Admin audit logs only the folder DELETE and not the contained file deletions, causing bulk folder deletions to be severely undercounted.

ℹ️ Support
, , , , , ,
1
Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    31.0.9.1

    Operating system and version (e.g., Ubuntu 24.04):
    Ubuntu 22.04.5 LTS (Nextcloud AIO on a Proxmox VE host, kernel 6.8.12-9-pve)

    **
    Web server and version (e.g, Apache 2.4.25):**
    Apache (Nextcloud AIO “apache” container) (exact version unknown, can provide if needed)

    **
    Reverse proxy and version _(e.g. nginx 1.27.2):**
    Nextcloud AIO built-in reverse proxy / Caddy (version unknown, can provide if needed)

    **
    PHP version (e.g, 8.3):**
    PHP 8.3

    **
    Is this the first time you’ve seen this error? (Yes / No):**
    Yes (noticed during initial monitoring/alerting setup)

    **
    When did this problem seem to first start?**
    Observed during testing on January 2026 while validating audit logging for mass deletions.

    **
    Installation method (e.g. AIO, NCP, Bare Metal/Archive, etc.):**
    Nextcloud AIO (Docker)

    **
    Are you using Cloudflare, mod_security, or similar? (Yes / No):**
    No

Summary of the issue you are facing:

Admin audit logging (admin_audit / audit.log) severely undercounts deletions when a user deletes a parent folder containing many files.

If I delete a folder with 500 files inside, only one DELETE audit log entry is created (folder delete), while deleting the same 500 files individually generates 500 DELETE entries.

This makes it impossible to reliably monitor or alert on mass deletions using audit logs (e.g. Loki/Grafana alerts).

Steps to replicate it (hint: details matter!):

  1. Create a folder in Nextcloud, e.g. BulkDeleteTest.

  2. Upload and extract a zip containing 500 files into that folder (file_0001.txt … file_0500.txt).

  3. Delete the entire folder BulkDeleteTest in the Nextcloud UI.

  4. Check audit log entries (admin_audit):

    • docker exec -it nextcloud-aio-apache sh -lc 'tail -n 200 /var/www/html/data/audit.log'

    • Or query log stream in Loki/Grafana filtering on app="admin_audit" and method="DELETE".

  6. (Optional) Repeat by deleting the 500 files individually (without deleting the folder) and compare log entries.

Expected: Deleting a folder containing many files should log per-file deletes (or at least include a summary count).

Actual: Only 1 DELETE entry is written for the folder; no per-file delete entries are logged.

Log entries

Nextcloud

Relevant log source is:

  • Audit log: /var/www/html/data/audit.log (admin_audit app)

Example log check command:

docker exec -it nextcloud-aio-apache sh -lc 'grep "\"app\":\"admin_audit\"" /var/www/html/data/audit.log | tail -n 50'

(If requested, I can paste folder delete vs file delete audit entries, redacted.)

Web Browser

Not UI-error related (no visible error in browser), this is about audit logging behavior.

Web server / Reverse Proxy

Not a webserver error; issue is specific to audit log content (admin_audit entries missing per-file deletes when deleting folders).

Configuration

Nextcloud

Sanitized occ config:list system excerpt shows audit logging enabled for admin_audit:

"loglevel": 1,
"log_type": "file",
"logfile": "/var/www/html/data/nextcloud.log",
"log.condition": { "apps": ["admin_audit"] }

(Full sanitized output available if needed.)

Apps

Relevant enabled app:

  • admin_audit 1.21.0

(Full occ app:list output available if needed.)