Nextcloud журнал ошибок

Managing Nextcloud snap logs

Tip:

Apps for viewing logs:
less is more, from head to tail with cat or bat but lnav is the way to go!

sudo lnav /var/snap/nextcloud/current/logs/nextcloud.log

Nextcloud snap log locations:

Logs for Nextcloud: `/var/snap/nextcloud/current/logs/nextcloud.log`
Logs for Apache2:   `/var/snap/nextcloud/current/logs/apache...`
Logs for Redis:     `/var/snap/nextcloud/current/logs/redis.log`
Logs for PHP-FPM:   `/var/snap/nextcloud/current/logs/php-fpm_errors.log`
Logs for PHP:       `/var/snap/nextcloud/current/logs/php_errors.log`
Logs for Certbot:   `/var/snap/nextcloud/current/certs/certbot/logs/letsencrypt.log`
Logs for MySQL:     `/var/snap/nextcloud/current/logs/mysql_errors.log`

Nextcloud snap service logs

@Kyrofa’s blog

Nextcloud snap has several services contained within it. There are four that are most important for upgrade purposes:

• MySQL (nextcloud.mysql)
• PHP (nextcloud.php-fpm)
• Apache (nextcloud.apache)
• Nextcloud Fixer (nextcloud.nextcloud-fixer)

MySQL

$ snap logs -f nextcloud.mysql

PHP

$ snap logs -f nextcloud.php-fpm

Apache

$ snap logs -f nextcloud.apache

Nextcloud Fixer

$ snap logs -f nextcloud.nextcloud-fixer

Issue debugging skript

Debugging skript

Go to NextCloud

Nextcloud log file

At first

Nextcloud is open source software that allows you to build online storage. With online storage, users can access it from anywhere, including take-out laptops and smartphones (although it does need to be published on the Internet). Convenience will improve, but companies need to have a firm grasp of who’s doing it, when, and what kind of operations they are doing. This time, we will introduce Nextcloud’s audit log function.

Plug-ins

The plug-in will be «Auditing/Logging». Since it is a plugin provided as a standard, I will enable it.

How to check

The audit log is mixed with other logs in the Nextcloud .log. You can also view and spit out logs on the management screen of the web interface, but it is easier to check if you log in to the actual machine. Nextcloud .log is located in the data directory (data storage area at the time of initial setup), so go to the data directory and check the Nextcloud .log. (For example, if /home/data is specified in the data directory)

cd /home/data

ls -la nextcloud.log
-rw-r----- 1 nginx nginx 49811897  3月  4 14:12 nextcloud.log

In the Nextcloud .log, the item «admin_audit» is the audit log. Try grepping all audit logs.

grep 'admin_audit' nextcloud.log

If you want to narrow down the number of users, try grepping further.

grep 'admin_audit' nextcloud.log | grep 'm-misu'

These steps will guide you through the audit log.
In addition, the items that can be acquired are as follows.

• login
• Login successful
• logout
• upload
• Rename a file
• download
• Folder Creation
• migration
• deletion
• Restoring deleted files
• File sharing
• Unshare files
• URL Sharing
• Change permissions when sharing
• Unshare URL
• URL sharing access
• Uploading URL Sharing
• URL Share Download

Summary

Knowing how to review audit logs allows you to manage a user’s set of behaviors. In addition, even in the event of a failure or trouble, it is easy to separate whether it is due to user operation or not. I think that it is better for administrators to check the audit log periodically on a daily basis.

This article is also available on Styles’ Nextcloud site.

Задача:

Настроить ведение логов в nextcloud.

—————————————————————

После очередной проверки сервера, выяснилось что затруднительно прочесть лог-файл размером 70Мб

root@cloud:/ # ls -lh data/ | grep log
-rw-r-----   1 www  www   7.3K Feb 24 13:54 audit.log
-rw-r-----   1 www  www     0B May  3 14:47 flow.log
-rw-r-----   1 www  www    70M May 23 14:33 nextcloud.log
-rw-r-----   1 www  www   100M Jan  7 09:04 nextcloud.log.1
-rw-r-----   1 www  www   189K Apr 27 02:20 updater.log
root@cloud:/ #

В FreeBSD за ведение логов отвечает демон syslog, а вот за их ротацию – утилита newsyslog. Демон syslog работает постоянно, и запускается вместе с системой при её старте. Утилита newsyslog – запускается по cron-у, раз в час – если не настроено иначе:

root@cloud:/etc # cat /etc/crontab | grep log
# Rotate log files every hour, if necessary.
0       *       *       *       *       root    newsyslog
root@cloud:/etc #

0 * * * * – означает, что выполнятся будет в начале каждого часа

* * * * * выполняемая команда
- - - - -
| | | | |
| | | | ----- День недели (0 - 7) (Воскресенье =0 или =7)
| | | ------- Месяц (1 - 12)
| | --------- День (1 - 31)
| ----------- Час (0 - 23)
------------- Минута (0 - 59)

Настроить ротацию логов можно при помощи файла /etc/newsyslog.conf:

root@cloud:/ # cat /etc/newsyslog.conf
# configuration file for newsyslog
# $FreeBSD: releng/12.0/usr.sbin/newsyslog/newsyslog.conf 337686 2018-08-12 13:24:53Z brd $
#
# Entries which do not specify the '/pid_file' field will cause the
# syslogd process to be signalled when that log file is rotated.  This
# action is only appropriate for log files which are written to by the
# syslogd process (ie, files listed in /etc/syslog.conf).  If there
# is no process which needs to be signalled when a given log file is
# rotated, then the entry for that file should include the 'N' flag.
#
# Note: some sites will want to select more restrictive protections than the
# defaults.  In particular, it may be desirable to switch many of the 644
# entries to 640 or 600.  For example, some sites will consider the
# contents of maillog, messages, and lpd-errs to be confidential.  In the
# future, these defaults may change to more conservative ones.
#
# logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
/var/log/all.log                        600  7     *    @T00  J
/var/log/auth.log                       600  7     1000 @0101T JC
/var/log/console.log                    600  5     1000 *     J
/var/log/cron                           600  3     1000 *     JC
/var/log/daily.log                      640  7     *    @T00  JN
/var/log/debug.log                      600  7     1000 *     JC
/var/log/init.log                       644  3     1000 *     J
/var/log/kerberos.log                   600  7     1000 *     J
/var/log/maillog                        640  7     *    @T00  JC
/var/log/messages                       644  5     1000 @0101T JC
/var/log/monthly.log                    640  12    *    $M1D0 JN
/var/log/devd.log                       644  3     1000 *     JC
/var/log/security                       600  10    1000 *     JC
/var/log/utx.log                        644  3     *    @01T05 B
/var/log/weekly.log                     640  5     *    $W6D0 JN

<include> /etc/newsyslog.conf.d/*
<include> /usr/local/etc/newsyslog.conf.d/*
# Nginx logs
/var/log/nginx/*.log         root:wheel      644  20    5000  *     GZ   /var/run/nginx.pid 30
# php-fpm logs
/var/log/php-fpm.log         www:www         644  3     *     @T00  JC   /var/run/php-fpm.pid
# redis logs
/var/log/redis/redis.log     redis:redis     644  5     *     *     CZN
# RSync server logs
/var/log/rsyncd.log                          600  2     500  *     ZC
root@cloud:/ # 

нам необходимо добавить

echo '# nextcloud logs' >> /etc/newsyslog.conf
echo '/usr/local/www/nextcloud/data/*.log  www:www     640  10     500    @T00  JC' >> /etc/newsyslog.conf

Проверяем, что получилось

root@cloud:/ # cat /etc/newsyslog.conf | grep nextcloud
# nextcloud logs
/usr/local/www/nextcloud/data/nextcloud.log  www:www     640  7     *    @T00  JC
root@cloud:/ #

Запустим newsyslog в режиме verbose

root@cloud:/ # newsyslog -v
Processing /etc/newsyslog.conf
Found: <include> /etc/newsyslog.conf.d/*
Found: <include> /usr/local/etc/newsyslog.conf.d/*
Processing /etc/newsyslog.conf.d/amd.conf
Processing /etc/newsyslog.conf.d/ftp.conf
Processing /etc/newsyslog.conf.d/lpr.conf
Processing /etc/newsyslog.conf.d/opensm.conf
Processing /etc/newsyslog.conf.d/pf.conf
Processing /etc/newsyslog.conf.d/ppp.conf
Processing /etc/newsyslog.conf.d/sendmail.conf
/var/log/all.log <7J>: does not exist, skipped.
/var/log/auth.log <7J>: --> will trim at Thu Dec 31 23:00:00 2020
/var/log/console.log <5J>: does not exist, skipped.
/var/log/cron <3J>: size (Kb): 34 [1000] --> skipping
/var/log/daily.log <7J>: does not exist, skipped.
/var/log/debug.log <7J>: size (Kb): 1 [1000] --> skipping
/var/log/init.log <3J>: does not exist, skipped.
/var/log/kerberos.log <7J>: does not exist, skipped.
/var/log/maillog <7J>: --> will trim at Thu May 28 00:00:00 2020
/var/log/messages <5J>: --> will trim at Thu Dec 31 23:00:00 2020
/var/log/monthly.log <12J>: does not exist, skipped.
/var/log/devd.log <3J>: size (Kb): 1 [1000] --> skipping
/var/log/security <10J>: size (Kb): 1 [1000] --> skipping
/var/log/utx.log <3>: --> will trim at Mon Jun  1 05:00:00 2020
/var/log/weekly.log <5J>: does not exist, skipped.
/var/log/php-fpm.log <3J>: --> will trim at Thu May 28 00:00:00 2020
/var/log/redis/redis.log <5Z>: --> skipping
/var/log/rsyncd.log <2Z>: size (Kb): 6 [500] --> skipping
/mnt/da1p1/data/nextcloud.log <10J>: size (Kb): 73866 [500] --> trimming log....
Executing: /usr/bin/bzip2 -f /mnt/da1p1/data/nextcloud.log.2

Проверяем что получилось

root@cloud:/ # ls -lh /usr/local/www/nextcloud/data/ | grep log
-rw-r-----   1 www  www   7.3K Feb 24 13:54 audit.log
-rw-r-----   1 www  www     0B May  3 14:47 flow.log
-rw-r-----   1 www  www   1.7K May 27 21:03 nextcloud.log
-rw-r-----   1 www  www   474B May 27 21:00 nextcloud.log.0.bz2
-rw-r-----   1 www  www   1.4M May 27 21:00 nextcloud.log.1.bz2
-rw-r-----   1 www  www   1.5M Jan  7 09:04 nextcloud.log.2.bz2
-rw-r-----   1 www  www   1.5M Jan  7 09:04 nextcloud.log.3.bz2
-rw-r-----   1 www  www   189K Apr 27 02:20 updater.log
root@cloud:/ #

Посмотрим как пишет nextcloud логи

root@cloud:/ # head /mnt/da1p1/data/nextcloud.log
May 27 21:00:00 cloud newsyslog[86820]: logfile turned over due to size>500K
{"reqId":"neXPMDKHjtaDhU51nd","level":2,"time":"2020-05-27T19:01:10+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://localhost/rss.php?f=1368 read error : Server error: `GET http://localhost/rss.php?f=1368` resulted in a `522 Origin Connection Time-out` response:\n<html>\r\n<head><title>522 Origin Connection Time-out</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>522 Origin Conne (truncated...)\n","userAgent":"--","version":"18.0.4.2"}
{"reqId":"neXPMDKvLHjtaDhU51nd","level":2,"time":"2020-05-27T19:02:14+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://localhost/blog/2447804/rss/ read error : cURL error 28: Connection timed out after 60001 milliseconds (see http://localhost/libcurl/c/libcurl-errors.html)","userAgent":"--","version":"18.0.4.2"}
{"reqId":"neXPMDKvLaDhU51nd","level":2,"time":"2020-05-27T19:02:45+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://localhost/rss.php?f=123 read error : Server error: `GET http://localhost/rss.php?f=123` resulted in a `522 Origin Connection Time-out` response:\n<html>\r\n<head><title>522 Origin Connection Time-out</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>522 Origin Conne (truncated...)\n","userAgent":"--","version":"18.0.4.2"}
{"reqId":"neXPMDKvaDhU51nd","level":2,"time":"2020-05-27T19:03:52+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://localhost/blog/2447804/rss/ read error : cURL error 28: Connection timed out after 60037 milliseconds (see http://localhost/libcurl/c/libcurl-errors.html)","userAgent":"--","version":"18.0.4.2"}
{"reqId":"neXPMDKvLHjtaDhU51nd","level":2,"time":"2020-05-27T19:04:23+00:00","remoteAddr":"","user":"--","app":"news","method":"","url":"--","message":"http://localhost/rss.php?f=1368 read error : Server error: `GET http://localhost/rss.php?f=1368` resulted in a `522 Origin Connection Time-out` response:\n<html>\r\n<head><title>522 Origin Connection Time-out</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>522 Origin Conne (truncated...)\n","userAgent":"--","version":"18.0.4.2"}
root@cloud:/ #

Логи созданные при обновлении версии имеют немного другой вид

root@cloud:/ # head /mnt/da1p1/data/updater.log
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] updater cli is executed
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] currentStep()
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] current version: 15.0.7 build time: 2019-04-08T21:25:55+00:00 e578672704cc159694dc2cd8e77c208ae84b35d6
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] getUpdateServerResponse()
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] updaterServer: https://updates.nextcloud.org/updater_server/
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] releaseChannel: stable
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] internal version: 15.0.7.0
2019-05-06T19:00:36+0000 0hsiKxHTzq [info] updateURL: https://updates.nextcloud.org/updater_server/?version=15x0x7x0xxxstablexx2019-04-08T21%3A25%3A55%2B00%3A00+e578672704cc159694dc2cd8e77c208ae84b35d6x7x3x4
2019-05-06T19:01:44+0000 0hsiKxHTzq [info] getUpdateServerResponse response: Array
(
root@cloud:/ #

Настроить ведение логов можно в файле /usr/local/www/nextcloud/config/config.php

• log_type – Этот параметр определяет, куда отправляются журналы Nextcloud. Есть несколько вариантов:
  • file – лог пишется в файл nextcloud.log в каталоге данных Nextcloud. Это значение по умолчанию. Место хранения можно изменит параметром logfile
  • syslog – журналы отправляются в системный журнал. Конечно демон syslog должен быть включённым.
  • errorlog – журналы отправляются в функцию PHP (error_log)
  • systemd – логи отправляются в Systemd. Для этого требуется расширение (extension) PHP “systemd”
• logfile – путь до лог-файла, при значении log_type = file. По умолчанию используется значение [datadirectory]/nextcloud.log
• logfilemode – права доступа на лог-файл
• loglevel – детализация логов. Warning – это значение по умолчанию. Допустимые значения:
  • 0 = Debug – все действия; наиболее подробное ведение журнала.
  • 1 = Info – действия, такие как входы пользователей и действия с файлами, а также предупреждения, ошибки и фатальные ошибки.
  • 2 = Warning – операции выполняются успешно, но с предупреждениями о потенциальных проблемах, а также об ошибках и фатальных ошибках
  • 3 = Error – операция завершается неудачно, но другие службы и операции продолжаются, плюс фатальные ошибки.
  • 4 = Fatal – только критические ошибки.
• syslog_tag – при значении log_type = syslog или systemd. Записи nextcloud можно помечать уникальным тегом. Значение по умолчанию – “Nextcloud”.
• log.condition – Этот параметр позволяет отлаживать определенные запросы, пользователей или приложения. Nextcloud может автоматически изменять детализацию лога на Debug, при выполнении одного из выбранных условий.
• logdateformat – формат даты в логах (PHP.date formatting). По умолчанию используется ISO 8601
• logtimezone – Временная зона
• log_query – активирует добавление всех запросов и параметров базы данных в файл журнала. Рекомендуется использовать только для отладки.
• log_rotate_size – Включает ротацию логов и ограничивает общий размер файлов журналов. Иначе говоря, это максимальный размер лог-файла в байтах. (По умолчанию 100 МБ = 104857600 байт = 100 * 1024 * 1024 байт)

Пример конфига

root@cloud:/ # cat /usr/local/www/nextcloud/config/config.php
<?php
$CONFIG = array (
  'instanceid' => 'ocf5bcvbnegso4j5',
  'passwordsalt' => 'jZOv+Tzrty1Ze1iJP17utOQEN',
  'secret' => 'dcQWpqM/l9TIg8dfgh25dvTzSVN/brEuNa5ucGKAYDvh2O',
  'trusted_domains' =>
  array (
    0 => 'nc.local',
    1 => 'nextcloud.ddns.net',
    2 => '192.168.177.130',
  ),
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'filelocking.enabled' => 'true',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' =>
  array (
    'host' => '/tmp/redis.sock',
    'port' => 0,
    'dbindex' => 0,
    'password' => '5e49d5aa132cc5e855hjd339ba6c62c295730dbac10',
    'timeout' => 1.5,
  ),
  'datadirectory' => '/usr/local/www/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '18.0.4.2',
  'overwrite.cli.url' => 'https://nextcloud.ddns.net',
  'dbname' => 'nextcloud_dbname',
  'dbhost' => 'localhost_dbhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud_dbuser',
  'dbpassword' => 'nextcloud_dbpassword',
  'installed' => true,
  'updater.release.channel' => 'stable',
  'maintenance' => false,
  'log_type' => 'file',
  'logfile' => '/usr/local/www/nextcloud/data/nextcloud.log',
  'logfilemode' => 0640,
  'loglevel' => 3,
  'syslog_tag' => 'Nextcloud',
  'log.condition' => [
        'shared_secret' => '57b58edb6637fe3059b3595cf9c41b9',
        'users' => ['sample-user'],
        'apps' => ['files'],
  ],
  'logdateformat' => 'F d, Y H:i:s',
  'logtimezone' => 'Europe/Moscow',
  'log_query' => false,
  'log_rotate_size' => 3145728‬,
  'theme' => '',
  'twofactor_enforced' => 'false',
  'twofactor_enforced_groups' =>
  array (
  ),
  'twofactor_enforced_excluded_groups' =>
  array (
  ),
);
root@cloud:/ #

в итоге существует два варианта ротации логов

1. nextcloud
2. newsyslog