Audit Log Pro

Capybara

clarkwinkelmann
I will buy the plugin if there is a money tracking feature. Because there is no single place where you can track the transfer of coins and the awarding of posts. I can view the database, but it doesn't have a very user-friendly interface. I use all of the above plugins

Gorm

clarkwinkelmann

I am forget to talk one more great miss. The Audit is not log session start/over. E.g. user register, in audit I can inspect ip/username/method... and... and... and user is gone. If he didnt touch auditable plugins. User can switch ip and be just unseenable for audit. It will be recorded only when logout (several ip can be missed). Somebody do it never and never can be find in audit log via username. You can get the session IP from the profile and didnt find anything in AuditLog. They are ghosts which are regulary visit the website but you cant see it. Theoretically, session-data stored in database and can be recorded to AuditLog with username assignment (event like "Start session with ip"). But you are know it much better then me 🙂

Problem is a twinks. I see them in access_log, but I cant find their usernames and this activity in AuditLog cause of lack of this information.

clarkwinkelmann

Gorm I don't quite understand your use case.

This extension logs actions, and specifically anything that can be relevant to security, so most write actions, and a few read actions if they are critical.

If you want to track all IPs a user ever used to access the forum, this might be better handled as a dedicated extension. Handling IP change as events might create too many events for the extension to handle efficiently if a user is behind a load balancing or VPN system.

Can you describe what you are trying to do? Are you trying to guess the frequency of visits from the audit log? Flarum sessions are long lived, hence why you will not see multiple login events for users who use the remember me feature. If you're trying to find actions for a specific user, the actor: gambit should take care of that. actor: takes either a user ID or username, and if you have the Pro version you can just use the log browser from a user's profile.

I could add a partial IP search gambit if you need it to inspect an entire subnet of suspicious IPs that might have been used to create many users.

Gorm

clarkwinkelmann

I just try to detect malicious activity/user via IP. Sample: user1 is register with his own IP and also register user account via VPN in another browser. I see user1 and user2 account and seems they are both independent for administrators. Then user1 do the trash and just switch to another browser to user2 profile. User1 banned, but user2 feels just perfect 🙂 Doesn't important is it still under VPN or not. He is will be absolutely transparent for AuditLog. They are both still independent for admins. I have user1/user2/user3/user4 and they are all have only registration in the AuditLog, but I see in the web-server log that it's just the same user. It's a space for some tricks for staying in the shadow (+switching the ip). Administrators require to check session data in manual mode and history of the users sessions is not available. AuditLog is the most right space for collecting this data. Maybe it can be supported with some database triggers, idk.

Of course it will be some additional loads, but collecting and storing of the audits logs its already additional loads. Simpler to do some selector which actions would be collected and which are not. Optional trimming the data are also good idea 🙂

Justman

@clarkwinkelmann

Warning: the packages key 'kilowhat/flarum-ext-audit-pro' doesn't match the name defined in the package metadata 'kilowhat/flarum-ext-audit' in repository https://flarum.org/composer

clarkwinkelmann

Justman you can ignore that warning. It's because I renamed the package when the free version was introduced and I don't want to delete the old tags from the repo.

Justman

clarkwinkelmann But it's annoying 😅

clarkwinkelmann

Justman I'm not sure Flarum.org versions can be deleted without also deleting the tags on the source GitHub repo 🤷‍♂️ On Packagist I don't think it can be done, as the tags would get re-synced. Flarum.org could maybe have the ability to blacklist some tags. I don't want to delete the historical tags from the repo as they are important meta-data.

luceos

clarkwinkelmann flarum.org syncs all versions, so if the repo has them, flarum.org has them. I don't feel this is a responsibility of the service, but of the maintainer. Maybe adding a faq or something in the readme of the premium extensions reduces confusion about this warning.

rayusoes

Hello,

I'm having trouble installing the Pro version. It seems the package is not available.

Here's the error message I'm getting:
"Root composer.json requires kilowhat/flarum-ext-audit-pro, it could not be found in any version, there may be a typo in the package name."

Could you please assist me with this?

I’ve already purchased the Pro version, and I’m currently using it in production.

Thank you!

clarkwinkelmann

rayusoes make sure the Flarum.org private Composer repository is configured.

If you purchased the extension back when Flarum.org was called Extiverse, you need to update your configuration to allow Composer to keep accessing it.

Unfortunately the instructions are not perma-linkable. You can visit your subscriptions page on Flarum.org and click the instructions to create a new token, and it will guide you though the steps.

If you have already done that, I'd need to see the content of your root composer.json file.

rayusoes

Hi clarkwinkelmann,
Thank you for your time and assistance earlier. We’ve reviewed our configuration but still can’t identify the root of the problem.

Here’s our composer.json for reference:
{ "name": "flarum/flarum", "description": "Delightfully simple forum software.", "type": "project", "keywords": [ "forum", "discussion" ], "homepage": "https://flarum.org/", "license": "MIT", "authors": [{ "name": "Flarum", "email": "info@flarum.org", "homepage": "https://flarum.org/team" }], "support": { "issues": "https://github.com/flarum/core/issues", "source": "https://github.com/flarum/flarum", "docs": "https://docs.flarum.org/" }, "require": { "blomstra/cache-assets": "^0.5.0", "clarkwinkelmann/flarum-ext-post-stream-search": "^1.1", "dentsu/disenio-tmt": "*@dev", "dentsu/tmt-estrellas": "*", "dentsu/tmt-links": "*", "dentsu/tmt-ranking": "*", "dentsu/tmt-scorm": "*", "dentsu/tmt-util": "^0.0.1", "dentsu/tmt-visits": "*", "flarum/approval": "*", "flarum/core": "^1.8.7", "flarum/flags": "*", "flarum/lock": "*", "flarum/markdown": "*", "flarum/mentions": "*", "flarum/nicknames": "^1.8", "flarum/statistics": "*", "flarum/sticky": "*", "flarum/subscriptions": "*", "flarum/suspend": "*", "flarum/tags": "*", "flarumite/simple-discussion-views": "*", "fof/best-answer": "*", "fof/byobu": "*", "fof/filter": "*", "fof/formatting": "*", "fof/gamification": "^1.6", "fof/impersonate": "*", "fof/linguist": "^1.1", "fof/polls": "^2.1", "fof/reactions": "*", "fof/upload": "*", "kilowhat/flarum-ext-audit-pro": "^1.7", "league/flysystem-aws-s3-v3": "1.*", "maicol07/flarum-ext-sso": "^1.11", "the-turk/flarum-flamoji": "^1.0", "the-turk/flarum-stickiest": "^3.0.0" }, "config": { "preferred-install": "dist", "sort-packages": true }, "repositories": { "flarum": { "type": "composer", "url": "https://flarum.org/composer" }, "0": { "type": "path", "url": "packages/*" } } }
We’d really appreciate any guidance on resolving this update issue.

Thanks again!

clarkwinkelmann

rayusoes I don't see any obvious problem. This is outside the scope of what I can help with.

If you can't get the Flarum.org repository to work with your hosting, I can refund the purchase.

luceos

Feel free to send me an email so we can trace the issue further. Premium extensions support is also an option on flarum.org/contact. My email address is in my bio here on discuss.

TheAbsoluteUnknown

I just have a slight question.
If I were not to directly own a forum, but have full owner permissions on that forum, and I bought Audit Pro, would I be able to use it?

clarkwinkelmann

TheAbsoluteUnknown I'm not sure I understand the question.

To install the extension, you need either SSH access to the server, or admin access with package manager extension available in the admin panel.

To use an instance of this extension that's already installed on a forum, you either need to be part of the admin group, or an admin can give access to the audit log to extra groups. If you are a member of a group that has the "View audit log" permission, you will see an additional button in the session dropdown that opens the audit log viewer. By default users with that permission will see everything, just like an admin, but there are also options to restrict what moderators can see, if needed.

TheAbsoluteUnknown

clarkwinkelmann
I'm talking about how to install the extension.
And what exactly is SSH access to the server or package manager?
I'm using freeflarum if that helps.

clarkwinkelmann

TheAbsoluteUnknown if your forum is not self-hosted, you would have to ask whoever manages the forum.

As far as I know, FreeFlarum accepts extension suggestions, but only for free extensions, as they install the extensions for every single forum at the same time.

If FreeFlarum wanted to work something with me to make this extension available, there could be a way to implement an activation system to switch between free and pro for individual tenants. Since most of the logic is server-side and untouchable by forum admins, making the pro extension activable on every forum wouldn't cause any risk of someone "stealing" the extension.

« Previous Page