How to identify who deleted a plan branch
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
The steps outlined on this article are provided AS-IS. This means we've had reports of them working for some customers — under certain circumstances — yet are not officially supported, nor can we guarantee they'll work for your specific scenario.
You may follow through and validate them on your own non-prod environments prior to production or fall back to supported alternatives if they don't work out.
We also invite you to reach out to our Community for matters that fall beyond Atlassian's scope of support!
Summary
This article will go through a few options to help identify who deleted a plan branch. This can be helpful for cases where one or more plan branches have disappeared from your plans.
Environment
Bamboo Server & Data Center where plan branches have been removed.
Solution
There are a few different ways to check for that information, which are described below.
Before going through the options below, please note the following regarding the results:
- If a username is related to the branch deletion activity, it means an actual Bamboo user performed the action, and you can reach out to them for more information.
- If you see SYSTEM (or
null) linked to the deletion activity, it means it was performed automatically by Bamboo based on the plan branch deletion settings for that build plan. For this case, please check the Plan Branch settings, especially the "Delete plan branch" section. You can find more information on how to configure that here.
Audit logs
If your Bamboo instance already had Audit Logs enabled when the plan branch was deleted, you can find that information by going to Cog icon >> Overview >> Audit logs. Whenever a plan branch is deleted, you'll see the following entry:
TIME, DATE USER / SYSTEM Plan deleted: PROJECT - PLAN NAME - BRANCH NAME (BRANCH KEY)For example, the following entry shows that the user admin deleted the "Test Branch" branch of the "First Build Plan" plan, which is part of the "2022" project. The branch key was "TTT-FBP0". The deletion happened on May 6th, 2022 at 6:17 PM.
18:17, 6 May 2022 admin Plan deleted: 2022 - First Build Plan - Test Branch (TTT-FBP0)Querying the database
If the deletion happened a while ago, it might be difficult to find the information in the Audit Logs through the UI. That being the case, we can query the database for that information:
SELECT USER_NAME AS USER,
MSG as ACTION,
TO_CHAR(TO_TIMESTAMP(MSG_TIME_STAMP / 1000), 'DD/MM/YYYY HH24:MI:SS') AS DATE
FROM AUDIT_LOG
WHERE MSG LIKE 'Plan deleted%'
AND MSG LIKE '%PROJ-PLAN%'Please replace PROJ-PLAN with the main branch key. For example, TTT-FBP, where TTT-FBP0, TTT-FBP1, TTT-FBP2 are the branches.
Please note that this query was created and tested on PostgreSQL. If your Bamboo instance is connected to a different DBMS, you will need to adapt the query to the DBMS's syntax (particularly the TO_CHAR function).
Log analysis
We can also manually check the Bamboo logs for a deletion entry for a given plan branch. We'll find a log entry in the atlassian-bamboo-access logs in case a user has manually deleted the branch.
- Navigate to
<bamboo-home-dir>/logsfolder Look for confirmDeleteChain.action?buildKey=<PROJECT_KEY-PLAN_KEY> inside the atlassian-bamboo-access files.
E.g., the project key is TTT and the plan key is BT, so you'd be searching for confirmDeleteChain.action?buildKey=TTT-BT.If you use Linux, you can use the following command, replacing the
PROJ-PLANkey:grep "confirmDeleteChain.action?buildKey=PROJ-PLAN" atlassian-bamboo-access*
If no records are found in the access logs, either the deletion timeframe is not part of those logs anymore, or the branch was removed by the system. For the latter, we can look into the atlassian-bamboo log files for the following entries:
[BranchExpiryJob] Deleting Plan Branch PROJECT_NAME - PLAN_NAME
# E.g., [BranchExpiryJob] Deleting Plan Branch ONE - TRAINING[BranchExpiryJob] Deleting Plan Branch 'PROJECT NAME - Plan Name
# E.g., [BranchExpiryJob] Deleting Plan Branch '2022 - Subversion