nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Jira / Confluence / Bitbucket: what kind of personal data is logged (GPDR)

Jens Kisters __SeibertSolutions

Hello fellow atlassian users,

our data security officer had one more question in the course of finalizing our measures to be GPDR compliant, and i am struggeling to find an answer:

Which personal data is logged by Jira / Confluence / Bitbucket in any "technical logs" ?

I studied Atlassians GDPR Guide and it names the obvious locations (Issue Fields, User Fields, Comments, Worklogs etc.)

But i know that for example in Jira

the atlassian-jira.log often holds user names
you can find out what a administrator did when looking at the audit logs
it is logged when a user logs in

and im pretty sure theres more data like this stored in Jira.

Is there a comprehensive list somewhere about these kind of logs?

Or is this not relevant from the GPDR point of view?

thanks in advance

Jens

Accepted answers

Jens Kisters __SeibertSolutions

To answer my own question after some great insights from @Alexander Kueken:

I am thinking of making the GPDR documentation state that Jira logs every action a user did and from which IP he/she did do that,

also stating how long logs are stored.

Even if this is only partially true, but i guess we'd be on the safe(er) side like this.

All comments

Mirek

There is a complete GDPR guide for all Atlassian products.

https://confluence.atlassian.com/gdpr/server-and-data-center-gdpr-support-guides-949245592.html

Nothing more to say

Jens Kisters __SeibertSolutions

Mirek, thank you for your reply,

i did check out the guide and what i am trying to find out:

Why does the guide not mention technical logs?

Mirek

Eveeryone understand GDPR regulations differently so you need to focus on the articles. In JIRA logs nothing can clearly identify you as you by name, email or phone. This is personal data which GDPR is protecting.

Jens Kisters __SeibertSolutions

hmmm....

To me this excerpt from our atlassian-jira.log dientifies me pretty clearly

2018-05-29 17:15:57,701 http-nio-8080-exec-8077 WARN j.kisters 1935x1119412x1 191yscl 89.246.xx.xx,127.0.0.1 /browse/ISS-123

Alexander Kueken

Hi Jens,

logging is always a difficult conflicted topic, already before GDPR. Before GDPR there was always the conflict between workers' councils, which didn't want you to write user information in the log files as you could potentially misuse them for performance measurements, and compliance, revision, it security and the operations department.

The solution in many of my projects was to take certain actions, to bring all involved parties together:

Reducing the number of people, who are able to access the log files, to a minimum
Configuring a very short log rotation (keeping the logs for less than 7 days)
Not including the log files in the backups

Perhaps the same works together with the GDPR. As long as you have a valid reason for it, it would be OK to write PIIs in the log files. For example, the access.log contains user information, which could be an important instrument to detect intruders or misuse.

As far as I know, there is no comprehensive list of information about in which cases Atlassian writes PIIs to the log. To make it more difficult, it could depend on the configuration of the logging. For example in the standard configuration "Mapped Diagnostic Context" is activated. This context contains the username and leads to the log entry in your example. See

https://developer.atlassian.com/server/confluence/logging-guidelines/

By manipulating the log4j settings, you can configure whether and how you want the content of the context printed to the log files. More difficulty it will get if PIIs are part of the log message by itself and as such is generated internally. There will be no easy solution to remove those log entries, besides deactivating the logging overall. Besides the base systems, also all the plugins/apps are writing to the same log file, which will make it even more difficult.

Independent of how your solution will look like, there is one important fact to keep in mind, in case you need technical support from Atlassian or a plugin vendor. In most cases, Atlassian or the vendor will ask you to generate the support ZIP and send it together with your support request. The support ZIP will contain a copy of the existing log files, so you would transfer PIIs of your users to Atlassian or the vendor.

I know all this is not a concrete answer to your questions, but perhaps it helps you on your journey to GDPR compliance.

Regards,
Alexander

Jens Kisters __SeibertSolutions

Alexander, thank you very much for taking so much time, i really appreciate it.

This definiately helps us.

Jens Kisters __SeibertSolutions

To answer my own question after some great insights from @Alexander Kueken:

I am thinking of making the GPDR documentation state that Jira logs every action a user did and from which IP he/she did do that,

also stating how long logs are stored.

Even if this is only partially true, but i guess we'd be on the safe(er) side like this.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-server

gdpr