Dear all,
I have a doubt about my nextcloud configuration, and I want to make sure that I haven’t made any mistakes in my server configuration. When I look at my logs, sometimes I don’t have an authenticated user to indicate:
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:51 +0000 “GET /ocs/v2.php” 200
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:52 +0000 “GET /index.php” 200
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:52 +0000 “PROPFIND /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:53 +0000 “GET /index.php” 200
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:53 +0000 “PUT /ocs/v2.php” 200
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:54 +0000 “PROPFIND /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:54 +0000 “REPORT /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:56 +0000 “PROPFIND /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:56 +0000 “GET /index.php” 200
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:58:57 +0000 “REPORT /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:14:59:21 +0000 “GET /ocs/v2.php” 304
nextcloud-docker-app-1 | 172.16.3.5 - 11/Feb/2023:15:01:25 +0000 “GET /index.php” 204
nextcloud-docker-app-1 | 172.16.3.5 - Bob 11/Feb/2023:15:01:26 +0000 “PROPFIND /remote.php” 207
nextcloud-docker-app-1 | 172.16.3.5 - Bob 11/Feb/2023:15:01:26 +0000 “HEAD /remote.php” 200
This is an extract from my nextcloud logs, if you look at the first ones, you can see that there is no authenticated user (after ip and before date) while for the last 2 lines we find the name of authenticated users.
When I check the amount of data and the number of connections for this “unknown user”, I am a little scared. An extraction obtained with goaccess gives 4,518 visits (06.96%), 34 visitors (08.08%) and above all 134.1 MiB (56.88%) for a single week. Can you confirm that everything is fine and this is normal operation found on all nextcloud servers?
My server is on docker with:
- nginx-reverse-proxy
- nextcloud 25 in a subdir
Thank in advance