See who did what with the panel activity log
The Activity page records every action taken on your server in the panel, so after something goes wrong you can see who did it and when.
6 min read · Updated Oct 21, 2026 · By GuavaHost Team
If you run a server on your own, the Activity page is a mild curiosity. The moment you add a second person, it becomes the most useful page in the panel. It is the difference between "the world got wiped and nobody knows why" and "the world got reinstalled at 21:14 by the person who was testing a modpack".
Where it is
- Sign in at customer.guavahost.com, open My servers and click Manage on your server.
- In the server menu, open More, then Activity.
Each entry is a line: what happened, who did it, and when. Newest first. There is nothing to switch on, it has been recording since the server existed.
What it records
The log covers the things done to the server through GuavaHost, not what happens inside the game. Roughly:
- Power actions. Start, stop, restart and force stop, with the person who pressed the button.
- Console commands. Commands typed into the panel's console command box.
- File changes. Files written, renamed, deleted, uploaded, downloaded from a link and unpacked.
- SFTP logins. When someone connected with an SFTP app, and which account they used. This matters, because file changes made over SFTP are a bulk operation rather than a click.
- Settings and startup changes. Edits to the server name, to startup settings, and a reinstall.
- Backups. Created, restored, deleted or downloaded.
- Scheduled tasks. A schedule added, edited or removed.
- Ports and databases. Ports added, repointed or removed, and databases created or dropped.
- People. Sub-users invited, edited and removed, and what permissions they were given.
- Crashes. When the server went down unexpectedly, with the last console lines attached so you can see what it was complaining about. Those console lines only show for people who are allowed to see the console.
What it does not record is in-game behaviour. Who griefed the spawn, who typed what in chat, who placed TNT: none of that is a panel action, so it is not here. That lives in your server's own log on the Console tab, and in a plugin built for it. For Minecraft, CoreProtect and rolling back griefing is the tool that answers "who broke this block", and stopping griefers on your server covers the wider job.
Reading it after something goes wrong
The log is most valuable when you work backwards from a moment in time.
- Pin down when. Ask your players when it last looked normal. "It was fine before dinner" is enough to start.
- Find the nearest entries. Scroll to that window and read everything around it, not just the one entry that looks guilty.
- Look for the pair. Most breakages are two entries together: a file change or settings change, then a restart. The restart is when players noticed. The change before it is the cause.
- Check for an SFTP login. If someone connected over SFTP just before, the real change was made there and the panel only saw the login.
- Pick your backup. Once you know the time, you know which backup predates it. Restore that one rather than the newest.
That last step is the whole point. Restoring the most recent backup often restores the problem along with everything else. Backups: creating, restoring and scheduling covers the restore itself, and remember a restore overwrites your current files, so take a fresh one first if the current state has anything you want to keep.
If the entry you find is a crash rather than a person, you have a different job on your hands: read the console lines in the entry, then follow why your server says Starting or is stuck offline and reading server logs and crash reports.
How it pairs with sub-users
Activity and sub-users are two halves of the same feature. Sub-users let you give each helper their own login, so every action carries a name rather than everyone sharing yours. Without that, the log says you did everything, which is accurate and useless.
So if more than one person touches your server, give them their own access instead of your password. Giving a friend access with sub-users has the steps, and staff permissions and least privilege covers how much to hand over.
Two practical notes:
- Permissions beat the log. A log tells you who deleted the world. Not granting file access in the first place means nobody could. Start people narrow and widen later.
- Removing a sub-user does not erase their history. Their past entries stay in the log, which is exactly what you want after an incident.
The Activity permission itself is one you can grant, so a co-admin can read the log without being able to change anything else.
Using it as a security check
Run your eye over Activity whenever something feels off about your account, not just your server. You are looking for:
- Power actions or file changes at times nobody was around.
- An SFTP login from an account that should not be using SFTP.
- A sub-user you do not remember inviting.
- A reinstall or a backup deletion you did not do.
If you see any of those, treat it as account compromise rather than a mistake: change your password from a device you trust, turn on two step login, remove any access you do not recognise, and set a new SFTP password. Protecting your account is the full checklist, two step login on GuavaHost covers the extra factor, and recovering a griefed server is the recovery path when damage has been done. Our team is online 24/7 if you want a second pair of eyes on what you are looking at.
How far back does it go?
Far enough to investigate a recent incident, which is what it is for. It is a rolling record rather than a permanent archive, so do not treat it as evidence you can come back to months later.
If an entry matters, capture it now. Note the timestamp, the account and what it says, or take a screenshot. That costs you ten seconds and saves the argument later. It also means you can hand us something concrete if you open a ticket, which gets you an answer much faster than "something happened last week".
Common questions
Does the activity log show in-game actions like who broke a block?
No. It records actions taken through GuavaHost, such as power buttons, file edits, settings changes and SFTP logins. For in-game events you need your game's own log on the Console tab, or a plugin like CoreProtect that is built to track block changes.
Can my sub-users see the activity log?
Only if you give them the Activity permission when you invite them or edit their access. It is a separate permission from the rest, so you can let a co-admin read the history without giving them the ability to change anything.
Someone deleted my files, can I undo it from here?
Not from the log itself, because it is a record rather than an undo button. What it gives you is the time the deletion happened, which tells you exactly which backup to restore from the Backups page.
Why does the log say I did something I did not do?
Usually because somebody is using your login rather than their own, which is the main reason to hand out sub-user access instead of sharing a password. If nobody should have your login, change your password straight away and check the log for anything else you did not do.
Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.
- panel
- activity
- security
- sub-users
- audit
Still need help? Our team is online 24/7 to answer questions.