Audit Log #

The audit_log app records who did what and when: logins, file access, shares, changes to accounts and groups, tags, comments, enabling and disabling apps, and every occ command. It is meant for instances that have to prove who accessed or changed what. Each entry is one line of JSON that SIEM systems such as Splunk, ELK, or Graylog can ingest directly.

Requirements #

Installation #

1. Request the API key from BW-Tech GmbH.
2. Open Market from the app menu in the top left. In the left column under Settings, click Add API Key.
3. Paste the key into the "Your personal API Key" field and click Save. The Market checks the key with the Marketplace and reloads the catalog. If the key was accepted, the entry in the left column now reads Edit API Key. If it still reads Add API Key, the key was rejected and not saved.
4. Go to the "Audit Log" app and click Install.

On the command line, once the key is entered:

sudo -u www-data php8.4 occ market:install audit_log

market:install downloads, installs, and enables the app. If the app is already present but disabled, run sudo -u www-data php8.4 occ app:enable audit_log. How to enter the key on the command line, and what to watch out for, is described for the BW-Tech File Firewall.

Configuration #

Separate log file #

Always set up a separate file. Without one, the app writes through the server log at the info level, and with the default level 2 (warning) the server drops these entries.

sudo install -d -o www-data -g www-data -m 0750 /var/log/owncloud.online
sudo -u www-data php8.4 occ config:system:set log.conditions 0 apps 0 --value admin_audit
sudo -u www-data php8.4 occ config:system:set log.conditions 0 logfile --value /var/log/owncloud.online/audit.log
sudo -u www-data php8.4 occ config:system:get log.conditions

If log.conditions already has entries, use the next free number instead of 0. The same entry directly in config/config.php:

'log.conditions' => [
    [
        'apps' => ['admin_audit'],
        'logfile' => '/var/log/owncloud.online/audit.log',
    ],
],

The entries carry the ID admin_audit. With a separate file, the app writes there directly, and the server's log level does not matter. If the file does not exist, the app creates it with permissions 0640.

Options #

Set app values like this:

sudo -u www-data php8.4 occ config:app:set audit_log log_rotate_max_files --value 30

Web interface #

The app has its own section: Settings → Admin → Audit Log.

Command line #

sudo -u www-data php8.4 occ audit:list -u anna -a file_read --from 2026-10-01 --to 2026-10-28
sudo -u www-data php8.4 occ audit:tail

A date without a time covers the whole day, in the time zone from logtimezone.

What is recorded #

One entry, wrapped here for readability:

{
  "reqId": "4uAiwjMtXOfVyPyn5B7H",
  "level": 1,
  "time": "2026-10-28T13:17:43+00:00",
  "remoteAddr": "203.0.113.24",
  "user": "anna",
  "app": "admin_audit",
  "method": "POST",
  "url": "/index.php/login",
  "message": "User "anna" logged in successfully",
  "action": "user_login",
  "CLI": false,
  "userAgent": "Mozilla/5.0 (…)",
  "success": true,
  "login": "anna",
  "auditUsers": ["anna"],
  "auditGroups": ["sales"]
}

Rotation #

A background job checks the separate file once a day. Once it has reached log_rotate_size, the job renames it to audit.log.1, moves older files up by one number, and deletes the oldest one beyond log_rotate_max_files. With the defaults, five older files are kept next to the current one, each at least 50 MB in size.

If you use logrotate instead, set log_rotate_size so high that the app never rotates. Running both at the same time leads to conflicts.

Without a separate file, the entries are in the server log. owncloud.online rotates that log itself (log_rotate_size in config/config.php, default 100 MB), and the app leaves it alone.

Usage #

Users do not see the app.

Limits and notes #

• Volume. Every read of a file creates a file_read entry. On busy instances, expect large log files and plan rotation and retention accordingly.
• Retention. With the defaults, rotation deletes older entries. If you must keep entries longer, raise log_rotate_max_files or forward the file to a SIEM system.
• Secrets on the command line. command_executed contains the complete command line. Passwords or keys that you pass to an occ command as an argument end up in the log.
• Gaps in version 1.3.2. The following is not recorded:
  • changes to app and system settings in the web interface; changes made with occ appear only as command_executed,
  • switching to another account with Impersonate; whatever happens afterwards is recorded under the other account,
  • two-factor authentication,
  • creating, renaming, and leaving custom groups. Only the deletion of such a group is recorded completely; for members and roles, the affected account is missing.
• Personal data. The log contains accounts, IP addresses, and file paths. Restrict access to the file and agree on a retention period with your data protection officer.
• Web interface and download read only the current file, not rotated ones.
• Reverse proxy. For remoteAddr to contain the client's address and not the proxy's, trusted_proxies must be correct, see Reverse proxy and TLS.

How the general server log works is described in Server log and error messages.

Troubleshooting #