How can I check what Nextcloud user is active

[JaredBusch]

I have a server at a client that is currently receiving 10mbps of traffic to the Nextcloud server.

How can I validate the user that is active? I cannot imagine a real reason for a user to be doing this for over half an hour from home.

[wirestyle22]

This post is deleted!

[JaredBusch]

Still going.

I have a feeling I have a user with a corrupted client install constantly trying to upload changes.

[JaredBusch]

10.202.1.16 is my Nginx Proxy.

But if I shutdown Nextcloud the traffic dies.

[momurda]

The User Management UI only shows last login, doesnt really let you know who is currently active.
You could probably cat or tail your apache or nextcloud logs on the NC server to find out who it is.

[black3dynamite]

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

[JaredBusch]

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

[black3dynamite]

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

My bad, I assumed it was Nextcloud 13.

[JaredBusch]

@black3dynamite said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

My bad, I assumed it was Nextcloud 13.

I had no idea it was this old... Guess what I am doing this weekend.......

[scottalanmiller]

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

Wow

[black3dynamite]

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

My bad, I assumed it was Nextcloud 13.

I had no idea it was this old... Guess what I am doing this weekend.......

Is your client using the latest version of Nextcloud Desktop client?

[momurda]

on my nc 12 server
cat /var/log/apache2/access.log
shows me all the web requests as well as username making them

edit: debian 9 NC server

[black3dynamite]

@momurda said in How can I check what Nextcloud user is active:

on my nc 12 server
cat /var/log/apache2/access.log
shows me all the web requests as well as username making them

And for those who are using Fedora, the location is /var/log/httpd/access_log .

[JaredBusch]

@black3dynamite said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

@black3dynamite said in How can I check what Nextcloud user is active:

Any useful information from Nextcloud logs?
https://domain.local/settings/admin/logging

Doesn't exist.. also.. fuck... I thought they were on NC 11

My bad, I assumed it was Nextcloud 13.

I had no idea it was this old... Guess what I am doing this weekend.......

Is your client using the latest version of Nextcloud Desktop client?

Mostly latest ownCloud client. Some few are on the Nextcloud client.

[JaredBusch]

@momurda said in How can I check what Nextcloud user is active:

on my nc 12 server
cat /var/log/apache2/access.log
shows me all the web requests as well as username making them

edit: debian 9 NC server

Have you ever seriously tried to monitor the log file for a site with ~80 users all using the sync client? Chatty is an understatement.

[momurda]

Yea i know, but at night when you posted the log probably was less active. Someone might want to make a NC feature request if there isnt one already.

[black3dynamite]

@momurda said in How can I check what Nextcloud user is active:

Yea i know, but at night when you posted the log probably was less active. Someone might want to make an NC feature request if there isnt one already.

How can one tell if the user is accessing from desktop/mobile app, WebDAV or web browser in the access logs?

[momurda]

@black3dynamite I am working on that now
I think something like
grep ncusername /var/log/apache2/access.log | grep PUT
^This one shows up when using NC sync client and editing/saving a file
grep ncusername /var/log/apache2/access.log | grep DELETE
^This one shows up when deleting things from Windows Explorer and then the sync client sync the change to NC.

edit, these arent quite right yet but a good starting point i think.
You dont know the username in this case so
grep dav /var/log/apache2/access.log | grep PUT
This will return all log entries of all users who have made changes with the sync client. It makes a log entries every file change, so the result list will be quite long.
You would need to glance at the results and look at the users that shows up the most i think. After hours this would lead you to the culprit.

edit: PUT is the function used when saving a changed/edited file.
grep dav /var/log/apache2/access.log | grep PUT
This gives you a list of user and files edited in current access.log using the NC sync client. With this you can change your next query to use a specific username that shows up a lot, like my first examples.

If you want to find the # of edited files in access log add | wc -l to the end which will give the number of files changed. change the username based on results from previous query. When you see a huge number returned that would probably be the person.
grep ncusername /var/log/apache2/access.log | grep PUT | wc -l

But all this seems like much work(and still not quite right) compared to getting NC to put this info in the Web UI.

[JaredBusch]

So, upgrading....

Nextcloud (and ownCloud before) always say to upgrade without skiping anything, but never to skip a major version.

As I am on the last version of 9 with this instance, Should I upgrade to 10.0.1 or straight to 10.0.6?
https://nextcloud.com/changelog/#latest10

And then subsequently? Point releases and then majors?
Or should I just do the latest 10, latest, 11, latest 12, and finally current 13?

[Alex Sage]

@jaredbusch build a new VM, and move the config and data over

https://docs.nextcloud.com/server/12/admin_manual/maintenance/migrating.html