Log IP and Username of every failed/successful login in Confluence

[Stephen Hayden]

Is that possible via https://confluence.atlassian.com/display/CONFKB/How+to+Enable+User+Access+Loggingor some other method in Confluence?

This is a followup to https://answers.atlassian.com/questions/300124/log-ip-of-login-attempts

I'd like the full username and IP information of every login attempt/success logged.

[Branno · Accepted solution]

Stephen (wow there are three of us here),

Using the instructions at https://confluence.atlassian.com/display/CONFKB/How+to+Enable+User+Access+Loggingwill get you the IP and Username for every failed and successful login in Confluence, it will just take some parsing to figure out what is what. Below are some examples (do mind the IP address will look off, as I am performing this on a local Confluence instance on my workstation).

A failed attempt would look like:

2014-08-06 17:03:13,276 INFO [http-bio-8443-exec-2] [atlassian.confluence.util.AccessLogFilter] doFilter - GET https://localhost:8443/conf/login.action 253559-83584 1854 127.0.0.1
2014-08-06 22:03:27,780 WARN [http-bio-8443-exec-25] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'sbrannen' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

In this case we are looking at the first line to see a login attempt was made, and the IP address it was from. The second line will tell you what account name was used to attempt the login.

A successful attempt woud look like:

2014-08-06 22:04:08,668 INFO [http-bio-8443-exec-12] [atlassian.confluence.util.AccessLogFilter] doFilter - POST https://localhost:8443/conf/dologin.action 175657-3661 50 127.0.0.1
2014-08-06 22:04:08,708 INFO [http-bio-8443-exec-12] [atlassian.confluence.util.AccessLogFilter] doFilter sbrannen GET https://localhost:8443/conf/index.action 171714-7318 36 127.0.0.1

Again, the first line shows an attempt was made to login but instead this time is followed by the page accessed by this user.

I do want to note, that this is with the basic configuration explained in the above link. Further tinkering could get you more specific results.

Cheers,

Stephen Brannen | Confluence Support

[Stephen Hayden]

Thanks. Was just coming to close this, was surprised to see another answer :). Support said this didn't provide what I asked for and opened a feature request I believe.

[NotTheRealStephenSifersNOPENOPENOPENOPE]

Are you hosted or on-premsis?

If on-premsis you can pull this information straight out of the database and report within confluence.