How to use access logs to identify changes made to base URL
Platform Notice: Data Center Only - This article only applies to Atlassian apps on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Purpose
There may be times when the base URL is mistakenly updated by an admin causing issues with email URLS, application links, and etc. When this occurs the access logs from our Logging and Profiling page can be used to determine who and when this was changed. There are 2 methods that an application link can be updated. There are two methods that the base URL can be updated from within the JIRA application.
Cause 1: Base URL pop up banner
When JIRA is accessed by a sysadmin from a URL that is not the base URL, a pop-up comes up that asks if the user would like to change the base URL.
Resolution:
From the atlassian-jira-http-access.log, you're able to search the logs for PUT /rest/api/2/settings/baseUrl
127.0.0.01 526x23030x1 admin [25/Apr/2016:08:46:46 -05700] "PUT /rest/api/2/settings/baseUrl HTTP/1.1" 204 - 32 "http://localhost:8091/CruzDesk/secure/Dashboard.jspa" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36" "1ubfnfb"Cause 2: Base URL changed
The base URL can be changed via Administration > System > General configuration
Resolution:
From the atlassian-jira-http-access.log, you're able to search the logs for GET <BASE_URL>/CruzDesk/secure/admin/EditApplicationProperties!default.jspa
127.0.0.1 i911x1978x1 admin [26/Apr/2016:15:11:28 -0500] "POST http://localhost:8091/CruzDesk/rest/webResources/1.0/resources HTTP/1.1" - - - "http://cruzinusa.local:8091/CruzDesk/secure/admin/EditApplicationProperties!default.jspa" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36" "1ubfnfb"Was this helpful?