Who deleted my workflow?

[JANSSENS Koenraad]

Users are evil!  You should keep them away from computers!

>-----Original Message-----
>From: sap-wug-bounces at mit.edu [mailto:sap-wug-bounces at mit.edu] On Behalf Of Keohan, Susan - 1140 - MITLL
>Sent: Thursday, September 08, 2011 3:26 PM
>To: SAP Workflow Users' Group
>Subject: RE: Who deleted my workflow?
>
>Never underestimate the power of 'normal users' to <fill in the blanks>
>
>----
>Susan R. Keohan
>SAP Workflow Specialist
>Enterprise Applications
>Information Services Department
>MIT Lincoln Laboratory
>244 Wood Street, LI-200
>Lexington, MA. 02420
>781-981-3561
>keohan at LL.MIT.EDU
>
>
>-----Original Message-----
>From: sap-wug-bounces at mit.edu [mailto:sap-wug-bounces at mit.edu] On Behalf Of
>Paul.Bakker at osr.treasury.qld.gov.au
>Sent: Wednesday, September 07, 2011 6:26 PM
>To: SAP Workflow Users' Group
>Subject: Re: Who deleted my workflow?
>
>Mike,
>
> ST03 looks gold. I'll give it a go and report back.
>
>I didn't think any normal user would _know_ how to delete workflows, so I'm
>very curious to determine the who/what/how.
>
>thanks!
>Paul
>
>
>
>From:	"Mike Pokraka" <wug at workflowconnections.com>
>To:	"SAP Workflow Users' Group" <sap-wug at mit.edu>
>Date:	07/09/2011 08:21 PM
>Subject:	Re: Who deleted my workflow?
>Sent by:	sap-wug-bounces at mit.edu
>
>
>
>G'Day Paul,
>
>A couple of things to try:
>Depending on the level of auditing you should see SWWL in the security log
>SM20.
>You can also use ST03 to look at system stats and see if SWWL was run.
>Either Detailed Analysis -> Business Transaction analysis (can take a
>while but may give you usernames), or Workload -> Total and then go to
>Transaction Profile in the Analysis views section and do a search.
>
>People can do stuff using SE38 as well, so +not+ finding SWWL isn't
>necessarily conclusive.
>
>Cheers,
>Mike
>
>On Wed, September 7, 2011 8:57 am, Paul.Bakker at osr.treasury.qld.gov.au
>wrote:
>>
>> Wug'ers,
>>
>> Today I encountered a strange situation : a user emailed me a screenshot
>> of
>> an (active X) workflow log, but when I logged into the (Production)
>> system,
>> the workflow instance had disappeared.
>>
>> I'm sure it's the right system, as I can see an email (in SOST) generated
>> by the workflow instance at the correct time.
>> The workflow cannot be found via GOS, SWI1, or even by looking through
>> SWWWIHEAD.
>>
>> I can only conclude that the workflow instance (and its log) was
>> physically
>> deleted!
>>
>> Does anyone know how to find out who deleted a workflow? Do they leave a
>> ghostly trace?
>> I tried the table CDHDR, but no joy there.
>>
>> thanks!
>> Paul Bakker
>> Australia
>>
>>
>>
>****************************************************************************
>*****************
>
>> Only an individual or entity who is intended to be a recipient of this
>> e-mail may access or use the information contained in this e-mail or any
>> of its attachments.  Opinions contained in this e-mail or any of its
>> attachments do not necessarily reflect the opinions of Queensland
>> Treasury.
>>
>> The contents of this e-mail and any attachments are confidential and may
>> be legally privileged and the subject of copyright.  If you have received
>> this e-mail in error, please notify Queensland Treasury immediately and
>> erase all copies of the e-mail and the attachments.  Queensland Treasury
>> uses virus scanning software.  However, it is not liable for viruses
>> present in this e-mail or in any attachment.
>>
>****************************************************************************
>***********************
>
>>
>> _______________________________________________
>> SAP-WUG mailing list
>> SAP-WUG at mit.edu
>> http://mailman.mit.edu/mailman/listinfo/sap-wug
>>
>
>
>_______________________________________________
>SAP-WUG mailing list
>SAP-WUG at mit.edu
>http://mailman.mit.edu/mailman/listinfo/sap-wug
>
>
>_______________________________________________
>SAP-WUG mailing list
>SAP-WUG at mit.edu
>http://mailman.mit.edu/mailman/listinfo/sap-wug
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5006 bytes
Desc: not available
Url : http://mailman.mit.edu/pipermail/sap-wug/attachments/20110908/e0f2aeb0/attachment.bin