JIRA, Confluence audit logs

[Thomas Have]

Hi!

I'm bundling these two together, as the docs seem to indicate they work in much the same way.

We need extensive logging of user activity on our ticketing and collaboration sites.

It seems that

• Reads can be logged in JIRA/Confluence.
• The audit logs don't per construction cover everything (like ticket updates and so on).
• Using tomcat/valve logging extensive loggin is possible. However to me it seems that tomcat/valve logging is based on urls and http access method and so on. So it's NOT in terms what the users are doing. We would actually have to deduce that from the urls?

Are the above correct? Any suggestions would be much appreciated.

Thanks,

Thomas

[Nic Brough -Adaptavist- · Accepted solution]

No.

Reads in Jira simply aren't logged unless you make some code changes. Reads in Confluence can be, there is a plugin that does it built into the system, but it's disabled by default because the load it imposes can end up crippliing it.

Almost all changes are logged in both systems - that is in fact what they are for - tracking changes. This data all shows up in the history of the issue/page (Minor things not directly related to the issue or page data are not logged though. Stuff like users being added/removed as watchers, votes etc)

You are right in that you can use Tomcat logging to trap the urls accessed. That's pretty much your only real option here for read access logging. Almost all writes are logged by definition inside the apps though.

My suggestion would be to consider exactly what you need to log and then use Tomcat / Apache logging for analysing read access and the application reporting for writes.