Configure your Nextcloud server

For the dashboards in this package to light up, the nextcloud.log and the audit.log log files from a Nextcloud server must be ingested. There are multiple ways of getting these log files ingested into a Falcon LogScale system. This documentation relies on logs being written to files. The nextcloud.log file is written to by default, but Nextcloud must be configured to write an audit.log log file. For the official documentation on configuring Nextcloud logging, see https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html

Some years ago I documented how to set up audit logging via the Nextcloud UI. I haven't tried this recently so I don't know if this is still a valid description for the latest versions of Nextcloud.

Logged in as an administrator in the Nextcloud UI, click on the icon for your user in the upper right corner, click on “Apps”. Enable the Nextcloud “Auditing / Logging” and the “Monitoring” apps. In the Nextcloud config/config.php file, you either need to change or add the ‘loglevel’ parameter. It should be set no higher than ‘1’. The “log_type” and “logfile” parameter defaults should be fine, but if you wish to ensure they are set correctly, set them as shown below. The default date and time format works well with LogScale, so I suggest you don’t change it.

'log_type' => 'file',
'loglevel' => 1,

If the config.php file is changed, Nextcloud must be restarted. This is done by restarting the web server. Ensure you know the path to where the ‘nextcloud.log’ and ‘audit.log’ files are written to by Nextcloud, this information will be needed when configuring the LogScale collector.