Which logs to keep, and for how long

Security & DDoS Reviewed September 6, 2026 2 min read

Logs are only useful if they still exist when you need them, and only affordable if they are not all kept forever. Four records cover almost everything you will ever want to look up.

What to keep

RecordAnswersKeep for
Server console logs«What did the server say when it crashed?»A month is plenty
Block logging«Who broke this, and when?»As long as your disk allows — this one is worth the space
Panel activity log«Who restarted it, and from where?»Whatever the panel keeps; check it periodically
Punishment history«Have we dealt with this person before?»Indefinitely. It is small and it is the most reread record you have
Console logs will fill a disk if something is wrong

A plugin throwing an error every tick writes hundreds of megabytes a day. If your disk usage climbed suddenly, check logs/ before assuming the world grew. The fix is the error, not deleting the log — but delete the log too, once you have read it.

A sensible arrangement

  1. Let the server rotate its own console logs

    It compresses yesterday's automatically. You mostly need to make sure old ones actually get removed rather than accumulating for a year.

  2. Give block logging a retention period

    Most block loggers can prune records older than a set age. Thirty to ninety days catches almost every grief report that will ever be made.

  3. Keep punishments forever

    They are text, they take no space, and «this is the third time» is the single most useful sentence in a moderation decision.

  4. Check disk use once a month

    One minute, and it catches every runaway log before it becomes a full disk at a bad moment.

A log nobody can read is not evidence

If your only record is a screenshot in a Discord thread from March, it is not going to help. Records that live in a system, with dates attached, are the ones that settle a question later — and the difference costs nothing at the time.

One thing not to keep in a public place

Console output can contain database credentials, tokens printed by a misbehaving plugin, and player addresses. It belongs in your panel and in a support ticket, not pasted into a public Discord channel where it stays searchable indefinitely.