qKVMDocs
All pages

Activity log

Who signed in, changed what, and did what to which machine: Settings > Activity, for admins.

  • The record is a set of text files in the data folder: audit.log, and before it audit.log.1 to audit.log.9, the oldest last. One entry a line, in JSON: time (seconds since 1970), event, ip, user (the account, or a token's name with " (token)"), and what it concerned: a machine by its name (device) and, since 0.2.0, its id (device_id). They are written first, by a thread of their own, as they were in 0.1.x; never rewritten; what --audit-syslog sends on; what grep and tail read when qKVM is down. When the newest is full it becomes audit.log.1, each of the others one older, and the oldest goes; a step of that which fails (a file held open by another program, on Windows) is taken up again at the next entry, from where it stopped, and no other file goes. A line cut off by a power cut is ended before the next entry, which is not lost with it.
  • How much is kept: 50 MB, in ten files of 5 MB. A busy wall (64 machines with alerts on, three people working at them: live views, keyboards taken, actions, sign-ins, some 1,200 entries a day) writes about 190 kB a day: 50 MB is some nine months of it. An entry is 90 to 180 bytes; a live view is two, keyboard and mouse taken and given back two more. At the worst, 64 machines whose state changes at every look of the alerts (every half minute) write some 27 MB a day, and 50 MB is two days of that. The size is activity_mb (10 to 100000; nothing, or 0, is 50), read at the start. Change it with offline server settings. A wall whose settings say a size already keeps it.
  • The page reads an index of it, audit.sqlite beside the files: the same entries, with what they are found by, so that a search of a long log is answered at once (on a test PC, a 100 MB log of 630,000 entries: a word that is nowhere in 0.2 s, one machine's alerts on a day a year ago in 0.2 s, the newest page in a few thousandths; reading the files for the same takes 2 to 5 s). It is made from the files and from nothing else, and holds what they hold and no more: an entry that goes from the files goes from it. It takes about two and a half times the files' size (some 125 MB beside their 50 MB, as it comes). At the first start of 0.2.0 it is made from the files an earlier version wrote (a few seconds for 20 MB), and again whenever it is damaged, missing, of another version, or finds that a file no longer holds what it read of it (a power cut can take the last lines of a text file, which is not written through to the disk at every entry, and leave them in the index) (some 15 s for 100 MB): nothing of the log is lost, and the log of qKVM says so. Nothing waits for it: the text files are written whatever it does, the wall answers as fast, and where it is behind (being made, its disk refusing) the page reads the files themselves, slower, with the same answers, for 5 s at the most (a page of a download, 15 s): a question that takes longer there is answered 503 activity_unavailable, to be asked again in a moment or narrowed down. It leaves the record its room: where the disk has less free than two text files and 32 MB more, it waits (the log of qKVM says so), and the page reads the files. Where two of the files begin with the same line (a copy made by hand), it steps aside until one of them goes, and is made again then. The newest file's last line counts once it has ended, for the index and the reading of the files alike (a line written into the file by hand without its end is run into by qKVM's next entry, as in 0.1.x, and is no entry for either; one cut off by a power cut is ended at the next start).
  • In the page the log is searched (under the names the page shows, or the ones in the file), narrowed to sign-ins, actions on machines, changes or alerts, to a machine (what was done to it; what was written before 0.2.0 named it only, and is found by the name it has now), to an account or a token (typed: one that was removed is in the log all the same), and to a time from and to; older entries come a page at a time (those of the moment a page ended in come on the next one: a removal of many machines can write hundreds with one time; of a moment with more than 500, the newest 500 are shown). It is downloaded as a table (CSV) or as the lines themselves, all of it or what is shown: made a page at a time, however long it is (never the whole log in memory: beyond 8 MB in a temporary file in the data folder, gone once it is sent, or at the next start where a power cut left it), and sent once it is whole, with its length, so that one cut off on its way shows as cut off; one that cannot be made whole is refused (503 activity_unavailable). It takes none of the record's room: where the disk would keep less than the index waits for, it is refused (507 not_saved). Three are made or sent at once, one of each account (beyond that, 503 busy), and one whose asker went away is made no further. What goes from the log while a long one is made (the oldest file, when the newest is full) is not in it; made from the files themselves, it is of the files as they were when it began (on a share, the newest file is then moved on only once it is made: nothing is lost, the file grows past its size meanwhile). Enlarged, a tile shows an admin the last three things done to its machine beside its history (live views left out: "Nothing but live views" where its last 100 entries are only those), and All of it opens the log on that machine.
  • What is written: sign-ins and sign-outs, wrong passwords and codes; every change of the settings, accounts, tokens, machines and saved actions; every action on a machine, and one that failed; a live view opened and ended, with how long it was open; keyboard and mouse taken, taken over and given back; a server's console opened, or asked for and not had; alerts; a file of the wall exported or taken in, and a download of this log with what it was of. Never a password, a key pressed, or a text that was typed. An account's live views write 120 entries an hour at the most, and the next one says how many were left out: two entries a view, a script opening lines in a loop would otherwise push out of the log what was done before it. The same for a server's console opened, and for one asked for and not had: 120 entries an hour of each account, each; and an opening of a server that no entry of that account named in the last hour is written whatever is left, so that every server whose console an account opened is named in the log within the hour (openings beyond that are counted).
  • Read in turns, as the history is: one read at a time of each account (its next waits its turn, and after a read as long again as it took), three at once from everybody together; beyond that, 503 busy with Retry-After. A read of the index is given up after 5 s (503 activity_unavailable: narrow it down). A read that waited asks again whether its asker may still have it (signed out, removed, or no longer an admin meanwhile: refused), and so does a download before each page.
  • For a program (an admin's session; a token is never an admin): GET /api/v1/audit with q (words, any of them, in any case; several q), kind (signin, action, change, alert), device (a machine's id), user (an account's name, or a token's as the log writes it, night script (token); in any case), since and until (seconds since 1970), before (older than this: the next page), limit (1 to 500, 100 left out) answers entries (newest first, as written), more, and missing (entries that could not be written, or null). GET /api/v1/audit/export takes the same but before and limit, and format (csv or jsonl), and answers the file with its Content-Length, or 503 activity_unavailable or busy, 507 not_saved. These are the page's own requests (see The API): they change with it. qkvm status says how large the files and the index are.