Activity log

Every event type the panel records, what writes each one, how to filter down to the row you want, and which row actions you are offered.

The Activity log is the audit trail for one server. Every ban, kick, unban, config save, admin change, world wipe and automated fix lands here with a timestamp and the name of whoever caused it. It is the page to open when you need to know who did something and when.

Reading the table

Column	What it holds
Time	The time on one line and the short date under it.
Type	The event type as a coloured pill, in capitals.
Player	A link into Lookup for that player, by name when the row has one and by its first identifier otherwise. A dash when the row is about no particular player.
Details	Whatever the row carries: usually a reason and a ban id, a capture link, or a one-line summary of what an automated fix changed.
Member	The dashboard account that acted, the in-game admin or console the game server reported, or a dash when nobody is named.
Actions	View details, on every row without exception.

Twenty rows a page, newest first, with a page picker and Previous and Next under the table.

Clicking View details opens the full record. From there a ban row offers Unban and, when the ban carries detection context, the Raven Mind route. A kick row offers Raven Mind only, since a kick cannot be unbanned. An unban row offers Restore ban.

Filtering

Control	What it narrows	Applied
Search box	Matches the type pill, the acting member, and every value the row recorded in its details, arrays included. So a reason, a ban id, an identifier or a permission name all find their row.	On the page you are looking at
Activity	One event type at a time, grouped into Players, Admin team, Server admin and Raven Mind.	On the whole history
Player	Every player name that appears anywhere in this server log, not only on the current page.	On the whole history
From	and To, a date window. To includes the whole of the day you pick.	On the whole history

Because the search box narrows the twenty rows in front of you rather than searching the whole history, combine it with a type or date filter when you are hunting through a long log. Changing any of the other three sends you back to page one.

The event types

Each type has a fixed pill label, which is what the Type column prints and what the search box matches.

Players

Pill	Written by
`BAN_PLAYER`	An admin banned from the Players List, the map, or the Bans List. The Member column names them.
`KICK_PLAYER`	An admin kicked from the Players List or the map.
`BAN_API`	The resource banned on its own, which means a detection fired.
`KICK_API`	The resource kicked on its own.
`UNBAN_PLAYER`	A ban was lifted, from the Bans List, from this log, or by the resource calling the unban endpoint.
`BANS_WIPED`	Wipe All on the Bans List. One row for the whole action, carrying the count and a sample of the cleared ban ids.

BAN_API and KICK_API are the two the overview charts count as Detections. Every other type on this page counts as an action.

Admin team

Pill	Written by
`ADD_ADMIN`	The Admins page. The row carries the resulting permission set.
`UPDATE_ADMIN`	A permission change on the Admins page, also carrying the resulting set, so a change is reconstructable later.
`REMOVE_ADMIN`	An admin was removed. The row carries the name only.
`ADD_MODERATOR`	An identifier was tagged on the In-Game Moderators page, or through Moderator Access on a player card.
`REMOVE_MODERATOR`	An in-game moderator tag was removed.

Server admin

Pill	Written by
`CONFIG_UPDATE`	A Main Settings save that actually changed something outside the detections.
`PROTECTION_RULES`	A save that changed the detections. One save can write both rows, and a save that changed nothing writes neither.
`SCREENSHOT`	A capture was taken and stored. Details carries a link that opens it in place, or a note that it was removed to save storage.
`RECORD`	A recording was captured and stored, linked the same way.
`ENTITIES_CLEARED`	A world wipe, from the World page or from the in-game command the cloud approved. The row says which entity types were asked for and carries a state chip while the clear is still running, or when it came back broken or never came back at all.
`IP_RESET_REQUEST`	The owner asked for the license to be unbound from its address.
`PROXY_UPDATE`	A historical type from when servers were reached over an inbound address. Nothing writes it any more, and the filter still offers it so an old row stays findable.

See IP reset requests for what the owner is asking for in that last row but one, and Resources and World for what a world wipe deletes.

Raven Mind

Pill	What happened
`RULE_PROPOSED`	A fix was worked out for a suspected false positive and left for you to accept.
`RULE_APPLIED`	The fix was written into this server’s configuration. Details names the option and the type it touched.
`RULE_REVERTED`	An applied fix was taken back out and the configuration pushed to the server again.
`RULE_ESCALATED`	The same false positive kept recurring after the automatic chain ran out, so the case was handed to a person.
`RULE_PROMOTED`	Somebody asked for this fix to be proposed to the other servers it would help. The row carries how many that is.
`AUTO_UNBAN`	A live ban was reversed on the spot as a likely false positive.
`MIND_RESOLVED`	An open case was closed, however it ended.
`MIND_REBAN`	A reversed ban was judged correct after all and reinstated.
`WAVE_RESOLVED`	A burst of same-reason bans and kicks was cleared together and the fix applied once.
`RESOURCE_CONSOLIDATED`	Several per-event whitelists were reverted and one resource-wide whitelist promoted in their place.

Every one of these attributes to Raven Mind in the Member column rather than to the admin who happened to click, because the row records the decision maker. The underlying user is still stored for tracing. Review a potential false ban covers what these rules do to your config.

Access

Reading the activity log needs the dashboard permission, which is the same permission that opens the server at all. In practice anyone who can open the server can read the log.

The buttons inside the details modal are gated more loosely than the endpoints behind them: Unban and Restore ban appear for anyone holding any Bans List tick, and Raven Mind for anyone holding any Settings tick, with a Bans List tick wanted as well when the row is a ban rather than a kick. The endpoints themselves check the exact permission, so a viewer with ban view and nothing else is offered Unban and then refused it. Hidden identifiers are a different matter: the IP and any other hidden identifier are stripped from every row before it reaches the browser.