Audit events in Bitbucket Server

Audit logging in Bitbucket Server

On this page

Still need help?

The Atlassian Community is here for you.

Ask the community

The auditing component of Bitbucket Server will log many different events that occur when Bitbucket Server is being used. The events have been assigned priorities based on how important they are – these priorities can be used to control how much information is added to the audit log file. For example, if you have a server under high load and no need for auditing, you may wish to turn audit logging off by setting it to NONE - see the audit log config properties.

On this page:

Server level events

EventDescriptionPriority
ApplicationConfigurationChangedEventThe server configuration has changed e.g. the display name or the base url.

HIGH

BackupEventAudited at the beginning and the end of a system backup.
HIGH
LicenseChangedEventThe server license has changed.
HIGH
MailHostConfigurationChangedEventThe servers mail host has changed (used to send email notifications).
HIGH
MigrationEventAudited at the beginning and the end of a database migration.
HIGH
ServerEmailAddressChangedEventThe server email address has changed (used in email notifications).
HIGH
TicketRejectedEventCertain resources (e.g. the Git processes) are throttled, when tickets are rejected (e.g. too many Git processes are in use) this event is fired.
LOW

User management events

EventDescriptionPriority
AuthenticationFailureEvent

Occurs every time there is a failed authentication.

Note, this can also apply with no authentication failure, if attempting to clone using a string with only a username. The request will fail, and the user will be prompted for the password.

HIGH

DirectoryCreatedEventOccurs when a new directory is created.

HIGH

DirectoryDeletedEventOccurs when a new directory is deleted.
HIGH
GroupCreatedEventOccurs when a new group is created in the internal directory.
HIGH
GroupUpdatedEventOccurs when a new group is updated (not when membership changes) in the internal directory.
HIGH
GroupDeletedEventOccurs when a new group is deleted from the internal directory.
HIGH
GroupMembershipCreatedEventOccurs when a user is added to a group in the internal directory.
HIGH
GroupMembershipDeletedEventOccurs when a user is removed from a group in the internal directory.
HIGH
UserAuthenticatedEventOccurs when a user is successfully authenticated (logged in).
LOW
UserAuthenticationFailedInvalidAuthenticationEvent

Occurs whenever a user fails to authenticate.

Note that this can occur frequently in Bitbucket Server whenever a command line CLI is used as the initial URL provided to Bitbucket Server contains a username but no password, which is rejected by Crowd.

MEDIUM
UserCreatedEventOccurs when a user is created in the internal directory.
HIGH
UserCredentialUpdatedEventOccurs when a user changes password in the internal directory.
HIGH
UserDeletedEventOccurs when a user is deleted from the internal directory.
HIGH
UserRenamedEventOccurs when the username of a user is changed in the internal directory.
HIGH

Permission events

(info) in the table below indicates that the event is visible in the recent audit log screen for the project or repository.

EventDescriptionPriority
GlobalPermissionGrantedEventOccurs when a user or group is granted a global permission (e.g. create project).
HIGH
GlobalPermissionRevokedEventOccurs when a user or group has a global permission revoked.
HIGH
ProjectPermissionGrantedEvent

Occurs when a user or group is granted a permission for a specific project. (info)

HIGH
ProjectPermissionRevokedEvent

Occurs when a user or group has a permission for a specific project revoked. (info)

HIGH
RepositoryPermissionEvent

Occurs when a user or group has a permission for a specific repository altered. (info)

HIGH
RestrictedRefEvent

Children of this event are fired when a restricted ref is altered. (info)

HIGH

Project events

(info) in the table below indicates that the event is visible in the recent audit log screen for the project.

EventDescriptionPriority
ProjectAvatarUpdatedEventRaised when a project avatar has been successfully updated.
LOW

ProjectCreatedEvent

Raised when a project is created. (info)

HIGH
ProjectCreationRequestedEventRaised just before a project is created; can be canceled.
LOW
ProjectModifiedEvent

Raised when a project has been successfully updated (e.g. the project name). (info)

HIGH
ProjectModificationRequestedEvent Raised just before a project is updated; can be canceled.
LOW
ProjectDeletedEvent Raised when a project is deleted.
HIGH
ProjectDeletionRequestedEvent Raised just before a project is deleted; can be canceled.
LOW

Repository events

(info) in the table below indicates that the event is visible in the recent audit log screen for the project or repository.

EventDescriptionPriority
RepositoryAccessedEvent

Raised when a repository is accessed by a user.
Bitbucket Server currently only fires this event selectively - when users hit a repository page.

LOW

RepositoryCreatedEvent

Raised when a repository is created. (info)

MEDIUM
RepositoryCreationFailedEventRaised when an attempt to create a repository fails.
LOW
RepositoryCreationRequestedEventRaised just before a repository is created; can be canceled.
LOW
RepositoryForkedEvent

Raised when a repository is forked successfully. (info)

MEDIUM
RepositoryForkFailedEventRaised when an attempt to fork a repository fails.
LOW
RepositoryForkRequestedEventRaised just before a repository is forked; can be canceled.
LOW
RepositoryDefaultBranchModifiedEventRaised when the default branch of a repository is reconfigured (typically through repository settings).
LOW
RepositoryDeletedEvent

Raised when a repository is deleted. (info)

HIGH
RepositoryDeletionRequestedEventRaised just before a repository is deleted; can be canceled.
LOW
RepositoryOtherReadEventRaised when the server uploads a pack file to the client via HTTP.
LOW
RepositoryOtherWriteEventRaised when the server receives a pack file from the client via HTTP.
LOW
RepositoryPullEventRaised when a Git client pulls from a repository (only when new content is sent to the client).
LOW
RepositoryPushEventRaised when a Git client pushed to a repository.
LOW

Pull request events

EventDescriptionPriority
PullRequestDeletedEventFired when a pull request is deleted (added in Bitbucket Server 5.1).

HIGH

PullRequestEventFired at different points in the pull request lifecycle (declined, merged, opened, reopened, rescoped [code updated], updated, approved, unapproved, participants updated).
LOW

Plugin events

See this plugin documentation for details of when these events below are triggered.

EventDescriptionPriority
PluginDisabledEventOccurs when a plugin has been disabled, either by the system or a user.
MEDIUM

PluginEnabledEvent

Occurs when a plugin has been enabled, either by the system or a user.
MEDIUM
PluginModuleDisabledEventOccurs when a plugin module has been disabled, either by the system or a user.
MEDIUM
PluginModuleEnabledEventOccurs when a plugin module has been enabled, either by the system or a user.
MEDIUM
PluginModuleUnavailableEventSignifies a plugin module is now unavailable outside the usual installation process.
MEDIUM
PluginUninstalledEventOccurs when a plugin is explicitly uninstalled (as opposed to as part of an upgrade).
MEDIUM
PluginUpgradedEventSignifies that a plugin has been upgraded at runtime.
MEDIUM
PluginContainerUnavailableEventOccurs when the container of a plugin is being shutdown, usually as a result of the server being stopped.
LOW
PluginModuleAvailableEventSignifies that a plugin module is now available outside the usual installation process.
LOW
PluginFrameworkStartedEventSignifies that the plugin framework has been started and initialized.
LOW


SSH key events

(info) in the table below indicates that the event is visible in the recent audit log screen for the project or repository.

EventDescriptionPriority
SshKeyCreatedEvent

Occurs when:

  • an SSH key is added for a user, or
  • an access key is added to a project or repository and the key has not yet been used on any other projects or repositories.
HIGH
SshKeyDeletedEvent

Occurs when:

  • an SSH key is removed from a user, or
  • an access key is removed from a project or repository and it is no longer being used by any other projects or repositories.
HIGH
SshKeyAccessGrantedEventOccurs when an access key is given access to a project or repository. (info)
HIGH
SshKeyAccessRevokedEventOccurs when an access key is removed from a project or repository. (info)
HIGH
Last modified on May 28, 2018

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.