Log IP and Username of every failed/successful login in Confluence

Is that possible via https://confluence.atlassian.com/display/CONFKB/How+to+Enable+User+Access+Loggingor some other method in Confluence?

This is a followup to https://answers.atlassian.com/questions/300124/log-ip-of-login-attempts

I'd like the full username and IP information of every login attempt/success logged.

2 answers

1 accepted

1 vote
Answer accepted

Stephen (wow there are three of us here),

Using the instructions at https://confluence.atlassian.com/display/CONFKB/How+to+Enable+User+Access+Loggingwill get you the IP and Username for every failed and successful login in Confluence, it will just take some parsing to figure out what is what. Below are some examples (do mind the IP address will look off, as I am performing this on a local Confluence instance on my workstation).

A failed attempt would look like:

2014-08-06 17:03:13,276 INFO [http-bio-8443-exec-2] [atlassian.confluence.util.AccessLogFilter] doFilter - GET https://localhost:8443/conf/login.action 253559-83584 1854
2014-08-06 22:03:27,780 WARN [http-bio-8443-exec-25] [atlassian.seraph.auth.DefaultAuthenticator] login login : 'sbrannen' tried to login but they do not have USE permission or weren't found. Deleting remember me cookie.

In this case we are looking at the first line to see a login attempt was made, and the IP address it was from. The second line will tell you what account name was used to attempt the login.

A successful attempt woud look like:

2014-08-06 22:04:08,668 INFO [http-bio-8443-exec-12] [atlassian.confluence.util.AccessLogFilter] doFilter - POST https://localhost:8443/conf/dologin.action 175657-3661 50
2014-08-06 22:04:08,708 INFO [http-bio-8443-exec-12] [atlassian.confluence.util.AccessLogFilter] doFilter sbrannen GET https://localhost:8443/conf/index.action 171714-7318 36

Again, the first line shows an attempt was made to login but instead this time is followed by the page accessed by this user.

I do want to note, that this is with the basic configuration explained in the above link. Further tinkering could get you more specific results.


Stephen Brannen | Confluence Support

Thanks. Was just coming to close this, was surprised to see another answer :). Support said this didn't provide what I asked for and opened a feature request I believe.

Are you hosted or on-premsis?

If on-premsis you can pull this information straight out of the database and report within confluence.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Mar 12, 2019 in Confluence

Confluence Admin Certification now $150 for Community Members

More and more people are building their careers with Atlassian, and we want you to be at the front of this wave! Important Dates Start the Certification Prep Course by 2 April 2019 Take your e...

1,481 views 4 13
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you