Is there a way to audit workflow actions? Built-in SharePoint audit on site collection level doesn't seem to offer filtering by workflow events.

In particular, I would like to trace which user pressed "End this workflow" on wrkstat.aspx page.

Ideally, this information should be available to end user who can have administrator permissions. Parsing ULS or IIS logs is a no go.


As this is a Workflow Manager workflow, you can query [WFInstanceManagementDB].dbo.Instances table (Workflow Manager database).

SELECT InstanceId,WorkflowStatusDetails FROM Instances WHERE WorkflowStatus = 'Terminated'

The InstanceId can be found via SharePoint for the actual instance of the WF, e.g. if you go to details of the WF instance, the URL will contain the WorkflowInstanceName value that matches the InstanceId value from the above query.


Within the WorkflowStatusDetails when the workflow is in a Terminated status (user manually stopped the workflow), you will have a message similar to:

RequestorId: <Id>. Details: System.Activities.Statements.WorkflowTerminatedException: This workflow was terminated by <user@contoso.com>

This isn't as straightforward as I think you were hoping for, but the activity is recorded, at the very least.


If you're trying to find this out after the fact, check the IIS logs or the SharePoint ULS logs.The IIS logs will capture who went to that page, and if they did a get or a post. Also, you can look at the SharePoint logs. Every request to SharePoint will log the request, including the user and the page requested.

Best to go get those logs now, as SharePoint only keeps a certain number of log files before discarding them.

(In either set of log files, just do a search for the page you're looking for: "wrkstat.aspx". perhaps end a workflow yourself, look at the log data generated, and that can help you narrow your search down for the previous event that you're looking for.)

  • I was unclear about the target audience. I will edit my post. – Slaven Semper Mar 13 '17 at 15:00
  • Downside with this approach is that ULS logs are deleted after 14 days by default. So if a user wants to know who terminated the instance a year ago, he can't get that answer. – Slaven Semper Mar 16 '17 at 11:16
  • Correct. This is answer works in a pinch, when someone has done something and IT wants to find out who and other auditing solutions aren't available. This method also works for finding out who deleted a site and other tasks. But you're right, it's not a long term auditing strategy. – Mike2500 Mar 16 '17 at 11:28

The hidden Workflow History list captures all workflow actions. You can find the list at http://site/Lists/Workflow%20History

  • I have added a tag to my post Workflow Manager. This is the new workflow engine introduced in SP 2013. I believe your answer nails it for SP 2010 as I cannot find such a list. – Slaven Semper Mar 13 '17 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.