Are these log entries suspicious? Advice please!

[Brian700 4]

Hey all, I have a question. I was just looking through the logs for my server this morning, and saw some entries that are new to me. Can anyone with a little more script knowledge tell me whether this was a legitimate use or an illegal spawn?

This was in the createvehicle.log:

04.09.2012 15:30:17: <Player> (PlayerIP) GUID - #0 "DZ_Backpack_EP1" 109:6 [0,0,0]

04.09.2012 15:37:13: <Player> (PlayerIP) GUID - #0 "GrenadeHandTimedWest" 109:96 109:4 [4713,2591,19] [-8,-19,10]

04.09.2012 15:37:25: <Player> (PlayerIP) GUID - #0 "G_40mm_HE" 109:101 109:4 [4712,2590,19] [-56,-56,-3]

04.09.2012 15:37:32: <Player> (PlayerIP) GUID - #0 "F_40mm_Green" 109:102 109:4 [4713,2590,19] [8,-74,28]

Now I know that the backpack is probably from spawning in, and I know that the grenade is when someone is using one, but I wasn't sure about the HE or the Flare. And it seems rather odd that this person was using all of this only 7 mins after logging in, when it is their only entries in the createvehicle log.

What is also a bit strange is that based on the server_console.log, they actually logged in at 15:10, and then logged out at 15:38. So the fact that there is 20 mins between them logging in and the logging of a backpack is rather odd.

Can anybody with a bit more experience on this script advise?

Also, on a side note, I see the DZ_Backpack_EP1 all the time, am I correct in assuming this is the regular patrol pack everyone starts with? Thanks a lot for the help!

[Gogster (DayZ) 626]

Looks legit to me, all normal usage.

[iogc_broadsword 33]

All legit instances created on player login. If there were multiple instances of say the 40mm grenade repeated one after the other then I would treat it with suspicion, from there you would need to look in the other logs to see what else he was up to.

[Brian700 4]

Correction: Apparently, in the server_console.log, it has the player in question logged at these times:

15:10:18 *** uses modified data file

15:10:18 Player *** connecting.

15:10:19 Player *** connected (id=********).

15:10:19 BattlEye Server: Player #5 *** (PlayerIP) connected

15:38:09 Player *** disconnected.

15:38:09 BattlEye Server: Player #5 *** disconnected

Yet in the arma2oaserver.rpt, it has the person logged at these times:

Line 72949: 15:30:16 "LOGIN ATTEMPT: "playerID" *** "

Line 72951: 15:30:17 "LOGIN LOADED: B 1-1-A:70 (***) REMOTE Type: Survivor1_DZ"

Line 72957: 15:30:18 "LOGIN PUBLISHING: B 1-1-B:1 (***) REMOTE Type: Survivor2_DZ"

Line 74435: 15:37:57 "DISCONNECT START (i): *** ("playerID") Object: B 1-1-B:1 (***) REMOTE"

Line 74435: 15:37:57 "DISCONNECT START (i): *** ("playerID") Object: B 1-1-B:1 (***) REMOTE"

So now, in addition to the stuff about grenades above, I am also wondering why the report file has him logging in at this time, but the console has a totally different time listed. I find it rather confusing, so if anyone could explain how that might occur I'd appreciate it. Thanks!

Edit: Sorry, now I see the posts above. Thanks for the info!

Edited September 5, 2012 by Brian700

[KField86 237]

DZ_Backpack_EP1 is a coyote backpack. The big one. This is not a ban worthy entry. No proof there to distinguish a potential hacker from a legit player. It truly seems legit here. Maybe he had an M16A2/M203 or M4A1 Holo and felt like just blowing up a zombie with an HE grenade, and then a green smoke grenade out of pure boredom, then logged off shortly after, for just that reason. Boredom. You need hard evidence of something wrong. Like the same player planting 10+ satchel charges in a 2 minute window. Something like that in the createvehicle log and you either have some kind of duping going on, or someone whose giving himself these items. Ones an exploit which can be temporarily banned for(I do it if I can catch a person, not long..24hr, enough for them to think about what they're doing, and possibly doing it on a DIFFERENT server) and the other, is enough to warrant a perma ban.

Edited September 5, 2012 by KField86