Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Nextcloud not cleaning up PHP Sessions in /var/lib/php/session/? #23094

Closed
nooblag opened this issue Sep 29, 2020 · 4 comments
Closed

Nextcloud not cleaning up PHP Sessions in /var/lib/php/session/? #23094

nooblag opened this issue Sep 29, 2020 · 4 comments
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap bug

Comments

@nooblag
Copy link
Contributor

nooblag commented Sep 29, 2020 •
edited
Loading

How to use GitHub

  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce

  1. Login to server, look in /var/lib/php/session/

Expected behaviour

Should only see a few active session files in there? Files with filename sess_*

Actual behaviour

Hundreds of thousands of session files starting with sess_*, none seem to be cleaned up. Using substantial disk space. There are thousands of files. Disk space of sess_ files is nearly 2GB+ in total.

Contents of a file, for example:

$ cat sess_vvnjisbuppp3ehpqn9ou5up1d4
encrypted_session_data|s:368:"6411f339 ... a309eec03fca|2";

Is this something to do with WebDAV?

Server configuration

Operating system:
Ubuntu 18.04.5 LTS

Web server:
nginx/1.16.1

Database:
psql (PostgreSQL) 10.14 (Ubuntu 10.14-0ubuntu0.18.04.1)

PHP version:
PHP 7.4.8 (cli) (built: Jul 13 2020 16:45:47) ( NTS )

Nextcloud version: (see Nextcloud admin page)
19.0.3.1

Updated from an older Nextcloud/ownCloud or fresh install:
Updated from Nextcloud 18

Where did you install Nextcloud from:
nextcloud.com

Signing status:

Signing status 
No errors have been found.

List of activated apps:

App list 
Enabled:
  - accessibility: 1.5.0
  - activity: 2.12.0
  - admin_audit: 1.9.0
  - announcementcenter: 3.8.1
  - apporder: 0.11.0
  - bruteforcesettings: 2.0.1
  - calendar: 2.0.4
  - camerarawpreviews: 0.7.8
  - cloud_federation_api: 1.2.0
  - comments: 1.9.0
  - dav: 1.15.0
  - event_update_notification: 1.0.2
  - external: 3.6.0
  - extract: 1.2.4
  - federatedfilesharing: 1.9.0
  - files: 1.14.0
  - files_accesscontrol: 1.9.1
  - files_automatedtagging: 1.9.0
  - files_downloadactivity: 1.8.0
  - files_pdfviewer: 1.8.0
  - files_readmemd: 1.1.4
  - files_rightclick: 0.16.0
  - files_sharing: 1.11.0
  - files_trackdownloads: 1.8.0
  - files_trashbin: 1.9.0
  - files_versions: 1.12.0
  - files_videoplayer: 1.8.0
  - firstrunwizard: 2.8.0
  - groupfolders: 7.0.0
  - impersonate: 1.6.1
  - logreader: 2.4.0
  - lookup_server_connector: 1.7.0
  - metadata: 0.12.0
  - notes: 3.6.4
  - notifications: 2.7.0
  - oauth2: 1.7.0
  - onlyoffice: 6.0.0
  - password_policy: 1.9.1
  - photos: 1.1.0
  - previewgenerator: 2.3.0
  - privacy: 1.3.0
  - provisioning_api: 1.9.0
  - quota_warning: 1.8.0
  - ransomware_protection: 1.7.0
  - recommendations: 0.7.0
  - serverinfo: 1.9.0
  - settings: 1.1.0
  - sharebymail: 1.9.0
  - suspicious_login: 3.2.1
  - systemtags: 1.9.0
  - tasks: 0.13.3
  - text: 3.0.1
  - theming: 1.10.0
  - twofactor_backupcodes: 1.8.0
  - updatenotification: 1.9.0
  - user_retention: 1.2.0
  - viewer: 1.3.0
  - workflowengine: 2.1.0
Disabled:
  - contacts
  - contactsinteraction
  - encryption
  - federation
  - files_external
  - files_linkeditor
  - nextcloud_announcements
  - support
  - survey_client
  - user_ldap

Nextcloud configuration:

Config report 
{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "skeletondirectory": "\/mnt\/ncdata\/__skeleton",
        "dbtype": "pgsql",
        "version": "19.0.3.1",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": 2,
        "logtimezone": "Australia\/Melbourne",
        "mail_smtpmode": "smtp",
        "remember_login_cookie_lifetime": 0,
        "log_rotate_size": "10485760",
        "trashbin_retention_obligation": "auto, 14",
        "versions_retention_obligation": "auto, 365",
        "simpleSignUpLink.shown": false,
        "login_form_autocomplete": true,
        "filelocking.enabled": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "***REMOVED SENSITIVE VALUE***",
            "dbindex": "0",
            "timeout": "1.5"
        },
        "maintenance": false,
        "default_locale": "en_AU",
        "force_locale": "en_AU",
        "default_language": "en",
        "force_language": "en",
        "defaultapp": "activity,files",
        "activity_expire_days": 180,
        "session_lifetime": 14400,
        "session_keepalive": false,
        "lost_password_link": "disabled",
        "auth.webauthn.enabled": false,
        "overwriteprotocol": "https",
        "app_install_overwrite": [
            "activitylog",
            "uploaddetails",
            "drop_account",
            "files_readmemd",
            "afterlogic"
        ],
        "updater.release.channel": "stable",
        "theme": "",
        "connectivity_check_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ]
    }
}

Are you using external storage, if yes which one: local/smb/sftp/...
No

Are you using encryption: yes/no
No

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
No

Client configuration

Browser:
Firefox 81.0

Operating system:
Windows 10
Linux Mint 19.3

Logs

Web server error log

Web server error log 
N/A

Nextcloud log (data/nextcloud.log)

Nextcloud log 
{"reqId":"4FtV5sCMA1JJFICwGdmb","level":2,"time":"2020-09-24T10:30:11+10:00","remoteAddr":"","user":"--","app":"OC\\Log\\Rotate","method":"","url":"--","message":"Log file \"/var/log/nextcloud/nextcloud.log\" was over 10485760 bytes, moved to \"/var/log/nextcloud/nextcloud.log.1\"","userAgent":"--","version":"19.0.3.1"}
{"reqId":"T6QFpMupVr2jjL5lxTG3","level":2,"time":"2020-09-24T10:32:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Q7UWZa6L7YXOTZlaeGdK","level":2,"time":"2020-09-24T10:46:58+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"SuGbAwqDinlCVCnOtdTv","level":2,"time":"2020-09-24T10:46:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"WkTrfB99cXHaEvE1w5J6","level":2,"time":"2020-09-24T10:47:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"J8e3Il8WMaidSUoHMdhx","level":2,"time":"2020-09-24T10:47:03+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"NloE6jp0TdVcl5mecACq","level":2,"time":"2020-09-24T11:16:57+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"gV4IbpIkvMDCAJIzE5ok","level":2,"time":"2020-09-24T11:46:57+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"QyqaAmryeyE1v2zpz2X0","level":2,"time":"2020-09-24T12:16:57+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"RqC0Tk8wEcQC5FN3jUjh","level":2,"time":"2020-09-24T12:46:58+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"NQumbwas07M2PFGD5YnS","level":2,"time":"2020-09-24T13:16:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ot3PBJx66ZO6M7OLF4qU","level":2,"time":"2020-09-24T13:47:00+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"EJIyB4LIVwar8FV4jrzu","level":2,"time":"2020-09-24T14:16:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"5nTCNfy7tLUze6S9dY0C","level":2,"time":"2020-09-24T14:46:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"HDSNvY032wcwYB60Yv26","level":2,"time":"2020-09-24T15:16:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"PO3ipAphx5Nd5rm6kFsQ","level":2,"time":"2020-09-24T15:37:55+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"vJqCsqM006XpcYWlzSbJ","level":2,"time":"2020-09-24T15:46:59+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"w0hBPXG48LZvoHwrrAer","level":2,"time":"2020-09-24T16:17:00+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"oPglxGp6Z7AG94XADU0e","level":2,"time":"2020-09-24T16:47:00+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"QLNLHfkVU0hlJ7e6y6rA","level":2,"time":"2020-09-24T17:17:00+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"SIwN5sIbtRQPAJIMYoUY","level":2,"time":"2020-09-24T17:47:00+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"4LWaSDRDBZV7zFZ8g4dJ","level":2,"time":"2020-09-24T18:17:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"noOVssmi0ZeCs5PgNy48","level":2,"time":"2020-09-24T18:47:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"JHRg7oZWqPVIE4dY5Qqx","level":2,"time":"2020-09-24T19:17:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"TMIsdyhJcvTCmXfgz4CT","level":2,"time":"2020-09-24T19:47:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"UwcRljr9YviozkUKCYoQ","level":2,"time":"2020-09-24T20:17:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"kXds3SBiFdmyeIjoGyje","level":2,"time":"2020-09-24T20:47:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"LzgVzq7uqE1jzUIVNhe6","level":2,"time":"2020-09-24T21:17:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"DI4N5sy9LaXW1xHl14j2","level":2,"time":"2020-09-24T21:47:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"IY1evzDl7tOOaxPePwEi","level":2,"time":"2020-09-24T22:17:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ynQo6RaOGs3iZa4SeqLb","level":2,"time":"2020-09-24T22:47:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"BbyNyPBKE4T0kMebyf40","level":2,"time":"2020-09-25T10:55:28+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"J9S3i9HbHORRjs5kQhvC","level":2,"time":"2020-09-25T10:55:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"a8D3nZ9nyNd9wNYbGggj","level":2,"time":"2020-09-25T10:55:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"VgX40NIKfARPHfkeXRjY","level":2,"time":"2020-09-25T10:55:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ut1HSbHch2fe08E8kH7i","level":2,"time":"2020-09-25T11:25:27+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"1s3ihh18KPxpEfhKoURj","level":2,"time":"2020-09-25T11:55:27+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"Vvg5vaem6wEvRLWbM6zG","level":2,"time":"2020-09-25T12:35:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ttJJK4sA0JR4SjGwUxjv","level":2,"time":"2020-09-25T12:35:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"VphYB3FSRREJIV7xwjUL","level":2,"time":"2020-09-25T12:35:32+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ktgBUOCp9H16Wp5fyVtU","level":2,"time":"2020-09-25T12:35:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"lVuuilibRSubo9icqcu2","level":2,"time":"2020-09-25T13:05:27+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"aLPzduLcwlOrRvyCsCrL","level":2,"time":"2020-09-25T13:35:28+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"7cPtlZfmqql5hogmB9Zx","level":2,"time":"2020-09-25T13:49:45+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"9RoocSVKhfMW1ZytvuJP","level":2,"time":"2020-09-25T13:50:10+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"9RoocSVKhfMW1ZytvuJP","level":3,"time":"2020-09-25T13:50:24+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":{"Exception":"Swift_TransportException","Message":"Connection to 127.0.0.1:25 Timed Out","Code":0,"Trace":[{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","line":358,"function":"getFullResponse","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","line":147,"function":"readGreeting","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Mailer.php","line":65,"function":"start","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/lib/private/Mail/Mailer.php","line":204,"function":"send","class":"Swift_Mailer","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginMailListener.php","line":78,"function":"send","class":"OC\\Mail\\Mailer","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":76,"function":"handle","class":"OCA\\SuspiciousLogin\\Listener\\LoginMailListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":251,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":86,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Service/LoginClassifier.php","line":186,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Service/LoginClassifier.php","line":125,"function":"notifyUser","class":"OCA\\SuspiciousLogin\\Service\\LoginClassifier","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginListener.php","line":77,"function":"process","class":"OCA\\SuspiciousLogin\\Service\\LoginClassifier","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginListener.php","line":65,"function":"handleClassification","class":"OCA\\SuspiciousLogin\\Listener\\LoginListener","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":76,"function":"handle","class":"OCA\\SuspiciousLogin\\Listener\\LoginListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":251,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":86,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/AppInfo/BootstrapSingleton.php","line":96,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/legacy/OC_Hook.php","line":110,"function":"handle","class":"class@anonymous\u0000/var/www/nextcloud/apps/suspicious_login/lib/AppInfo/BootstrapSingleton.php:80$1e4","type":"->"},{"file":"/var/www/nextcloud/lib/private/Server.php","line":558,"function":"emit","class":"OC_Hook","type":"::"},{"function":"OC\\{closure}","class":"OC\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Hooks/EmitterTrait.php","line":101,"function":"call_user_func_array"},{"file":"/var/www/nextcloud/lib/private/Hooks/PublicEmitter.php","line":40,"function":"emit","class":"OC\\Hooks\\BasicEmitter","type":"->"},{"file":"/var/www/nextcloud/lib/private/User/Session.php","line":409,"function":"emit","class":"OC\\Hooks\\PublicEmitter","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/CompleteLoginCommand.php","line":44,"function":"completeLogin","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\CompleteLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/LoggedInCheckCommand.php","line":61,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\LoggedInCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/EmailLoginCommand.php","line":58,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\EmailLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UidLoginCommand.php","line":54,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\UidLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UserDisabledCheckCommand.php","line":57,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\UserDisabledCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/PreLoginHookCommand.php","line":53,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/Chain.php","line":108,"function":"process","class":"OC\\Authentication\\Login\\PreLoginHookCommand","type":"->"},{"file":"/var/www/nextcloud/core/Controller/LoginController.php","line":307,"function":"process","class":"OC\\Authentication\\Login\\Chain","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"tryLogin","class":"OC\\Core\\Controller\\LoginController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","Line":473,"Previous":{"Exception":"Swift_IoException","Message":"Connection to 127.0.0.1:25 Timed Out","Code":0,"Trace":[{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","line":467,"function":"readLine","class":"Swift_Transport_StreamBuffer","type":"->"},{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","line":358,"function":"getFullResponse","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/AbstractSmtpTransport.php","line":147,"function":"readGreeting","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Mailer.php","line":65,"function":"start","class":"Swift_Transport_AbstractSmtpTransport","type":"->"},{"file":"/var/www/nextcloud/lib/private/Mail/Mailer.php","line":204,"function":"send","class":"Swift_Mailer","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginMailListener.php","line":78,"function":"send","class":"OC\\Mail\\Mailer","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":76,"function":"handle","class":"OCA\\SuspiciousLogin\\Listener\\LoginMailListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":251,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":86,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Service/LoginClassifier.php","line":186,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Service/LoginClassifier.php","line":125,"function":"notifyUser","class":"OCA\\SuspiciousLogin\\Service\\LoginClassifier","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginListener.php","line":77,"function":"process","class":"OCA\\SuspiciousLogin\\Service\\LoginClassifier","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/Listener/LoginListener.php","line":65,"function":"handleClassification","class":"OCA\\SuspiciousLogin\\Listener\\LoginListener","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":76,"function":"handle","class":"OCA\\SuspiciousLogin\\Listener\\LoginListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":251,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":86,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/apps/suspicious_login/lib/AppInfo/BootstrapSingleton.php","line":96,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/legacy/OC_Hook.php","line":110,"function":"handle","class":"class@anonymous\u0000/var/www/nextcloud/apps/suspicious_login/lib/AppInfo/BootstrapSingleton.php:80$1e4","type":"->"},{"file":"/var/www/nextcloud/lib/private/Server.php","line":558,"function":"emit","class":"OC_Hook","type":"::"},{"function":"OC\\{closure}","class":"OC\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Hooks/EmitterTrait.php","line":101,"function":"call_user_func_array"},{"file":"/var/www/nextcloud/lib/private/Hooks/PublicEmitter.php","line":40,"function":"emit","class":"OC\\Hooks\\BasicEmitter","type":"->"},{"file":"/var/www/nextcloud/lib/private/User/Session.php","line":409,"function":"emit","class":"OC\\Hooks\\PublicEmitter","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/CompleteLoginCommand.php","line":44,"function":"completeLogin","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\CompleteLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/LoggedInCheckCommand.php","line":61,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\LoggedInCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/EmailLoginCommand.php","line":58,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\EmailLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UidLoginCommand.php","line":54,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\UidLoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UserDisabledCheckCommand.php","line":57,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\UserDisabledCheckCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/PreLoginHookCommand.php","line":53,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->"},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/Chain.php","line":108,"function":"process","class":"OC\\Authentication\\Login\\PreLoginHookCommand","type":"->"},{"file":"/var/www/nextcloud/core/Controller/LoginController.php","line":307,"function":"process","class":"OC\\Authentication\\Login\\Chain","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"tryLogin","class":"OC\\Core\\Controller\\LoginController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/3rdparty/swiftmailer/swiftmailer/lib/classes/Swift/Transport/StreamBuffer.php","Line":166},"CustomMessage":"Could not send suspicious login email to <***REMOVED SENSITIVE VALUE***>"},"userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"bmZlGepIkA7ILuMlWkHj","level":2,"time":"2020-09-25T14:05:28+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"c8vLM3fwYKXZFoZsgKKr","level":2,"time":"2020-09-25T14:35:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"eMaUhrEwy0q4mWW2VBTq","level":2,"time":"2020-09-25T15:05:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"2CT5LxNvCP1BggKFJTfO","level":3,"time":"2020-09-25T15:30:32+10:00","remoteAddr":"219.90.178.201","user":"--","app":"onlyoffice","method":"GET","url":"/apps/onlyoffice/s/ZitZyCnbzGfiD6A","message":{"Exception":"OCP\\Files\\NotFoundException","Message":"Node for share not found, fileid: 22346","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":170,"function":"getNode","class":"OC\\Share20\\Share","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":116,"function":"getNodeByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/controller/editorcontroller.php","line":720,"function":"getFileByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/controller/editorcontroller.php","line":756,"function":"index","class":"OCA\\Onlyoffice\\Controller\\EditorController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"PublicPage","class":"OCA\\Onlyoffice\\Controller\\EditorController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Share20/Share.php","Line":190,"CustomMessage":"getNodeByToken error"},"userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36","version":"19.0.3.1"}
{"reqId":"NVvSzUsBpGEzHAV8fRTw","level":2,"time":"2020-09-25T15:35:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"LvOBS4yRthyWao9vGNyr","level":2,"time":"2020-09-25T16:05:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ObWzyXNFrXKZBmpSAqwr","level":2,"time":"2020-09-25T16:35:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"vG6JO8u7jSoWIzxWrViL","level":2,"time":"2020-09-25T17:05:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"Z7czlHYUVUYVQ8BCMPKQ","level":2,"time":"2020-09-25T17:10:54+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"OpenSync/1.5.0.3-ose (2017/04/18; dav4android; okhttp3) Android/11","version":"19.0.3.1"}
{"reqId":"g2VuUlcSlCPlokyiJ6DD","level":2,"time":"2020-09-25T17:23:03+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/addressbooks/users/***REMOVED SENSITIVE VALUE***/shared-contacts/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"OpenSync/1.5.0.3-ose (2017/04/18; dav4android; okhttp3) Android/11","version":"19.0.3.1"}
{"reqId":"RWXhGYITfKpcxXZMFDIP","level":2,"time":"2020-09-25T17:35:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"RWXhGYITfKpcxXZMFDIP","level":2,"time":"2020-09-25T17:35:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Suspicious login peak detected: ***REMOVED SENSITIVE VALUE*** received 73 alerts in the last two days","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"mdoH5ODg1mtK1RKVunCu","level":2,"time":"2020-09-25T18:05:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ZyBWifyyNR1185C7oSK5","level":2,"time":"2020-09-25T18:35:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ItCX3CO4PamlsbFu2ivX","level":2,"time":"2020-09-25T19:05:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"wloCHm16kBp0rqZQ15k5","level":2,"time":"2020-09-25T19:35:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"rQIiHfsxsLrlbfjRMIRS","level":3,"time":"2020-09-25T19:39:28+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"onlyoffice","method":"GET","url":"/apps/onlyoffice/s/iDRmEPHCDEiFtsC","message":{"Exception":"OCP\\Files\\NotFoundException","Message":"Node for share not found, fileid: 30045","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":170,"function":"getNode","class":"OC\\Share20\\Share","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":116,"function":"getNodeByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/controller/editorcontroller.php","line":720,"function":"getFileByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/controller/editorcontroller.php","line":756,"function":"index","class":"OCA\\Onlyoffice\\Controller\\EditorController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"PublicPage","class":"OCA\\Onlyoffice\\Controller\\EditorController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Share20/Share.php","Line":190,"CustomMessage":"getNodeByToken error"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36","version":"19.0.3.1"}
{"reqId":"jH2DAUXPLrmO8f5uxW4y","level":3,"time":"2020-09-25T19:39:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"onlyoffice","method":"GET","url":"/apps/onlyoffice/ajax/config/0?shareToken=iDRmEPHCDEiFtsC","message":{"Exception":"OCP\\Files\\NotFoundException","Message":"Node for share not found, fileid: 30045","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":170,"function":"getNode","class":"OC\\Share20\\Share","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/lib/fileutility.php","line":116,"function":"getNodeByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/apps/onlyoffice/controller/editorcontroller.php","line":826,"function":"getFileByToken","class":"OCA\\Onlyoffice\\FileUtility","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"config","class":"OCA\\Onlyoffice\\Controller\\EditorController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Share20/Share.php","Line":190,"CustomMessage":"getNodeByToken error"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36","version":"19.0.3.1"}
{"reqId":"jH2DAUXPLrmO8f5uxW4y","level":4,"time":"2020-09-25T19:39:29+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"onlyoffice","method":"GET","url":"/apps/onlyoffice/ajax/config/0?shareToken=iDRmEPHCDEiFtsC","message":"Config: 0 File not found","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36","version":"19.0.3.1"}
{"reqId":"YJPKGbrW8Kc7Dn6j1gxo","level":2,"time":"2020-09-25T20:05:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"as6krdIvIpZgUf1A7cmN","level":2,"time":"2020-09-25T20:35:32+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"3UTb6ofubg7WdQjTHIKX","level":2,"time":"2020-09-25T21:13:17+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"yV4n6wpatTRaEvzgON4y","level":2,"time":"2020-09-25T21:43:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"52ylp9KnGnrUHn8Aeog2","level":2,"time":"2020-09-25T22:13:17+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"Q4EJlDQIG1gIO88dVX5s","level":2,"time":"2020-09-25T22:43:15+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"7z11boz4t6HEwYxfp18e","level":2,"time":"2020-09-25T23:13:14+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"oc2A5L8EiC7zoNbu5xNK","level":2,"time":"2020-09-26T11:05:36+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"oc2A5L8EiC7zoNbu5xNK","level":2,"time":"2020-09-26T11:05:36+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Suspicious login peak detected: ***REMOVED SENSITIVE VALUE*** received 58 alerts in the last two days","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"PKiRikiUH3T7BZyyzzap","level":2,"time":"2020-09-26T11:05:37+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"1VINX8NKKJko1Q9mFFXl","level":2,"time":"2020-09-26T11:05:38+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"o5CSsu3ZH3oz6QDU0okL","level":2,"time":"2020-09-26T11:05:40+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"VUasoNXvJEB0trsqekmu","level":2,"time":"2020-09-26T11:35:39+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"PBBep9P2GnvbRtjtLS79","level":2,"time":"2020-09-26T12:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"slVsx68pwTKuItSa5E3m","level":2,"time":"2020-09-26T12:35:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"bZ2USlKwi1EKos8Z8faH","level":2,"time":"2020-09-26T13:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"AJzkKXVSIxV4MEJ42dSi","level":2,"time":"2020-09-26T13:35:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"7y3VZfoS6p7jn8yxPjYx","level":2,"time":"2020-09-26T14:05:36+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"OBValqZzuM4FTFrkuuLJ","level":2,"time":"2020-09-26T14:35:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"CYzwPDOJjZ9KHauCZMsE","level":2,"time":"2020-09-26T15:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"nZ4Ay7Iu3e9ySFruLAXV","level":2,"time":"2020-09-26T15:34:47+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":***REMOVED SENSITIVE VALUE***,"app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15","version":"19.0.3.1"}
{"reqId":"kUXSWLoj2Ts7S6A0KHwN","level":2,"time":"2020-09-26T15:35:37+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"n60ORjFbylVN6xsLAFjK","level":2,"time":"2020-09-26T15:35:46+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"ZtXv86YbgZDf8aNpxH5D","level":2,"time":"2020-09-26T15:36:15+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0","version":"19.0.3.1"}
{"reqId":"m8fMt2kG3AhGH4Vymgec","level":2,"time":"2020-09-26T16:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"9QHi3lSwqQ0GLLiwz6KE","level":2,"time":"2020-09-26T16:35:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"5IXoYOABVFpnTUwpNzVC","level":2,"time":"2020-09-26T17:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"rxngjmjDmQDWtAFnKYyS","level":2,"time":"2020-09-26T17:35:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"DkoezMipBK3ytUQgflk7","level":2,"time":"2020-09-26T18:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"KRmM02OwbXxV8HHmTnRK","level":2,"time":"2020-09-26T18:35:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"QSWmV2lMy7ecZeg6MWX0","level":2,"time":"2020-09-26T19:05:37+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"7ylEoDxDqSjpXcrr4scL","level":2,"time":"2020-09-26T19:35:42+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"5JwYOFsGY3JKJspqz9Ne","level":2,"time":"2020-09-26T20:05:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"M2mn4b5lMztaQ7djedLi","level":2,"time":"2020-09-26T20:08:54+10:00","remoteAddr":"121.200.7.152","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: 121.200.7.152)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","version":"19.0.3.1"}
{"reqId":"kFXUFo0y62v93eDNzMKw","level":2,"time":"2020-09-26T20:09:43+10:00","remoteAddr":"121.200.7.152","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: 121.200.7.152)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","version":"19.0.3.1"}
{"reqId":"dnOwh9GdfLKss3hj7WUZ","level":2,"time":"2020-09-26T20:35:38+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"xLJbOY02KsyAnsIgamCq","level":2,"time":"2020-09-26T21:05:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"dewlEinbnqr43JW6TR7Y","level":2,"time":"2020-09-26T21:12:32+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0","version":"19.0.3.1"}
{"reqId":"34qRnb6oWiVwl5Muv1XF","level":2,"time":"2020-09-26T21:35:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"XysW7KsbT8JMpDDdC85e","level":2,"time":"2020-09-26T22:05:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"EJ5QjJj3qejrZsWyGmXc","level":2,"time":"2020-09-26T22:35:36+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"3DfIZRc9Dtr7OZzkkCyj","level":2,"time":"2020-09-26T23:05:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"8v6NacuBfr9aNUPu4EiZ","level":2,"time":"2020-09-26T23:35:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ixufBbDzLHGumIMM5V1x","level":2,"time":"2020-09-27T00:05:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"zw0wIOhzBq2v0rahbna3","level":2,"time":"2020-09-27T01:06:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"Gk5P0SEbIAo4MWpVXxXC","level":2,"time":"2020-09-27T01:06:32+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"kMU8mDbIHf1z9UpnI2f2","level":2,"time":"2020-09-27T01:06:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"iH0GVz698285TH0Em1Ri","level":2,"time":"2020-09-27T01:06:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"2Lxg2TniJkfFVn1FZzeV","level":2,"time":"2020-09-27T01:29:11+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Kr7l490OXeVDE4ZWt78x","level":2,"time":"2020-09-27T03:08:45+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"6ctvg1o9D5IkUtMaPm9r","level":2,"time":"2020-09-27T03:08:46+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"3gABErOZHEWEYkaU55RA","level":2,"time":"2020-09-27T03:08:47+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"hfuOUeiE4vmZJvBCzcp7","level":2,"time":"2020-09-27T03:08:47+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"a5M4424hpDm1CLqmcerj","level":3,"time":"2020-09-27T10:10:49+10:00","remoteAddr":"121.200.7.152","user":"***REMOVED SENSITIVE VALUE***","app":"notes","method":"PUT","url":"/apps/notes/notes/114244/autotitle","message":{"Exception":"OCP\\Lock\\LockedException","Message":"\"Notes/Online LO training.txt\" is locked, existing lock on file: exclusive","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":2061,"function":"lockPath","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1141,"function":"lockFile","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":597,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Node/File.php","line":57,"function":"file_get_contents","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Note.php","line":39,"function":"getContent","class":"OC\\Files\\Node\\File","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":162,"function":"getContent","class":"OCA\\Notes\\Service\\Note","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Util.php","line":11,"function":"OCA\\Notes\\Service\\{closure}","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":163,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":144,"function":"generateContentEtag","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":123,"function":"updateIfNeeded","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":102,"function":"createMeta","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/NotesService.php","line":43,"function":"update","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/NotesController.php","line":197,"function":"get","class":"OCA\\Notes\\Service\\NotesService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Util.php","line":11,"function":"OCA\\Notes\\Controller\\{closure}","class":"OCA\\Notes\\Controller\\NotesController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/Helper.php","line":51,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/NotesController.php","line":204,"function":"handleErrorResponse","class":"OCA\\Notes\\Controller\\Helper","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"autotitle","class":"OCA\\Notes\\Controller\\NotesController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Files/View.php","Line":1951,"Previous":{"Exception":"OCP\\Lock\\LockedException","Message":"\"files/c2fc942fdd81cfd29d6ed0466492720e\" is locked, existing lock on file: exclusive","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Files/Storage/Common.php","line":752,"function":"acquireLock","class":"OC\\Lock\\MemcacheLockingProvider","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":594,"function":"acquireLock","class":"OC\\Files\\Storage\\Common","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":594,"function":"acquireLock","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":594,"function":"acquireLock","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":594,"function":"acquireLock","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1946,"function":"acquireLock","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":2061,"function":"lockPath","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1141,"function":"lockFile","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":597,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Node/File.php","line":57,"function":"file_get_contents","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Note.php","line":39,"function":"getContent","class":"OC\\Files\\Node\\File","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":162,"function":"getContent","class":"OCA\\Notes\\Service\\Note","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Util.php","line":11,"function":"OCA\\Notes\\Service\\{closure}","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":163,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":144,"function":"generateContentEtag","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":123,"function":"updateIfNeeded","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Service/MetaService.php","line":102,"function":"createMeta","class":"OCA\\Notes\\Service\\MetaService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/NotesService.php","line":43,"function":"update","class":"OCA\\Notes\\Service\\MetaService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/NotesController.php","line":197,"function":"get","class":"OCA\\Notes\\Service\\NotesService","type":"->"},{"file":"/var/www/nextcloud/apps/notes/lib/Service/Util.php","line":11,"function":"OCA\\Notes\\Controller\\{closure}","class":"OCA\\Notes\\Controller\\NotesController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/Helper.php","line":51,"function":"retryIfLocked","class":"OCA\\Notes\\Service\\Util","type":"::"},{"file":"/var/www/nextcloud/apps/notes/lib/Controller/NotesController.php","line":204,"function":"handleErrorResponse","class":"OCA\\Notes\\Controller\\Helper","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"autotitle","class":"OCA\\Notes\\Controller\\NotesController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":100,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":137,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":297,"function":"call_user_func"},{"file":"/var/www/nextcloud/lib/base.php","line":1012,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":37,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Lock/MemcacheLockingProvider.php","Line":79},"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0","version":"19.0.3.1"}
{"reqId":"FwFySdmNh4P9PA1EP5zJ","level":3,"time":"2020-09-27T16:35:48+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"FwFySdmNh4P9PA1EP5zJ","level":3,"time":"2020-09-27T16:35:48+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"KFtodY6073Wn6uM6qwk1","level":3,"time":"2020-09-27T16:35:53+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"ZHUZAR1uiBOufyKJQ929","level":3,"time":"2020-09-27T16:36:03+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"JYt10wniBXHNZdk4j6gj","level":3,"time":"2020-09-27T16:36:19+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"JYt10wniBXHNZdk4j6gj","level":3,"time":"2020-09-27T16:36:19+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"AsVLWXiQzpuNb8CaKfO1","level":2,"time":"2020-09-28T11:17:40+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"AsVLWXiQzpuNb8CaKfO1","level":2,"time":"2020-09-28T11:17:41+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Suspicious login peak detected: ***REMOVED SENSITIVE VALUE*** received 38 alerts in the last two days","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"bnftJJHJfGSStVIdoJUY","level":2,"time":"2020-09-28T11:17:42+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"k8KexUyQzfBlJ5W8IVet","level":2,"time":"2020-09-28T11:17:43+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"GNfgJDqMnD2YFS3grVwy","level":2,"time":"2020-09-28T11:17:44+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"BnOchWHkQnV3VfXUYoMM","level":2,"time":"2020-09-28T11:47:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"iPkeBuYT0tGn6jj1VYRr","level":2,"time":"2020-09-28T12:03:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"oZ34q8gBsSlGnI5mnUyr","level":3,"time":"2020-09-28T12:06:16+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"DELETE","url":"/remote.php/dav/files/***REMOVED SENSITIVE VALUE***/Repression%20Mapping/Slack%20Channel%20Export/repressionmapping%20Private%20Channel%20Slack%20Export%20-%202019-01-22%20-%202020-09-25.txt","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:21+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:21+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:21+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Ch3olduknpVHBi69SxGA","level":3,"time":"2020-09-28T12:06:23+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"PROPFIND","url":"/remote.php/dav/trashbin/***REMOVED SENSITIVE VALUE***/trash","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"bgnXmo6XvhIcughzAMKZ","level":3,"time":"2020-09-28T12:07:08+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"VMNQRFqSSRsm89QRhAvQ","level":3,"time":"2020-09-28T12:07:11+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"zOLnJjnfDGfrjxcKlQNm","level":3,"time":"2020-09-28T12:07:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"mVrkrvMQdPXdxHwPQt1Z","level":3,"time":"2020-09-28T12:07:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"Csi6OAZflYtM3WzG2dI7","level":3,"time":"2020-09-28T12:08:32+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"MEMsy7Fm6fqLOJFCtLJF","level":3,"time":"2020-09-28T12:08:52+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"w1ZYt5PfbyWd292SObYa","level":3,"time":"2020-09-28T12:09:44+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"rHkme08pi9cJRlxx9U4Q","level":3,"time":"2020-09-28T12:09:46+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"ZxhQcoFXuEZGerELhrkz","level":3,"time":"2020-09-28T12:10:01+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"XbJLCtb9P6GJUESrFdoi","level":3,"time":"2020-09-28T12:10:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"kU6LZoUltJGYnndXlEGS","level":3,"time":"2020-09-28T12:10:44+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"cuclW2fTe8G2MxTmmH91","level":3,"time":"2020-09-28T12:11:03+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"1jLx8XjA3EUUWch2TRjn","level":3,"time":"2020-09-28T12:11:14+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"sugtGk3LLYsgBZU45wUO","level":3,"time":"2020-09-28T12:11:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"li9YPXnI43yCgA1nSdwz","level":3,"time":"2020-09-28T12:12:46+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"PHP","method":"POST","url":"/apps/text/session/sync","message":"Trying to access array offset on value of type int at /var/www/nextcloud/lib/private/Files/Node/Node.php#328","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"I62Gb2pF0GVG6Qn4EDOG","level":2,"time":"2020-09-28T12:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"pwOyOFxirYyzZhUHyhU1","level":2,"time":"2020-09-28T12:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"F8AXA1rGOfvQt1T3hxLU","level":2,"time":"2020-09-28T13:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"urDwwrBWiPYdcA8qMvyj","level":2,"time":"2020-09-28T13:47:39+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"2dJru9GF7sXyg0PksBLv","level":2,"time":"2020-09-28T14:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"LeavR37Lgvf7mpvB1kEm","level":2,"time":"2020-09-28T14:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"MX7moolNxXq2xwV1wloN","level":2,"time":"2020-09-28T15:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"rxFia8qsEnquAAIqHetF","level":2,"time":"2020-09-28T15:28:23+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"hG09zvGJ5JIQXTtKTnrz","level":2,"time":"2020-09-28T15:28:38+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"0bTKaYmFSE5vNp9ZyZ2c","level":2,"time":"2020-09-28T15:28:42+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"q4V7MkvnQPP9KBhPX8tW","level":2,"time":"2020-09-28T15:29:05+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"Y4MFPsrraOxPgMY8n7CG","level":2,"time":"2020-09-28T15:29:13+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"V2X2wm21ncc893ErhxcG","level":2,"time":"2020-09-28T15:29:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"RbCA1j7Sx4X9Ye7Jxduv","level":2,"time":"2020-09-28T15:29:52+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"0mUb6Ub3LmodHugtlEta","level":2,"time":"2020-09-28T15:33:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"Wbwk5ckDA7cl7Y0UR7hc","level":2,"time":"2020-09-28T15:33:56+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** disabled (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:81.0) Gecko/20100101 Firefox/81.0","version":"19.0.3.1"}
{"reqId":"qToqWFrLAXqXPRa74KPg","level":2,"time":"2020-09-28T15:35:27+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0","version":"19.0.3.1"}
{"reqId":"QJ5zdue1pjaxDjsj7Vfy","level":2,"time":"2020-09-28T15:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"Wx1ZrlPJ3P5VTwymIx1a","level":2,"time":"2020-09-28T16:17:39+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"BUJp6mZVClVGLMklICv3","level":2,"time":"2020-09-28T16:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"YF1k8Xz0TLIfbpXoFAti","level":2,"time":"2020-09-28T17:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"KLPzpMml96rONig4LlpU","level":2,"time":"2020-09-28T17:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"JNwZmR92LbEqq3XNNheM","level":2,"time":"2020-09-28T18:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"3Z8N3kqmSkEZNQDU9MDr","level":2,"time":"2020-09-28T18:47:37+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"TtsInRsNqDJiE5dQAQyw","level":2,"time":"2020-09-28T19:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"jpXve66XNlkPYOZZ10RK","level":2,"time":"2020-09-28T19:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"TUYnviwGdXlpwcDYKseY","level":2,"time":"2020-09-28T20:17:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"9NQLv0Jg2OQ3uH5izbww","level":2,"time":"2020-09-28T20:47:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ers5CKShxnKWS2IumJhM","level":2,"time":"2020-09-28T21:17:38+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"GhJNPFcOMz1XYHs13PNH","level":2,"time":"2020-09-28T23:45:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"hrX4Fof7NtXoLH2r3lHs","level":2,"time":"2020-09-28T23:45:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"u23OXoS5EItZtJtEHQP8","level":2,"time":"2020-09-28T23:45:35+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"9cvPtgTbZLMjvI9VqU0w","level":2,"time":"2020-09-28T23:45:36+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"zYlLMBQ4CS13XbFTZsdn","level":2,"time":"2020-09-29T10:02:49+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","version":"19.0.3.1"}
{"reqId":"hCk65TUJ64mU8HaMPP6W","level":2,"time":"2020-09-29T10:04:09+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","version":"19.0.3.1"}
{"reqId":"s2qGYfyn3S4HdjdBQIYW","level":2,"time":"2020-09-29T10:31:04+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: ***REMOVED SENSITIVE VALUE*** (Remote IP: ***REMOVED SENSITIVE VALUE***)","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36","version":"19.0.3.1"}
{"reqId":"dplwRz5mfV8Rwev4Oomz","level":2,"time":"2020-09-29T13:17:58+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"nuGgdG4n8f04lSrPq70A","level":2,"time":"2020-09-29T13:18:02+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"wyWdtBiAVR4XBQYySePG","level":2,"time":"2020-09-29T13:18:04+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"hMp8c3hiZy0C688FZf4N","level":2,"time":"2020-09-29T13:18:06+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"f4x4pv7ZC9H8pzk2BgWc","level":2,"time":"2020-09-29T14:00:30+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ci4w8DnaBBs11quXsQhA","level":2,"time":"2020-09-29T14:00:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"OPTIONS","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"vKpb5UJfFuTzQlqP9PHU","level":2,"time":"2020-09-29T14:00:33+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"PROPFIND","url":"/remote.php/dav/principals/users/***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"7Pkc7kW0ePnna0EQ0XEv","level":2,"time":"2020-09-29T14:00:34+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"osTPzuupAZh6q06UNuiy","level":2,"time":"2020-09-29T14:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"cEsJCJFEjF8TYdhZ9vDB","level":2,"time":"2020-09-29T15:00:25+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"1e3ZwVoaVACPP2knkIp8","level":2,"time":"2020-09-29T15:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"PGZ14l9sqsoiW97O2DZQ","level":2,"time":"2020-09-29T16:00:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"3GOaa1XQndf47ZwB93Qo","level":2,"time":"2020-09-29T16:16:22+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}
{"reqId":"SYhHP15B0EHwP6g8SW2w","level":2,"time":"2020-09-29T16:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"xsSl0AGKmDep79CGK67C","level":2,"time":"2020-09-29T17:00:31+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"MuR5GeMsADfmwyyvBZjY","level":2,"time":"2020-09-29T17:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"J7YHhbadS4w7j83B76wN","level":2,"time":"2020-09-29T18:00:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"ZeJmnLV4Hoxnt9va6mUl","level":2,"time":"2020-09-29T18:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"bLN2mfhoSeQpiX6nZaiC","level":2,"time":"2020-09-29T19:00:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"KKREmXu1YdM1Tj1vfMK7","level":2,"time":"2020-09-29T19:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"etBp9X2vWCWDPbhe5PAr","level":2,"time":"2020-09-29T20:00:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"xe4AZ0YcgAKchr05sHMJ","level":2,"time":"2020-09-29T20:30:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"rbiomNWrvUZRe83sRxZf","level":2,"time":"2020-09-29T21:00:26+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"REPORT","url":"/remote.php/dav/calendars/***REMOVED SENSITIVE VALUE***/***REMOVED SENSITIVE VALUE***-events_shared_by_***REMOVED SENSITIVE VALUE***/","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 Lightning/68.9.0","version":"19.0.3.1"}
{"reqId":"j38eAHXaf38bhiF***REMOVED SENSITIVE VALUE***16","level":2,"time":"2020-09-29T21:00:46+10:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"***REMOVED SENSITIVE VALUE***","app":"suspicious_login","method":"POST","url":"/login","message":"Detected a login from a suspicious login. user=***REMOVED SENSITIVE VALUE*** ip=***REMOVED SENSITIVE VALUE*** strategy=ipv4","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.106 Safari/537.36","version":"19.0.3.1"}

Browser log

Browser log 
N/A
@nooblag nooblag added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Sep 29, 2020
@nooblag nooblag changed the title Nextcloud not cleaning up PHP Sessions? Nextcloud not cleaning up PHP Sessions in /var/lib/php/session/? Sep 29, 2020
@kesselb
Copy link
Contributor

kesselb commented Sep 29, 2020

Thanks for reporting 👍

Closing in favour of #7628.

@kesselb kesselb closed this as completed Sep 29, 2020
@nooblag
Copy link
Contributor Author

nooblag commented Sep 29, 2020 •
edited
Loading

Wow. #7628 got reported in 2017? Bit of a problem innit?

@kesselb
Copy link
Contributor

kesselb commented Sep 29, 2020

Bit of a problem innit

I don't think so. Most likely a weird server configuration / not using app passwords / cron is not purging the sessions.

@nooblag
Copy link
Contributor Author

nooblag commented Sep 29, 2020 •
edited
Loading

Could we troubleshoot some of these then? I've set server config as per documentation (so that's not a "weird server configuration") and using crontab as www-data. How to test if cron is not purging the sessions? And what is "not using app passwords"?

@nooblag nooblag mentioned this issue Jun 17, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@nooblag @kesselb