Record login repeat

ℹ️ Support
1

Recently I’m closely watching the INFO level information of the log. I may be concerned about login processing in that course.

INFO admin_audit Login attempt: “USERNAME01”
INFO admin_audit Login successful: “USERNAME01”
INFO admin_audit Login attempt: “USERNAME01”
INFO admin_audit Login successful: “USERNAME01”
INFO admin_audit Login attempt: “USERNAME01”
INFO admin_audit Login successful: “USERNAME01”
INFO admin_audit Login attempt: “USERNAME01”
INFO admin_audit Login successful: “USERNAME01”
INFO admin_audit Login attempt: “USERNAME01”
INFO admin_audit Login successful: “USERNAME01”

It is not all users and some users. Login work seems to be repeated continuously in a considerable number of times. Even if I change the user’s password, this state will not change. When this process appears in the log, it always repeats about 8 times. After a certain period of time, it recurred again.

This is not an error, so I can ignore it. But this number seems to be one of the reasons for enlarging the log file. Whether it is not an error, is this normal?

Nextcloud. 13.0.1 / nginx 1.10.11 / PHP 7.1.17 / CentOS 7.3

2

Hi @zoo3

If you are concerned I suggest you check your access log which IPs perform these logins. With geoiplookup you can then find out the location of that IP address(es).
With a series of logins it looks like a sync process to me. Maybe you can check if these are your IPs (mobile phone, PC, laptop), especially if you have the Nextcloud client installed or sync calendars and contacts with any devices.
Right now assuming this user, for which you see the login attempts is your user.