Audit Logging Policy
Audit Logging Policy
Adapted from GitLab's Audit Logging Policy.
Why
We can only investigate what we logged. In the 2026 mailbox incidents, the login and source-IP evidence had already gone from Nextcloud's activity stream (it kept about 6 months), and mail submission headers don't record the sender's IP. This policy closes that gap.
What must be logged
| System | Events | Owner |
|---|---|---|
| LDAP / mail (Postfix, Dovecot) | Successful and failed logins with username, source IP and time; messages sent per authenticated user | Federated Computer |
| Roundcube | Logins (userlogins log) with IP |
Federated Computer |
| Nextcloud | Logins, failed logins, app-password and 2FA changes, admin actions, sharing (the admin_audit app) | Security DRI |
| BookStack, ERPNext | Logins and admin changes (built-in audit logs) | System owners |
| Servers and field devices | SSH logins, sudo use, config changes | Tech lead |
Retention
Keep security logs for at least 12 months, so an incident found months later can still be investigated. Logs must be protected from changes and readable only by admins.
Review and alerts
- Alert when one account sends unusually many messages per hour, or logs in from a new country.
- The Security DRI checks failed-login and sending-volume summaries monthly, and DMARC aggregate reports (sent to admin@) monthly.
Status
As of October 2026, retention and alerting are not yet confirmed with Federated Computer. That is an open action from the 2026 incident report.
No comments to display
No comments to display