Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Audit Logs.

If you’ve ever needed to know who accessed a file, when a share was created, or whether someone’s been logging in at unusual hours, audit logs are your answer. Nextcloud Audit Logs track all user actions across the platform — file access, edits, shares, permission changes, and logins. For an organisation like NZRT, they’re essential for compliance, security monitoring, and forensic investigations when something goes wrong.

Let’s start with what actually gets logged. There are five main categories of events. First, file operations — that’s any time a file is created, edited, deleted, moved, or copied. Second, sharing events — when a share is created, when permissions on that share change, or when a share link expires. Third, user actions — things like logging in, logging out, changing a password, or setting up two-factor authentication. Fourth, admin actions — creating users, assigning someone to a group, or installing an app. And fifth, security events — failed login attempts, blocked shares, and any unauthorized access attempts. Together, that’s a comprehensive picture of everything happening inside your Nextcloud instance.

Now, how do you actually get to these logs? There are two ways. The first is through the web interface. You go into Settings, then Logging, and you’ll see the last hundred entries right there on screen — no extra tools needed, great for a quick check. The second way is to go directly to the log file on the server. That file lives at a path on the server’s file system, inside the Nextcloud data directory, and it’s called nextcloud.log. If you need to do any serious analysis — searching, filtering, exporting — you’ll want to pull that file directly rather than browsing through the web UI.

Next up is log retention. In Nextcloud’s configuration file, there are two key settings you should know about. The first controls how large the log file can get before it rotates — at NZRT, that’s set to ten megabytes. Once the log hits that size, it starts a fresh file so things don’t spiral out of control. The second setting just tells Nextcloud where to write the log file in the first place, pointing it to that same nextcloud.log location we mentioned. On top of that, logs older than ninety days are archived. That’s not arbitrary — it aligns with GDPR data minimisation principles, meaning you’re keeping what you need for a reasonable period and not holding onto personal data longer than necessary.

Now let’s talk about how NZRT specifically uses compliance monitoring, because different roles have different responsibilities here. There are four roles with distinct monitoring duties. Starting with xc — that’s the administrator — who monitors all actions across the board and gets alerted to things like bulk file deletions or mass sharing events, which could indicate either a mistake or something more serious. Then there’s fin, who focuses on data exports and share activity, with specific alerts for things like exported invoices or new shares being created — important for financial audit trails. Next is han, whose alerts are focused on HR-related activity: access to the HR folder and logins happening outside of office hours, which could signal unauthorized access. Finally, there’s ema, who watches for document changes — specifically anything that looks like an unapproved sync with Dolibarr, NZRT’s ERP system.

So why does all of this matter in the NZRT context specifically? There are three main compliance areas these logs support. First, Dolibarr EDM compliance — that’s electronic document management — where you need a clear record of who touched which documents and when. Second, HR record confidentiality, because personnel files need to be kept private and audit logs give you proof of who accessed them. And third, financial audit trails, so that any time financial data is exported or shared, there’s a record to point to. The person responsible for archiving and analysing logs at NZRT is dan, who holds the DBA role and steps in when there’s a security incident that needs investigation.

Pulling it all together, audit logs aren’t just a nice-to-have. They’re what lets you answer the hard questions after the fact — who did what, when, and from where. Whether it’s a compliance review, a security incident, or just wanting confidence that sensitive data is being handled correctly, Nextcloud Audit Logs give you the visibility you need. If you want to go deeper, the related wiki pages on Users and Groups, Logging and Monitoring, and Permissions and Sharing are worth reading alongside this one.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.