Audit log: who did what

The Audit tab is a timeline of actions taken on this specific server, newest first, with a category filter (Power, Server, Settings, Players, World, Files, Mods, Database, SFTP, Schedule, Backup, or All).

Reading a row

Each row shows the action (e.g. power.restart, file.delete, backup.restore) and a detail string when the action has one (a file path, a player name, a schedule kind). It also shows an actor — but for any action on this server, that's the account ID, not the specific team member who did it: the panel doesn't currently send a per-member identity along with a server action, so that field stays empty and every row looks the same regardless of who was actually at the keyboard. (The underlying schema has a slot for a per-user identity, but nothing populates it here — and this isn't a case of some other event filling it in: no account-level action, invites included, writes a row to this log or any audit log at all, since every audit entry is tied to a specific server by construction. What an invite records is who sent it — as a field on the invite itself, not as an entry in any audit trail.)

What gets recorded

Most things that change the server or its data, but not all — see the gaps below before you treat an empty result as proof nothing happened. Covered: starting/stopping/restarting, creating or deleting the server itself, settings changes (MOTD, server.properties, version, wake-on-join, RAM resize), player moderation (op/deop, ban/unban, kick, adding or removing a player from the whitelist by name), world resets and world switches, deleting, renaming, or copying a file, creating a file or folder, removing a mod/plugin, database create/rotate/drop, SFTP enable/rotate/disable, schedule create/delete/run-now, and backup create/restore/delete. Attaching or detaching a server from a network is recorded too, though it doesn't yet have its own entry in the category filter — look under All categories to see those rows.

Confirmed gaps — none of these show up here at all:

• Editing an existing file's contents, or uploading a file. Saving a change in the built-in editor goes through the WriteFile call, which writes no row. Uploading, through the Upload button or drag-and-drop, goes through a separate path (a direct upload endpoint, not the same RPC) that also records nothing — whether the upload creates a new file or overwrites an existing one. New File doesn't share this gap: creating a file goes through its own CreateFile call, which is recorded — same as New Folder's Mkdir call. Deleting, renaming, and copying a file are recorded too.
• Installing a mod or plugin. Removing one is recorded; adding one isn't, on either the Modrinth/CurseForge or upload rail.
• IP bans. Banning or unbanning a name is recorded; banning or unbanning an IP address is not, whether the server is running or sleeping.
• Toggling Enforce whitelist on the Players tab. Adding or removing a specific player from the whitelist by name is recorded — only the on/off enforcement switch itself isn't.
• A handful of narrower actions: enabling or disabling a schedule (creating, deleting, and running one now all are recorded), setting the Discord alert webhook, switching a server's own plan yourself, and retrying a failed install.

This list is what's confirmed missing as of this writing, not a guarantee the rest is complete — treat this log as a useful record, not a courtroom-grade one.

How far back it goes

The tab's own subtitle says "last 30 days" — that's not accurate, and this article says so rather than repeat it: there is no 30-day cutoff anywhere in the retention logic, and rows are never deleted. What you actually see is the most recent entries (up to 100 by default), ordered newest-first, with no date filter behind that. In practice that means a quiet server can show entries from months back, while a busy one might fill those same 100 rows in a single day.

Troubleshooting

A change I know happened isn't in the log. Check the confirmed-gaps list above first (a file edit, a mod install, an IP ban, and a few others are silent); otherwise, on a busy server the entry may simply have been pushed out by more recent rows, since only the most recent entries are kept in view.

I can't tell which teammate did this — the "who" column is the same for everyone. Expected today, not a bug in your reading of it — see "Reading a row" above. The log can tell you that an action happened on the account; it can't currently tell you which member of the account did it.

Nothing shows up at all. "No activity recorded yet" means no recordable action has happened on this server since audit logging existed for it — a newly created server should have at least a server.create row; if the filter is set to something other than All categories, check All first before assuming the log is empty.