How to find which user deleted a Jira issue
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
In some situations, Jira administrators might need to know which user deleted a specific Jira issue. the purpose of this knowledge base article is to provide several ways to identify which user deleted a Jira issue, which don't involve the usage of a 3rd party add-on:
- one of them involves using the Jira Audit Logs functionality
- the other one involves analyzing the Tomcat Access Logs
Please note that these methods are only applicable in the case where a Jira issue was deleted from the Jira UI via the button More > Delete. In the case where a Jira issue was deleted via a custom script or automation, these methods might not help.
Environment
Jira Server/Data Center from 8.8.0
Solution 1 (Data Center Only) - Using the Jira Audit Logs
This method will only work if the issues were deleted after a certain setting was changed in the Audit Logs configuration page.
This solution is only available for Jira versions from 8.8.0 and higher, and only for Jira Data Center (the Advanced level for the Audit Logs is not available in Jira Server).
To view which users deleted a Jira issue, you need to first update the Audit Logs configuration by following the steps below:
- Go to ⚙ > System > Audit Logs
- Click on ... > Settings
- Under Coverage, look for the End user activity setting, change it to Advanced, and click Save
Note that, with such settings, several issue operations will be recorded in the Audit Logs as explained in The Audit Logs documentation:Issue deleted, Issue archived, Issue restored, Issue attachment deleted, Comment of another user deleted, Sub-task deleted, Archived issues exported (8.12.0+), Issues exported (8.12.0+)
Any issue that was deleted after this configuration change was made will be found by searching for the string issue deleted (without double quotes) in the Audit Logs page, as shown in the example below:
Note that, due to some limitations around how the search works, it is not possible to filter the results by only including the "issue" category. Because of that, and as shown in the screenshot above, the results might also include actions that are not related to issue deletion.
Solution 2 (Server and Data Center) - Using the Tomcat Access Logs
This method is less straight forward than the 1st method, as it requires to perform some text search in Tomcat Access logs, provided that these logs are still available for the day the Jira issue was deleted.
The Tomcat Access Logs are stored in the directory <JIRA_INSTALL>/logs, and have the format access_log.<date>.log
Whenever a Jira issue is deleted by a user from the View Issue page via More > Delete, 2 HTTP requests as will be recorded in the Tomcat Access logs, as shown in the log snippet below (in the example below, the issue key ABC-123 was deleted):
0:0:0:0:0:0:0:1 862x8700x1 jirauser [07/Jul/2023:14:22:10 +0200] "GET /secure/DeleteIssue!default.jspa?id=14801&decorator=dialog&inline=true&_=1688732484760 HTTP/1.1" 200 831 10 "<JIRA_BASE_URL>/browse/ABC-123" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "vtj9gl"
0:0:0:0:0:0:0:1 862x8701x1 jirauser [07/Jul/2023:14:22:11 +0200] "POST /secure/DeleteIssue.jspa- HTTP/1.1" 200 86 52 "<JIRA_BASE_URL>/browse/ABC-123" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" "vtj9gl"To search for which user deleted a Jira issue (for example ABC-123), what you can do is a grep search of the regular expression below in the most recent Access Log files:
egrep '/secure/DeleteIssue!default.jspa.*ABC-123?' access_log.YYYY-MM-DD