Audit log: who did what

The Audit tab is a timeline of actions taken on this specific server, newest first, with a category filter (Power, Server, Settings, Players, World, Files, Mods, Database, SFTP, Schedule, Backup, or All).

Reading a row

Each row shows the action (e.g. power.restart, file.delete, backup.restore) and a detail string when the action has one (a file path, a player name, a schedule kind). It also shows an actor — but for any action on this server, that's the account ID, not the specific team member who did it: the panel doesn't currently send a per-member identity along with a server action, so that field stays empty and every row looks the same regardless of who was actually at the keyboard. (The underlying schema has a slot for a per-user identity, but nothing populates it here — and this isn't a case of some other event filling it in: every entry in this log is tied to a specific server, so nothing account-level lands here. Changes to who belongs to the account — removals, role changes, a limited member's servers, accepted invites — are kept separately under Dashboard → Members → Recent changes, which does name who made each change. Sending an invite isn't recorded anywhere; the invite itself records who sent it.)

What gets recorded

Most things that change the server or its data, but not all — see the gaps below before you treat an empty result as proof nothing happened. Covered: starting/stopping/restarting, creating or deleting the server itself, settings changes (MOTD, server.properties, version, wake-on-join, RAM resize), player moderation (op/deop, ban/unban, kick, adding or removing a player from the whitelist by name), world resets, world switches and world imports, deleting, renaming, or copying a file, extracting an uploaded archive into a folder, creating a file or folder, adding a mod/plugin from the catalog (an entry added because another project needs it says which project that was) and removing one, database create/rotate/drop, SFTP enable/rotate/disable, schedule create/delete/run-now, and backup create/restore/delete and keeping or unkeeping one (backup.keep / backup.unkeep, with the backup's time as the list shows it) — plus backup.restore_refused (a restore did not go ahead because its safety snapshot failed), backup.restore_failed (a restore that started did not finish, with the reason) and backup.restore_without_snapshot (the server had no data directory on its node, so there was nothing to save and it was restored without a snapshot) — and the same three for a world reset, a world deletion, a world import and a version change: world.reset_refused / world.delete_refused / world.import_refused / settings.version_refused (it did not go ahead because its safety snapshot failed), world.reset_failed / world.delete_failed / world.import_failed / settings.version_failed (one that was accepted did not finish, with the reason) and world.reset_without_snapshot / world.delete_without_snapshot / world.import_without_snapshot / settings.version_without_snapshot. A finished world import is world.import, with the world the server will load. Attaching or detaching a server from a network is recorded too, though it doesn't yet have its own entry in the category filter — look under All categories to see those rows.

Confirmed gaps — none of these show up here at all:

• Editing an existing file's contents, or uploading a file. Saving a change in the built-in editor goes through the WriteFile call, which writes no row. Uploading, through the Upload button or drag-and-drop, goes through a separate path (a direct upload endpoint, not the same RPC) that also records nothing — whether the upload creates a new file or overwrites an existing one. New File doesn't share this gap: creating a file goes through its own CreateFile call, which is recorded — same as New Folder's Mkdir call. Deleting, renaming, and copying a file are recorded too, as is extracting an uploaded archive into a folder.
• Uploading a mod or plugin .jar. Adding one from the catalog (Modrinth or CurseForge) is recorded, and so is removing one; an upload through Upload .jar isn't.
• IP bans. Banning or unbanning a name is recorded; banning or unbanning an IP address is not, whether the server is running or sleeping.
• Toggling Enforce whitelist on the Players tab. Adding or removing a specific player from the whitelist by name is recorded — only the on/off enforcement switch itself isn't.
• A handful of narrower actions: enabling or disabling a schedule (creating, deleting, and running one now all are recorded), setting the Discord alert webhook, switching a server's own plan yourself, and retrying a failed install.

This list is what's confirmed missing as of this writing, not a guarantee the rest is complete — treat this log as a useful record, not a courtroom-grade one.

How far back it goes

The tab's own subtitle says "last 30 days" — that's not accurate, and this article says so rather than repeat it: there is no 30-day cutoff anywhere in the retention logic, and rows are never deleted. It lists only this server's own history under your account: a server deleted earlier under the same name keeps its rows, and so does a server's previous account if it was moved to yours, but those rows don't show here. What you actually see is the most recent entries (up to 100 by default), ordered newest-first, with no cutoff other than when this server was created. In practice that means a quiet server can show entries from months back, while a busy one might fill those same 100 rows in a single day.

Troubleshooting

A change I know happened isn't in the log. Check the confirmed-gaps list above first (a file edit, a .jar upload, an IP ban, and a few others are silent); otherwise, on a busy server the entry may simply have been pushed out by more recent rows, since only the most recent entries are kept in view.

I can't tell which teammate did this — the "who" column is the same for everyone. Expected today, not a bug in your reading of it — see "Reading a row" above. The log can tell you that an action happened on the account; it can't currently tell you which member of the account did it.

Nothing shows up at all. "No activity recorded yet" means no recordable action has happened on this server since audit logging existed for it — a newly created server should have at least a server.create row; if the filter is set to something other than All categories, check All first before assuming the log is empty.