Summary

In some situations, Jira administrators might need to know which user deleted a specific Jira issue. the purpose of this knowledge base article is to provide several ways to identify which user deleted a Jira issue, which don't involve the usage of a 3rd party add-on:

• one of them involves using the Jira Audit Logs functionality
• the other one involves analyzing the Tomcat Access Logs

Environment

Jira Server/Data Center from 8.8.0

Solution 1 (Data Center Only) - Using the Jira Audit Logs

 This method will only work if the issues were deleted after a certain setting was changed in the Audit Logs configuration page.

This solution is only available for Jira versions from 8.8.0 and higher, and only for Jira Data Center (the Advanced level for the Audit Logs is not available in Jira Server).

To view which users deleted a Jira issue, you need to first update the Audit Logs configuration by following the steps below:

1. Go to ⚙ > System > Audit Logs
2. Click on ... > Settings
    
3. Under Coverage, look for the End user activity setting, change it to Advanced, and click Save
   
   
    Note that, with such settings, several issue operations will be recorded in the Audit Logs as explained in The Audit Logs documentation:

   Issue deleted, Issue archived, Issue restored, Issue attachment deleted, Comment of another user deleted, Sub-task deleted, Archived issues exported (8.12.0+), Issues exported (8.12.0+)

Any issue that was deleted after this configuration change was made will be found by searching for the string issue deleted (without double quotes) in the Audit Logs page, as shown in the example below:

Note that, due to some limitations around how the search works, it is not possible to filter the results by only including the "issue" category. Because of that, and as shown in the screenshot above, the results might also include actions that are not related to issue deletion.

Solution 2 (Server and Data Center) - Using the Tomcat Access Logs

This method is less straight forward than the 1st method, as it requires to perform some text search in Tomcat Access logs, provided that these logs are still available for the day the Jira issue was deleted.

The Tomcat Access Logs are stored in the directory <JIRA_INSTALL>/logs, and have the format access_log.<date>.log

Whenever a Jira issue is deleted by a user from the View Issue page via More > Delete, 2 HTTP requests as will be recorded in the Tomcat Access logs, as shown in the log snippet below (in the example below, the issue key ABC-123 was deleted):

 0:0:0:0:0:0:0:1 862x8700x1 jirauser [07/Jul/2023:14:22:10 +0200] "GET /secure/DeleteIssue!default.jspa?id=14801&decorator=dialog&inline=true&_=1688732484760 HTTP/1.1" 200 831 10 "<JIRA_BASE_URL>/browse/ABC-123" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "vtj9gl"
0:0:0:0:0:0:0:1 862x8701x1 jirauser [07/Jul/2023:14:22:11 +0200] "POST /secure/DeleteIssue.jspa- HTTP/1.1" 200 86 52 "<JIRA_BASE_URL>/browse/ABC-123" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "vtj9gl"

To search for which user deleted a Jira issue (for example ABC-123), what you can do is a grep search of the regular expression below in the most recent Access Log files:

egrep '/secure/DeleteIssue!default.jspa.*ABC-123' access_log.YYYY-MM-DD

Note that this method can only be used to detect which user deleted a Jira issue from the View Issue Screen, via the option More > Delete. If the issue was deleted via any other method (such as the ones listed below), it will not be possible to easily find out who deleted the issue:

• Deletion via a bulk delete operation
• Deletion via an automation rule
• Deletion via a custom script, or 3rd party add-on