Finding who deleted pages in Confluence
There is no built-in functionality to track page deletion. This page is to Identify the user who deleted page(s) in Confluence.
For Confluence 6.6.x onwards:
SELECT ar.authorname, ar.searchstring, ar.objectname, to_timestamp(1572292913868/1000)::TIMESTAMP FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.title = '<page-title>' AND c.content_status = 'deleted' ;
SELECT ar.authorname, ar.searchstring, ar.objectname as DeletedPageName, FROM_UNIXTIME(AR.CREATIONDATE/1000) AS DELETIONDATE FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.content_status = 'deleted'
For versions older than 6.6.x., use the queries below:
select um.username, c.title, s.spacename, c.lastmoddate from content c join user_mapping um on c.lastmodifier = um.user_key join spaces s on c.spaceid = s.spaceid where c.content_status = 'deleted' and contenttype = 'PAGE' order by username;
select um.username, c.TITLE, s.SPACENAME, c.LASTMODDATE from CONTENT c join user_mapping um on c.LASTMODIFIER = um.user_key join SPACES s on c.SPACEID = s.SPACEID where c.CONTENT_STATUS = 'deleted' and CONTENTTYPE = 'PAGE' order by username;
The above queries will only work for pages in trash and it is not valid for pages that are purged from trash. We cannot retrieve the data of the purged pages.
When a page is deleted, it will have a content_status = deleted in the content table in the database. We've just joined with the spaces table to retrieve the spacename and the user_mapping table to find the user who deleted the page. This query you will be able to find all deleted pages, who deleted it and the spacename to find the page.
If you wish identify a certain page, just add to the where parameter:
and title = '<page-title>';
If you want to find all deleted pages in a space, just add to the where parameter:
and spacename = '<spacename>';