Admin ability to view history for all channels, direct messages and private channels

[gt50]

Your Rocket.Chat version: 0.26.0

I would like to be able to view all conversations that have occurred on the RocketChat server. I would like to use it in an work environment. There is no expectation of privacy and the information would be accessed when needed for auditing purposes.

I imagine this either being added to the history area, or allowing an admin to view a room, or add themselves to a room from the rooms area in adminstration.

[edman545]

I agree, there is some expectation from upper management that all electronic communication is being logged somewhere. Even if if it just dumped every message sent to a log file somewhere, that would be enough for our purposes. It is very rare that I have to dig into such information, but sometimes there is good reason.

[tholu]

Could be implemented in the admin rooms view (where all direct messages are already listed as well), when clicking on the room to show the logs of it. Or in a separate audit view.

[kdahmani]

I also think that from a compliance point of view it would be very important to be able to access all chats on the server

[heytimc]

Definitely need logging for compliance here. Anything would be great; text, syslog, d/b, don't care how. We won't be able to go live until this is available.

[dereckhall]

same requirement for our office as well. currently utilizing openfire jabber for interoffice communication w/ their archive plugin. something similar or anything really would be great.

[thelilmatt]

+1 for this. It's the only thing holding us back from implementing RocketChat

[dupree972]

I would love this functionality too...

On Jun 10, 2016, at 3:36 PM, thelilmatt notifications@github.com wrote:

+1 for this. It's the only thing holding us back from implementing RocketChat

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub #2869 (comment), or mute the thread https://github.com/notifications/unsubscribe/AOVtMEqR3suEpU_gECJHTbf_otfHbdZdks5qKcrGgaJpZM4IGrw8.

[widget7h15]

Rocketchat is a fantastic platform but I would really like to see this feature implemented so we can use this in our organization. Pretty much every other chat style program has at least one way to audit conversations for HR purposes.

[dupree972]

Is there any progress or has anyone even found a work around for this. We are a SEC and CFTC regulated entity and our compliance officer has the need to randomly review a certain small percentage of messages per month. Also we have the need to archive messages. It does not need to be fancy, even if they all dropped into a text file or something that could be ingested somewhere like a smarsh or other archive that would be terrific.

[slowbiz]

This is also functionality we will need before moving to production in our environment.

[heytimc]

Yay! Merged to develop :)

[slowbiz]

I see the Smarsh Connector in the latest build, which is great. Is there any plan to offer a built-in log/archive/history page to audit conversations?

[patit72]

Here too, we need that function before moving to production

[megabit-computing]

This functionality is vital before we can consider using rocket Chat hosted version!

[rajsardhara]

+1

[Nepoxx]

You can already do this by connecting to your Mongo database.

List the rooms with db.rocketchat_room.find({}), grab the ID of the room you want the history for.

Then you can see that room's history with db.rocketchat_message.find({"rid": "your_chatroom_id"}, {"u.username": 1, "msg": 1, "_id": 0}).sort({ts: 1}).map(function (d) {return d.u.username + ": " + d.msg})

It's not as intuitive as a web interface, but auditing your users' chat logs should seldom be done therefore this is a viable workaround in the meantime.

This topic attracts a great deal of controversy, as it should. That being said, this method is a workaround until there is a corresponding UI. This also means that you are already being recorded when chatting using RocketChat since your messages are saved in the database unencrypted (unless you use OTR). If you allow your users to edit/delete their messages, they are indeed modified/deleted from the database, so take that into account.

[dereckhall]

@Nepoxx For the majority of users here this is a business requirement.

Also, your method doesn't take into account that users can still edit their original message, which modifies the original within mongo.

[philippevk]

@dereckhall He just gave us a workaround. You can disagree about the spying part (I don't), but where I'm from when someone help you, you say "thank you"

@Nepoxx thanks!

[xandershelley]

If this feature is enabled it should be made clear the chat is being recorded. RocketChat is already being used for private chat servers as well.

[patit72]

It might be required for forensic audit, and its use should be logged too. For sure it is a feature needed in business environments

[christopherturner]

Are there still plans to integrate this into the UI?

[sebastientaggart]

+1

[deiansp]

To have history for audit is one of the major mandatory business requirements for any company. So +1 for an easy UI interface. 10x!

[Nemra1]

we need that for admins only..we dont know what bad planes happend in direct rooms

[evaldoprestes]

+1

[sasha2002]

TWO years of +1 and no attention.... yeah serious company....
Disappointed!

[engelgabriel]

@sasha2002 @necil2201 @rmetzler @FaizanZahid and other, please send your details to contact@rocket.chat and our team will get in contact to talk to you regarding the History Audit app.

[piotrkochan]

Why The heck not on The public github issue page? W dniu śr., 26.12.2018 o 21:24 Gabriel Engel <notifications@github.com> napisał(a):

…

@sasha2002 <https://github.com/sasha2002> @necil2201 <https://github.com/necil2201> @rmetzler <https://github.com/rmetzler> @FaizanZahid <https://github.com/FaizanZahid> and other, please send your details to ***@***.*** and our team will get in contact to talk to you regarding the History Audit app. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2869 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFXy-dJVsCGdMaiXnR-2Zvuw_sxEAbGOks5u89sGgaJpZM4IGrw8> .

[ellisgeek]

Any news on when this will be available?

[sasha2002]

@engelgabriel WE choose to switch to another software because of multiple bugz and feature that is not present, and near future of this features is also unclear!
To all users, think twice before install!

[vynmera]

@sasha2002 Sorry to hear that. Where official support is lacking, I still very much enjoy using the APIs and JS to integrate my own code. I feel that's the power of RC.

[faziloub]

@vynmera can i test it ??

[spivey76]

Any news on this front? I'm currently testing several solutions and this is by far the most difficult to pin down.

[necil2201]

Everyone,

A new feature appeared on the Pricing page for the Enterprise version called "Message Auditing Panel". I think this puts the nail in the coffin of ever getting a dedicated Marketplace App for compliance auditing purposes.

This is particularly sad because I would have gladly paid for a dedicated app but I'm not going to pay thousands of dollars for a bunch of other features I don't want or need.

If your company works in an industry that requires compliance auditing you would do well to look elsewhere.

[rmundel]

What about the community join forces and develop an alternative plugin anyway?

[bkraul]

Yup...I don't think Rocket.Chat is actively saying their auditing panel is the end all be all. I also believe that the Pricing page is not the final word, you can talk to them and I am sure they can tailor services as well. I also do not think they would be far from rethinking their position should enough demand for the feature in self-hosted environments arise.

[paulomatheusgrr]

I was more than 2 years waiting to receive this bad news.
That makes me sad. I will have to remove the RC from my company for lack of this possibility, does anyone know another open source Software for it?

[graywolf336]

We will be eventually moving the Enterprise feature of Auditing over to an App in our interface. We are just lacking the support inside the App system to actually do it. It is on the long road map. But if you need it now, we have the Enterprise edition.

[Sing-Li]

Definitely don't wait. Even if we do actually eventually move it to apps, it will always be an Enterprise feature. Contact sales if you need this urgently.

[bkraul]

@Nemra1, I'm sorry, what is the point of your comment? You are directing us to a platform whose 2 main touted features are: "end-to-end encryption" and "de-centralized". Can you help us understand how this solves the issue of auditing, especially in terms of business auditing requirements?

[ghost]

Hello! I am an employee. I read this topic and it explains a lot to me. I left my companie's rocketchat never to return and I want te let you know that reading private messages is really really wrong. No matter how you justify your compliance, if you, as HR department read your employee's private messages, you are a cunt. If an employee is living a situation that need intervention, he can give you a copy of that conversation.

(ok, I took that part out... no need for this, you are right)

[bkraul]

@Emaelqc what exactly is your point? A company's rocketchat server is the property of the company. Contractually they have every right to audit for very real legal reasons. An employee is always free to either use OTR or not engage on personal conversations outside of what pertains to business matters. You really don't seem to understand business auditing.

Also, rather unhelpful attitude.

[ghost]

You are right. But we are in 2020, and I win, not you. Treat your employees like your clients. Thats what my point is. The company cannot afford losing me at all, and I am not using the chat anymore. So what is your point? The purpose of the chat is not reached if employees do not use it. You have no respect.

Sit down and take notes.

[Nepoxx]

You have no respect.

I mean, you just called people names...

Contractually they have every right to audit for very real legal reasons.

@bkraul The laws are not the same everywhere. Some countries allow employees to have a reasonable expectation of privacy, so these are really muddy waters...

@Emaelqc Arrête d'agir comme un enfant. C'est vrai que c'est cave de vouloir lire les messages privés de ses employés, mais tes commentaires n'aident pas.

[ghost]

Je suis d'accord que c'est plutôt une discussion pour LinkedIn que pour GitHub, et à cet effet, j'admets ne pas être au bon endroit.

(I agree that this is more of a discussion for LinkedIn than for GitHub, and as such, I admit I'm in the wrong place.)

[bkraul]

@Nepoxx I understand the laws are not the same. I speak for US law. And again, it is all on how the chat server is deployed. Obviously if I deploy a chat in my company, contractually granting employees an assurance of expectation of privacy and I breach such agreement, my company could be in deep waters. It's all about the disclosure.

[ghost]

So let's make something else clear : I will never use this product again. You can count on your right hand people who do what I do in Canada, so unfortunatly for employers... Anyway, I will drop this. I just had the need to express my feelings about such a functionality.

Have a good life,

[Darkestlyrics]

let's say around 75% of the messaging platforms you use will have a way for the messages to be retrieved unless you self host them. Are you going to stop using each and every single one of those?

Also, did you create a github profile just to complain about this?

[rmundel]

No one is irreplaceable. You're not the client. Just don't use it.

[ghost]

Naa I had a git hub profile for a while, email was not activated. Anyway, you are also right, everybody can be replaced, but that is not entirely true in the current state of events... lol. Anyway. like I said... im out ;P both from here and rocketchat.

[SteveScott]

I actually DON'T want an audit trail. So if the TB is encrypted and I don't use Enterprise version the messages are private?

[Darkestlyrics]

@SteveScott, whilst you may not want it, there are companies that do REQUIRE message logging of employees.
But not wanting audit trails is a bit strange. I'm all for bants at work, but remember, it is work.

Also before this thread gets a load of people coming off the WhatsApp security trend, if YOU do not host it, YOU do not own the data, simple.

[SteveScott]

@Darkestlyrics this isn't for work this is for my friends.

[Darkestlyrics]

@SteveScott

I do not want to detract from the development done by the devs. They are trying to cater for a wide audience of people. I enjoy privacy, and if you search up I was one of the first to find issue with this.

However, if you do not like a technology or a project. Don't use it, but don't slam it, that's a dick move.

There are other FOOS you could adopt, if you looked around.

[bbrendon]

Take your chit chat to the forums. People have work to do.