Using DEMORECORD To Find Who Is Sabotaging Lambda Badge Runs

[Oklahoman]

Honestly, I was at a point where I didn't want to run Lambda iTrials anymore. There was ALWAYS someone who would throw a grenade (and in a couple cases, an acid) and mess up the badge run for everyone else. The combat log was no help, and a video of the event might or might not help (probably not). You can try asking everyone to pass you said grenades and acids, but you're on the clock and you don't really know who has what anyway.

 

Then it occurred to me - DEMORECORD.

 

Demorecord captures all the detail of who did what, so you can play it back later. Sure enough, I had a saboteur in my group today, and I was able to catch him. Here's how I figured out who it was.

 

STEP ONE - Turn on demorecord

 

This is simple. Just type "/demorecord {filename}" (ex: /demorecord LAM1). Demorecords automatically stop when you zone, so I waited to start it until after Marauder's cutscene, when I was outside with him. I'm not sure if going to the hospital will cause it to stop, too. I recommend using a bind so you can start the recording as soon as possible - saboteurs often try to use a grenade or acid immediately, before you can start recording.

 

STEP TWO - Look for the sabotage

 

Even though they were informed twice that I would be demorecording the fight, they did it anyway. In fact, they waited until Marauder got to 1% health to do it. A message on the screen says "Marauder Pacified!" and everyone groans. If it's a problem with an acid, you'll notice that "Active Reinforcement Doors" has dropped below 10. Make a mental note of when the sabotage occurred, especially in relation to league chat. It might even help to post something to league yourself that you can look up later.

 

Once you exit the iTrial, the demorecord will stop automatically. Or, if you want to check while you are still inside the iTrial, just type /demostop. The demorecord file is not created until you exit the iTrial or use /demostop.

 

STEP THREE - Examine the evidence!

 

Your demorecord should have created a file in your City of Heroes folder, in the "client_demos" sub-folder. Look for the filename you used in step 1, followed by ".cohdemo" (ex: LAM1.cohdemo). Open this file in a text editor and admire the apparent gibberish.

 

Use the FIND feature in your text editor to look for, say, "pacification" and after some dialogue lines you'll probably find a line that looks like this:

Quote

0   12  FX OneShot 60997 POWERS/ITEMSANDTEMPPOWERS/GREG_PACIFICATIONGRENADE/PACIFICATIONGRENADE_ATTACK.FX 0

Yep, there's someone who used a Pacification Grenade! Got 'em!

 

You can research this part yourself, but trust me that the first number tells you how many milliseconds after the previous line this was executed. Ignore this for now. But you should be able to confirm everything by looking at the following lines for the mental note you made in step two.

 

That second number is the important one - 12, in this case, but it could be anything. This tells you who did it! Place your cursor back at the top of this text file, then use your FIND feature again and this time look for that number, with a space before and after it (" 12 " in this case).  You'll then see a line something like this:

Quote

0   12  NEW "Saboteur Bad Guy"

And there you go. You've found the person who messed up your badge run - a character named "Saboteur Bad Guy" in this case.

 

STEP FOUR - So.... what now?

 

Well, it's possible it was an honest mistake, so I recommend reaching out to them via a private tell and asking very diplomatically "WTF dude?" And, go from there. In my case, the guy chose not to respond and went offline, so I chose to use global ignore and then petition him. The powers that be are handling it now, and I've got one less saboteur to worry about. I didn't see a need to spam LFG with his name, just petition, write an angry forum post, and move on with life.

 

To find their global, type "/getglobalname Saboteur Bad Guy" and the answer will be in your Global chat window.

 

Save your demo file if you are going to petition them because the GMs and CMs may need that.

 

Also - you don't have to be a team or league leader to do this. Anyone playing in the team/league can do these steps themselves. Hope that's helpful!

Edited September 21, 2022 by Oklahoman
Updated some info

[Ulysses Dare]

I try never to attribute to malice that which is perfectly explained by stupidity, but grenading Marauder after you'd whittled him down to 1% sure feels like malice.

[Ura Hero]

It's happened quite a few times to @Oklahoman's runs.   Enough so that it feels intentional.

[Ulysses Dare]

Yeah, I was on one of those runs. Three LAMs, three times Marauder got grenaded. It's an understandable mistake for an excited newbie to make; the game does flash a message telling you to use the grenades. But three times?

 

Though I have to say, I'm surprised that it seems to be someone who was deliberately sabotaging badge runs. I'd assumed it was a frustrated speed runner who was using the their grenade to convert the badge run into the kind of run they wanted. But someone like that wouldn't have waited until Marauder was down that far before using the grenade.

Edited March 9, 2020 by Ulysses Dare

[Generator]

I'll flout my ignorance here.  I'm so deep into my altitis, I'm here 10 months and I have yet to get into a Lambda trial.  Can you remind me what the grenades do, and exactly how this is a d*ck move?

 

Thanks.

 

And OP, nice job finding a way to find the perp.

Edited March 9, 2020 by Generator

[Oklahoman]

8 hours ago, Ulysses Dare said:

Though I have to say, I'm surprised that it seems to be someone who was deliberately sabotaging badge runs. I'd assumed it was a frustrated speed runner who was using the their grenade to convert the badge run into the kind of run they wanted. But someone like that wouldn't have waited until Marauder was down that far before using the grenade.

This particular person was VERY involved in chat throughout the trial, at times even attempting to call out orders himself. And those who run with me know I say repeatedly not to use the temp powers. On this particular run another player chose to ignore this players instructions and asked me directly what I wanted to happen, which was opposite of what the saboteur wanted, and my guess is that ticked him off. I was approached by someone afterwards who knows this person in real life and said it's exactly the sort of thing he does for kicks. I have zero doubt it was intentional.

 

7 hours ago, Generator said:

Can you remind me what the grenades do, and exactly how this is a d*ck move?

The Lambda iTrial has several badge options, and in order to get all of them (along with the Master of Lambda badge) it usually takes at least 3 successful runs. One for the Antacid badge, one for the Well Stocked badge, and one for the Looter (and hopefully Synchronized) badge - and you would get the Master of Lambda badge after getting all the others. Grenades, found in the Munitions Depot and therefore part of a Well Stocked badge run, can be used to pacify Marauder and make him easier to take down. You need to get all 10 grenades - which are sorta randomly distributed among the team/league as you go - but then have no one to use them to get the Well-Stocked badge. This makes it very easy for someone to hold on to a grenade - perhaps even claim they don't have one at all - and then use it to ruin the badge run for everyone else. The combat logs won't tell you who used it, either.

 

And, it takes a lot of time and energy to even get to the fight with Marauder, not to mention just recruiting the league in general. The fight with Marauder itself can easily take 10 minutes or more without using the grenades, depending on league makeup. So to get to that very last step then have someone spoil the badge run for everyone else is very frustrating.

[Generator]

OK, it's all coming back now.  That someone would go to that much trouble to be a jerk about it is a little sad.

 

Anyway, thanks for the recap.  I promise I will be a good citizen if and when I finally start getting alts to Incarnate levels (I've had a slight altitis problem recently 😁).

[Ura Hero]

@Oklahoman I hope this doesn't spoil you from continuing the badge runs on Excelsior.   Personally I enjoy them and am very glad you run them.  Thanks!

[Oklahoman]

20 minutes ago, Ura Hero said:

@Oklahoman I hope this doesn't spoil you from continuing the badge runs on Excelsior.   Personally I enjoy them and am very glad you run them.  Thanks!

Course not! Marauder is gettin' too big fer his britches! Gotta take 'em down a notch!

[Shred Monkey]

At least in this game content is locked behind a instanced mission so you can keep the trolls out once you identify them. 

[FourSpeed]

Interesting idea.

 

I wonder if that idea might also be adapted for finding out who is griefing Rikti Ship Raids.  The other day I was on one, and someone there thought it was amusing to phase the Pylons making them impossible to hit for several seconds.  In the end, it didn't really affect the actual raid much, but it was a bit annoying to see "Unaffected..." pop up on several of the pylons at the beginning.

 

I really don't get the mindset of people who intentionally do Dumb Sh*t like that, but there's no doubt it's out there, if not prevalent (thankfully).  Still, if it becomes general knowledge that those people can be provably caught, petitioned, and possibly actioned by the GM's, perhaps a few of them may reconsider their behaviour  (I know, hope springs eternal) 😉

 

Anyway, interesting idea, and a novel use case for /demorecord -- thx for sharing it.

 

 

Regards,

4 

[Apparition]

19 minutes ago, FourSpeed said:

Interesting idea.

 

I wonder if that idea might also be adapted for finding out who is griefing Rikti Ship Raids.  The other day I was on one, and someone there thought it was amusing to phase the Pylons making them impossible to hit for several seconds.  In the end, it didn't really affect the actual raid much, but it was a bit annoying to see "Unaffected..." pop up on several of the pylons at the beginning.

 

I really don't get the mindset of people who intentionally do Dumb Sh*t like that, but there's no doubt it's out there, if not prevalent (thankfully).  Still, if it becomes general knowledge that those people can be provably caught, petitioned, and possibly actioned by the GM's, perhaps a few of them may reconsider their behaviour  (I know, hope springs eternal) 😉

 

Anyway, interesting idea, and a novel use case for /demorecord -- thx for sharing it.

 

 

Regards,

4 

 

That stinks and I'm sorry to hear that.  That is one of the reasons why I prefer the instanced Rikti mothership raid trials.  One of the zone MSRs I lead back around July of last year was griefed by two people continuously using Dimensional Shift while we were in the bowl.  Can't do much about things like that in a zone raid.  Instanced, /kick.  End of issue.

[_NOPE_]

This is a FANTASTIC use of the game's resources for data scraping, good job!

[Oklahoman]

On 3/13/2020 at 12:46 PM, FourSpeed said:

I wonder if that idea might also be adapted for finding out who is griefing Rikti Ship Raids.

I bet it could. I believe anything that a player does that would cause some sort of animation from them would need to be captured by DEMORECORD so it can accurately play it back later. In your case, or in the case @Apparitionlisted, you would likely search the demorecord file for "phase".

 

I used this very recently to catch someone who used a grenade in the final fight with Marauder during a LAM. Because I knew where to look, I was able to jump over and get the info from the files while we were still fighting Marauder, and then ask the player (via tell, because I try to give the benefit of the doubt) what happened. They said it was a mis-click (which can happen), but didn't respond after that and went offline as soon as the trial finished. I gignored them just to be safe.

 

I'd love to find a log monitoring tool that could look for keywords to appear in the demorecord text file ("grenade" or "acid" for instance) and then sound some kind of alert. I am told Notepad++ is used for monitoring log files a lot, but I have yet to figure out how to make it do what I described. Maybe someone else has an idea.

[AboveTheChemist]

I've written tools in Python to monitor log files for other games to look for certain keywords. Setting one up to monitor a demo file would be quite similar (but not possible because the file isn't created until the /demo_stop command is given, see Oklahoman's post below), and no doubt could be done in a myriad of other languages. I pretty much only know Python so that's what I use. I've not used Notepad++ to do that but it wouldn't surprise me if it could.

 

Edited September 25, 2022 by AboveTheChemist
update

[Crysis]

I use Splunk Enterprise in my own business.  It does great real-time event log monitoring.  Looks like a little science project in the making here!  Would actually be sorta fun to use it not just for catching saboteurs but rather as a League leader for announcing who got the killing shot, etc.

 

 

[Oklahoman]

On 4/29/2020 at 11:20 AM, Crysis said:

Would actually be sorta fun to use it not just for catching saboteurs but rather as a League leader for announcing who got the killing shot, etc.

 

BTW: the /demorecord option doesn't actually create a text file until you /demostop it, so I'm not sure Splunk would help you there. Definitely could be used on the log file, though, to get kill shots. I have a powershell script I run while streaming (when I do it, haven't streamed in a while) that catches the kill shot info, as well as anything sent to the local channel, and embeds it into my Twitch stream.

 

Also, updating the original post with some updated findings.

[MistressOhm]

Splunk is awesome for dissecting log files and the like (we used it at work a lot because we had a LOT of microservices running), but keep in mind that unless you've a freebie version or an Enterprise license, Splunk charges by the query.  So before you start unleashing it against your logs, make sure you're not in a pricing structure that will bleed your bank account dry.

 

We actually moved away from Splunk and went to Prometheus/Grafana for log analysis, because the two of them together were cheaper than Splunk for a large scale service deployment.  

[Oklahoman]

On 9/21/2022 at 12:59 PM, Krimson said:

I would pay good money to see the look on the Troll's face when confronted with evidence. 

 

Would be awesome if the NSA could share a photoshot from the offenders camera.