How To Detect Hackers & Dupers - ViLayer

[spex 47]

Hey Everyone,

I'm new to running my server so I'm trying to get some information.

My server is a Managed server from ViLayer. I seems I have access to several different logs that I can stream live but they seem really difficult to tell what's going on. I want to make sure I'm vigilant and stay on top of possible hackers. However, watching the logs stream seems almost useless.

Are there any tools that can connect via FTP and parse the logs in real time? Possibly displaying the data in a more user friendly manner?

My main interest is being able to quickly tell if someone spawns in a weapon, has a hacked in weapon(through viewing their inventory), or is duplicating items. I did hear there was a tool that could detect a server wide kill and automaticly shut down the server. Anyone know about this?

I've seen several different types of tools on here but it appears most of them are for dedicated servers. From what I've read, they will not work on a managed server.

If someone on here, with more experience than myself, can point me in the right direction, that would be greatly appreciated.

Edited September 2, 2012 by barrycarey

[butcher501 6]

Best thing you can do is find dedicated players on your server that call it home - and make them admins - Logs are not in real time, only way to catch cheaters in real time is to be in the server when they start blowing up towns and spawning multiple vehicles (or flying helicopters around that are hidden off map).

I have 10 random people as admins on my server, it restarts usually 4-5 times a day due to cheaters blowing up vehicles etc.

If you update your script detection it usually catches people right away, for example spawning a vehicle or weapon crate.

[spex 47]

Best thing you can do is find dedicated players on your server that call it home - and make them admins - Logs are not in real time, only way to catch cheaters in real time is to be in the server when they start blowing up towns and spawning multiple vehicles (or flying helicopters around that are hidden off map).

I have 10 random people as admins on my server, it restarts usually 4-5 times a day due to cheaters blowing up vehicles etc.

If you update your script detection it usually catches people right away, for example spawning a vehicle or weapon crate.

That's what I was worried about. I have several people as admins but doing it like that isn't as effective as I was hoping.

It seems like dedicated servers have far more options. I may look into changing unless someone can suggest some tools I might have missed.

[PolarBearJ 8]

Just download the logs via ftp, and check out these:

Helpful Tools: (I did not develop any of these tools, and do not accept responsibility for anything they may do to harm your server or system, nor can I provide any insight as to how they operate)

• DayZ Server Suite (log parser, etc)
  
• Paronity's Log Parser
  
• DayZ Log Parser
  
• Battleye Extended Controls (RCON command-line tool)
  
• Ryahn's Server Tool Sigma (Heartbeat, anti-crash, log pruner, etc)
  

I personally just go thru the logs manually and just prune them once I am done, I do keep a copy of all the logs. Just in-case someone posts a ban appeal and I give them proof.

[kaindebuddy 6]

if you have a secondary monitor keep streaming the web console in it.

i find it very useful and use it as of my first line of defense.

when you streamed it for a couple of days i think you should have learned to recognize the normal patterns.

when a hacker comes into the server that normal pattern usually breaks and it is very obvious.

you can then start look around in the other logs to try and find more evidence for a ban.

[spex 47]

Just download the logs via ftp, and check out these:

Helpful Tools: (I did not develop any of these tools, and do not accept responsibility for anything they may do to harm your server or system, nor can I provide any insight as to how they operate)

• DayZ Server Suite (log parser, etc)
  
• Paronity's Log Parser
  
• DayZ Log Parser
  
• Battleye Extended Controls (RCON command-line tool)
  
• Ryahn's Server Tool Sigma (Heartbeat, anti-crash, log pruner, etc)
  

I personally just go thru the logs manually and just prune them once I am done, I do keep a copy of all the logs. Just in-case someone posts a ban appeal and I give them proof.

Thanks for the info, I had seen these in the getting started sticky. I was hoping for some tools that would allow me to be more proactive but I'll give these a go.

if you have a secondary monitor keep streaming the web console in it.

i find it very useful and use it as of my first line of defense.

when you streamed it for a couple of days i think you should have learned to recognize the normal patterns.

when a hacker comes into the server that normal pattern usually breaks and it is very obvious.

you can then start look around in the other logs to try and find more evidence for a ban.

That's what I've started doing. I've started to get an idea of what's normal.

I was hoping for some sort of tool that comes right out and says "Hey, this dude is sketchy. You might want to deal with this idiot" But it doesn't look like there's anything along these lines.

[PolarBearJ 8]

You can also use a program named DaRT, its very nice. I will give you a link. :D

http://dayzmod.com/forum/index.php?/topic/68933-dart-a-lightweight-dayz-rcon-tool-v04-29082012/

[spex 47]

You can also use a program named DaRT, its very nice. I will give you a link. :D

http://dayzmod.com/f...l-v04-29082012/

Thanks, been using Dart since I got the server up. Probably should have mentioned that.

I'm starting to get the hang of watching the streaming logs. Kinda like reading the Matrix I guess.