Nextcloud MariaDB Direct Queries

Connection

Container: nextcloud-db-1 Database: nextcloud CLI: mariadb (NOT mysql) Credentials from ~/nextcloud/docker-compose.yml:

docker exec nextcloud-db-1 mariadb -u nextcloud -p'Nc2026Db!Szw' nextcloud -e "<SQL>"

File Metadata (oc_filecache)

When was a file stored? Who owns it? What's its real size?

SELECT fileid, path,
       FROM_UNIXTIME(storage_mtime) as stored_utc,
       FROM_UNIXTIME(mtime) as modified_utc,
       size
FROM oc_filecache
WHERE path LIKE '%关键词%';

Key fields:

storage_mtime: when the file was written to disk (UNIX timestamp)
mtime: last modification time
These are UTC — add 8 hours for Beijing time

Activity Log (oc_activity)

Who created/uploaded/modified a file?

SELECT activity_id,
       FROM_UNIXTIME(timestamp) as time_utc,
       user, subject, file
FROM oc_activity
WHERE file LIKE '%关键词%'
ORDER BY timestamp ASC;

Key subject values:

created_self — user uploaded/created the file
changed_self — user modified the file
deleted_self — user deleted the file

Important Distinction

Files uploaded via docker cp + occ files:scan (our automated workflow) do NOT create an oc_activity record. Only files uploaded through the Nextcloud web UI or sync client do. So:

Activity record exists → uploaded by that user through Nextcloud UI
No activity record but file exists in oc_filecache → uploaded via docker cp (automated pipeline)

Provenance Investigation Checklist

When Doro asks "这份文件哪来的" or "存入时间是什么时候":

cache/documents/ — check stat for when WeChat received it (Birth time)
oc_filecache — storage_mtime for when it landed on Nextcloud disk
oc_activity — check if there's a created_self record (means web upload)
No activity record → file was put there by automated workflow (docker cp)
gateway journal — journalctl --user -u hermes-gateway | grep "文件关键词" for WeChat reception time
session_search — search for the filename to find which session processed it

All timestamps are UTC on server. Always convert to Beijing time (UTC+8) before reporting to Doro.

2.2 KiB Raw Permalink Blame History