How to practically check logs?

I have a ticket from a player who claims offline protection did not work, which I highly doubt because I've tested everything. I tried to check the (simple) logs but I don't know how to read them. 

1. How do I know which ID is which TC? The TC is destroyed I only know the grid.

2. How do I subsequently check if there was protection active? As in, how do I check if claims of there not being protection are correct?

Its going to be hard to find that TC if its destroyed (I responded to your post with something you can try). In general, the /tc command (if you're an admin) has some helpful things. It will list out a bunch of commands. Specifically the /tc id command will tell you the ID of the cupboard you are standing within the area of, you can also optionally /tc id <playername> which will do the same thing, but will tell you the TC at the location of the specified player (useful if you want to do it from the server console). Once you have the id, you can do things like /tc protection <id> which will tell you all sorts of details on the current protection.

If you want more of a "history" of the protection, you can either Enable Logging or Enable Ledger, both will give you an idea of what occurred with a tool cupboard. The ledger mostly gives info related to the protection balance, and lets you perform rollbacks. The logging gives you a lot more info, but I dont recommend leaving it on for large servers (unless you have a lot of storage space) because it will generate a lot of files.

If you choose to use the logging, they get saved to oxide/logs/RaidProtection and are organized by TC for each day. It should give you pretty detailed info on what happened to each TC and when. If you're not sure which TC, but you know what day, you can narrow it down to just those files. Unfortunately theres no an easy way of finding a specific TC if you dont know the ID.