tapscrollWIKI

FAQ

Common questions about Argus — false positives, performance, privacy, networks and what it does not do.

Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x

Nobody shows up in the GUI. Is it broken?

Almost certainly not. Argus watches nobody until somebody holds argus.monitored:

BASH
lp group moderator permission set argus.monitored true

If the permission is set and the list is still empty, the member simply has not taken an action Argus scores yet. Ask them to run a /give on a test server and check again.

Does it slow the server down?

No measurable impact on a normal server. Argus reacts to events that are already rare — commands, container opens, item pickups — and does bookkeeping in memory. The audit chain is an append with a single SHA-256 hash per entry.

The one thing to size correctly is MySQL in network mode: put the database on the same host or the same LAN as the servers, not across the internet.

Will it flag my staff for doing their jobs?

That is the design problem the whole scoring model exists to solve. Moderation actions carry a weight of 4 out of 100 — visible in the timeline, meaningless to the rating. What gets weighted is item and money creation, snooping and traps.

If your team does get flagged for ordinary work, the fix is almost always one of:

  • lowering the weight of the signal that fired (scoring.weights)
  • raising signals.burst.threshold if your staff work in bursts legitimately
  • moving a badly placed honeypot

Can a staff member delete their own tracks?

They can delete the file. They cannot edit it invisibly — that is what the hash chain is for, and /argus verify will report exactly where it broke. Wholesale deletion is also loud: a log that suddenly starts at yesterday is its own finding.

Keep backups somewhere your staff have no access to, and Argus becomes very hard to work around.

Does it work on BungeeCord / Velocity?

Yes. Install it on every backend server, point them all at one MySQL database and set network.enabled: true with a unique server-id each. Full walkthrough on Storage & network. The proxy itself runs nothing.

Does anything leave my server?

Only what you configure. Discord alerts go to the webhook you set; that is the sole outbound connection Argus makes. There is no telemetry, no licence phone-home and no cloud backend. The web panel is served by your own machine.

What about GDPR?

Argus records staff actions on your server, which is ordinary server-administration logging. Two practical notes for German and EU operators:

  • Tell your team they are monitored. alerts.deterrent-mode doubles as a transparency measure, and it makes the plugin work better anyway.
  • The audit chain is append-only by design, so a deletion request means archiving and starting a new chain rather than editing entries out of the existing one.

This is not legal advice — check your own obligations.

Can I use it on 1.20 / on Spigot?

The jar targets Paper API 1.21 with api-version: '1.21', so 1.21 is the floor. It runs on current 1.21.x releases and on Paper forks like Purpur. Plain Spigot is not supported — several of the events Argus relies on are Paper APIs.

Does /reload work?

No. Use a full restart after every jar change or GUI-affecting config change. /argus reload re-reads config.yml only, and never touches storage or network.

Can I change the GUI icons?

Yes — every icon is a custom head and every key under gui.heads accepts a texture hash or a full Base64 value. See Configuration. Head changes need a restart.

Something is flagged and I disagree. What do I do?

Open the member's Why breakdown, read the signals, then open Rewind and read the two minutes around the event. If it was legitimate, use Clear — it resets the score and leaves the audit entry in place, which is the honest outcome. If the same false positive keeps recurring, tune the signal rather than clearing repeatedly.