The organization's audit log displays anonymous users deleting pages

Summary

As an Enterprise customer, upon using the organization API to retrieve content from the audit logs, entries related to viewing, editing, or deleting pages will be available. By inspecting the logs, some entries tied to the deletion of pages without additional context will be displayed (no page title, no location, and actor as an anonymous). For example:

These entries also have the following details:

• They run periodically.

• They usually happen in bulk.

Solution

Besides tracking the deletion of pages, the audit log also tracks the deletion of drafts. Differently from published pages, drafts can have an empty title, but will always need an "actor" to delete them. In such scenarios, what is happening is that Confluence runs an automation job to delete blank drafts, avoiding consuming additional storage, and having empty content not being used.

There is an existing suggestion to improve this behavior:

• ACCESS-1278 - Improve Audit log entries about the deletion of draft Confluence pages