How can I check what Nextcloud user is active

[JaredBusch]

I shut the server down and poof traffic stopped.

But the activity logs don't show shit.. This thing is receiving 10mbps for days...

[dafyre]

@jaredbusch said in How can I check what Nextcloud user is active:

I shut the server down and poof traffic stopped.

But the activity logs don't show shit.. This thing is receiving 10mbps for days...

Check and see whose folder is the biggeest? lol.

[JaredBusch]

@dafyre said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

I shut the server down and poof traffic stopped.

But the activity logs don't show shit.. This thing is receiving 10mbps for days...

Check and see whose folder is the biggeest? lol.

Many, but nothing new and nothing over limits. And nothing in the activity log so makes no sense.

[JaredBusch]

Rebooting the machine now. ScreenConnect..

[JaredBusch]

Well that was fast.

[dafyre]

@jaredbusch said in How can I check what Nextcloud user is active:

Well that was fast.

If this is for one particular client, could you check the ERL at their site and see who was sending the most data?

[JaredBusch]

The built in Activity thing does not show crap..

[DustinB3403]

@jaredbusch Just asking a question, this system is constantly using 10 MBps up and down?

[JaredBusch]

@dustinb3403 said in How can I check what Nextcloud user is active:

@jaredbusch Just asking a question, this system is constantly using 10 MBps up and down?

10 down. not up.

[JaredBusch]

@dafyre said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

Well that was fast.

If this is for one particular client, could you check the ERL at their site and see who was sending the most data?

None of the remote sites are pushing anything.

[DustinB3403]

@jaredbusch Have you put wireshark in front of this to see what might be going on?

[dafyre]

@dustinb3403 said in How can I check what Nextcloud user is active:

@jaredbusch Have you put wireshark in front of this to see what might be going on?

I'd suggest this as well.

Edit: At least a 30-60 second capture with tcpdump and then use wireshark to look at it.

[dafyre]

Do your NGINX logs show anything hitting port 80 or 443 in the log files for that server that looks out of the ordinary?

[momurda]

Did you ever try what i suggested?
https://mangolassi.it/topic/16565/how-can-i-check-what-nextcloud-user-is-active/19

[JaredBusch]

@dafyre said in How can I check what Nextcloud user is active:

Do your NGINX logs show anything hitting port 80 or 443 in the log files for that server that looks out of the ordinary?

Nginx access.log only shows traffic from the office addresses, generally.

[JaredBusch]

@momurda said in How can I check what Nextcloud user is active:

Did you ever try what i suggested?
https://mangolassi.it/topic/16565/how-can-i-check-what-nextcloud-user-is-active/19

Honestly no. I totally missed the post somehow.

[JaredBusch]

@jaredbusch said in How can I check what Nextcloud user is active:

@momurda said in How can I check what Nextcloud user is active:

Did you ever try what i suggested?
https://mangolassi.it/topic/16565/how-can-i-check-what-nextcloud-user-is-active/19

Honestly no. I totally missed the post somehow.

grep PUT ssl_access_log

And suspect located. /sigh

[dafyre]

@jaredbusch said in How can I check what Nextcloud user is active:

@jaredbusch said in How can I check what Nextcloud user is active:

@momurda said in How can I check what Nextcloud user is active:

Did you ever try what i suggested?
https://mangolassi.it/topic/16565/how-can-i-check-what-nextcloud-user-is-active/19

Honestly no. I totally missed the post somehow.

grep PUT ssl_access_log

And suspect located. /sigh

Ah... So what did you find?

[JaredBusch]

Sorry was summoned to help the 8yo get on the Nintendo switch with her friend.

[root@owncloud DUMBUSER]# du -h --max-depth=1 | sort -hr
26G	.
13G	./files
12G	./files_versions
942M	./files_trashbin
353M	./uploads
0	./cache

[JaredBusch]

[root@proxy ~]# tail /var/log/nginx/access.log -f | grep DUMBUSER
71.81.142.133 - DUMBUSER [13/Apr/2018:16:32:41 -0500] "PUT /owncloud/remote.php/dav/uploads/DUMBUSER/3860036260/00000015 HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"
71.81.142.133 - DUMBUSER [13/Apr/2018:16:32:41 -0500] "PROPFIND /owncloud/remote.php/dav/files/DUMBUSER/ HTTP/1.1" 207 525 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"
71.81.142.133 - DUMBUSER [13/Apr/2018:16:32:48 -0500] "PUT /owncloud/remote.php/dav/uploads/DUMBUSER/3860036260/00000016 HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"
71.81.142.133 - DUMBUSER [13/Apr/2018:16:32:56 -0500] "PUT /owncloud/remote.php/dav/uploads/DUMBUSER/3860036260/00000017 HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"
71.81.142.133 - DUMBUSER [13/Apr/2018:16:33:03 -0500] "PUT /owncloud/remote.php/dav/uploads/DUMBUSER/3860036260/00000018 HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"
71.81.142.133 - DUMBUSER [13/Apr/2018:16:33:10 -0500] "PUT /owncloud/remote.php/dav/uploads/DUMBUSER/3860036260/00000019 HTTP/1.1" 201 0 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "-"