# Audit Logging Policy

# Audit Logging Policy

*Adapted from GitLab's Audit Logging Policy.*

## Why

We can only investigate what we logged. In the 2026 mailbox incidents, the **login and source-IP evidence had already gone** from Nextcloud's activity stream (it kept about 6 months), and mail submission headers don't record the sender's IP. This policy closes that gap.

## What must be logged

| System | Events | Owner |
|---|---|---|
| LDAP / mail (Postfix, Dovecot) | Successful and failed logins with username, source IP and time; messages sent per authenticated user | Federated Computer |
| Roundcube | Logins (`userlogins` log) with IP | Federated Computer |
| Nextcloud | Logins, failed logins, app-password and 2FA changes, admin actions, sharing (the **admin_audit** app) | Security DRI |
| BookStack, ERPNext | Logins and admin changes (built-in audit logs) | System owners |
| Servers and field devices | SSH logins, sudo use, config changes | Tech lead |

## Retention

Keep security logs for **at least 12 months**, so an incident found months later can still be investigated. Logs must be protected from changes and readable only by admins.

## Review and alerts

- Alert when one account sends unusually many messages per hour, or logs in from a new country.
- The Security DRI checks failed-login and sending-volume summaries monthly, and DMARC aggregate reports (sent to admin@) monthly.

## Status

As of October 2026, retention and alerting are **not yet confirmed** with Federated Computer. That is an open action from the 2026 incident report.