Audit log events in Bitbucket

On this page

Still need help?

The Atlassian Community is here for you.

Ask the community

The auditing component of Bitbucket Server and Data Center will log many different events that occur when being used. Events have been assigned a coverage level to reflect the number and frequency of events that are logged – these levels can be used to control how much information is added to the audit log file. For example, if you have an instance under high load and no need for auditing in certain coverage areas, you may wish to turn audit logging off by selecting Off in the Audit log settings page. Learn more about these settings in Auditing in Bitbucket.

Coverage levels available with both a Server and Data Center license:

  • Off: Turns off logging events from this coverage area.
  • Base: Logs low-frequency and some of the high-frequency core events from selected coverage areas.

Coverage levels where events are only available with a Data Center license:

  • Advanced: Logs the core events as well as the low and medium frequency events from the coverage areas.
  • Full: Logs all the events available in Base and Advanced, plus additional events for a comprehensive audit.

The following tables provide lists of event summaries for all coverage levels and categories.

On this page:

Global configuration and administration coverage area

Global administration category

BaseApplicationSetupEvent
BackupCanceledEvent
BackupFailedEvent
BackupStartedEvent
BackupSucceededEvent
BaseUrlChangedEvent
DisplayNameChangedEvent
ElasticsearchConfigurationChangeAuditEvent
ElasticsearchFullSynchronisationAuditEvent
ElasticsearchRepositorySynchronisationAuditEvent
HttpScmHostingChangedEvent
LicenseChangedEvent
MailHostConfigurationChangedEvent
MigrationCanceledEvent
MigrationFailedEventMigrationStartedEvent
MigrationSucceededEvent
MirrorDisabledEvent
MirrorEnabledEvent
MirroringRequestRejectedEvent
MirroringRequestAcceptedEvent
MirroringRequestCreatedEvent
MirrorInstalledEventMirrorUninstalledEvent
ServerEmailAddressChangedEvent
ServerTimeZoneChangedEvent
TicketRejectedEvent
Advanced

DefaultRateLimitSettingsModifiedEvent

RateLimitingDisabledEvent
RateLimitingEnabledEvent
UserRateLimitSettingsCreatedEvent
UserRateLimitSettingsDeletedEvent
UserRateLimitSettingsModifiedEvent
FullNo additional events available


Apps category

BasePluginDisabledEvent
PluginEnabledEvent
PluginUninstalledEvent
PluginUpgradedEvent
Advanced

No additional events available

FullPluginContainerUnavailableEvent
PluginModuleDisabledEvent
PluginModuleEnabledEvent
PluginModuleAvailableEvent
PluginModuleUnavailableEvent
PluginFrameworkStartedEvent


User management coverage area

Users and groups category

BaseAccessTokenCreatedEvent
AccessTokenDeletedEvent
AccessTokenModifiedEvent
AutoGroupCreatedEvent
AutoGroupMembershipDeletedEvent
AutoUserCreatedEvent
DirectoryCreatedEvent
DirectoryDeletedEvent
GpgKeyCreatedEvent
GpgKeyDeletedEvent
GroupCreatedEvent
GroupDeletedEvent
GroupMembershipDeletedEvent
GroupMembershipsCreatedEvent
UserCreatedEvent
UserCreatedFromDirectorySynchronisationEvent
UserCredentialUpdatedEvent
UserDeletedEvent
UserErasedEvent
UserRenamedEvent
Advanced

No additional events available

Full

No additional events available



Permission coverage area

Permissions category

BaseGlobalPermissionGrantedEvent
GlobalPermissionGrantRequestedEvent
GlobalPermissionModificationRequestedEvent
GlobalPermissionModifiedEvent
GlobalPermissionRevocationRequestedEvent
GlobalPermissionRevokedEvent
ProjectPermissionGrantedEvent
ProjectPermissionGrantRequestedEvent
ProjectPermissionModificationRequestedEvent
ProjectPermissionModifiedEvent
ProjectPermissionRevocationRequestedEvent
ProjectPermissionRevokedEvent
RepositoryPermissionGrantedEvent
RepositoryPermissionGrantRequestedEvent
RepositoryPermissionModificationRequestedEvent
RepositoryPermissionModifiedEvent
RepositoryPermissionRevocationRequestedEvent
RepositoryPermissionRevokedEvent
Advanced

No additional events available

Full

No additional events available


Local configuration and administration coverage area

Projects category

BaseAutoMergeConfigUpdatedEvent
BranchModelConfigurationCreatedEvent
BranchModelConfigurationDeletedEvent
BranchModelConfigurationUpdatedEvent
HookScriptConfigurationRemovedEvent
HookScriptConfigurationSetEvent
HookScriptCreatedEvent
HookScriptDeletedEvent
HookScriptsDeletedByPluginKeyEvent
HookScriptUpdatedEvent
ProjectAvatarUpdatedEvent
ProjectCreatedEvent
ProjectCreationRequestedEvent
ProjectDeletedEvent
ProjectDeletionRequestedEvent
ProjectImportedEvent
ProjectModifiedEvent
PullRequestConditionCreatedEvent
PullRequestConditionDeletedEvent
PullRequestConditionUpdatedEvent
RefRestrictionAddedEvent
RefRestrictionDeletedEvent
RefRestrictionUpdatedEvent
SshAccessKeyGrantedEvent
SshAccessKeyRevokedEvent
Advanced

No additional events available

Full

No additional events available


Repositories category

BaseInternalWebhookCreatedEvent
InternalWebhookDeletedEvent
InternalWebhookModifiedEvent
RepositoryCreatedEvent
RepositoryCreationFailedEvent
RepositoryDefaultBranchModifiedEvent
RepositoryDeletedEvent
RepositoryDeletionRequestedEvent
RepositoryForkedEvent
RepositoryForkFailedEvent
RepositoryHookDeletedEvent
RepositoryHookDisabledEvent
RepositoryHookEnabledEvent
RepositoryHookSettingsChangedEvent
RepositoryImportedEvent
RepositoryModificationRequestedEvent
RepositoryModifiedEvent
Advanced

No additional events available

Full

No additional events available


Security coverage area

Auditing category

Base

No events available

Advanced

No events available

Full

No events available


Authentication category

Base

No events available

Advanced

No additional events available

FullAuthenticationFailureEvent
AuthenticationSuccessEvent
SshAuthenticationSuccessEvent


End user activity coverage area

Repositories category

BaseRepositoryAccessedEvent
Advanced

No additional events available

FullRepositoryOtherReadEvent
RepositoryOtherWriteEvent
RepositoryPullEvent
RepositoryPushEvent
RepositoryHookEvent
RepositoryCloneEvent


Pull requests category

BaseAutomaticMergeStoppedEvent
AutomaticMergeSucceededEvent
PullRequestParticipantStatusUpdatedEvent
PullRequestParticipantApprovedEvent
PullRequestParticipantReviewedEvent
PullRequestParticipantUnapprovedEvent
PullRequestParticipantsUpdatedEvent
PullRequestDeclinedEvent
PullRequestDeletedEvent
PullRequestMergedEvent
PullRequestOpenedEvent
PullRequestReopenedEvent
PullRequestReviewersUpdatedEvent
PullRequestOpenRequestedEvent
Advanced

No additional events available

Full

No additional events available


Apps category

BaseInsightReportConditionAddedEvent
InsightReportConditionDeletedEvent
InsightReportConditionUpdatedEvent
Advanced

No additional events available

Full

No additional events available


Diff category

Base

No events available

Advanced

No events available

Full

No events available


Search category

Base

No events available

Advanced

No events available

Full

No events available

Bitbucket Server customers can set the configuration property audit.legacy.events.logging.forced=true to move the following events from Full to Base level:

  • Plugin container unavailable, Plugin module disabled, Plugin module enabled, Plugin module available, Plugin framework started
  • User log in failed, User logged in, User logged in (SSH)
  • Repository read event, Repository write event, Repository pull event, Repository push event, Git hook activity, Repository cloned

Note that adding these events to Base can significantly increase the size of the audit log.

Last modified on Mar 3, 2020

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.