How to find out who modified a file through shared link?

Server
1

Hi,

we’d like to figure out who modified a file. In the owncloud log I can find this log line (some stuff obfuscated):

{“reqId”:“hw5XG9guf8gAUB20u9h9”,“level”:1,“time”:“10 October 2019, 14:59:47”,“remoteAddr”:“10.x.y.z”,“user”:"–",“app”:“admin_audit”,“method”:“POST”,“url”:"/index.php/apps/richdocuments/wopi/files/1458429_5256bdb1e218c/contents?access_token=OBFUSCATED&access_token_ttl=0&permission=edit",“message”:“Update “/obfuscated@obfuscated.com/files/FOLDER 1/FOLDER 2/FOLDER 3/FILENAME WITH SPACES.XSLX” with fileid: 1458429 by IP 10.x.y.z, owner: obfuscated@obfuscated.com [CLIENT_IP: 10.x.y.z] [USER_AGENT: LOOLWSD WOPI Agent 3.4.0]”}

Most lines (ones where Collabora isn’t in between), one of the IPs in the line will be the real IP of the client. We now only see the IP address of the Collabora server (runs on a different machine).

Can we obtain any information on the client that did it (client IP, username, e-mail address, whatever)?

Found some log files from loolwsd, but they’re over a year old. Logging seems to be set to ‘debug’, but logging to file seems disabled. Seems to go to /var/log/messages, but seems useless with regards to what I’m looking for.

<logging>
    <color type="bool">true</color>
    <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">debug</level>
    <file enable="false">
        <property name="path" desc="Log file path."></property>
        <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">weekly</property>
        <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
        <property name="compress" desc="Enable/disable log file compression.">true</property>
        <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
        <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
        <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
        <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
    </file>
</logging>

Thanks in advance.

2

Hi @freaky,
As far as I’m aware ‘admin_audit’ is an enterprise app, so you should have an enterprise key and therefore be able to contact official ownCloud support about this.

Otherwise, I would look into all available logs at the time of modification and see if some information in there is pointing to a specific user or an IP address, which you can correlate to a user.

1 Like