topic Keep logs of login attempts in Alfresco Forum

Keep logs of login attempts

Evgenia_Patsoni — Mon, 04 Apr 2022 13:29:29 GMT

Hello all,

We run Alfresco v7.0.0 using docker deployment (from https://www.npmjs.com/package/generator-alfresco-docker-installer).

We wish to access any logs that regard login attempts of our users, since we try to track failed logins as well as the reason of failure. We have set the following options in our docker-compose.yml:

-Daudit.enabled=true
-Daudit.alfresco-access.enabled=true
-Daudit.alfresco-access.sub-actions.enabled=false

However, we are still unable to find any additional information regarding login attempts in our logs.

Could anyone please let us know where such logs can be found for docker deployments?

Re: Keep logs of login attempts

abhinavmishra14 — Mon, 04 Apr 2022 13:55:04 GMT

Take a look at this post: https://hub.alfresco.com/t5/alfresco-content-services-forum/audit-only-user-logins/m-p/305771/highlight/true#M23543

Re: Keep logs of login attempts

Evgenia_Patsoni — Mon, 04 Apr 2022 14:10:12 GMT

Hello Abhinav,

Thanks for your reply.

However even while searching for a specific login request (without the filter) we don't seem to find anything related.
Maybe we are searching in the wrong log files?

Currently we are searching inside `localhost_access_log.txt`

Re: Keep logs of login attempts

abhinavmishra14 — Mon, 04 Apr 2022 17:03:53 GMT

You are looking at the web application log. Audit logs are not written in any log file.

You need to use services or rest apis in order to work with those logs.

Take a look at these docs:

https://docs.alfresco.com/content-services/latest/develop/rest-api-guide/audit-apps/

https://docs.alfresco.com/content-services/latest/admin/audit/#enableauditing

In the first link, there are rest apis to work with audits. for example, if you have enabled the audit, access this API will give following type of response:

HTTP GET: http://localhost:8080/alfresco/api/-default-/public/alfresco/versions/1/audit-applications/alfresco-access/audit-entries?include=values&alf_ticket=TICKET_aa4fe06e208bdc10a551b17d43626ef8df3174f9

"entries": [
			{
				"entry": {
					"createdAt": "2022-04-04T17:17:12.680+0000",
					"values": {
						"/alfresco-access/loginFailure/user": "admin"
					},
					"auditApplicationId": "alfresco-access",
					"id": 1
				}
			},
			{
				"entry": {
					"createdAt": "2022-04-04T17:17:18.570+0000",
					"createdByUser": {
						"id": "admin",
						"displayName": "Administrator"
					},
					"values": {
						"/alfresco-access/login/user": "admin"
					},
					"auditApplicationId": "alfresco-access",
					"id": 2
				},
.....
			]

Explore the docs for more info on working with audit.

Re: Keep logs of login attempts

Evgenia_Patsoni — Tue, 05 Apr 2022 07:45:25 GMT

Thanks for the information.

I had already used the API calls you mentioned, but simply knowing that a user made a failed login attempt doesn't help at the moment. I wish to know the reason of failure as well.

It seems that Alfresco does not provide this information atm.

Re: Keep logs of login attempts

abhinavmishra14 — Tue, 05 Apr 2022 14:31:14 GMT

yes, alfresco doesn't provide those details out of the box.

You were reffering to log files, that's why i shared the api documentation.