[Bug]: v28 - Receiving erroneous emails about removal from LDAP groups

[Caligatio]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Since upgrading to v28 yesterday, my users have been receiving emails at seemingly random intervals saying that "An administrator removed you from group ". The groups in question are LDAP based groups, absolutely no edits have been performed, and the users are actually still members of the group when viewed in the Nextcloud interface. This setup has been stable for months and I haven't received these sorts of messages previously.

Steps to reproduce

Unknown at this time other than to be using LDAP and upgrading to v28.

Expected behavior

Not to receive emails about being removed from a group.

Installation method

Community Manual installation with Archive

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 22 to 23)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.REDACTED_INTERNAL_DOMAIN",
            "nextcloud.REDACTED_EXTERNAL_DOMAIN"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "28.0.0.11",
        "overwrite.cli.url": "https:\/\/nextcloud.REDACTED_EXTERNAL_DOMAIN",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "mail_smtpmode": "smtp",
        "mail_smtpauth": 1,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "mail_smtpport": "465",
        "mail_sendmailmode": "smtp",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 3,
        "defaultapp": "files",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "default_phone_region": "US",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "account_manager.default_property_scope": {
            "displayname": "v2-local",
            "email": "v2-local",
            "avatar": "v2-local",
            "address": "v2-private",
            "website": "v2-private",
            "phone": "v2-private",
            "twitter": "v2-private",
            "fediverse": "v2-private",
            "organisation": "v2-private",
            "role": "v2-private",
            "headline": "v2-private",
            "biography": "v2-private",
            "profile_enabled": "v2-private"
        },
        "maintenance": false,
        "theme": "",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 2.20.0
  - bruteforcesettings: 2.8.0
  - circles: 28.0.0-dev
  - cloud_federation_api: 1.11.0
  - comments: 1.18.0
  - contactsinteraction: 1.9.0
  - dav: 1.29.1
  - federatedfilesharing: 1.18.0
  - federation: 1.18.0
  - files: 2.0.0
  - files_external: 1.20.0
  - files_pdfviewer: 2.9.0
  - files_reminders: 1.1.0
  - files_sharing: 1.20.0
  - files_trashbin: 1.18.0
  - firstrunwizard: 2.17.0
  - logreader: 2.13.0
  - lookup_server_connector: 1.16.0
  - nextcloud_announcements: 1.17.0
  - notifications: 2.16.0
  - oauth2: 1.16.3
  - password_policy: 1.18.0
  - photos: 2.4.0
  - privacy: 1.12.0
  - provisioning_api: 1.18.0
  - recommendations: 2.0.0
  - related_resources: 1.3.0
  - serverinfo: 1.18.0
  - settings: 1.10.0
  - sharebymail: 1.18.0
  - support: 1.11.0
  - survey_client: 1.16.0
  - systemtags: 1.18.0
  - text: 3.9.1
  - theming: 2.3.0
  - twofactor_backupcodes: 1.17.0
  - twofactor_totp: 10.0.0-beta.2
  - twofactor_webauthn: 1.3.2
  - updatenotification: 1.18.0
  - user_ldap: 1.19.0
  - viewer: 2.2.0
  - workflowengine: 2.10.0
Disabled:
  - admin_audit: 1.18.0
  - dashboard: 7.8.0 (installed 7.6.0)
  - encryption: 2.16.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - files_versions: 1.21.0 (installed 1.19.1)
  - suspicious_login: 6.0.0
  - user_status: 1.8.1 (installed 1.4.0)
  - weather_status: 1.8.0 (installed 1.7.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Note that I've remove the all the cron-related entries:

{"reqId":"Uo5k3mnjCCWK63cZzfKi","level":3,"time":"2023-12-12T14:21:54+00:00","remoteAddr":"","user":"--","app":"core","method":"","url":"--","message":"Error while running background job (class: OC\\Core\\BackgroundJobs\\GenerateMetadataJob, arguments: )","userAgent":"--","version":"28.0.0.11","exception":{"Exception":"Doctrine\\DBAL\\Driver\\PDO\\PDOException","Message":"SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":"HY000","Trace":[{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Connection.php","line":128,"function":"new","class":"Doctrine\\DBAL\\Driver\\PDO\\PDOException","type":"::"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1464,"function":"commit","class":"Doctrine\\DBAL\\Driver\\PDO\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1422,"function":"doCommit","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/ConnectionAdapter.php","line":154,"function":"commit","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/Service/IndexRequestService.php","line":87,"function":"commit","class":"OC\\DB\\ConnectionAdapter","type":"->"},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php","line":199,"function":"updateIndex","class":"OC\\FilesMetadata\\Service\\IndexRequestService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php","line":116,"function":"saveMetadata","class":"OC\\FilesMetadata\\FilesMetadataManager","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":107,"function":"refreshMetadata","class":"OC\\FilesMetadata\\FilesMetadataManager","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":90,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":81,"function":"scanFilesForUser","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/Job.php","line":81,"function":"run","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/TimedJob.php","line":102,"function":"start","class":"OCP\\BackgroundJob\\Job","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/TimedJob.php","line":92,"function":"start","class":"OCP\\BackgroundJob\\TimedJob","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":152,"function":"execute","class":"OCP\\BackgroundJob\\TimedJob","type":"->"}],"File":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/PDOException.php","Line":20,"Previous":{"Exception":"PDOException","Message":"SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":"HY000","Trace":[{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Connection.php","line":126,"function":"commit","class":"PDO","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1464,"function":"commit","class":"Doctrine\\DBAL\\Driver\\PDO\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1422,"function":"doCommit","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/ConnectionAdapter.php","line":154,"function":"commit","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/Service/IndexRequestService.php","line":87,"function":"commit","class":"OC\\DB\\ConnectionAdapter","type":"->"},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php","line":199,"function":"updateIndex","class":"OC\\FilesMetadata\\Service\\IndexRequestService","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/FilesMetadata/FilesMetadataManager.php","line":116,"function":"saveMetadata","class":"OC\\FilesMetadata\\FilesMetadataManager","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":107,"function":"refreshMetadata","class":"OC\\FilesMetadata\\FilesMetadataManager","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":101,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":90,"function":"scanFolder","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/core/BackgroundJobs/GenerateMetadataJob.php","line":81,"function":"scanFilesForUser","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/Job.php","line":81,"function":"run","class":"OC\\Core\\BackgroundJobs\\GenerateMetadataJob","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/TimedJob.php","line":102,"function":"start","class":"OCP\\BackgroundJob\\Job","type":"->"},{"file":"/var/www/nextcloud/lib/public/BackgroundJob/TimedJob.php","line":92,"function":"start","class":"OCP\\BackgroundJob\\TimedJob","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":152,"function":"execute","class":"OCP\\BackgroundJob\\TimedJob","type":"->"}],"File":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Connection.php","Line":126},"message":"Error while running background job (class: OC\\Core\\BackgroundJobs\\GenerateMetadataJob, arguments: )","exception":{"errorInfo":["HY000",2006,"MySQL server has gone away"]},"CustomMessage":"Error while running background job (class: OC\\Core\\BackgroundJobs\\GenerateMetadataJob, arguments: )"}}
{}"reqId":"Uo5k3mnjCCWK63cZzfKi","level":3,"time":"2023-12-12T14:21:54+00:00","remoteAddr":"","user":"--","app":"cron","method":"","url":"--","message":"Exception thrown: OC\\DB\\Exceptions\\DbalException","userAgent":"--","version":"28.0.0.11","exception":{"Exception":"OC\\DB\\Exceptions\\DbalException","Message":"An exception occurred while executing a query: SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":2006,"Trace":[{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":328,"function":"wrap","class":"OC\\DB\\Exceptions\\DbalException","type":"::"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":367,"function":"executeStatement","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":355,"function":"unlockJob","class":"OC\\BackgroundJob\\JobList","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":158,"function":"setLastJob","class":"OC\\BackgroundJob\\JobList","type":"->"}],"File":"/var/www/nextcloud/lib/private/DB/Exceptions/DbalException.php","Line":71,"Previous":{"Exception":"Doctrine\\DBAL\\Exception\\ConnectionLost","Message":"An exception occurred while executing a query: SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":2006,"Trace":[{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1938,"function":"convert","class":"Doctrine\\DBAL\\Driver\\API\\MySQL\\ExceptionConverter","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1880,"function":"handleDriverException","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1208,"function":"convertExceptionDuringQuery","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/Connection.php","line":294,"function":"executeStatement","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Query/QueryBuilder.php","line":386,"function":"executeStatement","class":"OC\\DB\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":280,"function":"execute","class":"Doctrine\\DBAL\\Query\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":326,"function":"execute","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":367,"function":"executeStatement","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":355,"function":"unlockJob","class":"OC\\BackgroundJob\\JobList","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":158,"function":"setLastJob","class":"OC\\BackgroundJob\\JobList","type":"->"}],"File":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/API/MySQL/ExceptionConverter.php","Line":104,"Previous":{"Exception":"Doctrine\\DBAL\\Driver\\PDO\\Exception","Message":"SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":2006,"Trace":[{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Statement.php","line":132,"function":"new","class":"Doctrine\\DBAL\\Driver\\PDO\\Exception","type":"::"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1202,"function":"execute","class":"Doctrine\\DBAL\\Driver\\PDO\\Statement","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/Connection.php","line":294,"function":"executeStatement","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Query/QueryBuilder.php","line":386,"function":"executeStatement","class":"OC\\DB\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":280,"function":"execute","class":"Doctrine\\DBAL\\Query\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":326,"function":"execute","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":367,"function":"executeStatement","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":355,"function":"unlockJob","class":"OC\\BackgroundJob\\JobList","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":158,"function":"setLastJob","class":"OC\\BackgroundJob\\JobList","type":"->"}],"File":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Exception.php","Line":28,"Previous":{"Exception":"PDOException","Message":"SQLSTATE[HY000]: General error: 2006 MySQL server has gone away","Code":"HY000","Trace":[{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Statement.php","line":130,"function":"execute","class":"PDOStatement","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Connection.php","line":1202,"function":"execute","class":"Doctrine\\DBAL\\Driver\\PDO\\Statement","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/Connection.php","line":294,"function":"executeStatement","class":"Doctrine\\DBAL\\Connection","type":"->"},{"file":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Query/QueryBuilder.php","line":386,"function":"executeStatement","class":"OC\\DB\\Connection","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":280,"function":"execute","class":"Doctrine\\DBAL\\Query\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/DB/QueryBuilder/QueryBuilder.php","line":326,"function":"execute","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":367,"function":"executeStatement","class":"OC\\DB\\QueryBuilder\\QueryBuilder","type":"->"},{"file":"/var/www/nextcloud/lib/private/BackgroundJob/JobList.php","line":355,"function":"unlockJob","class":"OC\\BackgroundJob\\JobList","type":"->"},{"file":"/var/www/nextcloud/cron.php","line":158,"function":"setLastJob","class":"OC\\BackgroundJob\\JobList","type":"->"}],"File":"/var/www/nextcloud/3rdparty/doctrine/dbal/src/Driver/PDO/Statement.php","Line":130}}},"CustomMessage":"Exception thrown: OC\\DB\\Exceptions\\DbalException"}}

Additional info

The frequency of the activity emails is every 65 minutes or not at all. For instance, I got them at 2000, 2105, 2210, and 2315 but then nothing for the next ~9 hours until now.

[joshtrichards]

SQLSTATE[HY000]: General error: 2006 MySQL server has gone away

Have you looked into why your database server is going offline?

[Caligatio]

SQLSTATE[HY000]: General error: 2006 MySQL server has gone away

Have you looked into why your database server is going offline?

This also super confuses me as it's a service running on the same VM. Much like the LDAP issue, this is a first time problem since upgrading to v28.

[joshtrichards]

For the group/ldap matter specifically:

• there may be some additional log entries that start with service upgradeGroups" [...]
• you probably won't see many log entries though since your loglevel is set to 3; most of the ldap updateGroups messages are logged at debug or info level. Try temporarily running at loglevel 1 and carefully monitoring for group related log entries. Those may provide some clues.

This also super confuses me as it's a service running on the same VM. Much like the LDAP issue, this is a first time problem since upgrading to v28.

Hmm. Those db connection errors are generated by the db stack - we don't even directly generate them. Anything interesting in your db server logs or server journalctl logs?

I understand the timing; that's weird. But generally that sort of thing is a local environment issue. 🤔

[Caligatio]

OK, on the DB front: I rebooted the machine within +/- 1 minute of that log so that almost definitively answers that one.

I cranked up the logging for the LDAP issue... now I just need to wait <= 65 minutes.

[Caligatio]

I've disabled my email as it was spamming affected users but there's now this:

{"reqId":"gPPNS8KsyGEG5Qx8txSN","level":3,"time":"2023-12-13T05:39:21+00:00","remoteAddr":"LOCAL_IPV6","user":"brian","app":"jsresourceloader","method":"GET","url":"/settings/user/externalstorages","message":"Could not find resource files_external/js/oauth1.js to load","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0","version":"28.0.0.11","data":{"app":"jsresourceloader"}}
{"reqId":"gPPNS8KsyGEG5Qx8txSN","level":3,"time":"2023-12-13T05:39:21+00:00","remoteAddr":"LOCAL_IPV6","user":"brian","app":"jsresourceloader","method":"GET","url":"/settings/user/externalstorages","message":"Could not find resource files_external/js/oauth2.js to load","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0","version":"28.0.0.11","data":{"app":"jsresourceloader"}}
{"reqId":"gPPNS8KsyGEG5Qx8txSN","level":3,"time":"2023-12-13T05:39:21+00:00","remoteAddr":"LOCAL_IPV6","user":"brian","app":"jsresourceloader","method":"GET","url":"/settings/user/externalstorages","message":"Could not find resource files_external/js/public_key.js to load","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0","version":"28.0.0.11","data":{"app":"jsresourceloader"}}
{"reqId":"XXctal5EXT13jTV5MDEb","level":1,"time":"2023-12-13T17:25:06+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_GROUP1\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"XXctal5EXT13jTV5MDEb","level":1,"time":"2023-12-13T17:25:06+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_GROUP2\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"XXctal5EXT13jTV5MDEb","level":1,"time":"2023-12-13T17:25:06+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 groups [] were removed.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}

I only have two groups so this is the whole list. It looks like I'm also suffering from #42158

[Caligatio]

More logs but still nothing clear why this is happening:

{"reqId":"0X70kdbe8W9R5u3WmT5t","level":1,"time":"2023-12-13T22:07:28+00:00","remoteAddr":"REDACTED_IPV6","user":"REDACTED_USERNAME","app":"user_ldap","method":"PROPFIND","url":"/remote.php/dav/files/REDACTED_USERNAME/","message":"OCA\\User_LDAP\\LoginListener \u2013 REDACTED_USERNAME postLogin","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.26.0","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"0X70kdbe8W9R5u3WmT5t","level":1,"time":"2023-12-13T22:07:29+00:00","remoteAddr":"REDACTED_IPV6","user":"REDACTED_USERNAME","app":"user_ldap","method":"PROPFIND","url":"/remote.php/dav/files/REDACTED_USERNAME/","message":"OCA\\User_LDAP\\LoginListener \u2013 REDACTED_USERNAME added to REDACTED_LDAP_GROUP2","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.26.0","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"XWcIPktbaUICJ1uo6UOi","level":1,"time":"2023-12-13T22:50:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 REDACTED_USERNAME removed from REDACTED_LDAP_GROUP2","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"XWcIPktbaUICJ1uo6UOi","level":1,"time":"2023-12-13T22:50:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_LDAP_GROUP1\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"XWcIPktbaUICJ1uo6UOi","level":1,"time":"2023-12-13T22:50:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 groups [] were removed.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"sQAWVvmPOYyDw627uXpR","level":1,"time":"2023-12-13T23:26:12+00:00","remoteAddr":"REDACTED_IPV6","user":"REDACTED_USERNAME","app":"user_ldap","method":"HEAD","url":"/remote.php/dav/files/REDACTED_USERNAME/Upload/Jillian/2023/07/PXL_20230720_162454657.jpg","message":"OCA\\User_LDAP\\LoginListener \u2013 REDACTED_USERNAME postLogin","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.26.0","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"sQAWVvmPOYyDw627uXpR","level":1,"time":"2023-12-13T23:26:12+00:00","remoteAddr":"REDACTED_IPV6","user":"REDACTED_USERNAME","app":"user_ldap","method":"HEAD","url":"/remote.php/dav/files/REDACTED_USERNAME/Upload/Jillian/2023/07/PXL_20230720_162454657.jpg","message":"OCA\\User_LDAP\\LoginListener \u2013 REDACTED_USERNAME added to REDACTED_LDAP_GROUP2","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.26.0","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"rAzh78MsN7wpO8fYB1Un","level":1,"time":"2023-12-13T23:55:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 REDACTED_USERNAME removed from REDACTED_LDAP_GROUP2","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"rAzh78MsN7wpO8fYB1Un","level":1,"time":"2023-12-13T23:55:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_LDAP_GROUP1\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"rAzh78MsN7wpO8fYB1Un","level":1,"time":"2023-12-13T23:55:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 groups [] were removed.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"28H4IisiOn2S28mzcYxC","level":1,"time":"2023-12-14T01:00:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_LDAP_GROUP2\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"28H4IisiOn2S28mzcYxC","level":1,"time":"2023-12-14T01:00:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 new group \"REDACTED_LDAP_GROUP1\" found.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}
{"reqId":"28H4IisiOn2S28mzcYxC","level":1,"time":"2023-12-14T01:00:03+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"","url":"--","message":"service \"updateGroups\" \u2013 groups [] were removed.","userAgent":"--","version":"28.0.0.11","data":{"app":"user_ldap"}}

[systemofapwne]

I have exactly the same problem.
Updated my NC instance on Wednesday. Since then, I get these messages. I first suspected an intrusion, which I could exclude by removing remote access to NC. Yet, I got the mails.
Right now, I disabled email notification for group changes to mitigate mail spam.

[Caligatio]

@systemofapwne Where did you find that notification setting? I ended up just invalidating my SMTP config

EDIT: Turns out I'm also bit by nextcloud/logreader/issues/1073, found the setting!

[systemofapwne]

@systemofapwne Where did you find that notification setting? I ended up just invalidating my SMTP config

EDIT: Turns out I'm also bit by nextcloud/logreader/issues/1073, found the setting!

Here you go:

[systemofapwne]

Yet, I emphasize, this is just a workaround for the bug (that has no other impact but the email spam). It might be related to the LDAP plugin, but I'm not 100% sure, since it just happened after the recent NC update.