• Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      We would like to add clones and pushes activities to the audit logging as it would help us to keep track of:

      1. The active users
      2. The owner of the content being pushed to Bitbucket (especially when it does not match with the "committer")
      3. After maintenance such as BFG and LFS, who did clone the latest version of the repository.

      These changes would be related to the feature http://blog.bitbucket.org/2013/08/15/new-audit-logs-give-you-the-who-what-when-and-where/

            [BCLOUD-8322] Add clones and pushes to audit logging (BB-9452)

            +1

            +1

            Given the age of this ticket, I'm not confident it's worth my time to post this.  Seems like a fairly simple enhancement that would add a LOT of value to a LOT of people for a LOT of different use cases.  Not to mention, this seems like an obvious, basic, essential piece of functionality in today's era where the need for visibility is critical to maintain security for our intellectual property.

            jstrohl-aptos-com added a comment - +1 Given the age of this ticket, I'm not confident it's worth my time to post this.  Seems like a fairly simple enhancement that would add a LOT of value to a LOT of people for a LOT of different use cases.  Not to mention, this seems like an obvious, basic, essential piece of functionality in today's era where the need for visibility is critical to maintain security for our intellectual property.

            +1

            John Eckhardt added a comment - +1

            Well this doesn't look good. We are forced to rethink our choices now.

            Rajitha Karunaratne added a comment - Well this doesn't look good. We are forced to rethink our choices now.

            jjacarillo added a comment -

            Too late... We already stopped using bitbucket.

            jjacarillo added a comment - Too late... We already stopped using bitbucket.

            This issue has gathered enough interest to be moved automatically to Reviewing status, where it will be reviewed to someone in the relevant product development team and moved on to the appropriate status.

            Mike Howells added a comment - This issue has gathered enough interest to be moved automatically to Reviewing status, where it will be reviewed to someone in the relevant product development team and moved on to the appropriate status.

            +1 

            keithhalterman added a comment - +1 

            Elias added a comment - - edited

            Very interesting why code repositories actively resist this feature. This issue is a decade old.

            Web traffic data has been provided since the web began, is trivial for Atlassian to implement, yet only Github provides this feature.

            Full traffic analysis to repos is needed, but I guess adding clones to the audit log would be a step in the right direction.

            Elias added a comment - - edited Very interesting why code repositories actively resist this feature. This issue is a decade old. Web traffic data has been provided since the web began, is trivial for Atlassian to implement, yet only Github provides this feature. Full traffic analysis to repos is needed, but I guess adding clones to the audit log would be a step in the right direction.

            Dale Tyler added a comment -

            The need for effective and useful logging is critical. I have spent more than 10 hours debugging a 'failed access' problem where ssh -T said there was no issue. There were numerous exchanges with Bitbucket tech support that did not result in a solution.

            The problem turned out to be that I had created a Bitbucket account and a repo for testing. This orphan account was interfering with the access to a different repo. 

             
            In the past ssh -T showed the workspace  ID that cpuld be used to determine which account was being accessed.  I think I understand the security implications of disclosing the Workspace ID.  However, the problem of understanding which repo is being accessed remains. 
             
            Perhaps there could be a log of IP addresses that have accessed the repo, showing both failed and successful attempts,  could be made available to repo admins, which could be checked and thus at least verify that access was attempted. This knowledge could be used to help debug this problem and others as well.
             
            The 'forgotten account' is a real issue and Bitbucket needs to address it. Developers join teams and have existing BitBucket accounts that they may have used briefly or for training or a personal project. 
             
            At this point, I will discourage the use of Bitbucket by any developer who asks my opinion due to the very poor debugging capabilities. I wasted at least 10 hours debugging this and that's really a great waste of  my time and company resources.
             
            Bitbucket could be a useful tool, but it fails to properly address debugging and tracking of failure to access repos. There are competitors that do this much better.

            Dale Tyler added a comment - The need for effective and useful logging is critical. I have spent more than 10 hours debugging a 'failed access' problem where ssh -T said there was no issue. There were numerous exchanges with Bitbucket tech support that did not result in a solution. The problem turned out to be that I had created a Bitbucket account and a repo for testing. This orphan account was interfering with the access to a different repo.    In the past ssh -T showed the workspace  ID that cpuld be used to determine which account was being accessed.  I think I understand the security implications of disclosing the Workspace ID.  However, the problem of understanding which repo is being accessed remains.    Perhaps there could be a log of IP addresses that have accessed the repo, showing both failed and successful attempts,  could be made available to repo admins, which could be checked and thus at least verify that access was attempted. This knowledge could be used to help debug this problem and others as well.   The 'forgotten account' is a real issue and Bitbucket needs to address it. Developers join teams and have existing BitBucket accounts that they may have used briefly or for training or a personal project.    At this point, I will discourage the use of Bitbucket by any developer who asks my opinion due to the very poor debugging capabilities. I wasted at least 10 hours debugging this and that's really a great waste of  my time and company resources.   Bitbucket could be a useful tool, but it fails to properly address debugging and tracking of failure to access repos. There are competitors that do this much better.

            +1 on this much needed basic visibility.

            Danny Patel added a comment - +1 on this much needed basic visibility.

              1c505570e116 Gayatri Ramesh
              mbertrand aMarcus (Inactive)
              Votes:
              211 Vote for this issue
              Watchers:
              174 Start watching this issue

                Created:
                Updated: