remoteexec.log - help

[Uthari 0]

Hey guys,

I'm new to this forum, so i'm not really sure where to post this. But anyway, here goes.

Today I had a player on my rMod server walking around with a weapon that is disabled on my server. I asked him where he got from it and he told me he got it from a dead player which he couldn't remember the name of. He volunteered to drop it in the ocean, so I was fine with the course of action and didn't think anything of it. Later when checking my remoteexec.log i find the following lines, from the player that had the weapon.

remoteexec log:

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:49: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this] spawn BIS_Effects_AirDestruction"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:53: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94]spawn BIS_Effects_AirDestructionStage2"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #0 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #38 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

10.01.2013 23:49:55: fisher9000 (IP removed) 85640092850e6b308e77f0fa7edc67f3 - #53 "[this, 8.47936, 7775.94,false,true]spawn BIS_Effects_Burn"

Later today I found a maphacker and banned him. When i check the remoteexec log, he had exactly the same kind of log as the guy above. And the funny thing is that those are the only 2 players I have found behaving suspicious and THOSE are the only 2 people showing in my remoteexec.log for this day. I'll post his remoteexec.log as well.

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:41: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this] spawn BIS_Effects_AirDestruction"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:43: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81]spawn BIS_Effects_AirDestructionStage2"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #0 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #38 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

11.01.2013 06:20:47: Rane (IP removed) d9559367dfe2ca881432c1e311a4af7f - #53 "[this, 8.04328, 1133.81,false,true]spawn BIS_Effects_Burn"

So, my question is if anyone knows how I can tell if someone has been hacking on my server, and what to look for in the logs?

Thanks in advance.

/Uthari

[oppa (DayZ) 46]

crashed helis/planes .. nothing unusual

[robhill@lestorouteworks.com 10]

Need to be careful if looking to ban people for just those log lines, as mentioned above they are crashed helicopters. If you see a load of them by the same person in quick succession then its worth investigating that person some more.