Finding who deleted pages in Confluence
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Purpose
The only thing displayed when viewing trash is the page name. More information regarding the delete operation would help users/admins at the moment of decision for purging. This has been implemented in Confluence 8.7.1 or later as outlined in CONFSERVER-4792 - Display more details for pages in the trash: "who", "why", "what".
With Confluence 7.5, a new Auditing feature is introduced and for Data Center (only), it is possible to track page operations like restore/delete/purge/etc. For more information: End user activity - Audit Log Events in Confluence
Workaround
The below queries will only work for pages in the trash and it is not valid for pages that are purged from the trash. We cannot retrieve the data of the purged pages.
- For 7.5 and above, use the following KB article: How to Identify the user who deleted page(s) in Confluence
For Confluence 6.6 onwards but below 7.5:
SELECT ar.authorname, ar.searchstring, ar.objectname as DeletedPageName, to_timestamp(ar.creationdate/1000)::timestamp FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.content_status = 'deleted';
SELECT ar.authorname, ar.searchstring, ar.objectname as DeletedPageName, FROM_UNIXTIME(ar.creationdate/1000) AS DeletionDate FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.content_status = 'deleted';
If you wish to identify a certain page, just add to the where parameter:
and c.title = '<page-title>';
If you want to find all deleted pages in a space, just add to the where parameter:
and s.spacename = '<spacename>';
For versions older than 6.6, we don't store any data related to deletion time or the user. Only the content_status column is changed to 'deleted'. Because of this, there is no way to extract this data from the database.