Audit log file fed but not displayed through the admin web interface

[oxlanech]

Steps to reproduce

1. Activate debug level logging (0) in config/config.php
2. Activate Audit Nextcloud app from the web administration panel
3. Login and logout several times
4. Login back with an admin account and go to the administration panel: the login and logout requests are not displayed
5. However, these requests are logged in the audit.log file

Expected behaviour

The content of the audit.log file should be displayed in the web administration logging panel

Actual behaviour

Login or log out requests are not displayed on the web interface

Server configuration

Operating system: Debian 9

Web server: Apache 2

Database: Mysql

PHP version: 7

Nextcloud version: 16.0.3

Updated from an older Nextcloud/ownCloud or fresh install: fresh install

List of activated apps:

App list

Auditing / Logging

Nextcloud configuration:

Config report

'owsk6pnizeou', 'passwordsalt' => 'xxxxx' 'secret' => 'xxxxx', 'trusted_domains' => array ( 0 => 'nextcloud.intra.inet, ), 'datadirectory' => '/home/nextclouduser', 'dbtype' => 'mysql', 'version' => '16.0.3.0', 'overwrite.cli.url' => 'https://nextcloud.intra.inet', 'dbname' => 'xxxx', 'dbhost' => 'xxxx', 'dbport' => '', 'dbtableprefix' => 'oc_', 'mysql.utf8mb4' => true, 'dbuser' => 'nextcloud', 'dbpassword' => '', 'installed' => true, 'log_type' => 'file', 'logfile' => 'nextcloud.log', 'loglevel' => '0', );

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser: Firefox/60.0

Operating system: Microsoft Windows 10

Logs

Web server error log

Web server error log

No error in the error log

Nextcloud log

Nextcloud log

{"reqId":"xxxx","level":0,"time":"August 16, 2019 10:12:45","remoteAddr":"10.100.20.19","user":"--","app":"cron","method":"GET","url":"\/cron.php","message":"Run OC\\Log\\Rotate job with ID 20","userAgent":"Mozilla\/5.0 Gecko\/20100101 Firefox\/60.0","version":"16.0.3.0"}

Nextcloud audit log

``` {"reqId":"A2rPl1W4l4JQTIOih1aS","level":1,"time":"August 16, 2019 13:16:56","remoteAddr":"10.100.18.116","user":"Admin01","app":"admin_audit","method":"GET","url":"\/ocs\/v2.php\/apps\/notifications\/api\/v2\/notifications","message":"Login successful: \"Admin01\"","userAgent":"Mozilla\/5.0 (Windows 10 rv:58.0) Gecko\/20100101 Firefox\/60.0","version":"16.0.3.0"} ```

[luixal]

Same thing here.

I'm using docker oficial image and can't get the audit log working... any ideas?

[Nividan]

Same issue here. Nextcloud on Apache2.

[GambaJo]

Same here (apache2, without docker).

[jmartin-oss]

Same problem. Tested on:
NC 15.0.14 with apache2 (no docker)
NC 17.0.2 with apache2 (no docker)

[jmartin-oss]

Tested also with NC 18.0.1 with apache2 (no docker) and still have the same problem

[GambaJo]

maybe the problem is not the logreader but the log itself. I think, the log is in JSON format. Maybe the JSON stucture in the log file is corrupt.

[jmartin-oss]

GambaJo, I don't think so, the JSON structure is pretty the same compared to nextcloud.log.

I think that the problem could be because logreader is ignoring 'audit.log' file and only reading 'nextcloud.log' file, all the events in nextcloud.log are represented but audit.log ones are absent.

I tried to move audit.log file out of the cloud storage to /var/log/nextcloud/audit.log for avoiding permissions problem, locating it in the same place that nextcloud.log without success.

[GambaJo]

I updated NC to 18.0.1 and now I can see the log.

[jmartin-oss]

I updated some days ago to 18.0.1 and I still cannot view the logs.
Can you share the admin_audit section obtained with the command: occ config:list

This is mine:
"admin_audit": {
"enabled": "yes",
"installed_version": "1.8.0",
"logfile": "/var/log/nextcloud/audit.log",
"types": "logging"
},

Also version and logfile, please:
"version": "18.0.1.3",
"logfile": "/var/log/nextcloud/nextcloud.log",

[jmartin-oss]

Updated to 18.0.3 and I still cannot see the audit log in the admin web interface.
Any idea?

[aproposnix]

I never had this issue until I updated to NC 20 b1-2

Update: NC 20 B3 seems to have fixed it. I can see the logs again.

[joshtrichards]

The logreader currently only accesses the nextcloud.log. The audit log, however, can be integrated by configuring it to also log there. That's how you end up with an integrated view of everything in the Web UI.

Try this in your config.php (adjusting the path to your own nextcloud.log path):

  'log.condition' => [
          'apps' => [ 'admin_audit'],
  ],
  'logfile_audit' => '/var/www/html/data/nextcloud.log',

And make sure you don't have any other stray audit related references in your config.php