Readable Audit log?

tevfikceydeliler · February 9, 2021, 8:06am

Hi,
I collect my audit logs in another file as audit.log
But I cannot see audit logs on logging. Is there any way to read those log from a GUI or parsing method to export outside?

j-ed · February 9, 2021, 8:41am

Only the default nextcloud log can be read using an implemented gui. The audit log need to be set-up separately and cannot be displayed within Nextcloud at all. Check-out the administrator guide for further information:

https://docs.nextcloud.com/server/21/admin_manual/configuration_server/logging_configuration.html?highlight=audit#logging

tevfikceydeliler · February 9, 2021, 9:26am

Thanks for quick reply. But I read already ant set up my audit log by using this document. All I want to know is there any parsing method or etc. to export those log to outside to more readable format.
Regards,

gas85 · February 9, 2021, 1:29pm

For example I use it with Cacti:

github.com

GAS85/nextcloud_scripts/blob/master/nextcloud-auditlog.sh

#!/bin/bash
 
# By Georgiy Sitnikov.
#
# AS-IS without any warranty

NextCloudPath=/var/www/nextcloud

knownUsersList=

lastMinutes=5

#LogFilePath=/var/www/nextcloud/data/audit.log

tempfile=/tmp/nextcloud_auditlog_$(date +"%M-%N").tmp

show_help () {

	echo "This script will fetch data from the Nextclud audit.log and make it Human or Cacti readable.
Syntax is nextcloud-auditlog.sh -h?Hcan <user>

This file has been truncated. show original

tevfikceydeliler · February 9, 2021, 1:45pm

Cool!
really thank you. May I ask , How cacti read this? Which cacti plugin ?

gas85 · February 9, 2021, 7:13pm

It is offtopic of this forum, so short story:
Basically scipt will produce output as Cacti wants:

sudo -u www-data /var/www/cacti/scripts/nextcloud_auditlog.sh -n
Login_UnknownUser:6 FileAccess_UnknownUser:0 FileWritten_UnknownUser:0 FileCreated_UnknownUser:0 FileDeleted_UnknownUser:0 New_Share_UnknownUser:0 Share_access_UnknownUser:0 Preview_access_UnknownUser:0

Just create “Data Input Method” with path to the script. e.g. <path_cacti>/scripts/nextcloud_auditlog.sh <user>

Then you need to create “Data Source”, with enabled Field “User” e.g.:

You can create graphs per user:

tevfikceydeliler · February 10, 2021, 1:21pm

Really Thank you.