We run into scenarios where we need to identify who deleted the file from the Artifactory. We can get the information in the following way.
From UI:
If the file is still in the trashcan, then we can click on the file and see Deleted by on the General tab. If the username is _system_, then it is being deleted by a cleanup process.
From the log:
If the files were deleted from the Trashcan as well, we can identify from the logs. On the Artifactory server, navigate to the log directory $JFrog_Home/arifactory/var/log and process those logs according to your requirements. We can use tools like grep to process the information.
For example:
grep -i “test.ps1” *
If the logs were rotated and moved to the “archived” directory, then we can either unzip them or use the zgrep kind of tools to parse through the archived log files. Here is a sample command for your reference.
zgrep -ir “test.ps1” *
The following are the example log entries
artifactory-access.log:
2025-12-16T19:59:57.104Z [9649bc6894bfc8d6944e5b2f1a0124a4] [ACCEPTED DELETE] example-repo-local:test.ps1 for client : <usernmae> / <IP> [token]
artifactory-request.log:
2025-12-16T19:59:57.179Z|9649bc6894bfc8d6944e5b2f1a0124a4|<IP>|<username>|POST|/api/artifactactions/delete|200|64|41|199|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:145.0) Gecko/20100101 Firefox/145.0
If the deletion is performed through the UI, we will have the entries in the frontend logs.
frontend-request.log:
2025-12-16T19:59:57.181Z|00-9649bc6894bfc8d6944e5b2f1a0124a4-5de3a491632ff9cd-01|<IP>|<username>|POST|/api/v1/ui/artifactactions/delete|200|41|64|206.975|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:145.0) Gecko/20100101 Firefox/145.0
For cloud instances:
If we have cloud log collection enabled, then we can get the logs from the "jfrog-logs" repository, or if we have cloud log streaming, then we can get the logs in your monitoring tool.
If the log collection/log streaming service was not enabled, and the file is deleted from the Trashcan, kindly reach out to JFrog support and share the filenames for further assistance.