Set Up ownCloud Enterprise Auditing and Verify the Logs

To record user and administrator actions in ownCloud Enterprise, install and enable the Enterprise-only Auditing app, then route its admin_audit log messages to a file that administrators can protect and review. Enabling the app is necessary, but it is not enough by itself: ownCloud’s server log level must be set to 1 (Info) or 0 (Debug), unless a separate log condition routes audit messages to their own file.

Know which “activity log” you need

The Activity app and the Auditing app serve different purposes. Activity is the user-facing stream of file and collaboration events. The Enterprise Auditing app records selected user and admin actions as structured log entries intended for operational review and analysis. Installing or configuring Activity alone does not enable the Enterprise audit trail. If your goal is a traceable record of logins, file operations, sharing changes, user administration, app changes, or OCC commands, enable Auditing. The current ownCloud Server 11 Auditing documentation lists these event categories.

Verified: the app is Enterprise-only and available through the ownCloud Marketplace. Context-dependent: the exact app-management screen and configuration method vary by ownCloud release and deployment. Action: confirm your server version and that your Enterprise subscription includes the app before troubleshooting a missing app listing. The ownCloud Auditing feature page also identifies it as an Enterprise capability.

Enable Auditing in ownCloud

1. Confirm the app is installed. In the ownCloud app settings, locate Auditing. On ownCloud 10.16, the official guide says to download it from the Marketplace and enable it in app settings; ownCloud 11 documentation says to enable the app there. If it is missing, verify the Enterprise entitlement, Marketplace access, and app compatibility for your server version before installing a package.
2. Enable the app. Use the app settings as an administrator and confirm Auditing is enabled. Depending on the deployment and version, a command-line administrator can also inspect the app state with occ app:list; use the installation’s supported occ invocation. Do not assume a web-interface Activity feed means the audit app is active.
3. Choose where audit entries will go. For a quick verification, ownCloud may write audit entries to the standard owncloud.log. For ongoing operations, a separate restricted audit file is easier to route to a log collector and review independently.
4. Set an effective log level or dedicated route. Keep the general log level at 1 or 0 if you want audit events in the standard log. Alternatively, add a condition for app ID admin_audit that writes to a dedicated file. The syntax depends on whether you use ownCloud 11 in Docker or a 10.16 PHP installation.
5. Generate a harmless test event and verify it. Sign in or create a temporary test file, then inspect the selected log destination for a new audit entry before relying on the configuration.

Route audit records to a separate file

ownCloud Server 11 in Docker

The current ownCloud 11 guide documents the OWNCLOUD_LOG_CONDITIONS environment variable. Add it to the ownCloud service’s Compose environment and adjust the file path to a persistent location available in the container:

OWNCLOUD_LOG_CONDITIONS=[{"apps":["admin_audit"],"loglevel":0,"logfile":"/mnt/data/files/admin_audit.log"}]

The example uses the Docker data mount path documented by ownCloud. Keep the JSON value valid when adding it to YAML, and use the deployment’s persistent mounted volume so a container replacement does not discard the log. Apply the Compose change using your normal deployment process, then confirm the service starts and the file is created. The separate condition logs audit messages regardless of the global log level, according to the Server 11 Auditing guide.

ownCloud Server 10.16 PHP installation

For the 10.16 PHP-based configuration documented by ownCloud, add a log.conditions entry to the active config.php file and replace the sample path. The web-server user must be able to write to the target file and its directory:

'log.conditions' => [
    [
        'apps' => ['admin_audit'],
        'logfile' => '/var/www/owncloud/data/admin_audit.log'
    ]
],

Back up config.php before editing and do not create a duplicate log.conditions key if one already exists. Check PHP syntax and file permissions after the change. Do not copy the 10.16 PHP array into a Docker environment variable or the Server 11 JSON environment value into a PHP configuration file; they are different deployment interfaces. See the official ownCloud 10.16 Auditing instructions.

What the audit trail does—and does not—prove

Verified: documented events include login and logout, file create/delete/move operations, sharing changes, tags, comments, user and group administration, user settings, impersonation, app enablement, and OCC execution. Entries include event-specific fields and are structured for analysis; ownCloud describes JSON-compatible records and integrations such as Splunk. Action: create a test event from a category your team needs to audit and confirm the expected user, action, time, and file context appear.

Misunderstanding: enabling Auditing automatically creates a separate admin_audit.log file. It does not; the default may be the standard ownCloud log unless you configure a separate destination. Action: verify the actual file path and volume rather than relying on the app’s enabled status.

Limit: an event log is not, by itself, a complete compliance program or a guarantee that every action in a customized deployment is recorded. The available events, app version, filters, log level, and retention controls affect what you can review. Action: compare the event coverage with your policy, decide retention and access controls, and forward important records to an appropriately secured central logging system if your requirements call for independent preservation. This final control recommendation is an operational safeguard; ownCloud’s app documentation describes event logging and integration, not a certification that a particular configuration meets a legal requirement.

Verify access and ongoing collection

After the test event appears, confirm that the audit file survives a service restart or container replacement, that only authorized administrators and log collectors can read it, and that log rotation does not break the app’s ability to write. If using the standard log, ownCloud’s admin page provides a Download logfile option. If configured to a separate file, the documentation says to retrieve that file manually. Keep the event timestamp, actor, action, and path as your acceptance check, and review the logs again after upgrades or changes to the logging configuration.