The panel records account actions — logins, power actions, file changes, permission edits. It is dull until the day something is different and everyone says it was not them.
What it answers
- Who restarted the server at 2 a.m., and from where.
- Whether a file was deleted or was never there.
- When a subuser's permissions changed, and who changed them.
- Whether a login came from an address you do not recognise.
Using it when something is wrong
- Start from when it last worked
The log is chronological. Knowing the last moment things were fine turns a wall of entries into a short window.
- Look for actions, not logins
A login on its own means little. A login followed by a file deletion is a sequence.
- Check the addresses
Your own entries come from addresses you recognise. One that does not match anyone who should have access is worth acting on immediately.
- Cross-check against the console
The panel log records panel actions; the server console records in-game ones. A problem that appears in neither was probably a plugin acting on its own.
Change your password, remove any subuser you did not add, and check the Startup and Settings tabs for changes. Then look at what else uses that password — if it was reused anywhere, that account is exposed too.
«The log says the restart was at 21:40 and the world saved first» ends a conversation that would otherwise go in circles. Having a neutral record is worth more on a shared server than on a solo one.