User Tools

Site Tools


nextcloud:nextcloud_audit

Nextcloud audit

FIXME basis is goed. Nog wel wat finetunen.

context

dit document beschrijft hoe je Nextcloud nakijkt op gebruikersacties.
Niet onbelangrijk gezien bestanden vanop alle mogelijke apparaten een onwaarschijnlijke weg kunnen afleggen.
Het is ook een prima manier om uploads van bestanden te troubleshooten

installatie

  • installeer de NC module Auditing / Logging
  • meld aan op linux
  • FIXME open config/config.php
  • voeg onderstaande lijnen toe:
     'loglevel' => 3,
      'logdateformat' => 'F d, Y H:i:s',
      'logtimezone' ⇒ 'Europe/Brussels',
      'log.condition' => [
                      'apps' => ['admin_audit'],
              ],

werking

  • bewerkingen worden nu gelogd naar data/audit.log:
    {"reqId":"YBKCOlfNqcu@wMAGcT1ragAAAAc","level":1,"time":"January 28, 2021 10:22:03","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MKCOL","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File created: \"/home/media/scans/New folder\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"}
    {"reqId":"YBKCOlfNqcu@wMAGcT1ragAAAAc","level":1,"time":"January 28, 2021 10:22:03","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MKCOL","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File written to: \"/home/media/scans/New folder\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"}
    {"reqId":"YBKCQlfNqcu@wMAGcT1rdgAAAAc","level":1,"time":"January 28, 2021 10:22:11","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MOVE","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File renamed: \"/home/media/scans/New folder\" to \"/home/media/scans/Voorbeeld\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"}
  • nakijken of bestanden vanaf een apparaat worden geupload: tail -f data/audit.log|grep -i created –color
    {"reqId":"YBXqnurT7cjSN@bVAmmLWgAAACs","level":1,"time":"January 31, 2021 00:24:15","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MOVE","url":"/remote.php/dav/uploads/koen/c9fede51d1980bd566f529a9043ca141/.file","message":"File created: \"/home/media/fotos/20200109_075205.jpg\"","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.14.3","version":"20.0.4.0"}

meer info

nextcloud/nextcloud_audit.txt · Last modified: by 127.0.0.1