I was at log level 1 but my nextcloud.log for some reason swelled to over 7GB so I deleted it and created an new nextcloud.log with log level 2. A day later, nextcloud.log is 4.0K but there is no content when I open it via command line. If I try to view in Nextcloud, I get the permanently spinning circle.
But to confuse me even more, I received emails this morning from my fail2ban service (ban based on multiple failed logins) banning two ip addresses. My nextcloud.conf jail is set up to search nextcloud.log for failed logins. The ip address that was banned is from the hospital my friend works at so it seems fail2ban worked properly, I just can’t see the content that fail2ban was scanning.
Why can’t I see any content in nextcloud.log? I checked and it’s the only nextcloud.log on the server.
Thanks!
Nextcloud 11.0.0 on Ubuntu 16.04, PHP7.0
php.config:
<?php $CONFIG = array ( 'instanceid' => 'XXXXXXXXXXX', 'passwordsalt' => 'XXXXXXXXXXXXXXXXXXX', 'secret' => 'XXXXXXXXXXXXXXXXXX', 'trusted_domains' => array ( 0 => 'XXX.XXX.XXX.XXX', 1 => 'share.domain.com', 2 => 'XXX.XXX.XXX.XXX', ), 'datadirectory' => '/etc/nextclouddata/nextcloud/data/', 'overwrite.cli.url' => 'http://XXX.XXX.XXX.XXX/', 'dbtype' => 'mysql', 'version' => '11.0.0.10', 'loglevel' => 2, 'logfile' => '/etc/nextclouddata/nextcloud/data/nextcloud.log', 'logtimezone' => 'UTC', 'installed' => true, 'mail_smtpmode' => 'smtp', 'mail_from_address' => 'ITSecurity', 'mail_domain' => 'domain.com', 'mail_smtpauthtype' => 'LOGIN', 'mail_smtpauth' => 1, 'mail_smtphost' => 'mail.domain.com', 'mail_smtpname' => 'itsecurity@domain.com', 'mail_smtppassword' => 'XXXXXXX', 'mail_smtpport' => '25', 'mail_smtptimeout' => 30, 'maintenance' => false, 'dbname' => 'nextcloud', 'dbhost' => '127.0.0.1', 'dbuser' => 'XXXXXX', 'dbpassword' => 'XXXXXXXX', 'defaultapp' => 'files', 'updater.secret' => 'XXXXXXXXXXXXXXXXXXXXXXXXXX', ); Nextcloud jail in Fail2Ban: [nextcloud] filter = nextcloud enabled = true port = anyport banaction = iptables-allports protocol = all logpath = /etc/nextclouddata/nextcloud/data/nextcloud.log findtime = 604800 bantime = 600 maxretry = 4 Fail2Ban nextcloud.conf failregex: [Definition] failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: ''\)","level":2,"time":".*"} Email received from Fail2Ban: From: Fail2Ban Sent: Sunday, January 22, 2017 6:28 AM To: serverwarning@domain.com Subject: [Fail2Ban] nextcloud: banned 162.82.215.201 from share Hi, The IP 162.82.215.201 has just been banned by Fail2Ban after 8 attempts against nextcloud.