Is auditing in syncthing possible?

Feature
1

I would like to generate a report of who created or changed files, how do I do this?

2

I think that the --audit flag comes closest to what you want.

1 Like
3

I’m running Windows Server 2019, how do I apply this command?

4

How did you install it?

PS/ I have never used that flag myself, so others are more than welcome to jump in and help once we know how Syncthing was installed. /DS

5

I installed it by running the standard installer. I just clicked and followed the installation wizard.

6

I think the simplest way will be to enable it via the GUI. If you go to “Actions” → “Advanced” → “Options”, you will find “Audit Enabled” and “Audit File”, which you need to enable and configure. For the file, just input a full path to a text file located in your system. Please keep in mind that with time, the audit file may grow to a very large size.

7

{“id”:56,“globalID”:56,“time”:“2025-09-04T22:35:46.1553602-04:00”,“type”:“LocalChangeDetected”,“data”:{“action”:“modified”,“folder”:“nvxj5-jlryt”,“folderID”:“nvxj5-jlryt”,“label”:“compartilhado_note”,“modifiedBy”:“HRCIN6G”,“path”:“teste - Copia.txt”,“type”:“file”}}

Thanks for the tip, I managed to activate it. I came across this log. Is it possible to configure anything else, or will the filtering have to be done manually?

8

Unfortunately, there are no more detailed filtering options built into Syncthing. The format is JSON though, so you could easily use PowerShell to filter what you need (or any of the other, third-party JSON filtering tools).

9

I’ve been using https://jqlang.org/ to parse Syncthing API responses because I don’t care for Powershell.