The audit service logs all events of the system as an audit log. Per default, it will be logged to standard out, but can also be configured to a file output. Supported log formats are json or a minimal human-readable format.

Besides shares, links, files, spaces, users and groups, tag changes are recorded: adding tags to a file or folder is logged as file_tags_add and removing them as file_tags_remove, each with the acting user, the file id and the tags as requested. The request is recorded as made: a tag that was already present (or, for a removal, absent) is still listed, so repeated requests remain visible.

With audit logs, you are able to prove compliance with corporate guidelines as well as to enable reporting and auditing of operations. The audit service takes note of actions conducted by users and administrators.

Example minimal format:

file_delete)
   user 'user_id' trashed file 'item_id'
file_trash_delete)
   user 'user_id' removed file 'item_id' from trashbin

Example json:

{"RemoteAddr":"","User":"user_id","URL":"","Method":"","UserAgent":"","Time":"","App":"admin_audit","Message":"user 'user_id' trashed file 'item_id'","Action":"file_delete","CLI":false,"Level":1,"Path":"path","Owner":"user_id","FileID":"item_id"}
{"RemoteAddr":"","User":"user_id","URL":"","Method":"","UserAgent":"","Time":"","App":"admin_audit","Message":"user 'user_id' removed file 'item_id' from trashbin","Action":"file_trash_delete","CLI":false,"Level":1,"Path":"path","Owner":"user_id","FileID":"item_id"}

The audit service is not started automatically when running as single binary started via ocis server or when running as docker container and must be started and stopped manually on demand.

The audit service logs:

File system operations
(create/delete/move; including actions on the trash bin and versioning)
User management operations
(creation/deletion of users)
Sharing operations
(user/group sharing, sharing via link, changing permissions, calls to sharing API from clients)