Why does confluence cloud audit logs not display the space id ?

[Sarthak Kapoor]

I was going through the audit logs for my Confluence Cloud instance. I was surprised to see that when logging the affected objects, the space key is not always mentioned but only the space name. This happened when I removed some user permissions for a space. In case I have 2 spaces with the exact same name it makes it very difficult to understand which space was affected.

Is there a way for me to know which space was actually affected ?

Thank you

[Jessica]

Hi @Sarthak Kapoor 

Welcome to the Atlassian Community!

I gave it a try and can confirm that indeed the space key is not being recorded for certain actions as you mentioned.

We understand this can make things more difficult if you have spaces with the same name indeed and I have created this bug report, in order to address that.

To know who did these changes, depending on when it happened, we may need to access your database or look at our logs, depending on when the changes took place, as we have a very limited amount of time that these logs are available.

If you would like to see this for your site, and you are not a site-admin, please ask your admin to raise a ticket on your behalf.

In case you are a site-admin of a free subscription site but need help with that, please let me know to which site you want help with that and I can open a ticket on your behalf, as well when this change you noticed happened, so we can set the right expectations if we will be able to gather any logs :) 

Hope this helps,
Jessica

[Sarthak Kapoor]

Thanks for the response @Jessica !

I am the site-admin for a free subscription instance: https://sarthak-kaps-test.atlassian.net/wiki/ and planning to upgrade to the premium version.

I noticed this issue while looking into the Audit logs since I would like to use that to understand which space/page are getting affected by changes in permissions/deletions.

In particular I want to use the Audit logs API to get this information programatically.
It would be great if we can get a resolution for this. 

I have been noticing this thing from the very moment I started using Confluence around April 2023.

Let me know what steps I need to take next.
Thanks.

[Jessica]

Hey @Sarthak Kapoor 

Taking a look at our REST API for audit logs, I believe we wouldn't be able to retrieve the space key for those changes as well, as when we consult the same through API, it displays the same results, with no space key:

• https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-audit/#api-wiki-rest-api-audit-get

But indeed, it does not display the space key or page for a few items, while other actions record the Space key in the audit log.

For now, we wouldn't have a resolution for the bug we just reported or an official ETA.

However, if this information is something you would like to go after, depending on when the action was done, we can give try checking our internal logs, to see if we still have this information.
We can't guarantee the data will be still there since it is been some time since it was reported and we have a limited time of when these logs are available, for troubleshooting purposes.

Let me know if you would like to give it a try, even though there is a possibility we wouldn't have this information available.

Regards,
Jessica

[Sarthak Kapoor]

Thanks for the followup @Jessica .

It is fine if we are unable to fetch the details for the previous actions. I agree that most of the internal logs might be unavailable at this point.
But it will be very useful if the Audit logs do populate the Space key information for various actions. Currently this information is present for some cases only.

If this information can be made available through the API, then that will be great as well. Can we file a feature request for this ?

Let me know if some action is needed on my end.

[Sarthak Kapoor]

Interestingly I do see the space key in Audit logs when Space permissions are added.

When I add/remove page restrictions for a page, again neither the space key nor page id is logged.