> For the complete documentation index, see [llms.txt](https://mango-5m.gitbook.io/mango5m-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mango-5m.gitbook.io/mango5m-docs/resources/mango-admin/resource-protection/incidents-and-who-stopped-it.md).

# Incidents and Who Stopped It

What the server can honestly tell you about who stopped the resource - and what it will not guess.

Every incident carries an id, a timestamp, the resource, the action, the source, the recovery result, and what was done about it.

```
[RESOURCE PROTECTION]
Protected resource stopped unexpectedly.
Resource: mango_admin
Source: In-Game
Server ID: 47
Player: ExampleName
Time: 2026-09-18 10:42:31
Action: AUTOMATIC RECOVERY
Held while down: 2 deaths, 1 report
Status: SUCCESS
```

The history lives in the guard's `data/incidents.json`, capped by `Config.Incidents.Max`, and every incident is mirrored into the panel's audit log under **Watchdog** once the panel is up — which is where you read them day to day, alongside everything else that happened at that minute.

## What the source can honestly be

FiveM gives a resource very little about who issued a console command. This is the whole truth of it:

| Recorded as                  | When                                                                                                                                                                                                                          |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **In-Game, Server ID N**     | The action came through the panel itself — a stop or restart from its Resources page. The panel tells the guard **before** the command runs, with the staff member's server id. This is the **only** path that names a player |
| **Console (rcon)**           | The server raised `rconCommand` for a stop or restart of a guarded resource                                                                                                                                                   |
| **Resource *****name*** | Another script called `StopResource()`. Best effort — this is not documented behaviour for that event                                                                                                                         |
| **txAdmin**                  | Nothing above, and the server runs under txAdmin. txAdmin owns stdin, so its live console and its Resources page are the only way a console command reaches the server                                                        |
| **Server Console**           | Nothing above, and not under txAdmin                                                                                                                                                                                          |
| **Unknown**                  | Found stopped with no stop event seen — at boot, or by the heartbeat                                                                                                                                                          |

{% hint style="danger" %}
**What is not possible, and is therefore never claimed.** A player who types `/stop <resource>` in chat while holding the `command.stop` ace is invisible: the server executes that as a console command and raises no event any resource can hook. It is recorded as txAdmin or console. txAdmin's own web panel does not pass the acting admin's identity to the server either.

**No player is ever guessed.** A record that names the wrong person is worse than one that says Unknown.
{% endhint %}

## Staff are told

```
⚠ ADMIN RESOURCE PROTECTION
The admin menu was stopped and was automatically restarted.
Resource: mango_admin · Stopped by: Server ID 47 (Jordy) · Method: In-Game · Time: 10:42:31
Held while it was down: 2 deaths, 1 report - delivered.
```

Through whatever notification resource you run. If the panel is the thing that is down, the guard falls back to a chat line using the last staff list the panel gave it — because "we could not tell anyone" is the one outcome worth avoiding.

## Discord

{% code title="mango\_watchdogs/config.lua" %}

```lua
Config.Discord = {
    Enabled  = true,
    Webhook  = 'YOUR_WEBHOOK_HERE',
    Username = 'Resource Protection',
    Mention  = '',            -- a role id, or 'everyone' / 'here', for CRITICAL only
}
```

{% endcode %}

Posted by the guard directly, so it still works while the panel is down — which is exactly when it matters.