How heliana parses the Squad log
heliana reads the Squad game server’s log over SFTP and turns each line into a structured event that the rest of the platform — analytics, automations, the Live feed — can act on.
Why SFTP, not an in-game plugin
Section titled “Why SFTP, not an in-game plugin”heliana installs nothing on the game server. It reaches the server over two channels: RCON and SFTP, which gives it the server’s log file.
heliana connects over SFTP and follows the log file, picking up only what’s new since the last check, so it stays cheap to run even on a busy server. The polling cadence is fixed — it isn’t something you configure per server.
SFTP can do double duty. On a server with Config managed by heliana turned on, heliana also uses the same connection to push your whitelist, so an access list with whitelist access is re-applied to the server within about a minute of a change; the server’s header on the Dashboard shows if a write fails. Only then does the SFTP account you give heliana need write access; without that switch heliana never touches Admins.cfg and read access is enough.
What comes from RCON
Section titled “What comes from RCON”RCON is heliana’s other channel, and the two depend on each other: the log says what happened, RCON says who the players are.
RCON gives heliana a live roster snapshot: who’s online right now, which squad they’re in, who’s the squad leader, and the current layer and player count. It’s also how heliana runs admin commands from automations. Chat comes from RCON too, independent of the log.
Everything else comes from the log: a continuous, timestamped record of what happened between roster checks — kills, wounds, revives, weapon detail, round tickets and tick rate.
From log lines to events
Section titled “From log lines to events”Every line in the Squad log follows one of a set of known shapes. heliana recognizes each one and pulls out the useful details — what happened, when, who was involved, what weapon, how much damage, what IP address, and so on. A player death becomes a structured death event with an attacker and a victim; a teamkill is recognized by cross-checking the log against the live roster from RCON to confirm attacker and victim were on the same team.
A join event comes from the log, which carries the player’s IP address and exact timestamp; that player’s team at that moment comes from the RCON roster, which also fills in the EOS ID or name the log line lacks. Squad and role are not recorded on the event.
A log line that names a player waits for the RCON roster. If no roster arrives within about 15 seconds, the line is released without it and is not saved — it never reaches the Live feed or analytics. The same happens to lines read more than a minute behind the end of the log, which is what a catch-up after downtime looks like: they are not enriched and player events among them are lost. Without a working RCON connection only game-level events are kept: broadcast, new game, round ended, capture zone changes, deployable spawns and tick rate.
From log lines, heliana produces: join, leave, death, wound, damage, revive, deployable damage, deployable spawned, capture zone change, map marker, new game (map), round ended, broadcast, game version change, and tick rate (recorded, but with no Live feed category). Teamkill isn’t its own log line — it’s the same death event reclassified once the RCON roster check confirms attacker and victim were on the same team. Chat isn’t in this list at all: it’s a distinct event type, but it arrives over RCON, not the log. For what each type carries, see the Event types reference.
To connect your server’s SFTP credentials so heliana can start reading the log, see Get SFTP access.