if you have admin_audit enabled maybe the easiest way would be to extract the list of users and their clients from the audit.log.
This file hold user actions and is JSON formatted. the example below shows initial unauthenticated request (user is βββ), once the user successfully login user field becomes populatedβ¦
{
"reqId": "asSZfp8wE6FgWnSZn5Xq",
"level": 1,
"time": "2022-08-10T11:35:00+00:00",
"remoteAddr": "192.168.11.204",
"user": "--",
"app": "admin_audit",
"method": "GET",
"url": "/ocs/v2.php/cloud/capabilities",
"message": "Login attempt: \"mytestuser\"",
"userAgent": "Mozilla/5.0 (Android) Nextcloud-Talk v14.1.0",
"version": "24.0.3.2",
"data": {
"app": "admin_audit"
}
}
in your case interesting fields would be user and userAgent. you can process this file with jq
command and filter and extract this attributes:
cat audit.log|jq '{user: .user, userAgent: .userAgent}'|jq --slurp 'unique_by(.user, .userAgent)'
Explanation:
-
cat audit.log|
first output the content of the audit.log and pipe it to jq
-
|jq '{user: .user, userAgent: .userAgent}'
using jq only process user and userAgent from each log line (and create new JSON string with this data)
-
|jq --slurp 'unique_by(.user, .userAgent)'
use another jq instance to build unique list
Depending on your goal you may filter by specific userAgent (mirall is desktop client):
cat audit.log | jq 'select(.userAgent |test("mirall")) | {user: .user, userAgent: .userAgent}' | jq --slurp 'unique_by(.user, .userAgent)'
or specific user:
cat audit.log | jq 'select(.user |test("mytestuser")) | {user: .user, userAgent: .userAgent}' | jq --slurp 'unique_by(.user, .userAgent)'
if you want you can export this as csv as well
cat audit.log|jq 'select(.userAgent |test("mirall")) | {user: .user, userAgent: .userAgent}'|jq --slurp 'unique_by(.user, .userAgent)|.[] |flatten|@csv'
hope this helps you further. Definitely it is possible to collect the data from nermal nextcloud.log as well but it is definitely harder as this logs hold much more (diferent) information so itβs harder to extract useful data there.