Audit log & rewind
A SHA-256 hash chain that turns your staff log into evidence, plus the rewind timeline you investigate with.
Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x
Any plugin can write a log. The problem with a log is that the people most able to edit it are exactly the people you would be investigating.
Argus appends every recorded action to a hash chain: each entry stores the SHA-256 hash of the entry before it. Change one line anywhere and every hash after it stops matching.
Verifying the chain
/argus verifyArgus walks a sample of up to 5,000 entries and reports one of two things:
- "Audit chain intact across the sampled entries." — nothing was edited.
- "Tampering detected! Chain breaks at entry #N" — entry N is where the file stops being consistent with itself.
That second message is the whole product. It does not tell you what was changed — the original is gone — but it tells you that somebody with file access reached in, and roughly when.
Verify on a schedule
Run /argus verify after every restore, and make it part of whatever weekly check you already do.
A break discovered in the middle of an investigation is a break you cannot date.
What lands in the log
Every action Argus scores, plus context it does not score:
| Kind | Examples |
|---|---|
| Item actions | creative grabs, /give, drops matched to pickups |
| Economy | /eco give, /money give and equivalents |
| Access | /invsee, container opens on other players' storage |
| Moderation | kicks, mutes, warns, bans and unbans |
| Traps | honeypot opens and breaks |
| Argus itself | freezes, unfreezes, score clears, reloads |
Exempt members are logged too. argus.exempt suppresses scoring, not recording — a gap in a
hash chain is worse than a boring entry.
In network mode every entry carries the server-id it happened on, so a timeline spanning three
backends still reads in order.
The rewind timeline
The log is the evidence; the rewind view is how you read it. Open /argus, pick a member, open
Rewind, and you get their recent actions in order with inventory diffs — what they were
carrying before and after each step.
This is what turns "they ran /give four times" into "they spawned four stacks of netherite,
dropped three of them, and logged out with one". The diff is the difference between a suspicion and
a case.
Retention
Entries are kept indefinitely by default. On a busy network the file grows steadily but slowly — it is one line per sensitive action, not per event tick.
If you need to prune, archive the old file rather than truncating the live one. Truncating breaks
the chain by definition, and /argus verify will correctly report it as tampering forever after.
Never edit the log by hand
Not to fix a typo, not to remove a test entry. There is no supported way to re-seal the chain, and a permanently "broken" verify result makes the whole mechanism useless to you.
Exporting evidence
Evidence export to PDF/HTML is on the roadmap. Today, the two supported ways to hand an investigation
to somebody else are the web panel's /api/audit endpoint, which returns
the entries as JSON, and the raw file under plugins/Argus/.