Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Audit log file fed but not displayed through the admin web interface #318

Closed
oxlanech opened this issue Aug 16, 2019 · 12 comments · Fixed by nextcloud/documentation#10604 · May be fixed by #476
Closed

Audit log file fed but not displayed through the admin web interface #318

oxlanech opened this issue Aug 16, 2019 · 12 comments · Fixed by nextcloud/documentation#10604 · May be fixed by #476

Comments

@oxlanech
Copy link

Steps to reproduce

  1. Activate debug level logging (0) in config/config.php
  2. Activate Audit Nextcloud app from the web administration panel
  3. Login and logout several times
  4. Login back with an admin account and go to the administration panel: the login and logout requests are not displayed
  5. However, these requests are logged in the audit.log file

Expected behaviour

The content of the audit.log file should be displayed in the web administration logging panel

Actual behaviour

Login or log out requests are not displayed on the web interface

Server configuration

Operating system: Debian 9

Web server: Apache 2

Database: Mysql

PHP version: 7

Nextcloud version: 16.0.3

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

List of activated apps:

App list Auditing / Logging

Nextcloud configuration:

Config report 'owsk6pnizeou', 'passwordsalt' => 'xxxxx' 'secret' => 'xxxxx', 'trusted_domains' => array ( 0 => 'nextcloud.intra.inet, ), 'datadirectory' => '/home/nextclouduser', 'dbtype' => 'mysql', 'version' => '16.0.3.0', 'overwrite.cli.url' => 'https://nextcloud.intra.inet', 'dbname' => 'xxxx', 'dbhost' => 'xxxx', 'dbport' => '', 'dbtableprefix' => 'oc_', 'mysql.utf8mb4' => true, 'dbuser' => 'nextcloud', 'dbpassword' => '', 'installed' => true, 'log_type' => 'file', 'logfile' => 'nextcloud.log', 'loglevel' => '0', );

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Firefox/60.0

Operating system: Microsoft Windows 10

Logs

Web server error log

Web server error log

No error in the error log

Nextcloud log

Nextcloud log
{"reqId":"xxxx","level":0,"time":"August 16, 2019 10:12:45","remoteAddr":"10.100.20.19","user":"--","app":"cron","method":"GET","url":"\/cron.php","message":"Run OC\\Log\\Rotate job with ID 20","userAgent":"Mozilla\/5.0 Gecko\/20100101 Firefox\/60.0","version":"16.0.3.0"}

Nextcloud audit log ``` {"reqId":"A2rPl1W4l4JQTIOih1aS","level":1,"time":"August 16, 2019 13:16:56","remoteAddr":"10.100.18.116","user":"Admin01","app":"admin_audit","method":"GET","url":"\/ocs\/v2.php\/apps\/notifications\/api\/v2\/notifications","message":"Login successful: \"Admin01\"","userAgent":"Mozilla\/5.0 (Windows 10 rv:58.0) Gecko\/20100101 Firefox\/60.0","version":"16.0.3.0"} ```
@luixal
Copy link

luixal commented Aug 28, 2019

Same thing here.

I'm using docker oficial image and can't get the audit log working... any ideas?

@Nividan
Copy link

Nividan commented Jan 16, 2020

Same issue here. Nextcloud on Apache2.

@kesselb kesselb transferred this issue from nextcloud/server Feb 2, 2020
@GambaJo
Copy link

GambaJo commented Feb 24, 2020

Same here (apache2, without docker).

@jmartin-oss
Copy link

Same problem. Tested on:
NC 15.0.14 with apache2 (no docker)
NC 17.0.2 with apache2 (no docker)

@jmartin-oss
Copy link

Tested also with NC 18.0.1 with apache2 (no docker) and still have the same problem

@GambaJo
Copy link

GambaJo commented Feb 27, 2020

maybe the problem is not the logreader but the log itself. I think, the log is in JSON format. Maybe the JSON stucture in the log file is corrupt.

@jmartin-oss
Copy link

jmartin-oss commented Mar 2, 2020

GambaJo, I don't think so, the JSON structure is pretty the same compared to nextcloud.log.

I think that the problem could be because logreader is ignoring 'audit.log' file and only reading 'nextcloud.log' file, all the events in nextcloud.log are represented but audit.log ones are absent.

I tried to move audit.log file out of the cloud storage to /var/log/nextcloud/audit.log for avoiding permissions problem, locating it in the same place that nextcloud.log without success.

@GambaJo
Copy link

GambaJo commented Mar 2, 2020

I updated NC to 18.0.1 and now I can see the log.

@jmartin-oss
Copy link

jmartin-oss commented Mar 2, 2020

I updated some days ago to 18.0.1 and I still cannot view the logs.
Can you share the admin_audit section obtained with the command: occ config:list

This is mine:
"admin_audit": {
"enabled": "yes",
"installed_version": "1.8.0",
"logfile": "/var/log/nextcloud/audit.log",
"types": "logging"
},

Also version and logfile, please:
"version": "18.0.1.3",
"logfile": "/var/log/nextcloud/nextcloud.log",

@jmartin-oss
Copy link

Updated to 18.0.3 and I still cannot see the audit log in the admin web interface.
Any idea?

@aproposnix
Copy link

aproposnix commented Aug 27, 2020

I never had this issue until I updated to NC 20 b1-2

Update: NC 20 B3 seems to have fixed it. I can see the logs again.

Abijeet added a commit that referenced this issue Mar 27, 2021
Add a LogFileProvider class that identifies the available log files
It checks if the admin_audit app is enabled, and fetches it's logfile
path.

Additionally, add ability for user to select the file they want to
view. The "Download logs" button now downloads the currently selected
log file.

Tested by enabling and disabling the admin_audit app

TODO: Update the commands to also use the choosen logfile

Fixes: #318
Signed-off-by: Abijeet <abijeetpatro@gmail.com>
Abijeet added a commit that referenced this issue Mar 28, 2021
Add a LogFileProvider class that identifies the available log files
It checks if the admin_audit app is enabled, and fetches it's logfile
path.

Additionally, add ability for user to select the file they want to
view. The "Download logs" button now downloads the currently selected
log file.

Tested by enabling and disabling the admin_audit app

TODO: Update the commands to also use the chosen logfile

Fixes: #318
Signed-off-by: Abijeet <abijeetpatro@gmail.com>
Abijeet added a commit that referenced this issue Mar 28, 2021
Add a LogFileProvider class that identifies the available log files
It checks if the admin_audit app is enabled, and fetches it's logfile
path.

Additionally, add ability for user to select the file they want to
view. The "Download logs" button now downloads the currently selected
log file.

Tested by enabling and disabling the admin_audit app

TODO: Update the commands to also use the chosen logfile

Fixes: #318
Signed-off-by: Abijeet <abijeetpatro@gmail.com>
@joshtrichards
Copy link
Member

The logreader currently only accesses the nextcloud.log. The audit log, however, can be integrated by configuring it to also log there. That's how you end up with an integrated view of everything in the Web UI.

Try this in your config.php (adjusting the path to your own nextcloud.log path):

  'log.condition' => [
          'apps' => [ 'admin_audit'],
  ],
  'logfile_audit' => '/var/www/html/data/nextcloud.log',

And make sure you don't have any other stray audit related references in your config.php

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
8 participants