What we log, and why
Which addresses and logs your server keeps, for how long, and how to see that it is so.
A server has to know who is knocking at the door, or it cannot lock anyone out. So LibrePortal keeps some addresses, for as short a time as security needs, and keeps no log that nothing reads. Admin → Tools → Privacy check has a Logs card that shows each line below and puts a tick on it only after checking.
What is kept, and for how long#
| What | Kept | Why |
|---|---|---|
| Sign-in limits and lockouts | In memory only, gone when the control panel restarts | To slow down password guessing |
| CrowdSec bans | An address until its ban ends (4 hours); CrowdSec's own records after 48 hours | To keep attackers out |
| Traefik's access log | Failed web requests only, at most 48 hours, never in a backup | So CrowdSec can spot probing |
| The control panel's activity log | The person and the action; the full address for 30 days, then only its network | To see who did what and from where |
| Sessions | The full address while the session is active, only its network after | So you can tell your own devices from a stranger |
| Container logs | 10 MB times 3 files per app, then the oldest goes | So a log can never fill the disk |
| Mail server | Warnings and errors, delivery history 7 days | To find out why a message did not arrive |
"Only its network" means the first three numbers of an IPv4 address (203.0.113.77 becomes 203.0.113.0/24) or the first three groups of an IPv6 one. The action, the person and the time stay.
The Traefik log has no cookies, no passwords and no query strings. Traefik cannot leave query strings out itself, so the log is rotated every 15 minutes and each closed file is cleaned; nothing older than a quarter of an hour holds one.
Quiet apps#
Apps that can be told how much to log are set to warnings and errors only, with their own access log off. In an app's Config tab, Detailed logs puts back its normal logging. Not every app has such a switch yet; the Log level of each app list on the Logs card says which do.
Debug for 24 hours#
When something is wrong and you need to see everything, turn on Debug logging for 24 hours in the app's Config tab, or run:
libreportal privacy debug vaultwarden on
It turns itself off after 24 hours, so you cannot forget it. libreportal privacy debug <app> off ends it sooner.
Seeing it#
libreportal privacy logs # the Logs card in words
libreportal privacy logs apply # bring this server to the policy