The script shown below can be run via a CRON job (we run it every 15 minutes). It checks the Nextcloud apache2 log and sends out an email if a Share has been accessed since the last time the CRON job ran. The curl command which sends out the email uses the free Twillo SendGrid service,
$$
#!/usr/bin/env bash
#
FILE="/home/karmst/Documents/nextcloud_access.log"
mapfile -t my_array < <( grep -E "^.+GET /s/.+" /var/log/apache2/sites/nextcloud_access.log )
counter=0
for value in "${my_array[@]}"
do
to_check=$(echo "$value" | sed -E 's/(^.+\[.+\].+)( .+)$/\1/')
share_name=$(echo "$value" | sed -E 's/(^.+GET )(.+) (HTTP.+)$/\2/')
result=$(echo "$value" | sed -E 's/(^.+GET )(.+?) (HTTP.+?)"\s([0-9]{3})(.+$)/\4/')
to_check_replace_1=${to_check//[/\\[}
to_check_replace_2=${to_check_replace_1//]/\\]}
downloads_file_check=$( grep "$to_check_replace_2" $FILE)
if [ -z "$downloads_file_check" ]; then
counter=$((counter+1))
downloads_to_file=$( echo "$value" >> $FILE )
IP=$(echo "$value" | sed -E 's/(^.+) - - (.+)$/\1/')
DATE=$(echo "$value" | sed -E 's/^.+(\[.+\])(.+)$/\1/')
LOCATION=$(curl ipinfo.io/"$IP"/city)
THECONTENT+=$(echo Date : $DATE"
"Location : $LOCATION"
"Address : $IP"
"Share : $share_name"
"Result : $result"
") fi done SUBJECT=$(echo Belkast fileshare was accessed $counter time\(s\)) if [ -n "$THECONTENT" ]; then curl --request POST \ --url https://api.sendgrid.com/v3/mail/send \ --header 'Authorization: Bearer API-KEY' \ --header 'Content-Type: application/json' \ --data '{"personalizations": [{"to": [{"email": "test@example.com"}]}],"from": {"email": "admin@example.com"},"subject": '\""$SUBJECT\""',"content": [{"type": "text/html", "value": '\""$THECONTENT\""'}]}' fi exit 0; $$
"Location : $LOCATION"
"Address : $IP"
"Share : $share_name"
"Result : $result"
") fi done SUBJECT=$(echo Belkast fileshare was accessed $counter time\(s\)) if [ -n "$THECONTENT" ]; then curl --request POST \ --url https://api.sendgrid.com/v3/mail/send \ --header 'Authorization: Bearer API-KEY' \ --header 'Content-Type: application/json' \ --data '{"personalizations": [{"to": [{"email": "test@example.com"}]}],"from": {"email": "admin@example.com"},"subject": '\""$SUBJECT\""',"content": [{"type": "text/html", "value": '\""$THECONTENT\""'}]}' fi exit 0; $$
The content of the email is shown below. Only one email is sent, regardless of how many times the Share was accessed.
Date : [22/Oct/2024:13:33:50 +0100]
Location : Boston
Address : 172.172.172.1
Share : /s/36Tm5RS38bJ5D5wfgB
Result : 404
Date : [22/Oct/2024:15:58:53 +0100]
Location : Boston
Address : 172.172.172.1
Share : /s/36Tm5RS38bJ5D5wfgB
Result : 404
Date : [22/Oct/2024:16:36:50 +0100]
Location : Boston
Address : 172.172.172.1
Share : /s/36Tm5RS38bJ5D5wfgB
Result : 404