Skip to content

WebTop: send login events to the system journal #8250

Open
Feature
Open
WebTop: send login events to the system journal#8250
Feature
Assignees
lucagasparini
Labels
verifiedAll test cases were verified successfully
Milestone
NethServer 8.11

Description

@stephdl
stephdl
opened on Oct 19, 2026

WebTop keeps a record of every login, but none of it reaches the system journal. The Wazuh module reads the journal, so today it cannot see WebTop logins. Admins want an alert when someone fails to log in, and when a user logs in from a country they have not allowed. Wazuh needs one line per login, with the user name, the client IP and whether it worked.

Proposed solution

WebTop already writes every login, logout and failed login to an internal log that is turned off by default. Turn it on and send it to the system journal, so each event shows up as one line at login time, with a fixed prefix that Wazuh can match.

Alternative solutions

A small service that reads the WebTop database every few seconds and writes new logins to the journal. It works, but it adds a delay, a background process and more code to maintain than turning on the log WebTop already has.

See also

Activity

  1. stephdl
    self-assigned this
    on Oct 19, 2026
  2. stephdl
    added the
    Feature
    issue type on Oct 19, 2026
  3. stephdl
    added this to the NethServer 8.11 milestone on Oct 19, 2026
  4. stephdl
    added this to NethServeron Oct 19, 2026
  5. github-project-automation
    moved this to ToDo in NethServeron Oct 19, 2026
  6. nethbot
    moved this from ToDo to In Progress in NethServeron Oct 20, 2026
  7. stephdl
    added a commit that references this issue on Oct 22, 2026

    feat: send WebTop auth log to journald (#324)

    a358eed

  8. stephdl commented on Oct 22, 2026

    @stephdl
    stephdl
    on Oct 22, 2026
    Author

    QA: WebTop auth log to journald (#324)

    Version: 1.5.17-dev.1

    api-cli run update-module --data '{"module_url":"ghcr.io/nethserver/webtop:1.5.17-dev.1","instances":["webtop1"],"force":true}'
journalctl -f | grep webtop-auth
    • Valid login: one webtop-auth: line with user and client IP.
    • Wrong password or unknown user: one webtop-auth: line.
    • Logout: no line.
    • Username with a line break: still one line, no forged second line.
    • Line not duplicated, no extra timestamp, other WebTop logs unchanged.
  9. stephdl
    moved this from In Progress to Testing in NethServeron Oct 22, 2026
  10. stephdl
    assigned
    lucagasparini
    and unassigned
    stephdl
    on Oct 22, 2026
  11. stephdl
    added
    testingPackages are available from testing repositories
    on Oct 22, 2026

  12. lucagasparini commented on Oct 22, 2026

    @lucagasparini
    lucagasparini
    on Oct 22, 2026

    Test VERIFIED
    Very good job 👍

  13. lucagasparini
    added
    verifiedAll test cases were verified successfully
    on Oct 22, 2026
  14. github-actions
    removed
    testingPackages are available from testing repositories
    on Oct 22, 2026
  15. nethbot
    moved this from Testing to Verified in NethServeron Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

verifiedAll test cases were verified successfully

Type

Feature

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions