How to use access logs to identify changes made to base URL
Purpose
There may be times when the base URL is mistakenly updated by an admin causing issues with email URLS, application links, and etc. When this occurs the access logs from our Logging and Profiling page can be used to determine who and when this was changed. There are 2 methods that an application link can be updated. There are two methods that the base URL can be updated from within the JIRA application.
Cause 1: Base URL pop up banner
When JIRA is accessed by a sysadmin from a URL that is not the base URL, a pop-up comes up that asks if the user would like to change the base URL.
Resolution:
From the atlassian-jira-http-access.log, you're able to search the logs for
PUT /rest/api/2/settings/baseUrl
127.0.0.01 526x23030x1 admin [25/Apr/2016:08:46:46 -05700] "PUT /rest/api/2/settings/baseUrl HTTP/1.1" 204 - 32 "http://localhost:8091/CruzDesk/secure/Dashboard.jspa" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36" "1ubfnfb"
Cause 2: Base URL changed
The base URL can be changed via Administration > System > General configuration
Resolution:
From the atlassian-jira-http-access.log, you're able to search the logs for GET <BASE_URL>/CruzDesk/secure/admin/EditApplicationProperties!default.jspa
127.0.0.1 i911x1978x1 admin [26/Apr/2016:15:11:28 -0500] "POST http://localhost:8091/CruzDesk/rest/webResources/1.0/resources HTTP/1.1" - - - "http://cruzinusa.local:8091/CruzDesk/secure/admin/EditApplicationProperties!default.jspa" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36" "1ubfnfb"