Keep logs of login attempts

[Evgenia_Patsoni]

Hello all,

We run Alfresco v7.0.0 using docker deployment (from https://www.npmjs.com/package/generator-alfresco-docker-installer).

We wish to access any logs that regard login attempts of our users, since we try to track failed logins as well as the reason of failure. We have set the following options in our docker-compose.yml:

-Daudit.enabled=true
-Daudit.alfresco-access.enabled=true
-Daudit.alfresco-access.sub-actions.enabled=false

However, we are still unable to find any additional information regarding login attempts in our logs.

Could anyone please let us know where such logs can be found for docker deployments?

[abhinavmishra14]

Take a look at this post: https://hub.alfresco.com/t5/alfresco-content-services-forum/audit-only-user-logins/m-p/305771/highli...

[Evgenia_Patsoni]

Hello Abhinav,

Thanks for your reply.

However even while searching for a specific login request (without the filter) we don't seem to find anything related.
Maybe we are searching in the wrong log files?

Currently we are searching inside `localhost_access_log.txt`

[abhinavmishra14]

You are looking at the web application log. Audit logs are not written in any log file. 

You need to use services or rest apis in order to work with those logs.

Take a look at these docs:

https://docs.alfresco.com/content-services/latest/develop/rest-api-guide/audit-apps/

https://docs.alfresco.com/content-services/latest/admin/audit/#enableauditing

In the first link, there are rest apis to work with audits. for example, if you have enabled the audit, access this API will give following type of response:

HTTP GET: http://localhost:8080/alfresco/api/-default-/public/alfresco/versions/1/audit-applications/alfresco-...

"entries": [
			{
				"entry": {
					"createdAt": "2022-04-04T17:17:12.680+0000",
					"values": {
						"/alfresco-access/loginFailure/user": "admin"
					},
					"auditApplicationId": "alfresco-access",
					"id": 1
				}
			},
			{
				"entry": {
					"createdAt": "2022-04-04T17:17:18.570+0000",
					"createdByUser": {
						"id": "admin",
						"displayName": "Administrator"
					},
					"values": {
						"/alfresco-access/login/user": "admin"
					},
					"auditApplicationId": "alfresco-access",
					"id": 2
				},
.....
			]

Explore the docs for more info on working with audit.

[Evgenia_Patsoni]

Thanks for the information.

I had already used the API calls you mentioned, but simply knowing that a user made a failed login attempt doesn't help at the moment. I wish to know the reason of failure as well.

It seems that Alfresco does not provide this information atm.

[abhinavmishra14]

yes, alfresco doesn't provide those details out of the box. 

You were reffering to log files, that's why i shared the api documentation.