• 2
    • 25
    • We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      Improve Confluence user access logging so:

      • It can be enabled from the GUI just like JIRA 4.x
      • Include HTTP status code and HTTP methods (GET/POST), along with the existing fields.
      • Include user IP address that is accessing Confluence (workaround does not include this)

      Workaround solution:
      Add the following code in the server.xml before the tag "</Engine>"

      <Valve className="org.apache.catalina.valves.AccessLogValve" pattern="%a %t %I %{X-AUSERNAME}o &quot;%m %U%q %H&quot; %s %b %D &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot %D %F" resolveHosts="false"/>
      

            [CONFSERVER-23034] Improve Confluence User access logging

            Hi all,

            Thank you so much for your votes and comments on this suggestion.

            We are beginning greater research on the topic of advanced auditing and would love to hear from you.

            We intend to better understand:

            • What information you need to log and keep about your Atlassian applications and environments
            • What are the questions you need to answer, or specific insights your are looking for when auditing logs

            Responses can be in regard to information that needs to be tracked for internal policies (i.e. security) or compliance standards (i.e. SOC2 or SOX)

            What’s involved in the research:

            • Sessions are 1 hour and conducted over video-conference, so you can participate from anywhere around the globe.
            • After scheduling, you'll receive a calendar invite with a video-conference link.
            • During the research, we'll start with a general chat to get to know you and your company, then try to understand better your auditing needs and even explore some prototypes.
            • As a token of our appreciation, you'll receive an e-gift card worth $100 USD within 5 days of completing your session.

            If you're interested in taking part, please send me an email at rbattaglin@atlassian.com and I'll get in touch. We can't guarantee that all interested parties will be selected but we appreciate your interest in helping us to make auditing in our products satisfy more advanced use cases.

            We look forward to meeting you!

            Cheers,
            Renan Battaglin
            Server and Data Center Team

            Renan Battaglin added a comment - Hi all, Thank you so much for your votes and comments on this suggestion. We are beginning greater research on the topic of advanced auditing and would love to hear from you. We intend to better understand: What information you need to log and keep about your Atlassian applications and environments What are the questions you need to answer, or specific insights your are looking for when auditing logs Responses can be in regard to information that needs to be tracked for internal policies (i.e. security) or compliance standards (i.e. SOC2 or SOX) What’s involved in the research: Sessions are 1 hour and conducted over video-conference, so you can participate from anywhere around the globe. After scheduling, you'll receive a calendar invite with a video-conference link. During the research, we'll start with a general chat to get to know you and your company, then try to understand better your auditing needs and even explore some prototypes. As a token of our appreciation, you'll receive an e-gift card worth $100 USD within 5 days of completing your session. If you're interested in taking part, please send me an email at rbattaglin@atlassian.com and I'll get in touch. We can't guarantee that all interested parties will be selected but we appreciate your interest in helping us to make auditing in our products satisfy more advanced use cases. We look forward to meeting you! Cheers, Renan Battaglin Server and Data Center Team

            Dalectric added a comment - - edited

            I added

            %{X-Forwarded-For}i 

            to be able to see the client's IP address with my server behind an Apache reverse proxy.

            Dalectric added a comment - - edited I added %{X-Forwarded-For}i  to be able to see the client's IP address with my server behind an Apache reverse proxy.

            Ann Worley (Inactive) added a comment - - edited

            I was able to get the log to write in the home directory by specifying the entire path to the directory:

            Valve className="org.apache.catalina.valves.AccessLogValve" directory="/path/to/confluence/home/logs" prefix="conf_access_log" fileDateFormat="-yyyyMMdd" suffix=".log" pattern="%h %l %{X-AUSERNAME}o %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;" resolveHosts="false"/>
            

            Ann Worley (Inactive) added a comment - - edited I was able to get the log to write in the home directory by specifying the entire path to the directory: Valve className= "org.apache.catalina.valves.AccessLogValve" directory= "/path/to/confluence/home/logs" prefix= "conf_access_log" fileDateFormat= "-yyyyMMdd" suffix= ".log" pattern= "%h %l %{X-AUSERNAME}o %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;" resolveHosts= " false " />

            Actual Metrics added a comment - - edited

            The suggested log format in the workaround is non-standard. If the intent is to create an access log that can be used by web analytics tools, then the log format should match an established / accepted format. e.g. NCSA Combined.

            The below Valve statement creates a log in NCSA Combined format, with the following naming convention: conf_access_log-YYYYMMDD.log

            <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="conf_access_log" fileDateFormat="-yyyyMMdd" suffix=".log" pattern="%h %l %{X-AUSERNAME}o %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;" resolveHosts="false"/>
            

            The above statement could be further improved by changing the "directory" value so the log is written to $CONFLUENCE_HOME/logs/ but the syntax of this is beyond the scope of my Confluence abilities.

            Actual Metrics added a comment - - edited The suggested log format in the workaround is non-standard. If the intent is to create an access log that can be used by web analytics tools, then the log format should match an established / accepted format. e.g. NCSA Combined. The below Valve statement creates a log in NCSA Combined format, with the following naming convention: conf_access_log-YYYYMMDD.log <Valve className= "org.apache.catalina.valves.AccessLogValve" directory= "logs" prefix= "conf_access_log" fileDateFormat= "-yyyyMMdd" suffix= ".log" pattern= "%h %l %{X-AUSERNAME}o %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot;" resolveHosts= " false " /> The above statement could be further improved by changing the "directory" value so the log is written to $CONFLUENCE_HOME/logs/ but the syntax of this is beyond the scope of my Confluence abilities.

            Kasi Sama added a comment -

            Can you please fix the issue ASAP, so that it will be helpful for the auditing.

            Kasi Sama added a comment - Can you please fix the issue ASAP, so that it will be helpful for the auditing.

            David Yu added a comment -

            The workaround (RemoteIPValve) in JRA-22399 should also work here.

            David Yu added a comment - The workaround (RemoteIPValve) in JRA-22399 should also work here.

            We need this functionality for IT audit dept.

            iliya shevel added a comment - We need this functionality for IT audit dept.

            Karaul added a comment -

            We also would like to see this functionality.

            Karaul added a comment - We also would like to see this functionality.

            If we look at old documentation on User Access Logging
            https://confluence.atlassian.com/display/CONF25/Enable+user+access+logging

            Then there will be comment
            >>To capture all of the parameters included in the URL, logging threshold must be set to "TRACE" instead of "DEBUG"

            So i think it was possible to log URL parameters before, why it broken now?
            I try to set TRACE logging threshold, but without luck.

            Roman Cherepanov added a comment - If we look at old documentation on User Access Logging https://confluence.atlassian.com/display/CONF25/Enable+user+access+logging Then there will be comment >>To capture all of the parameters included in the URL, logging threshold must be set to "TRACE" instead of "DEBUG" So i think it was possible to log URL parameters before, why it broken now? I try to set TRACE logging threshold, but without luck.

            Similar requests

            Sim Hua Soon added a comment - Similar requests

              Unassigned Unassigned
              rhartono Roy Hartono [Atlassian]
              Votes:
              34 Vote for this issue
              Watchers:
              28 Start watching this issue

                Created:
                Updated: