I think you may be getting the two threads confused. The events in my other thread (about cyrus imap repeatedly calling sudo) are coming from the secure log. These are not coming from any log file.

BTW:

grep cyrus /var/log/* -r | grep runuser

indicates the messages are coming from /var/log/secure*

I am not convinced app-events is the right app although it is what could be indicated by the url bar. I think it is used to trigger things like a firewall reload on interface change and things like that. I don't know what the right app is.

I'm on 7.4 Business but those notes are from when I was running community. I've just tried it now and it works:

[root@server ~]# /usr/clearos/sandbox/usr/bin/mysql -D reports -u reports -p`cut -f3 -d" " /var/clearos/system_database/reports`

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A



Welcome to the MariaDB monitor.  Commands end with ; or \g.

Your MariaDB connection id is 18285

Server version: 5.5.56-MariaDB MariaDB Server



Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.



Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.



MariaDB [reports]>

Perhaps you have no reports installed.

I noticed there were no events-looking reports earlier when I edited my post. I'll have to try pulling the rpm down, but I can't really read the code either.

# /usr/clearos/sandbox/usr/bin/mysql -D reports -u reports -p`cut -f3 -d" " /var/clearos/system_database/reports`

cut: /var/clearos/system_database/reports: No such file or directory

-bash: /usr/clearos/sandbox/usr/bin/mysql: No such file or directory

Are we both on ClearOs 7 Community Edition?

Perhaps you have a different app which creates that database?

I have mariadb installed for other reasons, and the only possible relevant database is performance_schema, but there appears to be no data in most of the tables.

Besides, the source code (if I have the right app) specifically mentions a SQLite database.

I think the database is system-mysql (mariadb), a sandboxed version of mysql (mariadb). If you want to look at it you can go to Webconfig > Server > Database > MariaDB Database Server the admin tool. The password is in /var/clearos/system_database/root. The reports password is in /var/clearos/system_database/reports.

To access the reports database you can do a long-winded:

/usr/clearos/sandbox/usr/bin/mysql -D reports -u reports -p`cut -f3 -d" " /var/clearos/system_database/reports`

Or someone set up a nice shortcut, and you can just type "rmysql"

[edit]
... and having writtes all that, all I can see in the system-mysql database are the roundcube and reports databases and in reports there is only network, proxy, proxy_domains and resource
[/edit]

Nick: I see those buttons now - I was looking on a 10" tablet, and the sidebars were hidden!

Mansoor: Software Repository has no messages today. When I first installed it (yesterday) it complained that clearos-centos and clearos-centos-updates weren't enabled (so I enabled them). So perhaps the warning was related to that.

I am quite surprised that, if those repos are important, they are not enabled by default.

Also, it would be useful if the messages in the Events and Notifications app gave a better idea of what was wrong, and where to go to fix it. I imagined that clicking on a message would give more information, or take me to the app or log that created the message, but unfortunately not.

If I had a better idea how the app worked, I might submit a patch. Unfortunately my reading of the source code of app-events indicates the events are stored in a database, but a

find / - mount - name sysmon.db - print

as root fails to find the named file, so how it works remains a mystery.

On the right of the screen there are three check boxes for Show Info, Show Warning and Show Critical. Try those.

It seems that you have enabled one or more of the repositories that the clearOS system considers "dangerous" (as updates from them may break things in the server).

So, go to Could > Software Repository and see if you have any warning there.