One DayZ server, zero players, six days of logs. The collector at CT 140 holds 131,546 lines forwarded from CT 161 gamelab, covering runs from 2026-08-07 through 2026-08-13. Nobody connected the entire time. The box was at rest, running the game server and writing log lines anyway.
Where the volume lives
| stream | lines |
|---|---|
| dayz-rpt.log | 82,211 |
| dayz-console.log | 48,256 |
| dayz-crash.log | 995 |
| dayz-script.log | 34 |
| systemd.log | 32 |
| su.log | 8 |
| rsyslogd.log | 8 |
| lab-test.log | 1 |
| (systemd).log | 1 |
| total | 131,546 |
Two application streams — dayz-rpt.log and dayz-console.log — are 130,467 of those lines, 99.2% of the corpus. Everything the operating system had to say about this machine over six days fits in 49 lines.
How repetitive the noise is
Masking every number in the RPT and counting distinct message shapes collapses 82,211 lines to 16,820 distinct shapes. The top 10 shapes account for 9,764 lines, 11.9% of the file. Another 1,096 shapes appear exactly once.
The loudest repeated shapes were:
2215 Warning Message: Trying to access error value.
1795 Warning Message: Size: '/' not an array
981 ENTITY (W): Door 'DoorsTwinN' is missing geometry compone...
909 Convex "componentN" selection faces are less then N in dz\struc...
804 Warning: No components in dz\water_bliss\river\enoch_river_N.pN
747 Convex "componentN" selection faces are less then N in dz\struc...
594 Warning: No components in dz\structures\roads\parts\asfN_N N.pNThese are asset and geometry complaints from the game’s own content and its mods. They repeat continuously and mean nothing operationally.
The alert rules that would have paged
| rule | matching lines |
|---|---|
Warning | 97,819 |
error | 4,017 |
Cannot | 579 |
ERROR | 566 |
Scripted variables corrupted | 387 |
Exception | 233 |
Unhandled exception | 1 |
A rule on Warning would have paged 97,819 times. That is 74.4% of everything this server said, three lines out of four. Lowercase error catches 4,017 lines. Uppercase ERROR catches 566. Exception catches 233. Unhandled exception catches exactly one.
Every rule in that table except the last is a rule you could write without ever looking at this server. Warning is a severity word. error is a severity word. Cannot and Exception are runtime vocabulary. But the only line that marked the moment the server process actually died was the single Unhandled exception.
The crash stream itself holds 92 Virtual Machine Exception blocks across 15 distinct vehicle classes — the detail of the failure. The single line that says the process is gone appears once, and it appears in a file most people never open.
What this does not measure
- This is a server at rest. Zero players for the entire window. A populated server would add player and admin traffic that is not represented here at all.
- The corpus is a mixture: six days of accumulated files, shipped when the collector was first pointed at them, not six days of steady streaming.
- The 92 exception blocks come from more than one crash, not one event.
Severity keywords describe how the developer felt, not whether anything is wrong. The application sprays Warning continuously while the process is healthy. If you are configuring syslog monitoring tools, the starting point is not the vocabulary a logging library defaults to. Pull the shapes from the logs you already have, count them, and then write the rule that fires once.
