Nextcloud Snap - how to check for login attempts?

[ernolf]

@jtr

Admin → Logging

Afaik, login attempts are not logged in nextcloud server log.

@YamiYukiSenpai

if anyone else has been trying to log into my Nextcloud

you must activate the audit logfile (as a file, not in syslog). Then you can monitor all login attempts with a jq-filter:

tail -F /path/to/audit.log | jq -r 'select(.message | test("Login|Logout")) | [.time, .remoteAddr, .user, .method, .url, .message, .userAgent] | join(" - ")'

Here I explained it more in deep:

Is there any admin_audit parameter to filter or limit events to be logged?

The audit.log is, as the nextcloud.log in json format. The great thing about json is its filterability. The command-line JSON processor jq is needed for this. Here some examples: Follow the audit.log in a compact format, beginning with the last 100 lines: tail -Fn 100 /path/to/audit.log | jq -r '[.time, .remoteAddr, .user, .method, .url, .message, .userAgent] | join(" - ")'" tail -F /path/to/audit.log | jq -r 'select(.message | test("Login|Logout")) | [.time, .remoteAddr, .user, .method, …

Much luck,
ernolf