Workflow actions auditing

Question

Is there a way to audit workflow actions? Built-in SharePoint audit on site collection level doesn't seem to offer filtering by workflow events.

In particular, I would like to trace which user pressed "End this workflow" on wrkstat.aspx page.

Ideally, this information should be available to end user who can have administrator permissions. Parsing ULS or IIS logs is a no go.

Answer 1

As this is a Workflow Manager workflow, you can query [WFInstanceManagementDB].dbo.Instances table (Workflow Manager database).

SELECT InstanceId,WorkflowStatusDetails FROM Instances WHERE WorkflowStatus = 'Terminated'

The InstanceId can be found via SharePoint for the actual instance of the WF, e.g. if you go to details of the WF instance, the URL will contain the WorkflowInstanceName value that matches the InstanceId value from the above query.

https://sharePointSite/_layouts/15/wrkstat.aspx?List=445d42a3-aa33-4a5f-a911-078663d68297&WorkflowInstanceName=cd193bc8-e346-4e0d-8242-2a9c3e8740b8

Within the WorkflowStatusDetails when the workflow is in a Terminated status (user manually stopped the workflow), you will have a message similar to:

RequestorId: <Id>. Details: System.Activities.Statements.WorkflowTerminatedException: This workflow was terminated by <user@contoso.com>

This isn't as straightforward as I think you were hoping for, but the activity is recorded, at the very least.

Answer 2

If you're trying to find this out after the fact, check the IIS logs or the SharePoint ULS logs.The IIS logs will capture who went to that page, and if they did a get or a post. Also, you can look at the SharePoint logs. Every request to SharePoint will log the request, including the user and the page requested.

Best to go get those logs now, as SharePoint only keeps a certain number of log files before discarding them.

(In either set of log files, just do a search for the page you're looking for: "wrkstat.aspx". perhaps end a workflow yourself, look at the log data generated, and that can help you narrow your search down for the previous event that you're looking for.)

Answer 3

The hidden Workflow History list captures all workflow actions. You can find the list at http://site/Lists/Workflow%20History