Audit Log Events in Confluence
This page outlines the auditing events available in Confluence Server and Data Center, and which events fall into each coverage level.
For more information about how auditing works, see Auditing in Confluence.
Definitions
Coverage area
A coverage area is a grouping of events related to a similar theme.
Category
A category is a grouping of related events. Categories can belong to multiple coverage areas.
Coverage level
Coverage levels allow you to control which events are logged. Some levels are only available with a Data Center license.
Global configuration and administration
Coverage level | Category | Events logged |
|---|---|---|
Base | Global administration | Mail server created |
Apps | App installed | |
Page templates | Page template updated | |
Advanced | Global administration | Mobile apps configuration updated |
Full | No additional events available | |
User management
Coverage level | Category | Events logged |
|---|---|---|
| Base | Users and groups | User created |
| Advanced | Users and groups | User was invited to join site |
| Full | No additional events available | |
Permissions
Coverage level | Category | Events logged |
|---|---|---|
| Base | Permissions | Space permission removed |
| Advanced | No additional events available | |
| Full | No additional events available | |
Local configuration and administration
Coverage level | Category | Event |
|---|---|---|
| Base | Pages and blogs | Page hierarchy copy started |
Import/Export | Space import | |
Spaces | Space created | |
Advanced | No additional events available | |
Full | No additional events available | |
Security
Coverage level | Category | Event |
|---|---|---|
| Base | Auditing | Audit log search performed Audit log exported Audit log configuration updated |
Advanced | Authentication | Secure admin access granted |
Users and groups | Forgot password feature triggered | |
Security | User tried to access restricted page | |
Full | Authentication | User login successful User logout |
*We only track User login failed events if the authentication does not involve a redirect to an external identity provider. If a user tries to log in using SSO and fails, this event will not be logged. Most identity providers track these events in their own audit logs.
End user activity
DATA CENTER ONLY
Coverage level | Category | Events logged |
|---|---|---|
| Base | No events available | |
Advanced | Pages and blogs | Blog post edit restriction added |
| Import/Export | Page exported to PDF Blog post exported to PDF Page exported to Word Blog post exported to Word | |
Full | Pages and blogs | Page created |