I’ve been looking to into the GitLab CE logs in the hope of being able to see which Users have cloned private repositories, and performed other git commands against the repositories on our gitlab server.
I can see this entry when using ssh to clone a repo…
==> /var/log/gitlab/gitlab-shell/gitlab-shell.log <==
I, [2017-04-18T08:56:08.991605 #21792] INFO -- : POST http://127.0.0.1:8080/api/v3/internal/allowed 0.12897
I, [2017-04-18T08:56:08.991874 #21792] INFO -- : gitlab-shell: executing git command <git-upload-pack /var/opt/gitlab/git-data/repositories/group1/repo1.git> for user with key key-7.
I assume “key-7” is my user, but how do I check that?
How do I know what type of git command it was? I generate this log entry using a git clone command, but the log doesn’t mention the clone command at all.
And only these log messages when using https to clone a repo…
==> /var/log/gitlab/gitlab-workhorse/current <==
2017-04-18_08:49:12.65372 git.ai-knows.com @ - - [2017-04-18 08:49:12.058956403 +0000 UTC] "GET /group1/repo1.git/info/refs?service=git-upload-pack HTTP/1.1" 200 310 "" "git/2.7.4" 0.594697
==> /var/log/gitlab/nginx/gitlab_access.log <==
111.222.333.444 - blair [18/Apr/2017:08:49:12 +0000] "GET /group1/repo1.git/info/refs?service=git-upload-pack HTTP/1.1" 200 310 "-" "git/2.7.4"
==> /var/log/gitlab/gitlab-rails/production.log <==
Started POST "/group1/repo1.git/git-upload-pack" for 111.222.333.444 at 2017-04-18 08:49:13 +0000
Processing by Projects::GitHttpController#git_upload_pack as application/x-git-upload-pack-result
Parameters: {"namespace_id"=>"group1", "project_id"=>"repo1.git"}
Completed 200 OK in 414ms (Views: 0.2ms | ActiveRecord: 24.1ms)
==> /var/log/gitlab/gitlab-workhorse/current <==
2017-04-18_08:49:13.72971 git.ai-knows.com @ - - [2017-04-18 08:49:13.045264041 +0000 UTC] "POST /group1/repo1.git/git-upload-pack HTTP/1.1" 200 10355 "" "git/2.7.4" 0.684403
==> /var/log/gitlab/nginx/gitlab_access.log <==
111.222.333.444 - blair [18/Apr/2017:08:49:13 +0000] "POST /group1/repo1.git/git-upload-pack HTTP/1.1" 200 10389 "-" "git/2.7.4"
From the gitlab_access.log I can see my username “blair” and my ip address was 111.222.333.444. But how do I know that the request was a clone versus some other git command?