Understanding the logs

[Omaran 18]

I'm a new server admin who needs some help with the logs, I've searched the forums and there are some good posts for server administration but not much about the logs themselves.

Is there a website or a forum post on here I have missed which explains what I am looking for?

For example I have a few entries in remoteexec.log - are these all hackers?

The same for setpos.log, there is an entry in there - teleporting?

I would like to fully understand what I am looking for as I don't want to ban innocent players.

TIA

[kranky@dir.bg 27]

Go here :

http://code.google.com/p/dayz-community-banlist/issues/list

There are over thousand and a five hundred reports. Study them and you will find the pattern in a matter of 20 to 30 min. It is quite obvious. You can get players from this list to add to your bans.txt file and you also can report your "patients" to this list. Enjoy.

[maddyn99 (DayZ) 25]

I feel your pain Omaran, what little info out there about logs is hard to find. Its taken me about 3 weeks to really get a handle on what the logs are telling me.

1. Go to the link that Diakoona provided and install all the bans on the community ban file as well as dwbans.txt. The community ban file hasnt been updated this month at all so I am not sure how up to date it is.

2. Install the newest filters for all the log files as well. Make sure you use the raw format to copy and paste otherwise you will get errors.

3. Look at your logs every time you get a chance. When my server is crowded I keep em open. Anything that shows up in the setpos.log file is a teleport, however that being said sometimes its a hacker teleporting another player to kill them so I dont ban anyone with less than 3 or 4 teleport entries. However its your server so do as you like here.

4. 99% of anything in the remoteexec.log file is a hack. Ban em Somethings are more obvious than others and you will get familiar with what is what after looking at them a million times.

5. Scripts.log is the trickest one. Lots of stuff that shows up here isnt hacking but some of it is. Its like a needle in a haystack. Some people will say its hacking while others say no its not. All i can say is that if it looks fishy I ban em. Stuff like...

veh = 'SUV_TK_CIV_EP1';

if (isServer) then

{

(veh createVehicle (position hreh1))setVariable ['ObjectID', 124, true];

dayz_ser"

27.09.2012 12:30:14: Tregge.^.e (208.46.102.130:6079) aaff1d5ed58f62332e03caa0a6675e0e - #20 "

is obviously hacking as they are summoning a vechicle, other stuff that shows up like the server interface isnt.

[Omaran 18]

Awesome, thanks for your help :)

I have all the latest files running on my server - the bans though, do I just copy all the bans and dwbans.txt to bans.txt?

The main 2 files I have been looking at is the setpos.log and the remoteexec.log, this is a fairly new server so not many entries, but in remoteexec.log I have this:

24.09.2012 13:29:26: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #38 "[this] spawn BIS_Effects_AirDestruction"

24.09.2012 13:29:26: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #40 "[this] spawn BIS_Effects_AirDestruction"

24.09.2012 13:29:27: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #38 "[this, 9.6362, 23273]spawn BIS_Effects_AirDestructionStage2"

24.09.2012 13:29:27: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #40 "[this, 9.6362, 23273]spawn BIS_Effects_AirDestructionStage2"

24.09.2012 13:29:27: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #38 "[this, 9.6362, 23273,false,true]spawn BIS_Effects_Burn"

24.09.2012 13:29:27: PLAYER1 (PLAYER1_IP) PLAYER1_GUID - #40 "[this, 9.6362, 23273,false,true]spawn BIS_Effects_Burn"

25.09.2012 13:16:20: PLAYER2 (PLAYER2_IP) PLAYER2_GUID - #0 "beeeh = this"

25.09.2012 13:16:20: PLAYER2 (PLAYER2_IP) PLAYER2_GUID - #38 "beeeh = this"

25.09.2012 13:16:20: PLAYER2 (PLAYER2_IP) PLAYER2_GUID - #69 "beeeh = this"

25.09.2012 15:40:59: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #38 "[this] spawn BIS_Effects_AirDestruction"

25.09.2012 15:40:59: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #40 "[this] spawn BIS_Effects_AirDestruction"

25.09.2012 15:41:02: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #38 "[this, 8.65203, 6868.74]spawn BIS_Effects_AirDestructionStage2"

25.09.2012 15:41:02: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #40 "[this, 8.65203, 6868.74]spawn BIS_Effects_AirDestructionStage2"

25.09.2012 15:41:04: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #38 "[this, 8.65203, 6868.74,false,true]spawn BIS_Effects_Burn"

25.09.2012 15:41:04: PLAYER3 (PLAYER3_IP) PLAYER3_GUID - #40 "[this, 8.65203, 6868.74,false,true]spawn BIS_Effects_Burn"

Pretty sure PLAYER1 and PLAYER3 is hacking, but PLAYER2 - what is "beeeh = this" ?

[maddyn99 (DayZ) 25]

Its a script. Definite hackage. Ban em all. I have no pity anymore for anyone i even THINK is hacking. I spend way too much time looking at logs instead of playing.

[qauntum 7]

1. Go to the link that Diakoona provided and install all the bans on the community ban file as well as dwbans.txt. The community ban file hasnt been updated this month at all so I am not sure how up to date it is.

The community bans list last updated 3 days ago, it was updated the day before that, and 2 days before that.

[maddyn99 (DayZ) 25]

The community bans list last updated 3 days ago, it was updated the day before that, and 2 days before that.

Hey I am just going by whats on their own page...

DayZ Community Banlist

this page was last updated on 2012-09-03 banlist is currently not being updated due to serious illness of a team member :(

The last file i see updated is dwbans.txt ban list which is not the same.

[qauntum 7]

This is a better place to check for file changes. http://code.google.com/p/dayz-community-banlist/source/list

[Omaran 18]

OK, so on my server, in the Battleye dir I have:

DayzGlobalBans.txt

bans.txt

If I download the latest bans.txt it will overwrite my current one and the bans I have added my self won't be there?

And what about dwbans.txt? Do I just download that as well - or does it need to be some how merged into one file?

Sorry for all the questions, I'll get there eventually!!

[Siggy (DayZ) 95]

I am also curious to know some of this stuff. Also when i go to ban someone i just add the number to ban.txt right? it's also about 8 numbers long am i right?

Edited September 29, 2012 by Siggy