How to enable access logs?

[marcottedan]

In the timesketch-web docker (or mapped through the HOST OS), the logs files are:

ls /var/log/timesketch/
worker.log wsgi_error.log

However I see no access log. Even the NGINX logs are not enough. I need to monitor who logs in on the Timesketch server. I tried to grep them against my login username and there's zero traces even though I did a successful login.

Could you help me?

Thank you

[marcottedan]

I ended up mapping them in the docker-compose file (which should be by default IMO)

  nginx:
    container_name: nginx
    image: nginx:${NGINX_VERSION}
    restart: always
    ports:
      - ${NGINX_HTTP_PORT}:80
      - ${NGINX_HTTPS_PORT}:443
    volumes:
      - ${NGINX_CONFIG_PATH}:/etc/nginx/nginx.conf
      - ./logs/nginx:/var/log/nginx

and run that command:

sudo cat /opt/timesketch/logs/nginx/timesketch_access.log | grep "200" | grep "/login/"

[jkppr]

Glad you found a solution to your problem and thanks for sharing it here.

It would be great if you could update the install instructions with an optional step to enable the mapping of the access logs so others can benefit from this knowledge too.