elukey@matomo:~$ sudo -u www-data /usr/bin/php /usr/share/matomo/console core:update

    *** Update ***

    Database Upgrade Required

    Your Matomo database is out-of-date, and must be upgraded before you can continue.

    Matomo database will be upgraded from version 3.7.0 to the new version 3.9.1.

    *** Note: this is a Dry Run ***

    ALTER TABLE `piwik_user` ADD COLUMN `twofactor_secret` VARCHAR(40) NOT NULL DEFAULT '';
    CREATE TABLE `piwik_twofactor_recovery_code` (`idrecoverycode` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT, `login` VARCHAR(100) NOT NULL, `recovery_code` VARCHAR(40) NOT NULL, PRIMARY KEY ( `idrecoverycode` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    ./console plugin:activate "TwoFactorAuth"
    ./console plugin:deactivate "GoogleAuthenticator"
    CREATE TABLE `piwik_tracking_failure` (`idsite` BIGINT(20) UNSIGNED NOT NULL, `idfailure` SMALLINT UNSIGNED NOT NULL, `date_first_occurred` DATETIME NOT NULL, `request_url` MEDIUMTEXT NOT NULL, PRIMARY KEY ( `idsite`, `idfailure` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    CREATE TABLE `piwik_brute_force_log` (`id_brute_force_log` bigint(11) NOT NULL AUTO_INCREMENT, `ip_address` VARCHAR(60) DEFAULT NULL, `attempted_at` datetime NOT NULL, PRIMARY KEY ( `id_brute_force_log` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    ALTER TABLE `piwik_brute_force_log` ADD INDEX index_ip_address (`ip_address`);

    *** End of Dry Run ***

A database upgrade is required. Execute update? (y/N) y

Starting the database upgrade process now. This may take a while, so please be patient.

    *** Update ***

    Database Upgrade Required

    Your Matomo database is out-of-date, and must be upgraded before you can continue.

    Matomo database will be upgraded from version 3.7.0 to the new version 3.9.1.

    The database upgrade process may take a while, so please be patient.

  Executing ALTER TABLE `piwik_user` ADD COLUMN `twofactor_secret` VARCHAR(40) NOT NULL DEFAULT '';... Done. [1 / 7]
  Executing CREATE TABLE `piwik_twofactor_recovery_code` (`idrecoverycode` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT, `login` VARCHAR(100) NOT NULL, `recovery_code` VARCHAR(40) NOT NULL, PRIMARY KEY ( `idrecoverycode` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;... Done. [2 / 7]
  Executing ./console plugin:activate "TwoFactorAuth"... Done. [3 / 7]
  Executing ./console plugin:deactivate "GoogleAuthenticator"... Done. [4 / 7]
  Executing CREATE TABLE `piwik_tracking_failure` (`idsite` BIGINT(20) UNSIGNED NOT NULL, `idfailure` SMALLINT UNSIGNED NOT NULL, `date_first_occurred` DATETIME NOT NULL, `request_url` MEDIUMTEXT NOT NULL, PRIMARY KEY ( `idsite`, `idfailure` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;... Done. [5 / 7]
  Executing CREATE TABLE `piwik_brute_force_log` (`id_brute_force_log` bigint(11) NOT NULL AUTO_INCREMENT, `ip_address` VARCHAR(60) DEFAULT NULL, `attempted_at` datetime NOT NULL, PRIMARY KEY ( `id_brute_force_log` )) ENGINE=InnoDB DEFAULT CHARSET=utf8;... Done. [6 / 7]
  Executing ALTER TABLE `piwik_brute_force_log` ADD INDEX index_ip_address (`ip_address`);... Done. [7 / 7]

Matomo has been successfully updated!

It appears you have executed this update with user www-data:www-data, while your Matomo files are owned by root:root.

To ensure that the Matomo files are readable by the correct user, you may need to run the following command (or a similar command depending on your server configuration):

$ chown -R www-data:www-data /usr/share/matomo