Cloud
Data Center 7.4
Versions

Audit log events in Bitbucket

Auditing in Bitbucket

On this page

Related content

  • No related content found

Still need help?

The Atlassian Community is here for you.

Ask the community

The auditing component of Bitbucket Server and Data Center will log many different events that occur when being used. Events have been assigned a coverage level to reflect the number and frequency of events that are logged – these levels can be used to control how much information is added to the audit log file. For example, if you have an instance under high load and no need for auditing in certain coverage areas, you may wish to turn audit logging off by selecting Off in the Audit log settings page. Learn more about these settings in Auditing in Bitbucket.

Coverage levels available with both a Server and Data Center license:

  • Off: Turns off logging events from this coverage area.
  • Base: Logs low-frequency and some of the high-frequency core events from selected coverage areas.

Coverage levels where events are only available with a Data Center license:

  • Advanced: Logs the core events as well as the low and medium frequency events from the coverage areas.
  • Full: Logs all the events available in Base and Advanced, plus additional events for a comprehensive audit.

The events generated by external apps that call Jira REST API that fall into the Apps coverage area are not listed here because they are app-dependent.

The following tables provide lists of event summaries for all coverage levels and categories.

On this page:

Global configuration and administration coverage area

Global administration category

BaseInstance setup completed
System backup cancelled
System backup failed
System backup started
System backup succeeded
Base URL changed
Server name changed
Elasticsearch settings changed
Elasticsearch full sync started
HTTP access to SCM hosting changed
Product license changed
Mail server changed
Database migration failed
Database migration started
Database migration succeeded
Database migration cancelled
Mirror disabled
Mirror enabled
Mirroring request rejected
Mirroring request accepted
Mirroring request received
Mirror installed
Mirror uninstalled
Server email address changed
Server time zone changed
Resource throttled
Advanced

Default rate limiting settings changed
 Rate limiting disabled
 Rate limiting enabled
 User rate limiting settings created
 User rate limiting settings deleted
 User rate limiting settings changed
 SSH settings changed
LFS enabled
LFS disabled
Announcement banner created
Announcement banner deleted
Announcement banner updated
Logging settings enabled
Logging settings disabled
Profiling settings disabled
Profiling settings enabled
Application link created
Application link edited
Application link deleted

FullNo additional events available


Apps category

BasePlugin disabled
Plugin enabled
Plugin uninstalled
Plugin upgraded
Advanced

No additional events available

FullPlugin container unavailable
Plugin module disabled
Plugin module enabled
Plugin module available
Plugin module unavailable
Plugin framework started


User management coverage area

Users and groups category

BasePersonal access token created
Personal access token deleted
Personal access token changed
User group automatically created
User automatically deleted from user group
User automatically created
User directory created
User directory deleted
GPG key added
GPG key deleted
User group created
User group deleted
User group updated
User deleted from user group
Users added to user group
User created
User created from directory sync
User password changed
User deleted
User erased
Username changed
Advanced

No additional events available

Full

No additional events available



Permission coverage area

Permissions category

BaseGlobal permission granted
Global permission requested
Global permission change request
Global permission changed
Global permission remove request
Global permission removed
Project permission granted
Project permission requested
Project permission change request
Project permission changed
Project permission remove request
Project permission removed
Repository permission granted
Repository permission requested
Repository permission change request
Repository permission changed
Repository permission remove request
Repository permission removed
Advanced

No additional events available

Full

No additional events available


Local configuration and administration coverage area

Projects category

Base

Hook configuration removed
Hook configuration set
Hook created
Hook deleted
Hook deleted by app
Hook changed
Project avatar changed
Project created
Project creation requested
Project deleted
 Project deletion requested
Project settings change requested
Project imported
Project settings changed
 SSH key added to project
 SSH key deleted from project
Project branch model created
Project branch model deleted
Project branch model updated
Project branch permission added
Project branch permission deleted
Project branch permission updated

Advanced

Project pull request merge config deleted
Project pull request merge config updated

Full

No additional events available


Repositories category

Base

Repository webhook created
Repository webhook deleted
Repository webhook changed
Repository created
Repository failed to create
Default branch changed
Repository deleted
Repository deletion requested
Repository forked
Repository fork failed
Repository hook deleted
Repository hook disabled
Repository hook enabled
Repository hook settings changed
Repository imported
Repository change requested
Repository settings changed
Elasticsearch repository sync completed
Repository branch model created
Repository branch model deleted
Repository branch model updated
Repository branch permission added
Repository branch permission deleted
Repository branch permission updated

Advanced

Repository LFS enabled
 Repository LFS disabled
Repository pull request merge config deleted
Repository pull request merge config updated
 Repository transcode diff setting enabled
 Repository transcode diff setting disabled

Full

No additional events available

System category

BaseNo additional events available
Advanced

SCM pull request merge config deleted
SCM pull request merge config updated

Full

No additional events available


Security coverage area

Auditing category

Base

Audit log search performed
Audit log exported
Audit log configuration updated

Advanced

No events available

Full

No events available


Authentication category

Base

No events available

Advanced

User log in failed
User log in failed (SSH)
 User logged out

FullUser logged in
User logged in (SSH)

Security category

Base

No events available

Advanced

Unauthorized access to a resource

FullNo events available


End user activity coverage area

Repositories category

BaseRepository accessed by user
Advanced

Repository watcher added
Repository watcher removed
Repository notification settings updated
Branch created
Git archive created
Git archive failed
Branch deleted
Diff succeeded

FullRepository read
Repository write
Repository pull
Repository push
Git hook activity
Repository cloned


Pull requests category

BaseAuto merge failed
Auto merge succeeded
Pull request approved by participant
Pull request reviewed by participant
Pull request unapproved by participant
Pull request participants changed
Pull request declined
Pull request deleted
Pull request merged
Pull request opened
Pull request reopened
Pull request reviewers changed
Pull request open request
Advanced

Pull request rebased
Pull request watcher added
Pull request watcher removed
Pull request filters used

Full

Pull request comment reply added
Pull request comment created
Pull request comment deleted
Pull request comment changed
Pull request task created
Pull request task deleted
Pull request task changed


Search category

Base

No events available

Advanced

No events available

Full

Repository search succeeded
Code search succeeded

Apps category

This category is for auditing events generated by third-party apps.


Bitbucket Server customers can set the configuration property  audit.legacy.events.logging.forced=true to move the following events from Full to Base level:

  • Plugin container unavailable, Plugin module disabled, Plugin module enabled, Plugin module available, Plugin framework started
  • User log in failed, User logged in, User logged in (SSH)
  • Repository read event, Repository write event, Repository pull event, Repository push event, Git hook activity, Repository cloned

Note that adding these events to Base can significantly increase the size of the audit log.

Last modified on Jun 4, 2022

Was this helpful?

Yes
No
Provide feedback about this article

Related content

  • No related content found
Powered by Confluence and Scroll Viewport.