The current logged in users are shown on the page: <Jira_Base_URL>secure/admin/CurrentUsersList.jspa
https://community.atlassian.com/t5/Jira-Questions/Currently-logged-in-users/qaq-p/388195/var/atlassian/application-data/jira/log
atlassian-jira-apdex.log
atlassian-jira-http-access.log
atlassian-jira-http-dump.log
atlassian-jira-incoming-mail.log
atlassian-jira.log
atlassian-jira-outgoing-mail.log
atlassian-jira-perf.log
atlassian-jira-querydsl-sql.log
atlassian-jira-security.log
atlassian-jira-slow-queries.log
atlassian-jira-slow-querydsl-queries.log
atlassian-jira-sql.log
atlassian-jira-xsrf.log
atlassian-remoteapps-security.log
atlassian-servicedesk.log
insight_audit.log
insight_automation.log
insight_import.log
insight_objectschema_export.log
insight_objectschema_import.log
insight_workflow.log
jira-diagnostics.log
/var/atlassian/application-data/jira/log/audit
In the example above we see that...
JIRAUSER99999 was removed from myoldadmingroup by an anonymous user with a source IP of 49.111.111.111 at 14:10:43 on 28-Mar-2023
JIRAUSER99999 was added to myadmingroup by myuser@mycompany.com from 200.111.111.111 at 14:41:47 GMT on 28-Mar-2023
This is an issue related to /media/atl/jira/shared...
Are you sure the same EFS volume is mounted on all nodes?
Check cluster.properties in /var/atlassian/application-data/jira/
See: https://confluence.atlassian.com/jirakb/healthcheck-shared-home-738722489.html
Check whether any Assets/Insight objects have the URL Ping service enabled using this SQL...
SELECT "ID",
"NAME",
"OBJECT_TYPE_ID",
"ADDITIONAL_VALUE",
"DEFAULT_TYPE_ID"
FROM "AO_8542F1_IFJ_OBJ_TYPE_ATTR"
WHERE "DEFAULT_TYPE_ID"=7
AND "ADDITIONAL_VALUE"='ENABLED';
If URL Ping is enabled but the URLs are not reachable from Assets/Insight, you might see the errors above.