Set the size of the logging file audit.log (log rotate)

Hello!
I have a problem with the size settings of the logging file in the data folder on the server. I am following the instructions, according to the following sources:

https://docs.nextcloud.com/server/20/admin_manual/configuration_server/occ_command.html
I also checked the information from reliable sources that the maximum size of this file is 100 MB by default.
But despite all this information, the size of the logging file is growing more and more, exceeding the above-mentioned factors and settings.
Based on this, the question is: what exactly and how should I do to set the parameter for configuring the size of the logging file, that is, its rotation?

My configuration file:

<?php
$CONFIG = array (
'instanceid' => 'ocrz2kpko6i9',
'passwordsalt' => 'sv9SxNQLhWdVY4o4FxBBDXTmb9a9f6',
'secret' => 'LYEXp4v8tQzVM4m5H4Pgc4NpEaA5e2DGKcV4vfNoHD8O8mgv',
'trusted_domains' =>
array (
0 => 'nextcloud',
),
'datadirectory' => '/var/www/nextcloud/data',
'dbtype' => 'mysql',
'version' => '27.1.3.2',
'overwrite.cli.url' => 'http://nextcloud/nextcloud',
'dbname' => 'znextclouddb',
'dbhost' => 'localhost',
'dbport' => '',
'dbtableprefix' => 'oc_',
'mysql.utf8mb4' => true,
'dbuser' => 'ea',
'dbpassword' => 'flvw003',
'installed' => true,
'log_query' => false,
'log_type' => 'file',
'logfile' => '/var/www/nextcloud/data/audit.log',
'logfilemode' => 0640,
'loglevel' => '0',
'log.condition' => [
'apps' => ['admin_audit'],
],
'logfile_audit' => '/var/www/nextcloud/data/audit.log',
'logdateformat' => 'F d, Y H:i:s',
'logtimezone' => 'Europe/Moscow',
'log_rotate_size' => 10485760,
);

My request for parameter settings in the console:

sudo -u www-data php /var/www/nextcloud/occ log:file --rotate-size=10MB
[sudo] password for ea:
Log backend file: enabled
Log file: /var/www/nextcloud/data/nextcloud.log
Rotate at: 10 MB

sudo -u www-data php /var/www/nextcloud/occ log:file
[sudo] password for ea:
Log backend file: enabled
Log file: /var/www/nextcloud/data/nextcloud.log
Rotate at: 10 MB

And also, in addition to my question, I want to ask another one. Can I receive events from logs in real time in turn so that they come as push notifications not to the server, but to another remote machine?

hi @Danil_Kovalenko welcome to the forum :handshake:

Please use code marks to make you posts more readable.

You mix two different things. The mentioned blog describes log rotation performed by an OS and not NC application itself.

The occ command you show looks right. In my system the change is visible but I can’t say right now log rotation adopts the new setting. Earlier the system was rotating the file every 100MB (according to default config).

you can use syslog as described in official Logging docs and process the logs in real-time manner.

My console, immediately after I set a certain value, confirmed the file rotation size as 10 MB. I also set this value in the configuration file to be even more sure that one of these parameters will actually affect the file size and stop its growth when the corresponding value is reached. But after saving the parameters and restarting the system, after a certain period of time the size of the existing file grew from 0 MB to 300 MB, and it seems to me that it would not have stopped and increased further, although for me it is critical to control the size of this file and not let it become too heavy. In theory, after passing the set value, the nextcloud.log.1 or nextcloud1.log file should have been created, but the nextcloud.log file continues to grow. Maybe I forgot something or didn’t take it into account? I don’t even need this personally, but for work, so it’s fundamentally important to find the answer and solve this problem.

‘log_rotate_size’ => 1048576,
‘logfile’ => ‘/var/www/nextcloud/data/nextcloud.log’,
‘logfile_audit’ => ‘/var/www/nextcloud/data/nextcloud.log’,

sudo -u www-data php /var/www/nextcloud/occ log:file
Log backend file: enabled
Log file: /var/www/nextcloud/data/nextcloud.log
Rotate at: 1 MB

I don’t see a lot you can do wrong. I have to check if my new value works - the old value of 100MB worked good (in my Docker installation) and the file didn’t grow higher and 1 history file nextcloud.log.1 was kept until the next rotation cycle. now I set it to 1MB in my test system - will see what happens

The output you posted does not match your posted configuration.

Can you please post the output of occ config:list system since it is multi-config.php aware? It’ll also take care of redacting sensitive values.

ea@nextcloud:~$ sudo -u www-data php /var/www/nextcloud/occ config:list system
[sudo] password for ea:
{
“system”: {
“instanceid”: “REMOVED SENSITIVE VALUE”,
“passwordsalt”: “REMOVED SENSITIVE VALUE”,
“secret”: “REMOVED SENSITIVE VALUE”,
“trusted_domains”: [
“nextcloud”
],
“datadirectory”: “REMOVED SENSITIVE VALUE”,
“dbtype”: “mysql”,
“version”: “27.1.3.2”,
“overwrite.cli.url”: “http://nextcloud/nextcloud”,
“dbname”: “REMOVED SENSITIVE VALUE”,
“dbhost”: “REMOVED SENSITIVE VALUE”,
“dbport”: “”,
“dbtableprefix”: “oc_”,
“mysql.utf8mb4”: true,
“dbuser”: “REMOVED SENSITIVE VALUE”,
“dbpassword”: “REMOVED SENSITIVE VALUE”,
“installed”: true,
“log_query”: false,
“log_type”: “file”,
“logfile”: “/var/www/nextcloud/data/nextcloud.log”,
“logfilemode”: 416,
“loglevel”: “0”,
“log.condition”: {
“apps”: [
“admin_audit”
]
},
“logfile_audit”: “/var/www/nextcloud/data/nextcloud.log”,
“logdateformat”: “F d, Y H:i:s”,
“logtimezone”: “Europe/Moscow”,
“log_rotate_size”: 104857600
}
}

I already changed the log file name to ‘logfile’ => ‘/var/www/nextcloud/data/nextcloud.log’, but that didn’t help me and with the 100 MB limit the file size is already 239 MB. I’m just desperate, why doesn’t such a primitive instruction fulfill the promised functionality?

Can I ask you to clarify for me some points that may influence the refusal of the parameters I have set to limit the size of the logging file?
Are there any questions you could ask me that would help you determine what’s wrong with my system?

I’m sorry I understand the statement “it works on my machine” is not very satisfactional :wink:

but till now my Docker/Apache system did rotate the logs at 100MB in the past which was OK for me. I changed the setting in my lab system but this one still didn’t hit 1MB limit so I can’t say it works now. for this reason I reduced the rotate limit in my real system but this one is small as well - I will report if it worked…

in my system I see

      # 10MB
        "log_rotate_size": 10485760
       # 1MB
        "log_rotate_size": 1048576

after running respective occ log:file --rotate-size=10MB which makes me think changing the setting with occ works and your system uses 100MB rotate size… but according to your post it doesn’t work either… I will check later if new setting works

UPDATE: I can confirm log rotation works. I don’t know this is required but I restarted my app container after setting new value - and some minutes later my nextcloud.logbecame nextcloud.log.1 with the size the file had at this time - 61MB and new very small nextcloud.log was created. So log rotation works as expected (NC 28.0.1 Docker/apache). I’m not sure if rotation is done by the cron job - please review if the cron runs on your system.

I tried setting the parameter values to 1 MB, 10 MB and 100 MB, but the file size ended up successfully exceeding all of these limits, so it seems to me that the problem is not the size limit, but some other limit that I am not aware of at this time day of nuances. Maybe you could send your version of the configuration file so that I can compare it with mine? Or any other option you might suggest.

I double checked the list of Background Tasks (internal NC cron) and it looks log rotate happens there ( OC\Log\Rotate, OCA\AdminAudit\BackgroundJobs\Rotate) - please double check your cron is running well

job list in NC 28.0.1 looks like below: (from "select id,class from nextcloud.oc_jobs";)
+------+-----------------------------------------------------------------+
| id   | class                                                           |
+------+-----------------------------------------------------------------+
|   37 | OCA\Activity\BackgroundJob\DigestMail                           |
|    1 | OCA\Activity\BackgroundJob\EmailNotification                    |
|    2 | OCA\Activity\BackgroundJob\ExpireActivities                     |
|  236 | OCA\AdminAudit\BackgroundJobs\Rotate                            |
|  481 | OCA\Calendar\BackgroundJob\CleanUpOutdatedBookingsJob           |
|   98 | OCA\Circles\Cron\Maintenance                                    |
|    3 | OCA\ContactsInteraction\BackgroundJob\CleanupJob                |
|   55 | OCA\Contacts\Cron\SocialUpdateRegistration                      |
|  206 | OCA\DAV\BackgroundJob\CalendarRetentionJob                      |
|    4 | OCA\DAV\BackgroundJob\CleanupDirectLinksJob                     |
|    6 | OCA\DAV\BackgroundJob\CleanupInvitationTokenJob                 |
|    7 | OCA\DAV\BackgroundJob\EventReminderJob                          |
|  703 | OCA\DAV\BackgroundJob\PruneOutdatedSyncTokensJob                |
|    5 | OCA\DAV\BackgroundJob\UpdateCalendarResourcesRoomsBackgroundJob |
|    8 | OCA\Federation\SyncJob                                          |
|  924 | OCA\FilesReminders\BackgroundJob\CleanUpReminders               |
|  925 | OCA\FilesReminders\BackgroundJob\ScheduledNotifications         |
|   12 | OCA\Files\BackgroundJob\CleanupDirectEditingTokens              |
|   11 | OCA\Files\BackgroundJob\CleanupFileLocks                        |
|  603 | OCA\Files\BackgroundJob\DeleteExpiredOpenLocalEditor            |
|   10 | OCA\Files\BackgroundJob\DeleteOrphanedItems                     |
|    9 | OCA\Files\BackgroundJob\ScanFiles                               |
|   42 | OCA\Files_External\BackgroundJob\CredentialsCleanup             |
|   15 | OCA\Files_Sharing\BackgroundJob\FederatedSharesDiscoverJob      |
|   13 | OCA\Files_Sharing\DeleteOrphanedSharesJob                       |
|   14 | OCA\Files_Sharing\ExpireSharesJob                               |
|   16 | OCA\Files_Trashbin\BackgroundJob\ExpireTrash                    |
|   17 | OCA\Files_Versions\BackgroundJob\ExpireVersions                 |
|  287 | OCA\GroupFolders\BackgroundJob\ExpireGroupTrash                 |
|  229 | OCA\GroupFolders\BackgroundJob\ExpireGroupVersions              |
|  297 | OCA\Mail\BackgroundJob\CleanupJob                               |
|  919 | OCA\Mail\BackgroundJob\DraftsJob                                |
|  608 | OCA\Mail\BackgroundJob\IMipMessageJob                           |
|  298 | OCA\Mail\BackgroundJob\OutboxWorkerJob                          |
|  607 | OCA\Mail\BackgroundJob\PreviewEnhancementProcessingJob          |
|  918 | OCA\Mail\BackgroundJob\QuotaJob                                 |
|  482 | OCA\Mail\BackgroundJob\SyncJob                                  |
|  483 | OCA\Mail\BackgroundJob\TrainImportanceClassifierJob             |
|  920 | OCA\Mail\BackgroundJob\TrashRetentionJob                        |
|  921 | OCA\Mail\BackgroundJob\WakeJob                                  |
|   18 | OCA\NextcloudAnnouncements\Cron\Crawler                         |
|  248 | OCA\Notifications\BackgroundJob\GenerateUserSettings            |
|  249 | OCA\Notifications\BackgroundJob\SendNotificationMails           |
| 1221 | OCA\OAuth2\BackgroundJob\CleanupExpiredAuthorizationCode        |
|  701 | OCA\Photos\Jobs\AutomaticPlaceMapperJob                         |
|  252 | OCA\Richdocuments\Backgroundjobs\Cleanup                        |
|   52 | OCA\Richdocuments\Backgroundjobs\ObtainCapabilities             |
|  207 | OCA\ServerInfo\Jobs\UpdateStorageStats                          |
|   19 | OCA\Support\BackgroundJobs\CheckSubscription                    |
|  291 | OCA\Survey_Client\BackgroundJobs\MonthlyReport                  |
|   93 | OCA\Talk\BackgroundJob\CheckHostedSignalingServer               |
|   94 | OCA\Talk\BackgroundJob\CheckMatterbridges                       |
|  610 | OCA\Talk\BackgroundJob\ExpireChatMessages                       |
|   89 | OCA\Talk\BackgroundJob\ExpireSignalingMessage                   |
|  923 | OCA\Talk\BackgroundJob\Reminder                                 |
|   90 | OCA\Talk\BackgroundJob\RemoveEmptyRooms                         |
|   91 | OCA\Talk\BackgroundJob\ResetAssignedSignalingServer             |
|   21 | OCA\Text\Cron\Cleanup                                           |
|   56 | OCA\TwoFactorBackupCodes\BackgroundJob\RememberBackupCodesJob   |
|   58 | OCA\TwoFactorBackupCodes\BackgroundJob\RememberBackupCodesJob   |
|  274 | OCA\TwoFactorNextcloudNotification\BackgroundJob\CleanupTokens  |
|   22 | OCA\UpdateNotification\Notification\BackgroundJob               |
|  725 | OCA\UpdateNotification\ResetTokenBackgroundJob                  |
|  602 | OCA\UserOIDC\Cron\CleanupSessions                               |
|   45 | OCA\UserStatus\BackgroundJob\ClearOldStatusesBackgroundJob      |
|   23 | OCA\WorkflowEngine\BackgroundJobs\Rotate                        |
|  562 | OC\Authentication\Token\TokenCleanupJob                         |
|   32 | OC\Core\BackgroundJobs\CleanupLoginFlowV2                       |
|   25 | OC\Log\Rotate                                                   |
|   26 | OC\Preview\BackgroundCleanupJob                                 |
|   63 | OC\Security\Bruteforce\CleanupJob                               |
|  917 | OC\TextProcessing\RemoveOldTasksBackgroundJob                   |
| 1229 | OC\TextToImage\RemoveOldTasksBackgroundJob                      |
+------+-----------------------------------------------------------------+

My version of the table you gave as an example

±----±----------------------------------------------------------------+
| id | class |
±----±----------------------------------------------------------------+
| 29 | OCA\Activity\BackgroundJob\DigestMail |
| 27 | OCA\Activity\BackgroundJob\EmailNotification |
| 28 | OCA\Activity\BackgroundJob\ExpireActivities |
| 69 | OCA\AdminAudit\BackgroundJobs\Rotate |
| 50 | OCA\Calendar\BackgroundJob\CleanUpOutdatedBookingsJob |
| 13 | OCA\Circles\Cron\Maintenance |
| 33 | OCA\ContactsInteraction\BackgroundJob\CleanupJob |
| 51 | OCA\Contacts\Cron\SocialUpdateRegistration |
| 11 | OCA\DAV\BackgroundJob\CalendarRetentionJob |
| 7 | OCA\DAV\BackgroundJob\CleanupDirectLinksJob |
| 9 | OCA\DAV\BackgroundJob\CleanupInvitationTokenJob |
| 10 | OCA\DAV\BackgroundJob\EventReminderJob |
| 12 | OCA\DAV\BackgroundJob\PruneOutdatedSyncTokensJob |
| 8 | OCA\DAV\BackgroundJob\UpdateCalendarResourcesRoomsBackgroundJob |
| 16 | OCA\Federation\SyncJob |
| 112 | OCA\FilesLock\Cron\Unlock |
| 3 | OCA\FilesReminders\BackgroundJob\CleanUpReminders |
| 4 | OCA\FilesReminders\BackgroundJob\ScheduledNotifications |
| 20 | OCA\Files\BackgroundJob\CleanupDirectEditingTokens |
| 19 | OCA\Files\BackgroundJob\CleanupFileLocks |
| 21 | OCA\Files\BackgroundJob\DeleteExpiredOpenLocalEditor |
| 18 | OCA\Files\BackgroundJob\DeleteOrphanedItems |
| 17 | OCA\Files\BackgroundJob\ScanFiles |
| 103 | OCA\Files_External\BackgroundJob\CredentialsCleanup |
| 25 | OCA\Files_Sharing\BackgroundJob\FederatedSharesDiscoverJob |
| 23 | OCA\Files_Sharing\DeleteOrphanedSharesJob |
| 24 | OCA\Files_Sharing\ExpireSharesJob |
| 6 | OCA\Files_Trashbin\BackgroundJob\ExpireTrash |
| 26 | OCA\Files_Versions\BackgroundJob\ExpireVersions |
| 111 | OCA\GroupFolders\BackgroundJob\ExpireGroupTrash |
| 110 | OCA\GroupFolders\BackgroundJob\ExpireGroupVersions |
| 52 | OCA\Mail\BackgroundJob\CleanupJob |
| 55 | OCA\Mail\BackgroundJob\DraftsJob |
| 54 | OCA\Mail\BackgroundJob\IMipMessageJob |
| 53 | OCA\Mail\BackgroundJob\OutboxWorkerJob |
| 56 | OCA\Mail\BackgroundJob\TrashRetentionJob |
| 57 | OCA\Mail\BackgroundJob\WakeJob |
| 32 | OCA\NextcloudAnnouncements\Cron\Crawler |
| 30 | OCA\Notifications\BackgroundJob\GenerateUserSettings |
| 31 | OCA\Notifications\BackgroundJob\SendNotificationMails |
| 34 | OCA\Photos\Jobs\AutomaticPlaceMapperJob |
| 59 | OCA\Richdocuments\Backgroundjobs\Cleanup |
| 58 | OCA\Richdocuments\Backgroundjobs\ObtainCapabilities |
| 2 | OCA\ServerInfo\Jobs\UpdateStorageStats |
| 143 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 144 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 145 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 146 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 147 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 148 | OCA\Settings\BackgroundJobs\VerifyUserData |
| 5 | OCA\Support\BackgroundJobs\CheckSubscription |
| 60 | OCA\Talk\BackgroundJob\CheckHostedSignalingServer |
| 61 | OCA\Talk\BackgroundJob\CheckMatterbridges |
| 142 | OCA\Talk\BackgroundJob\CheckReferenceIdColumn |
| 63 | OCA\Talk\BackgroundJob\ExpireChatMessages |
| 64 | OCA\Talk\BackgroundJob\ExpireSignalingMessage |
| 65 | OCA\Talk\BackgroundJob\Reminder |
| 66 | OCA\Talk\BackgroundJob\RemoveEmptyRooms |
| 67 | OCA\Talk\BackgroundJob\ResetAssignedSignalingServer |
| 1 | OCA\Text\Cron\Cleanup |
| 22 | OCA\UpdateNotification\Notification\BackgroundJob |
| 14 | OCA\UserStatus\BackgroundJob\ClearOldStatusesBackgroundJob |
| 15 | OCA\WorkflowEngine\BackgroundJobs\Rotate |
| 35 | OC\Authentication\Token\TokenCleanupJob |
| 36 | OC\Log\Rotate |
| 37 | OC\Preview\BackgroundCleanupJob |
| 38 | OC\TextProcessing\RemoveOldTasksBackgroundJob |
±----±----------------------------------------------------------------+

You should do logrotation by the logrotate daemon instead of the nextcloud server itself.
Unfortunately I could not find any information about your operating system but my example is for debian like operating systems like Ubuntu.

First of all, move your logfiles out of the netcloud data directory to /var/log/nextcloud/*

sudo mkdir -p /var/log/nextcloud
sudo chown www-data.www-data /var/log/nextcloud

Create this file (change the value of size to your needs):
/etc/logrotate.d/nextcloud

var/log/nextcloud/*.log {
    rotate -1
    su www-data www-data
    size 10485760
    missingok
    create 640 www-data www-data
    compress
    delaycompress
}

Change the log settings from your config.php (example like I use it):

config/config.php

  'logtimezone' => 'Europe/Moscow',
  'logfile' => '/var/log/nextcloud/nextcloud.log',
  'logfile_audit' => '/var/log/nextcloud/audit.log',
  'log.condition' => 
  array (
    'apps' => 
    array (
      0 => 'admin_audit',
    ),
  ),
  'log_query' => false,
  'loglevel' => 2,
  'log_rotate_size' => 0,

With 'log_rotate_size' => 0,Nextcloud does not logrotate at all and so it can be carried out by the operating system’s logrotate service, which is much more suitable for this purpose.

Hope this helps!

Much luck,
ernolf

1 Like

from the table you deleted earlier I see Nextclouds rotate jobs didn’t run since multiple days (Fri 22 Dec 16:00:04, Mon 25 Dec 12:42:19 - see unixtime in the column last_run) - I think this is the reason why the log keeps growing.

1 Like

Why could this process stop and stop working?

I think now it’s your job to find the reason why this and maybe other jobs don’t run…

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.