Who deleted my workflow?

Thu Sep 8 09:26:11 EDT 2011

Never underestimate the power of 'normal users' to <fill in the blanks>

----
Susan R. Keohan
SAP Workflow Specialist
Enterprise Applications
Information Services Department
MIT Lincoln Laboratory
244 Wood Street, LI-200
Lexington, MA. 02420
781-981-3561
keohan at LL.MIT.EDU

-----Original Message-----
From: sap-wug-bounces at mit.edu [mailto:sap-wug-bounces at mit.edu] On Behalf Of
Paul.Bakker at osr.treasury.qld.gov.au
Sent: Wednesday, September 07, 2011 6:26 PM
To: SAP Workflow Users' Group
Subject: Re: Who deleted my workflow?

Mike,

 ST03 looks gold. I'll give it a go and report back.

I didn't think any normal user would _know_ how to delete workflows, so I'm
very curious to determine the who/what/how.

thanks!
Paul

From:	"Mike Pokraka" <wug at workflowconnections.com>
To:	"SAP Workflow Users' Group" <sap-wug at mit.edu>
Date:	07/09/2011 08:21 PM
Subject:	Re: Who deleted my workflow?
Sent by:	sap-wug-bounces at mit.edu

G'Day Paul,

A couple of things to try:
Depending on the level of auditing you should see SWWL in the security log
SM20.
You can also use ST03 to look at system stats and see if SWWL was run.
Either Detailed Analysis -> Business Transaction analysis (can take a
while but may give you usernames), or Workload -> Total and then go to
Transaction Profile in the Analysis views section and do a search.

People can do stuff using SE38 as well, so +not+ finding SWWL isn't
necessarily conclusive.

Cheers,
Mike

On Wed, September 7, 2011 8:57 am, Paul.Bakker at osr.treasury.qld.gov.au
wrote:
>
> Wug'ers,
>
> Today I encountered a strange situation : a user emailed me a screenshot
> of
> an (active X) workflow log, but when I logged into the (Production)
> system,
> the workflow instance had disappeared.
>
> I'm sure it's the right system, as I can see an email (in SOST) generated
> by the workflow instance at the correct time.
> The workflow cannot be found via GOS, SWI1, or even by looking through
> SWWWIHEAD.
>
> I can only conclude that the workflow instance (and its log) was
> physically
> deleted!
>
> Does anyone know how to find out who deleted a workflow? Do they leave a
> ghostly trace?
> I tried the table CDHDR, but no joy there.
>
> thanks!
> Paul Bakker
> Australia
>
>
>
****************************************************************************
*****************

> Only an individual or entity who is intended to be a recipient of this
> e-mail may access or use the information contained in this e-mail or any
> of its attachments.  Opinions contained in this e-mail or any of its
> attachments do not necessarily reflect the opinions of Queensland
> Treasury.
>
> The contents of this e-mail and any attachments are confidential and may
> be legally privileged and the subject of copyright.  If you have received
> this e-mail in error, please notify Queensland Treasury immediately and
> erase all copies of the e-mail and the attachments.  Queensland Treasury
> uses virus scanning software.  However, it is not liable for viruses
> present in this e-mail or in any attachment.
>
****************************************************************************
***********************

>
> _______________________________________________
> SAP-WUG mailing list
> SAP-WUG at mit.edu
> http://mailman.mit.edu/mailman/listinfo/sap-wug
>

_______________________________________________
SAP-WUG mailing list
SAP-WUG at mit.edu
http://mailman.mit.edu/mailman/listinfo/sap-wug

_______________________________________________
SAP-WUG mailing list
SAP-WUG at mit.edu
http://mailman.mit.edu/mailman/listinfo/sap-wug
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5398 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/sap-wug/attachments/20110908/087d148e/attachment.bin