Why is my apache log being spammed

with messages like:

172.17.2.118 - - [06/Sep/2020:19:46:35 +0100] "GET /nextcloud/ocs/v2.php/core/navigation/apps?absolute=true&format=json HTTP/1.1" 304 - "-" "Mozilla/5.0 (Windows) mirall/3.0.1stable-Win64 (build 20200828) (Nextcloud)"
172.17.2.118 - - [06/Sep/2020:19:46:35 +0100] "PROPFIND /nextcloud/remote.php/dav/files/d70fe274-b2e2-1031-8364-07b6468f0715/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/3.0.1stable-Win64 (build 20200828) (Nextcloud)"
172.17.2.118 - - [06/Sep/2020:19:46:35 +0100] "PROPFIND /nextcloud/remote.php/dav/files/d70fe274-b2e2-1031-8364-07b6468f0715/ HTTP/1.1" 207 427 "-" "Mozilla/5.0 (Windows) mirall/3.0.1stable-Win64 (build 20200828) (Nextcloud)"
172.17.2.118 - - [06/Sep/2020:19:47:06 +0100] "PROPFIND /nextcloud/remote.php/dav/files/d70fe274-b2e2-1031-8364-07b6468f0715/ HTTP/1.1" 207 427 "-" "Mozilla/5.0 (Windows) mirall/3.0.1stable-Win64 (build 20200828) (Nextcloud)"
172.17.2.118 - - [06/Sep/2020:19:47:07 +0100] "PROPFIND /nextcloud/remote.php/dav/files/d70fe274-b2e2-1031-8364-07b6468f0715/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/3.0.1stable-Win64 (build 20200828) (Nextcloud)"

The sequence is not always the same but the content is,

Running NC 19.0.0 on the server and NC3.x on the desktop (but the desktop was giving the same messages before upgrading to NC3.x.

@KeyCDN, Please let me know how this is supposed to help?

The article explains what the access log is. Nextcloud desktop client is accessing your webserver to synchronize files hence the requests are logged to the access log.

Ouch. I understand the apache log file. So for a single desktop I am getting about 6MB of logs a week without ever changing any files. That will add up to a lot of logs with multiple users, especially if they change files.

Yeah. One should invent a tool to automatically rotate log files :upside_down_face:

Jokes aside :slight_smile: Log rotation is what you are looking for or how to disable the access log.

The logs do rotate fine. I just like to keep my logs as clean as possible without repeating data, especially when it repeats that fast. It makes it much harder to find useful bits of logs.

Maybe this helps you further:

And what fix are you thinking of? It’s possible to change the intervals for the desktop client: https://docs.nextcloud.com/desktop/3.0/advancedusage.html#options. But the sync clients will always talk to your web server. That’s what the sync client is supposed to do. Another option could be to not use the sync client and use web dav to mount it locally on demand (but this will also produce log entries).

You are doing it wrong :wink: To reduce the number of log entries is quite impossible for a service connected to the internet nowdays. But there are tools to analyze your log files and notify you if something unusual is happening.

I’m afraid that isn’t totally true. You can often do things to cut down on spurious logging but unfortunately you can’t use rsyslog filters on apache logs. I also use logwatch to have a look at the logs daily. There may be other tools but often there is no substitute for a glance at the logs.

Can you tell me how you are using logwatch with nextcloud logs? I am trying to use it, but it’s not a recognized service in the tool. I don’t know how to customize it, besides adding the nextcloud log folder location in the logwatch config file.

My NC installation logs directly to the apache logs in /var/log/httpd. I don’t find customisng logwatch easy and do it as little as possible, just tweaking here and there.

Hi. The main apache configurations are here:

  • /etc/apache2/apache2.conf
  • /etc/apache2/sites-enabled/000-default.conf
  • /etc/apache2/conf-available/other-vhosts-access-log.conf

You can change the logging for the webserver as you wish. For me it was a bit tricky, because I’m running NC in Docker. I entered in the container’s terminal, printed out these two files, and mapped them as persistent data:

nextcloud:
image: nextcloud
container_name: nextcloud
links:
- mariadb
depends_on:
- mariadb
environment:
- TZ=Europe/…
volumes:
- /…/nextcloud:/var/www/html
- /…/nextcloud/apache2/apache2.conf:/etc/apache2/apache2.conf
- /…/nextcloud/apache2/000-default.conf:/etc/apache2/sites-enabled/000-default.conf
- /…/nextcloud/apache2/other-vhosts-access-log.conf:/etc/apache2/conf-available/other-vhosts-access-log.conf
ports:
- …:80
restart: unless-stopped

My changes:

  • apache2.conf:

(143) LogLevel error ← changed to ‘error’
(213) # LogFormat “%v:%p %h %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” vhost_combined ← commented out
(214) # LogFormat “%h %l %u %t “%r” %>s %O “%{Referer}i” “%{User-Agent}i”” combined ← commented out

  • 000-default.conf file:

(21) # CustomLog ${APACHE_LOG_DIR}/access.log combined ← commented out

  • other-vhosts-access-log.conf:

(2) # CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined ← commented out

Im not an expert in apache, especially not in logging configuration.