Event (audit) logs (upload, delete)

[totalbot123]

Hey @drakkan ,

I am looking to find logs on events (upload, delete, move). When looking at logs from the server, I do not see these.
Documentation points to: https://github.com/drakkan/sftpgo/blob/main/docs/logs.md
And other discussion (#537) points to usage of eventstore and eventsearch plugins.

Do we need to use eventstore/eventsearch plugins in order to get audit logs? If not, what is the way to configure the server to log these events?

Kind regards,
Milan.

[tristanlu11]

Hi @totalbot123

I am also try find way how to log user activity, but no idea now.
Can you please tell me if you have any progress.

Thanks,
Tristan

[totalbot123]

Hey @tristanlu11,

We've been able to configure audit logs via Event Rules & Event Manager.
Event rules will allow you to pick events that you need, while the Event manager allows you to send these events to your logging server.

I hope this helps.

[caveman2003]

Hi all,

i use two ways to monitor the logs. One way use the environment variables:
- SFTPGO_LOG_FILE_PATH=/srv/sftpgo/logs/sftpgo.log
- SFTPGO_LOG_FILE__TRANSFER_LOGS=true
then i setup telegraf (inputs.tail) with the folowing grok paterns:
grok_patterns = ['{"%{DATA}%{WORD:level}","%{DATA}%{TIMESTAMP_ISO8601:timestamp}","%{DATA}%{WORD:sender}","local_addr":"%{SPACE}%{GREEDYDATA:local_addr}","remote_addr":"%{SPACE}%{GREEDYDATA:remote_addr}%{SPACE}","%{DATA}%{WORD:elasped_ms},%{DATA}%{WORD:size_bytes},"%{DATA}%{WORD:username}","file_path":"%{GREEDYDATA:file_path}%{SPACE}","%{DATA}%{WORD:connection_id}","%{DATA}%{WORD:protocol}"}']

the result is stored in InfluxDB from where i visualise it with grafana. (i do some calculations...also):

The second way is using Event Rules & Event Manager ... again with telegraf (inputs.http_listener_v2, you have to declare some fields as string) + grafana
(json_string_fields = ["filename","event","username","protocol","conn_id"])

Unfortunatly the "{{UID}}" is not the same as "connection_id" as in the logs (above)... but i can live with that it's only for debugging.

For me only Upload was relevant ... but i am sure this work also for download ... Btw. local_addr and remote_addr are not realy usable when you run sftpgo as container :-) ... you get the container IPs not the real IPs.

[manaschandanroy]

How are you doing it through event rules and event actions can you please explain . my sftpgo is deplyed in kubernetes but i am not sure how to send log these action events such as rename , upload events by the user . If you can tell me how can i log thee events