Audit log events in Bitbucket

Auditing in Bitbucket

On this page

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

The auditing component of Bitbucket Server and Data Center will log many different events that occur when being used. Events have been assigned a coverage level to reflect the number and frequency of events that are logged – these levels can be used to control how much information is added to the audit log file. For example, if you have an instance under high load and no need for auditing in certain coverage areas, you may wish to turn audit logging off by selecting Off in the Audit log settings page. Learn more about these settings in Auditing in Bitbucket.

Coverage levels available with both a Server and Data Center license:

  • Off: Turns off logging events from this coverage area.
  • Base: Logs low-frequency and some of the high-frequency core events from selected coverage areas.

Coverage levels where events are only available with a Data Center license:

  • Advanced: Logs the core events as well as the low and medium frequency events from the coverage areas.
  • Full: Logs all the events available in Base and Advanced, plus additional events for a comprehensive audit.

The events generated by external apps that call Jira REST API that fall into the Apps coverage area are not listed here because they are app-dependent.

The following tables provide lists of event summaries for all coverage levels and categories.

On this page:

Global configuration and administration coverage area

Global administration category

BaseApplicationSetupEvent
BackupCanceledEvent
BackupFailedEvent
BackupStartedEvent
BackupSucceededEvent
BaseUrlChangedEvent
DisplayNameChangedEvent
ElasticsearchConfigurationChangeAuditEvent
ElasticsearchFullSynchronisationAuditEvent
HttpScmHostingChangedEvent
LicenseChangedEvent
MailHostConfigurationChangedEvent
MigrationCanceledEvent
MigrationFailedEvent
MigrationStartedEvent
MigrationSucceededEvent
MirrorDisabledEvent
MirrorEnabledEvent
MirroringRequestRejectedEvent
MirroringRequestAcceptedEvent
MirroringRequestCreatedEvent
MirrorInstalledEvent
MirrorUninstalledEvent
ServerEmailAddressChangedEvent
ServerTimeZoneChangedEvent
TicketRejectedEvent
Advanced

DefaultRateLimitSettingsModifiedEvent
RateLimitingDisabledEvent
RateLimitingEnabledEvent
UserRateLimitSettingsCreatedEvent
UserRateLimitSettingsDeletedEvent
UserRateLimitSettingsModifiedEvent
SshScmHostingChangedEvent
GitLfsFeatureEnabledEvent
GitLfsFeatureDisabledEvent
AnnouncementBannerCreatedEvent
AnnouncementBannerDeletedEvent
AnnouncementBannerUpdatedEvent
LoggingSettingsDisabledEvent
LoggingSettingsEnabledEvent
ProfilingSettingsDisabledEvent
ProfilingSettingsEnabledEvent
ApplicationLinkAddedEvent
ApplicationLinkUpdatedEvent
ApplicationLinkDeletedEvent

FullNo additional events available


Apps category

BasePluginDisabledEvent
PluginEnabledEvent
PluginUninstalledEvent
PluginUpgradedEvent
Advanced

No additional events available

FullPluginContainerUnavailableEvent
PluginModuleDisabledEvent
PluginModuleEnabledEvent
PluginModuleAvailableEvent
PluginModuleUnavailableEvent
PluginFrameworkStartedEvent


User management coverage area

Users and groups category

BaseAccessTokenCreatedEvent
AccessTokenDeletedEvent
AccessTokenModifiedEvent
AutoGroupCreatedEvent
AutoGroupMembershipDeletedEvent
AutoUserCreatedEvent
DirectoryCreatedEvent
DirectoryDeletedEvent
GpgKeyCreatedEvent
GpgKeyDeletedEvent
GroupCreatedEvent
GroupDeletedEvent
GroupUpdatedEvent
GroupMembershipDeletedEvent
GroupMembershipsCreatedEvent
UserCreatedEvent
UserCreatedFromDirectorySynchronisationEvent
UserCredentialUpdatedEvent
UserDeletedEvent
UserErasedEvent
UserRenamedEvent
Advanced

No additional events available

Full

No additional events available



Permission coverage area

Permissions category

BaseGlobalPermissionGrantedEvent
GlobalPermissionGrantRequestedEvent
GlobalPermissionModificationRequestedEvent
GlobalPermissionModifiedEvent
GlobalPermissionRevocationRequestedEvent
GlobalPermissionRevokedEvent
ProjectPermissionGrantedEvent
ProjectPermissionGrantRequestedEvent
ProjectPermissionModificationRequestedEvent
ProjectPermissionModifiedEvent
ProjectPermissionRevocationRequestedEvent
ProjectPermissionRevokedEvent
RepositoryPermissionGrantedEvent
RepositoryPermissionGrantRequestedEvent
RepositoryPermissionModificationRequestedEvent
RepositoryPermissionModifiedEvent
RepositoryPermissionRevocationRequestedEvent
RepositoryPermissionRevokedEvent
Advanced

No additional events available

Full

No additional events available


Local configuration and administration coverage area

Projects category

BaseAutoMergeConfigUpdatedEvent
BranchModelConfigurationCreatedEvent
BranchModelConfigurationDeletedEvent
BranchModelConfigurationUpdatedEvent
HookScriptConfigurationRemovedEvent
HookScriptConfigurationSetEvent
HookScriptCreatedEvent
HookScriptDeletedEvent
HookScriptsDeletedByPluginKeyEvent
HookScriptUpdatedEvent
ProjectAvatarUpdatedEvent
ProjectCreatedEvent
ProjectCreationRequestedEvent
ProjectDeletedEvent
ProjectDeletionRequestedEvent
ProjectImportedEvent
ProjectModifiedEvent
PullRequestConditionCreatedEvent
PullRequestConditionDeletedEvent
PullRequestConditionUpdatedEvent
RefRestrictionAddedEvent
RefRestrictionDeletedEvent
RefRestrictionUpdatedEvent
SshAccessKeyGrantedEvent
SshAccessKeyRevokedEvent
Advanced

ProjectPullRequestMergeConfigDeletedEvent
ProjectPullRequestMergeConfigUpdatedEvent

Full

No additional events available


Repositories category

BaseInternalWebhookCreatedEvent
InternalWebhookDeletedEvent
InternalWebhookModifiedEvent
RepositoryCreatedEvent
RepositoryCreationFailedEvent
RepositoryDefaultBranchModifiedEvent
RepositoryDeletedEvent
RepositoryDeletionRequestedEvent
RepositoryForkedEvent
RepositoryForkFailedEvent
RepositoryHookDeletedEvent
RepositoryHookDisabledEvent
RepositoryHookEnabledEvent
RepositoryHookSettingsChangedEvent
RepositoryImportedEvent
RepositoryModificationRequestedEvent
RepositoryModifiedEvent
ElasticsearchRepositorySynchronisationAuditEvent
Advanced

GitLfsEnabledEvent
GitLfsDisabledEvent
RepositoryPullRequestMergeConfigDeletedEvent
RepositoryPullRequestMergeConfigUpdatedEvent

Full

No additional events available

System category

BaseNo additional events available
Advanced

ScmPullRequestMergeConfigDeletedEvent
ScmPullRequestMergeConfigUpdatedEvent

Full

No additional events available


Security coverage area

Auditing category

Base

Audit log search performed
Audit log exported
Audit log configuration updated

Advanced

No events available

Full

No events available


Authentication category

Base

No events available

Advanced

AuthenticationFailureEvent
SshAuthenticationFailureEvent
SshAuthenticationSuccessEvent
LogoutSuccessEvent

FullAuthenticationSuccessEvent

Security category

Base

No events available

Advanced

AuthorizationFailureEvent

FullNo events available


End user activity coverage area

Repositories category

BaseRepositoryAccessedEvent
Advanced

RepositoryWatcherAddedEvent
RepositoryWatcherRemovedEvent
BranchCreatedEvent
ContentArchiveSuccessfulEvent
ContentArchiveFailedEvent
BranchDeletedEvent
DiffSucessfulEvent

FullRepositoryOtherReadEvent
RepositoryOtherWriteEvent
RepositoryPullEvent
RepositoryPushEvent
RepositoryHookEvent
RepositoryCloneEvent


Pull requests category

BaseAutomaticMergeStoppedEvent
AutomaticMergeSucceededEvent
PullRequestParticipantStatusUpdatedEvent
PullRequestParticipantApprovedEvent
PullRequestParticipantReviewedEvent
PullRequestParticipantUnapprovedEvent
PullRequestParticipantsUpdatedEvent
PullRequestDeclinedEvent
PullRequestDeletedEvent
PullRequestMergedEvent
PullRequestOpenedEvent
PullRequestReopenedEvent
PullRequestReviewersUpdatedEvent
PullRequestOpenRequestedEvent
Advanced

PullRequestRebasedEvent
PullRequestWatcherAddedEvent
PullRequestWatcherRemovedEvent
PullRequestFilterEvent

Full

PullrequestCommentAddedEvent
PullrequestCommentRepliedEvent
PullrequestCommentDeletedEvent
PullrequestCommentEditedEvent
PullrequestTaskAddedEvent
PullrequestTaskDeletedEvent
PullrequestTaskEditedEvent


Apps category

BaseInsightReportConditionAddedEvent
InsightReportConditionDeletedEvent
InsightReportConditionUpdatedEvent
Advanced

No additional events available

Full

No additional events available


Search category

Base

No events available

Advanced

No events available

Full

RepositoriesSearchSucessfulEvent
CodeSearchSucessfulEvent

Bitbucket Server customers can set the configuration property audit.legacy.events.logging.forced=true to move the following events from Full to Base level:

  • Plugin container unavailable, Plugin module disabled, Plugin module enabled, Plugin module available, Plugin framework started
  • User log in failed, User logged in, User logged in (SSH)
  • Repository read event, Repository write event, Repository pull event, Repository push event, Git hook activity, Repository cloned

Note that adding these events to Base can significantly increase the size of the audit log.

Last modified on Jan 27, 2022

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.