848,36] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:189 [10099,2821,44] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:190 [10117,2823,39] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:191 [10089,2835,46] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:192 [10112,2848,40] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:193 [10107,2811,42] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:194 [10124,2828,37] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:195 [10131,2820,36] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:197 [10088,2794,48] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:198 [10087,2828,47] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:199 [10097,2824,45] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:200 [10063,2805,53] 15.09.2012 14:47:44: DleseMur (<hidden>) <hidden> - 2:201 [10119,2786,40] 15.09.2012 14:49:49: DleseMur (<hidden>) <hidden> - 45:427 [-10000,-10000,100] 15.09.2012 14:49:49: DleseMur (<hidden>) <hidden> - 50:148 [-10000,-10000,100] 15.09.2012 14:49:49: DleseMur (<hidden>) <hidden> - 48:109 [-10000,-10000,100] 15.09.2012 14:49:49: DleseMur (<hidden>) <hidden> - 54:84 [-10000,-10000,100] 15.09.2012 14:49:49: DleseMur (<hidden>) <hidden> - 55:4 [-10000,-10000,100] 15.09.2012 14:49:54: DleseMur (<hidden>) <hidden> - 45:427 [-10000,-10000,100] 15.09.2012 14:49:54: DleseMur (<hidden>) <hidden> - 50:148 [-10000,-10000,100] 15.09.2012 14:49:54: DleseMur (<hidden>) <hidden> - 48:109 [-10000,-10000,100] 15.09.2012 14:49:54: DleseMur (<hidden>) <hidden> - 54:84 [-10000,-10000,100] 15.09.2012 14:49:54: DleseMur (<hidden>) <hidden> - 55:4 [-10000,-10000,100]

I found on our own server that old barbed wires and tank traps disappear after a set period of time (~7 days?). I haven't tested how it behaves on .5 yet though (e.g. does it reappear after a server restart despite being manually removed or destroyed by a vehicle).

I've just updated my scripts and it has been spamming publicvariables.txt with (presumably innocent) stuff from all players. http://pastebin.com/aK6EnQBX Edit: I found the comment ("logs are more spammy but quite informative, until future BE improvements it needs to be visible") that came with the change. I don't see how this is informative or even needed when 99% of the log is regular behaviour.

The new log is for remote code executions, so I'm assuming it means someone is using external "aids" to supply morphine.

That's just people (accidentally) opening the Server Control menu and getting kicked for it. It's mostly nothing to worry about, but there's also a RCON password retrieval exploit, so it just kicks by default to be on the safe side.

Well, look at the bright side - at least I get kicked by BE when I crash or blow up a chopper.

If I remember correctly DayZ Commander uses its own server listing which is regularly updated. I'd guess you should see your server within 24 hours. Alternatively you could already add the server to your Favourites by manually adding the IP.

Sounds like a left-over of the BE update to be honest. Are you sure you're running the latest versions of the filters? I haven't been seeing this at all.

There's a cute little church in some backward village called Elektrozavodsk.

There should probably be more than one entry going with that one (Google says it looks like one way of spawning in objects).

Yeah, I was running with my bandit buddies the other day and we noticed after a while that a fresh spawn had been following us from Kamenka. He seemed to be trying really hard, so instead of just shooting him we just led him to someone else's camp (which keeps respawning high-end gear thanks to 1.7.2.5.) and logged off for the night.

Not really, just mainly the three BE logs (createvehicle.log, scripts.log and remoteexec.log). The .RPT just harbours some additional information which mostly isn't (directly) related to cheating anyway. Also, the .RPT seems to be pruned after every server restart so most information is regularly lost anyway.

Frank, I've only been running a server and all the BE DayZ scripts for a week or two, but I'll try to summarize my understanding of the logging. You can find a BE post at the beginning of this thread detailing the new logging, which basically boils down to A. do not log this, B. log this and C. log and kick. The team maintaining the scripts mostly seem to make sure that the legit actions aren't being logged, but for instance are logging the ghillie and the Coyote Backpack in createvehicle.log since hackers are most likely to spawn in the higher tier items. If you see these items followed by [0,0,0] it means the player joined the server with these items in their possession. However, if these items do have a location code (like [12000,3000,100] there's a chance they are spawning them in with a script. createvehicle.log will mostly show people joining the server with the aforementioned equipment. Any other entries deserve more attention and might show people trying to script in certain items. Most legit actions like entering/exiting vehicles, loot spawns and such will not show up in the BE logs. scripts.log will often show people opening the ServerInterface.sqf (sic) and that kind of stuff. Not much to worry about, because these often show up after a server restart (it's mostly the Mission and/or Lobby screen as far as I know). There's a known exploit with remote controlling a server through RCon (password stealing), but right now BE will kick players trying to access this feature. Better safe than sorry. Anything else in scripts.log is worthy of your attention, albeit the fact that most scripts make innocent players show up (for instance when a hacker is teleporting them) which makes researching them a bit harder. Post snippets of those logs here (hide the IP/GUID) for a second opinion. Almost everything in remoteexec.log concerns people being very, very naughty. Again, post any examples here for a second opinion. You will also need to browse through your server_console.log to see if someone got kicked for a script restriction. The actual kick is not logged in the BE logs. The .RPT file which is only accessible when the server is shut down will show you other detailed logging like player inventories. I try to refrain from going through these for obvious reasons, but last week I found a tent on my server with a G36 in it. I can't ban people with "illegal" items in their inventory since they might have found these by accident, but I'm sure as hell not going to allow people to knowingly store them on my server. You can find a list with current DayZ items and their codes (like BAF_AS50_scoped for the AS50) here: http://db.dayzwiki.com/items Check out the links in Vortech's signature for the latest scripts, a link to the Community Ban List (if you have a Google account you can also submit your own ban reviews) and some further info on scripting commands.

Another telltale sign is that HDMI managed to go from one side of the map to the other (and apparently back again) in a matter of minutes.

I have no idea, because I had my first major hacking event yesterday. We were flying around in the chopper, a bunch of guys joined the server and one guy got kicked for spawning in a vehicle. He rejoined and before I could ban him, we got teleported to Cherno's power plant (in mid flight) and he/they killed one of my buddies before we could log out. I just banned the lot of them, but can't really make up who was exactly hacking in the logs (other than the fact the Unskillz guy got kicked for spawning in a vehicle which was actually still there after I restarted the server). Was Unskillz the only guy hacking here? My buddies are Ted and Steve_ who were with me in the chopper at the time. I'm also curious as to why nobody got kicked with the current .txts even though they were clearly being registered. 27.08.2012 00:01:56: Frop (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Frop (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Frop (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:01:56: Ted (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Ted (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Ted (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:01:56: Robin (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Robin (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Robin (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:01:56: Unskillz (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Unskillz (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Unskillz (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:01:56: Unskillz (<hidden>) <hidden> - #41 "player setHit ['legs',0]; player setVariable ['hit_legs',0,false]; player setVariable['medForceUpdate',true,true];" 27.08.2012 00:01:56: Steve_ (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Steve_ (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:56: Steve_ (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:01:57: xonicontour (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:57: xonicontour (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:01:57: xonicontour (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:02:18: Frop (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: Frop (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: Frop (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:02:18: xonicontour (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: xonicontour (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: xonicontour (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:02:18: Steve_ (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: Steve_ (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:02:18: Steve_ (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:44: Masonna (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: Masonna (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: Masonna (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:44: Robin (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: Robin (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: Robin (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:44: xonicontour (<hidden>) <hidden> - #121 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: xonicontour (<hidden>) <hidden> - #122 " _whatIsThis = compile fap_fnExec; call _whatIsThis; " 27.08.2012 00:04:44: Robin (<hidden>) <hidden> - #2 "n sdasdadsasdsaffsdsdfrtretrwe; (findDisplay 46) displayAddEventHandler ['KeyDown','_this call gfdiogfhdoigfdhiogfdoigfhd'];" 27.08.2012 00:04:44: xonicontour (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:47: Masonna (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:47: xonicontour (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:47: Robin (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:47: Robin (<hidden>) <hidden> - #41 "player setHit ['legs',1]; player setVariable ['hit_legs',2,true]; player setVariable['medForceUpdate',true,true];" 27.08.2012 00:04:48: xonicontour (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};" 27.08.2012 00:04:48: Masonna (<hidden>) <hidden> - #121 "if (name vehicle player == TTT5NamePl) then {_xcompiled = compile TTT5derCode;call _xcompiled;};"

I find it odd that someone would have a ghillie _and_ a camo suit on at the same time. Yesterday I had very strong indications someone was teleporting on our server, but I couldn't find anything in the logs except the fact he spawned in with two different backpacks at the same time (Assault and Coyote). I think I've seen screenshots here on the forum of hackers having multiple backpacks on them (I guess the spawn scripts don't take into account regular inventory restrictions), so I had to ban him. Better safe than sorry.

Obviously BE doesn't count commented lines, so the scripting team put +# behind the commented lines for convenience (for instance everything under a "#+10" line needs to have 10 subtracted to get to the kick reason, e.g. something on line 200 would be kick reason #190).

The new .txts released last night seem to fix the spam problem of "STR_DAYZ_CODE_1".

I've seen this one too and my uneducated guess would be that people are hiding the Advanced video options after they tried flushing their memory with the Video Memory setting.

I've edited out the following (and coincidentally the first) line of scripts.txt. I doubt it's a good idea on the long run, but at least for now it gets rid of the spam. 1 addAction !"\"addAction\"," !"_action1 = _unit addAction [localize \"str_actions_medical_01" !"s_player_grabflare = player addAction [format[localize \"str_actions_medical_15\",_te" !"raddAction = 'addAction'" !"raddActioncode = compile PreprocessFile (BIS_PathMPscriptCommands + 'addAction.sqf')" !"null = _holder addAction [format[(localize \"STR_DAYZ_CODE_1\"),_name], \"z\addons\dayz_code\actions\object_pickup.sqf\"," !"NORRN_dropAction = player addAction [\"Drop body\", \"\z\addons\dayz_code\medical\drop_body.sqf\",_dragee, 0, false, true];" !"s_player_dropflare = player addAction [format[localize \"str_actions_medical_16\",_text],"

I doubt it since this entry has come up multiple times for nearly everyone on the server (even a buddy who doesn't hack for sure).

My scripts.log has been spammed with this entry somewhere after midnight. Even after restarting the server it keeps occurring and my logfile is simply exploding in size. Does anyone have an idea what's going on and how to fix this (other than commenting out the corresponding line in scripts.txt)? 23.08.2012 12:57:02: <hidden> (<hidden>) <hidden> - #0 "e >> _type >> _classname >> "displayName"); null = _holder addAction [format[(localize "STR_DAYZ_CODE_1"),_name], "\z\addons\day"

Not quite, you can reload all the filters at any time using the BERCon utility (http://community.bis...i/BattlEye#RCon) and the accompanying loadscripts/loadevents commands.

I could recommend getting one at www.i3d.nl (hosting all over the world), because my server has been running pretty well thus far. They're going to introduce ARMA/DayZ update packages for installation through their GUI, they're quick to reply to mail and are generally very helpful. They don't have a whitelist deal (yet) though, so it might take a few days before your server is whitelisted. All in all I have plenty of control considering it's managed and they certainly don't feel the need to dictate how I run my server.

That can't be right, because these entries appeared in remoteexec.log. I have personally crashed a tractor last week and yesterday one of my mates crashed his UAZ right into a tree. No entries appeared in any logs (createvehicle/scripts/remoteexec) indicating the subsequent explosions (the tractor also had a secondary explosion from a full jerry can).