Investigation and Alerts

Investigation and Alerts

Find out what happened, who did it and get warned early.

Investigate

/up investigate [r:15] [t:2h] analyzes the area around you. It works in-game only and needs universalprotect.admin. r: is the radius (default 15, at most 150), t: the time span (default 2 hours).

The report shows:

• Suspects with a risk level (low, medium, high) and the reasons. Each suspect has buttons for their Timeline and a Preview rollback
• Causes of the block changes (player, explosion, fire, mob, nature, tool)
• Containers that were opened, and what was taken or put in
• Entities that were killed or spawned
• Connections between players
• A condensed timeline

/up investigate r:30 t:2h

The report is split into pages, use /up view <n>.

Timeline

/up timeline <player|#entity> [t:24h] [a:...] [p:<page>] shows a chronological history with grouped runs and day separators. It includes logins, blocks, containers, kills, deaths, commands and signs by default.

/up timeline Steve t:1d                 Everything Steve did in the last day
/up timeline Steve t:1d a:command       Only Steve's commands
/up timeline #enderman t:1d             What endermen did
/up timeline Steve #creeper t:1d        Steve's timeline, only entries involving creepers

Cause tracking

Each change records its likely cause: a player, an explosion, fire, a mob, nature or a plugin or tool. On Paper this includes the player who ignited TNT. Lookups show the cause, and entries that are only a good guess are marked as probably by. Search by cause with system users such as u:#tnt or u:#creeper, see Parameters and Tags.

Staff audit log

/up audit [t:7d] [u:<staff>] shows what staff did: rollbacks, restores, undos, purges, compaction, imports, migrations, reloads, consumer toggles, investigations and lookups on other players. Entries show the position and a teleport link.

Alerts

Everyone with universalprotect.admin who has alerts turned on receives them in chat. Alerts are also written to the console and can be posted to a Discord webhook. Toggle your own alerts with /up alerts.

Alert	What it detects
X-ray	Many separate veins of rare ore found in a short time with very little mining in between
Spawner breaking	Several spawners broken in a short time
TNT, lava, mass breaking, container looting	Optional rules, off by default

Every alert has a level: LOW, MEDIUM or HIGH, and a link to teleport to the position.

False alarms are avoided on purpose. A single large ore vein is not flagged, ore found with explosives is ignored for ancient debris, and changes made by commands are ignored.

All thresholds, the Discord webhook and the rules are described in Configuration under detection.*.

Discord notifications

Alerts, staff actions and startup errors can be posted to Discord. Create a webhook in Discord (channel settings, Integrations, Webhooks), put its URL into config.yml and run /up reload. All keys are listed in Configuration under discord.*.

Channel	Webhook key	What is posted
Alerts	discord.alerts-webhook	Anomaly alerts with level, rule, player, summary, world, position and a ready-to-copy /up tp command
Audit	discord.audit-webhook	Staff actions from the audit log, for example rollbacks, restores, purges and migrations, with the staff member and the full command including its filters. Also startup errors such as an unreachable database

• Use two different webhooks to keep alerts and audit messages in separate channels, or the same URL for both.
• Only alerts at or above discord.min-level are posted, so you can limit Discord to MEDIUM and HIGH. Alerts in the game chat are not affected.
• Which staff commands are posted is controlled by discord.audit-events.
• Messages are queued and sent with a short delay. If Discord limits the rate, the plugin waits and retries, and the server is never slowed down.
• Mentions are disabled in all messages. Only discord.com webhook URLs are accepted. Keep the URL secret.

---

Related pages: Commands · Rollback and Restore · Configuration