Finding who deleted pages in Confluence

Summary

The only thing displayed when viewing trash is the page name. More information regarding the delete operation would help users/admins at the moment of decision for purging. This has been implemented in Confluence 8.7.1 or later as outlined in CONFSERVER-4792 - Display more details for pages in the trash: "who", "why", "what".

With Confluence 7.5, a new Auditing feature is introduced and for Data Center (only), it is possible to track page operations like restore/delete/purge/etc. For more information: End user activity - Audit Log Events in Confluence

Solution

Workaround

⚠️The below queries will only work for pages in the trash and it is not valid for pages that are purged from the trash. We cannot retrieve the data of the purged pages.

• For 7.5 and above, use the following KB article: How to Identify the user who deleted page(s) in Confluence

• For Confluence 6.6 onwards but below 7.5:

  Postgres query

  1 SELECT ar.authorname, ar.searchstring, ar.objectname as DeletedPageName,      to_timestamp(ar.creationdate/1000)::timestamp FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.content_status = 'deleted';

  MySQL query

  1 2 3 4 5 6 7 SELECT ar.authorname, ar.searchstring, ar.objectname as DeletedPageName, FROM_UNIXTIME(ar.creationdate/1000) AS DeletionDate FROM auditrecord ar INNER JOIN content c ON (lower(ar.objectname) = c.lowertitle) WHERE c.content_status = 'deleted';

  💡 If you wish to identify a certain page, just add to the where parameter:

  1 and c.title = '<page-title>';

  💡 If you want to find all deleted pages in a space, just add to the where parameter:

  1 and s.spacename = '<spacename>';

• For versions older than 6.6, we don't store any data related to deletion time or the user. Only the content_status column is changed to 'deleted'. Because of this, there is no way to extract this data from the database.