deletion of a page in confluence audit vs database

maarten breesnee

Hi,

I am a sysadmin of confluence. I got a question from one of my users to find out who deleted a page. 

I looked in the audit log on that page title and I found a result

it didn't match with their expectations so I digged more and I found an query:

<span>select</span> um<span>.</span>username<span>,</span> <span>c</span><span>.</span>title<span>,</span> s<span>.</span>spacename<span>,</span> <span>c</span><span>.</span>lastmoddate
<span>from</span> content <span>c</span> 
<span>join</span> user_mapping um <span>on</span> <span>c</span><span>.</span>lastmodifier <span>=</span> um<span>.</span>user_key
<span>join</span> spaces s <span>on</span> <span>c</span><span>.</span>spaceid <span>=</span> s<span>.</span>spaceid
<span>where</span> <span>c</span><span>.</span>content_status <span>=</span> <span>'deleted'</span> <span>and</span> contenttype <span>=</span> <span>'PAGE'</span>
<span>order</span> <span>by</span> username

I specified that on the specific page and it didn't match the audit result. It popped another name and another (earlier) datestamp. How can this be explained?

Davin Studer

When you delete a page the lastmodifier is not set. It is only set when you change the page content. In fact a new version is not created when the page is deleted. The most recent version is simply set to "deleted" for the CONTENT_STATUS. So, your audit log would be the correct place to go for deletions.