Logging and audit trails for shared servers

Multiple admins. Multiple moderators. Multiple players with elevated permissions. At some point, someone will say "I didn't do that" about a thing on the server, and you'll wish you had logs.

This article is what to log, how to log it, and how to make logs useful when you need them.

Why logs matter (beyond debugging)

The obvious uses:

• Diagnose crashes and bugs.
• Trace lag back to specific events.
• Roll back grief.

The less-obvious uses:

• Accountability for staff actions.
• Audit when permissions were changed.
• Investigate "who took the diamond from the public chest."
• Resolve disputes ("you banned me unfairly" / "no, here's the chat from when you said X").

A small community can get away with informal log-keeping. Anything past 10 players benefits from structure.

The categories of log

For a typical game server, you have:

Game server logs

The server's own output. Player joins, chat messages, errors, world events. Usually in logs/latest.log and rotated automatically.

What to keep: at least 30 days. More if your community has investigations open longer than that.

Block / inventory logs (CoreProtect or equivalent)

For Minecraft: who placed / broke what block, who opened what chest. The forensic record of in-world activity.

Retention: 30 to 90 days minimum. Longer for serious investigations.

Plugin / mod logs

Some plugins keep their own logs. Economy plugins log transactions. Moderation plugins log staff actions. Combine into your overall log strategy.

Staff action audit log

The most important non-default log: who on staff did what staff thing.

A staff member used /op on someone. Who did it? When? Why?

A staff member kicked a player. Who did it? Reason?

These should be logged separately, viewable by the entire staff team. Not just one person's memory.

Permission change audit

Whenever permissions change (a player promoted, a group's permissions edited): logged. With timestamp, the person who made the change, and the change.

LuckPerms has a built-in audit log. Use it.

The four log layers

Where logs should live

Don't keep logs only on the server. The server is what failed when you need them most.

A multi-location pattern:

• On the server: live logs in logs/, panel-level logs, plugin logs.
• In a Discord channel: webhook posts for important events.
• Off-host: nightly upload of important log files to cloud storage.

The Discord channel is the most useful in practice. Staff can scroll through "who did what today" without logging into the server.

A typical setup pushes these events to Discord:

• Player joined / left.
• Staff promoted / demoted a player.
• Player was kicked / banned (with reason).
• Server restarted / crashed.
• Backup completed / failed.
• Specific high-impact commands (/op, /deop, /ban).

Privacy considerations

Logs contain player data: chat, coordinates, IP addresses (in server logs), UUIDs, sometimes plugin database links to emails.

This means:

• Don't share logs publicly. Even snippets. Redact names if you must show them.
• Apply retention limits. Keep what's useful, delete what's old.
• Encrypt off-site logs. Same backup encryption as the world.
• Know your jurisdiction's privacy rules. GDPR-equivalent in your region. Even for a hobby server.

If a player asks "what data do you have about me?":

• For non-trivial requests, take it seriously.
• For most: log files contain UUIDs, IPs, chat messages, and play time.
• Be honest about retention.

For most community servers, GDPR-style obligations are low-friction in practice: don't sell data, delete on request, be transparent.

A working log structure

For a small-to-medium server:

[live]
logs/latest.log               (current)
logs/2026-05-15-1.log.gz      (rotated daily)
plugins/CoreProtect/database.db
plugins/LuckPerms/audit.log
plugins/Essentials/spam.log

[discord webhook]
#server-events  (joins, leaves, crashes)
#staff-audit    (op, ban, kick, perm changes)

[off-host nightly]
b2:my-bucket/logs/2026-05-15-server.tar.gz  (rolled-up daily logs)

This setup costs roughly nothing in storage and serves the typical investigation in minutes.

Making logs queryable

Logs you can't search aren't useful. A few options:

Grep over text files. Works for under a few hundred MB. Painful at gigabytes.

grep "playername" logs/*.log

Discord channel. Searchable in the Discord UI. Convenient if logs are short and well-structured.

A log indexing tool. Tools like Loki + Grafana, or Elastic, or even SQLite with a custom ingester. Overkill for hobbyist servers; right for serious communities.

For most servers, grep + Discord covers 95 percent of investigations.

Common investigations and how logs help

"Who broke my house at coords X Y Z?"

CoreProtect or equivalent. Click the broken block in inspector mode. Time-stamped record of who did it. Roll back.

"Why was I banned?"

Staff audit log. Show the entry. (Bonus: show the player exactly which rule was cited.)

"Did the backup run last night?"

Backup webhook log in #server-events.

"When did the lag start?"

Server log timeline. Plus performance metrics if you have them. Correlate event start with known changes.

"Did the staff member I think did the thing actually do the thing?"

Audit log. The whole point of having it.

A team norm: log everything that touches privilege

The simple rule: any action that requires more than default-player permissions gets logged. Not just kicks and bans, also:

• /give (especially of valuable items).
• /gamemode creative toggles.
• World edits (WorldEdit operations).
• /op and /deop.
• Restarts and shutdowns.

This sounds heavy. In practice, plugins log most of this automatically. You just need to direct the logs somewhere you can find them.

Anti-patterns

Trusting memory. "I remember someone did that two weeks ago." Memory is unreliable; logs aren't.

Logging everything, viewing nothing. Logs only help if someone reads them when needed. Maintain Discord channels and known queries.

Logs only on the affected server. Off-host is essential.

Public log channels. Some servers post every chat message to a public Discord channel. Privacy disaster. Staff-only channels for staff data.

Indefinite retention. Keep what's useful. Delete what's not. Privacy and disk both matter.

Setting it up: minimum viable

For someone starting now:

1. Install CoreProtect (Minecraft) or equivalent forensic plugin.
2. Set up a Discord webhook for major server events.
3. Configure LuckPerms or your permission plugin's audit logging.
4. Nightly cron pushes the last day's logs to cloud storage.
5. Pin a staff document explaining where to find which logs.

Total time: 90 minutes.

Conclusion

Logging is invisible work that becomes essential exactly when you need it. The minimum viable setup is one afternoon. The maximum-useful setup is also not much harder.

The next time someone says "I didn't do that," you'll have the answer in 30 seconds rather than the answer "I don't know." That difference is what good logging buys you.