Cloud
Data Center 7.13
Versions

Audit log events

View and configure the audit log

On this page

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

The auditing component of Bitbucket Data Center and Server will log many different events that occur when being used. Events have been assigned a coverage level to reflect the number and frequency of events that are logged – these levels can be used to control how much information is added to the audit log file. For example, if you have an instance under high load and no need for auditing in certain coverage areas, you may wish to turn audit logging off by selecting Off in the Audit log settings page. Learn more about these settings in View and configure the audit log.

Coverage levels available with both a Server and Data Center license:

  • Off: Turns off logging events from this coverage area.
  • Base: Logs low-frequency and some of the high-frequency core events from selected coverage areas.

Coverage levels where events are only available with a Data Center license:

  • Advanced: Logs the core events as well as the low and medium frequency events from the coverage areas.
  • Full: Logs all the events available in Base and Advanced, plus additional events for a comprehensive audit.

The events generated by external apps that call Jira REST API that fall into the Apps coverage area are not listed here because they are app-dependent.

The following tables provide lists of new and legacy event summaries for all coverage levels and categories. 

On this page:

Global configuration and administration coverage area

Global administration category 

BaseInstance setup completed (ApplicationSetupEvent)
System backup cancelled (BackupCanceledEvent)
System backup failed (BackupFailedEvent)
System backup started (BackupStartedEvent)
System backup succeeded (BackupSucceededEvent)
Base URL changed (BaseUrlChangedEvent)
Server name changed (DisplayNameChangedEvent)
Elasticsearch settings changed (ElasticsearchConfigurationChangeAuditEvent)
Elasticsearch full sync started (ElasticsearchFullSynchronisationAuditEvent)
HTTP access to SCM hosting changed (HttpScmHostingChangedEvent)
Product license changed (LicenseChangedEvent)
Mail server changed (MailHostConfigurationChangedEvent)
Database migration failed (MigrationFailedEvent)
Database migration started (MigrationStartedEvent)
Database migration succeeded (MigrationSucceededEvent)
Database migration cancelled (MigrationCanceledEvent)
Mirror disabled (MirrorDisabledEvent)
Mirror enabled (MirrorEnabledEvent)
Mirroring request rejected (MirroringRequestRejectedEvent)
Mirroring request accepted (MirroringRequestAcceptedEvent)
Mirroring request received (MirroringRequestCreatedEvent)
Mirror installed (MirrorInstalledEvent)
Mirror uninstalled (MirrorUninstalledEvent)
Server email address changed (ServerEmailAddressChangedEvent)
Server time zone changed (ServerTimeZoneChangedEvent)
Resource throttled (TicketRejectedEvent)
Advanced

Default rate limiting settings changed (DefaultRateLimitSettingsModifiedEvent)
Rate limiting disabled (RateLimitingDisabledEvent)
Rate limiting enabled (RateLimitingEnabledEvent)
User rate limiting settings created (UserRateLimitSettingsCreatedEvent)
User rate limiting settings deleted (UserRateLimitSettingsDeletedEvent)
User rate limiting settings changed (UserRateLimitSettingsModifiedEvent)
SSH settings changed (SshScmHostingChangedEvent)
LFS enabled (GitLfsFeatureEnabledEvent)
LFS disabled (GitLfsFeatureDisabledEvent)
Announcement banner created (AnnouncementBannerCreatedEvent)
Announcement banner deleted AnnouncementBannerDeletedEvent)
Announcement banner updated (AnnouncementBannerUpdatedEvent)
Logging settings enabled (LoggingSettingsEnabledEvent)
Logging settings disabled (LoggingSettingsDisabledEvent)
Profiling settings disabled (ProfilingSettingsDisabledEvent)
Profiling settings enabled (ProfilingSettingsEnabledEvent)
Application link created (ApplicationLinkAddedEvent)
Application link edited (ApplicationLinkUpdatedEvent)
Application link deleted (ApplicationLinkDeletedEvent)

FullNo additional events available


Apps category

BasePlugin disabled (PluginDisabledEvent)
Plugin enabled (PluginEnabledEvent)
Plugin uninstalled (PluginUninstalledEvent)
Plugin upgraded (PluginUpgradedEvent)
Advanced

No additional events available

FullPlugin container unavailable (PluginContainerUnavailableEvent)
Plugin module disabled (PluginModuleDisabledEvent)
Plugin module enabled (PluginModuleEnabledEvent)
Plugin module available (PluginModuleAvailableEvent)
Plugin module unavailable (PluginModuleUnavailableEvent)
Plugin framework started (PluginFrameworkStartedEvent)


User management coverage area

Users and groups category

BasePersonal access token created (AccessTokenCreatedEvent)
Personal access token deleted (AccessTokenDeletedEvent)
Personal access token changed (AccessTokenModifiedEvent)
User group automatically created (AutoGroupCreatedEvent)
User automatically deleted from user group (AutoGroupMembershipDeletedEvent)
User automatically created (AutoUserCreatedEvent)
User directory created (DirectoryCreatedEvent)
User directory deleted (DirectoryDeletedEvent)
GPG key added (GpgKeyCreatedEvent)
GPG key deleted (GpgKeyDeletedEvent)
User group created (GroupCreatedEvent)
User group deleted (GroupDeletedEvent)
User group updated (GroupUpdatedEvent)
User deleted from user group (GroupMembershipDeletedEvent)
User added to user group ((GroupMembershipsCreatedEvent)
Group added to user group (GroupMembershipsCreatedEvent)
User created (UserCreatedEvent)
User created from directory sync (UserCreatedFromDirectorySynchronisationEvent)
User password changed UserCredentialUpdatedEvent)
User deleted (UserDeletedEvent)
User erased (UserErasedEvent)
Username changed (UserRenamedEvent)
Advanced

No additional events available

Full

No additional events available



Permission coverage area

Permissions category

BaseGlobal permission granted (GlobalPermissionGrantedEvent)
Global permission requested (GlobalPermissionGrantRequestedEvent)
Global permission change request (GlobalPermissionModificationRequestedEvent)
Global permission changed (GlobalPermissionModifiedEvent)
Global permission remove request (GlobalPermissionRevocationRequestedEvent)
Global permission removed
Project permission granted (ProjectPermissionGrantedEvent)
Project permission requested (ProjectPermissionGrantRequestedEvent)
Project permission change request (ProjectPermissionModificationRequestedEvent)
Project permission changed (ProjectPermissionModifiedEvent)
Project permission remove request (ProjectPermissionRevocationRequestedEvent)
Project permission removed (ProjectPermissionRevokedEvent)
Repository permission granted (RepositoryPermissionGrantedEvent)
Repository permission requested (RepositoryPermissionGrantRequestedEvent)
Repository permission change request (RepositoryPermissionModificationRequestedEvent)
Repository permission changed (RepositoryPermissionModifiedEvent)
Repository permission remove request (RepositoryPermissionRevocationRequestedEvent)
Repository permission removed (RepositoryPermissionRevokedEvent)
Repository auto-merge configuration changed (RepositoryAutoMergeConfigUpdatedEvent)
Advanced

No additional events available

Full

No additional events available


Local configuration and administration coverage area

Projects category

Base

Hook configuration removed (HookScriptConfigurationRemovedEvent)
Hook configuration set (HookScriptConfigurationSetEvent)
Hook created (HookScriptCreatedEvent)
Hook deleted (HookScriptDeletedEvent)
Hook deleted by app (HookScriptsDeletedByPluginKeyEvent)
Hook changed (HookScriptUpdatedEvent)
Project avatar changed (ProjectAvatarUpdatedEvent)
Project created (ProjectCreatedEvent)
Project creation requested (ProjectCreationRequestedEvent)
Project deleted (ProjectDeletedEvent)
Project deletion requested (ProjectDeletionRequestedEvent)
Project settings change requested (ProjectModificationRequestedEvent)
Project imported ProjectImportedEvent)
Project settings changed ((ProjectModifiedEvent)
SSH access key added to project (SshAccessKeyGrantedEvent)
SSH access key deleted from project (SshAccessKeyRevokedEvent)
Project branch model created (ProjectBranchModelConfigurationCreatedEvent)
Project branch model deleted (ProjectBranchModelConfigurationDeletedEvent)
Project branch model updated (ProjectBranchModelConfigurationUpdatedEvent)
Project branch permission added (ProjectRefRestrictionAddedEvent)
Project branch permission deleted (ProjectRefRestrictionDeletedEvent)
Project branch permission updated (ProjectRefRestrictionUpdatedEvent)
Project code insight condition added (ProjectInsightReportConditionAddedEvent)
Project code insight condition deleted (ProjectInsightReportConditionDeletedEvent)
Project code insight condition changed (ProjectInsightReportConditionUpdatedEvent)
Project auto-merge configuration changed (RepositoryAutoMergeConfigUpdatedEvent)
Project default reviewers added (ProjectPullRequestConditionCreatedEvent)
Project default reviewers deleted (ProjectPullRequestConditionDeletedEvent)
Project default reviewers updated (ProjectPullRequestConditionUpdatedEvent)
Project auto-decline settings created (ProjectAutoDeclineSettingsCreatedEvent)
Project auto-decline settings deleted (ProjectAutoDeclineSettingsDeletedEvent)
Project auto-decline settings changed (ProjectAutoDeclineSettingsUpdatedEvent)

Advanced

Project pull request merge config deleted (ProjectPullRequestMergeConfigDeletedEvent)
Project pull request merge config updated (ProjectPullRequestMergeConfigUpdatedEvent)
Pull request description template created (PullRequestTemplateCreatedEvent)
Pull request description template deleted (PullRequestTemplateDeletedEvent)
Pull request description template updated (PullRequestTemplateUpdatedEvent)
Pull request reviewer group created (ReviewerGroupCreatedEvent)
Pull request reviewer group deleted (ReviewerGroupDeletedEvent)
Pull request reviewer group updated (ReviewerGroupUpdatedEvent)

Full

No additional events available


Repositories category

Base

Repository webhook created (InternalWebhookCreatedEvent)
Repository webhook deleted (InternalWebhookDeletedEvent)
Repository webhook changed (InternalWebhookModifiedEvent)
Repository created (RepositoryCreatedEvent)
Repository failed to create (RepositoryCreationFailedEvent)
Default branch changed (RepositoryDefaultBranchModifiedEvent)
Repository deleted (RepositoryDeletedEvent)
Repository deletion requested (RepositoryDeletionRequestedEvent)
Repository forked (RepositoryForkedEvent)
Repository fork failed (RepositoryForkFailedEvent)
Repository hook deleted (RepositoryHookDeletedEvent)
Repository hook disabled (RepositoryHookDisabledEvent)
Repository hook enabled (RepositoryHookEnabledEvent)
Repository hook settings changed (RepositoryHookSettingsChangedEvent)
Repository imported (RepositoryImportedEvent)
Repository change requested (RepositoryModificationRequestedEvent)
Repository settings changed (RepositoryModifiedEvent)
Elasticsearch repository sync completed (ElasticsearchRepositorySynchronisationAuditEvent)
Repository branch model created (RepositoryBranchModelConfigurationCreatedEvent)
Repository branch model deleted (RepositoryBranchModelConfigurationDeletedEvent)
Repository branch model updated (RepositoryBranchModelConfigurationUpdatedEvent)
Repository branch permission added (RepositoryRefRestrictionAddedEvent)
Repository branch permission deleted (RepositoryRefRestrictionDeletedEvent)
Repository branch permission updated (RepositoryRefRestrictionUpdatedEvent)
Repository code insight condition added (RepositoryInsightReportConditionAddedEvent)
Repository code insight condition deleted (RepositoryInsightReportConditionDeletedEvent)
Repository code insight condition changed (RepositoryInsightReportConditionUpdatedEvent)
Repository default reviewers added (RepositoryPullRequestConditionCreatedEvent)
Repository default reviewers deleted (RepositoryPullRequestConditionDeletedEvent)
Repository default reviewers updated (RepositoryPullRequestConditionUpdatedEvent)
Repository auto-decline settings created (RepositoryAutoDeclineSettingsCreatedEvent)
Repository auto-decline settings deleted (RepositoryAutoDeclineSettingsDeletedEvent)
Repository auto-decline settings changed (RepositoryAutoDeclineSettingsUpdatedEvent)

Advanced

Repository LFS enabled (GitLfsEnabledEvent)
Repository LFS disabled (GitLfsDisabledEvent)
Repository pull request merge config deleted (RepositoryPullRequestMergeConfigDeletedEvent)
Repository pull request merge config updated (RepositoryPullRequestMergeConfigUpdatedEvent)
Repository transcode diff setting enabled (GitTranscodeDiffEnabledEvent)
Repository transcode diff setting disabled (GitTranscodeDiffDisabledEvent)
Pull request reviewer group created (ReviewerGroupCreatedEvent)
Pull request reviewer group deleted (ReviewerGroupDeletedEvent)
Pull request reviewer group updated (ReviewerGroupUpdatedEvent)

Full

No additional events available

System category

BaseNo additional events available
Advanced

SCM pull request merge config deleted (ScmPullRequestMergeConfigDeletedEvent)
SCM pull request merge config updated (ScmPullRequestMergeConfigUpdatedEvent)

Full

No additional events available


Security coverage area

Auditing category

Base

Audit log search performed
Audit log exported
Audit log configuration updated

Advanced

No events available

Full

No events available


Authentication category

Base

No events available

Advanced

User login failed (AuthenticationFailureEvent)
User login failed (SSH) (SshAuthenticationFailureEvent)
User logged out (LogoutSuccessEvent)

FullUser logged in (AuthenticationSuccessEvent)
User logged in (SSH) (SshAuthenticationSuccessEvent)

Security category

Base

No events available

Advanced

Unauthorized access to a resource (AuthorizationFailureEvent)

FullNo events available


End user activity coverage area

Repositories category

BaseRepository accessed by user (RepositoryAccessedEvent)
Run build (AnalyticsActionRunEvent)
Advanced

Repository watcher added (RepositoryWatcherAddedEvent)
Repository watcher removed (RepositoryWatcherRemovedEvent)
Repository notification settings updated (RepositoryNotificationSettingsUpdatedEvent)
Branch created (BranchCreatedEvent)
Git archive created (ContentArchiveSuccessfulEvent)
Git archive failed (ContentArchiveFailedEvent)
Branch deleted (BranchDeletedEvent)
Diff succeeded (DiffSuccessfulEvent)

FullChanges read from repository (RepositoryOtherReadEvent)
Repository written to (RepositoryOtherWriteEvent)
Repository pulled (RepositoryPullEvent)
Changes pushed to repository (RepositoryPushEvent)
Git hook activity (RepositoryHookEvent)
Repository cloned (RepositoryCloneEvent)


Pull requests category

BaseAuto merge failed (AutomaticMergeStoppedEvent)
Auto merge succeeded (AutomaticMergeSucceededEvent)
Pull request approved by participant (PullRequestParticipantApprovedEvent)
Pull request reviewed by participant (PullRequestParticipantReviewedEvent)
Pull request unapproved by participant (PullRequestParticipantUnapprovedEvent)
Pull request participants changed (PullRequestParticipantsUpdatedEvent)
Pull request declined (PullRequestDeclinedEvent)
Pull request deleted (PullRequestDeletedEvent)
Pull request merged (PullRequestMergedEvent)
Pull request opened (PullRequestOpenedEvent)
Pull request reopened (PullRequestReopenedEvent)
Pull request reviewers changed (PullRequestReviewersUpdatedEvent)
Pull request open request (PullRequestOpenRequestedEvent)
Advanced

Pull request rebased (PullRequestRebasedEvent)
Pull request watcher added (PullRequestWatcherAddedEvent)
Pull request watcher removed (PullRequestWatcherRemovedEvent)
Pull request filters used (PullRequestFilterEvent)

Full

Pull request comment reply added (PullRequestCommentRepliedEvent)
Pull request comment created (PullRequestCommentAddedEvent)
Pull request comment deleted (PullrequestCommentDeletedEvent)
Pull request comment changed (PullRequestCommentEditedEvent)
Pull request task created (PullRequestTaskAddedEvent)
Pull request task deleted (PullRequestTaskDeletedEvent)
Pull request task changed (PullRequestTaskEditedEvent)

Search category

Base

No events available

Advanced

No events available

Full

Repository search succeeded (RepositoriesSearchSucessfulEvent)
Code search succeeded (CodeSearchSuccessfulEvent)

Apps category

This category is for auditing events generated by third-party apps.

Bitbucket Server customers can set the configuration property  audit.legacy.events.logging.forced=true to move the following events from Full to Base level:

  • Plugin container unavailable, Plugin module disabled, Plugin module enabled, Plugin module available, Plugin framework started
  • User log in failed, User logged in, User logged in (SSH)
  • Repository read event, Repository write event, Repository pull event, Repository push event, Git hook activity, Repository cloned

Note that adding these events to Base can significantly increase the size of the audit log.

Last modified on Sep 8, 2021

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.