Introducing Server-side Event Logging/Blocking

[cm. 10]

The explanations are all over the place, If they could be updated to the wiki it would make everyone's life a lot easier.

And no I do not have time atm to update the wiki myself.

[gc8 970]

is it possible to detect createmarkerlocal with this or just the commands that interact with server?

[Dwarden 1124]

two new BattlEye server filters are now available, for DayZ mod is usage of 5 "" in each enough

waypointcondition.txt

waypointstatement.txt

remotexec.txt filter is also applied against some RE exploits utilizing waypoint related calls

OA beta game build 1.62.103419 or newer is needed

Edited April 4, 2013 by Dwarden

[GeordieBen 1]

Hi all,

could someone help me get my createvehicle.txt to start logging please? I run a wasteland server with a pre-built createvehicles.txt in my BE directory but it doesnt seem to create a log file for spawned vehicles heres whats in my txt file

1 ""

1 "" !"WeaponHolder" !"ParachuteC" !"CZ_VestPouch_EP1" !"US_Bag_EP1" !"Land_Barrel_empty" !"SmokeLauncherAmmo" !"SmokeShell" !"Suitcase" !"SmokeShell" !"G_40mm_HE" !"EvMoney" !"Land_Teapot_EP1" !"Soldier_Medic_PMC" !"Ins_Soldier_CO" !"Ins_Soldier_Sab" !"Ins_Soldier_Medic" !"Ins_Soldier_AT" !"GUE_Soldier_AT" !"Land_Bag_EP1" !"Soldier_Engineer_PMC" !"USMC_SoldierS_Engineer" !"CDF_Soldier_Medic" !"RU_Soldier_Sniper" !"BAF_Soldier_Officer_MTP" !"GUE_Soldier_Scout" !"USMC_SoldierS_Sniper" !"USMC_Soldier_AT" !"UN_CDF_Soldier_Officer_EP1" !"SmallSecondary" !"M_TOW_AT" !"SeaGull" !"R_PG7V_AT" !"CMflareAmmo" !"Mine" !"DSHKM_TK_INS_Bag_EP1" !"Tripod_Bag" !"Land_CamoNet_NATO" !"M1130_HQ_unfolded_Base_EP1" !"M1133_MEV_EP1"

1 "SeaGull"

1 "box"

1 "Mine"

1 "ARTY_"

1 "SADARM_"

1 "LASER_"

1 "WP_"

1 "_MLRS"

5 "A10"

1 "_81"

1 "_82"

1 "-105"

1 "_120"

1 "_122"

1 "_227"

5 "Bo_GBU12_LGB"

1 "M_Hellfire_AT"

1 "R_Hydra_HE"

5 "M_NLAW_AT"

5 "Su25_TK_EP1"

5 "ZU23_Ins"

5 "M1A1"

5 "USSpecialWeapons_EP1"

1 "_AA" !"M_Strela_AA"

1 "_AT" !"R_M136_AT" !"GUE_Soldier_AT" !"Ins_Soldier_AT" !"USMC_Soldier_AT" !"R_PG7V_AT" !"M_TOW_AT"

1 "R_M136_AT" //keep monitoring to catch obvious abuse

1 "_AP" //"_APHE"

1 "_80"

1 "_57"

1 "_85"

1 "_100"

1 "_125"

1 "_30"

1 "_ied"

1 "_CRV7"

1 "_MEEWS"

1 "_GRAD"

1 "_SABOT"

1 "_SH"

1 "KORD"

1 "DSHKM" !"DSHKM_TK_INS_Bag_EP1"

1 "MK19"

1 "AGS"

1 "Nest_" //Nest_M240 //Nest_PK

1 "R_PG"

1 "R_OG"

1 "B_"

1 "_YakB"

1 "_ball"

1 "_HE" !"G_40mm_HE" //keep monitoring to catch obvious abuse

1 "HE_" //keep monitoring to catch obvious abuse

1 "M_" !"G_40mm_HE" !"G_40mm_Smoke" //!"40mm_" //keep monitoring to catch obvious abuse

1 "cock"

5 "dog" //until released not welcome

1 "Land_" !"Land_Teapot_EP1" !"Land_Bag_EP1" !"Land_CamoNet_NATO" !"Land_Barrel_empty"

1 "BBarracks"

1 "_ep1" !"pack_EP1" !"pouch_EP1" !"UN_CDF_Soldier_Officer_EP1" !"M2StaticMG_US_Bag_EP1" !"Land_Bag_EP1" !"Land_Teapot_EP1" !"M1130_HQ_unfolded_Base_EP1" !"M1133_MEV_EP1" !"DSHKM_TK_INS_Bag_EP1"

1 "cz_" !"CZ_VestPouch_EP1"

1 "_LHD_"

1 "_PMC" !"Soldier_Medic_PMC" !"Soldier_Engineer_PMC"

1 "_acr"

1 "MASH_"

1 "Fort_"

5 "BasicWeapons"

5 "SpecialWeapons"

5 "Goat"

5 "Sheep"

5 "Cow"

1 "igger"

5 "FlagCarrierGermany_EP1"

5 "BAF_Merlin"

5 "M119"

5 "BTR90"

5 "MQ9Predator"

5 "T55_TK_EP1"

5 "GuerillaCacheBox_EP1"

5 "Mi24_P"

5 "Bo_FAB_250"

1 "M_47_AT_EP1"

Should this be logging or do i have to setup something else to help with the logging.

Regards,

Geordie

[redshirt_ensign 11]

Hi all,

could someone help me get my createvehicle.txt to start logging please? I run a wasteland server with a pre-built createvehicles.txt in my BE directory but it doesnt seem to create a log file for spawned vehicles heres whats in my txt file

I would be willing to bet that you are just using the wrong BE directory. You are probably placing these in the wasteland/battleye/ folder aren't you?

Try putting them in the original battleye folder of your Arma2OA. Also, get a beserver.cfg setup in there too so you can test for RCON access (plus then you can use BERcon or battlewarden to reload the events/scripts so you don't have to do a full server restart just to re-read the BE scripts).

Lastly, once you do get it working, try not to freak out about all the stuff that gets logged by those pre-baked scripts for Wasteland. They require a bit of fine tuning to filter out some of the false positives you will have (depending on how you have your wasteland configured re: weapons / vehicles / player skins). ;)

[GeordieBen 1]

I would be willing to bet that you are just using the wrong BE directory. You are probably placing these in the wasteland/battleye/ folder aren't you?

Try putting them in the original battleye folder of your Arma2OA. Also, get a beserver.cfg setup in there too so you can test for RCON access (plus then you can use BERcon or battlewarden to reload the events/scripts so you don't have to do a full server restart just to re-read the BE scripts).

Lastly, once you do get it working, try not to freak out about all the stuff that gets logged by those pre-baked scripts for Wasteland. They require a bit of fine tuning to filter out some of the false positives you will have (depending on how you have your wasteland configured re: weapons / vehicles / player skins). ;)

Thanks for the reply "redshirt_ensign"

Correct i am using the Wasteland/BE directory because that seems to be the only place Battleye is, i dont have a folder in my OA server files at all..... Scripts.log seems to work ok there but the vehicle.txt wont, also i have RCON access working at the moment. Is there anything else i could try?

[Dwarden 1124]

it's not createvehicles.txt it's createvehicle.txt

[redshirt_ensign 11]

it's not createvehicles.txt it's createvehicle.txt

Aha! Well spotted Dwarden, I completely missed that :)

[markusua 10]

Possible to implement a record log messages that appear on the screen, the players?

example of cheating messages:

titleText [format ["Just-A-Box spawned nearby."], "PLAIN DOWN"];titleFadeOut 4;

titleText [format["Just-A-Box will disappear in %1 seconds.",SelectDelay],"PLAIN DOWN"]; titleFadeOut 4;

titleText [format["Just-A-Box disappeared."],"PLAIN DOWN"]; titleFadeOut 4;

[GeordieBen 1]

Sorry yea thats what i have "createVehicle.txt" and it still doesnt log

[redshirt_ensign 11]

Sorry yea thats what i have "createVehicle.txt" and it still doesnt log

Are you sure the scripts.txt is working? When was the last log entry in there?

Can you give us a list of all the files in your Battleye folder?

---------- Post added at 01:48 ---------- Previous post was at 23:53 ----------

Possible to implement a record log messages that appear on the screen, the players?

example of cheating messages:

titleText [format ["Just-A-Box spawned nearby."], "PLAIN DOWN"];titleFadeOut 4;

titleText [format["Just-A-Box will disappear in %1 seconds.",SelectDelay],"PLAIN DOWN"]; titleFadeOut 4;

titleText [format["Just-A-Box disappeared."],"PLAIN DOWN"]; titleFadeOut 4;

I am not aware of any way for BE to interact with your mission code like that.

You can however have BE logs being sent to RCON and then use something like Gotcha anti-hack to identify certain events (vehicle creations especially) and auto-ban the offending player.

Simultaneously you can add code to you mission that will loop through all of the boxes on the server and generate the messages you suggest and delete the box too (assuming you can identify non-legit boxes - eg: assigning a "nothacked" var to each of the boxes you spawn in your mission and then looking for / deleting any that don't have that var).

Edited April 17, 2013 by redshirt_ensign

[markusua 10]

I translate google translator maybe you did not understand me)

logging like:

titleText.txt

1 ""

and to write in the log:

titleText.log

17.04.2013 09:19:13: player1 (ip: port) guid - # 0 "Fill Jerrycan"

17.04.2013 09:19:48: player2 (ip: port) guid - # 0 "That tent is already being packed."

All original posts dayz make to avoid and easy to track foreign posts

[Dwarden 1124]

there is no titleText filter, only these I published ...

[GeordieBen 1]

Are you sure the scripts.txt is working? When was the last log entry in there?

Can you give us a list of all the files in your Battleye folder?

Sure buddy, heres a Screenshot

[redshirt_ensign 11]

Sure buddy, heres a Screenshot

http://i47.tinypic.com/2agemg.png

Hmmm ... yeah that is weird :confused:

[GeordieBen 1]

Hmmm ... yeah that is weird :confused:

Yea i'm confused aswell buddy hahaha, oh well nvm :)

[Dwarden 1124]

are you using latest OA beta ?

[GeordieBen 1]

Hey mate, i am running Beta-103718 dunno if thats the latest one XD

[wyattwic 38]

I am guessing the ArmA2 Vanilla guys are not gaining this feature any time soon?

[bango 10]

So will this work with Arma II Free?

[nik21 1]

^ No.

[semiconductor 309]

For some reason BattlEye won't do anything with those filters. For example, I have publicvariable.txt with ' 4 "" ' and mission with script

var1 = 2;
publicVariable "var1";
hint "Published";

that is called form action menu of some BMP. When I start the mission and activate that script I get "Published" hint and nothing else happens. Same problem with createvehicle.txt and setpos.txt - BE won't kick or at least log events when clients activate script that teleports them to their group leader. What could be the problem?

PS: scripts.txt works well, BE kicks or writes events to log as it should.

[Sari 18]

Right, trying to get to the cause of a long standing problem that I keep putting off asking for help about - Our remoteexec.log keeps logging legitimate entries and I cannot seem to exclude them in remoteexec.txt, can someone take a quick look and see if its not something stupid:

Entries i don't want showing in the logs. These have been executed from a setvehicleinit command:

08.01.2015 15:50:25: *name removed* (*IP removed*) *GUID removed* - #1 "[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

08.01.2015 15:56:01: *name removed* (*IP removed*) *GUID removed* - #0 "[this,1] ExecVM 'Common\Init\Init_Unit.sqf'"

Various entries I've tried putting in remoteexec.txt to stop these entries showing, based off various examples i've trawled the web for:

1 !="[this,1] ExecVM 'Common\Init\Init_Unit.sqf'" !="[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !"[this,1] ExecVM 'Common\Init\Init_Unit.sqf'" !"[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !="[this,1] ExecVM 'Common\Init\Init_Unit.sqf';[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !"[this,1] ExecVM 'Common\Init\Init_Unit.sqf';[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !="[this,1] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !="[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !"[this,1] ExecVM 'Common\Init\Init_Unit.sqf'"

1 !"[this,2] ExecVM 'Common\Init\Init_Unit.sqf'"

None of the above seem to filter this entry out after using #loadevents from rcon or server reboot, so where am I going wrong (I do have //new at the top of the .txt file)?