ALTERYX INSPIRE | Join us this May for for a multi-day virtual analytics + data science experience like no other! Register Now
1 Day Left! - The Alteryx Community will be temporarily unavailable for a few hours due to implementation of the new SSO experience starting tomorrow at 5pm MDT. Please plan accordingly. For more information, read the blog.

Alteryx Server Knowledge Base

Definitive answers from Server experts.

How to determine which User deleted a Gallery application

SophiaF
Alteryx
Alteryx
Created

How to determine which User deleted a Gallery application (Server 2019.2+)

 
Administrators may wish to audit the deletion of workflows and applications on the Gallery. This guide utilizes the /admin/v1/auditlog endpoint (and subsequent Collection in MongoDB) that was introduced in Alteryx Server 2019.2.
 

Prerequisites

  • Alteryx Server
    • Version 2019.2+
  • Admin API credentials required for querying the /admin/v1/auditlog endpoint (Procedure 1)
  • MongoDB credentials required for querying the auditEvents collection (Procedure 2)

 

Procedure 1 - Query via the API

This procedure utilizes the Admin API /admin/v1/auditlog/ endpoint. These steps will guide you through what information you need to query the API, but the actual query can be made via any method. This guide will give details for querying the API via the Interactive Documentation.
 
  1. Gather your Admin API credentials from found in the Keys section of account settings on your Alteryx Gallery.
    • Enter these credentials in the Interactive Documentation for your Gallery.
      • NOTE: This link directs to the Public Gallery documentation. You will need to navigate to the documentation for your Gallery.
  2. Run the /admin/v1/auditlog/ endpoint with the following parameters:
    1. entity=AppInfo
    2. page=0
    3. pageSize=n (where n is the number of results you want to return)
idea SkyscrapersYou may need to increment the page and pageSize values if you have a large number of records.
  1. The API does not allow you to filter the information further, so you will need to look through the responses to find the following:
    • "event" = update
    • "newValues" contains "isDeleted\":trueidea Skyscrapers​​​​​​​
  2. Once you locate the correct response, you can match the userId against the id returned from the /admin/v1/users endpoint with the following parameters:
    • "page"=0
    • "pageSize"=n (where n is the number of users to return)idea Skyscrapers​​​​​​​
 

Procedure 2 - Query the information in MongoDB

This procedure queries MongoDB directly. Please use caution if proceeding with this method on Production systems.
 
  1. Gather your MongoDB credentials.
  2. Connect to the AlteryxGallery database.
  3. Run the following query to return all events where a workflow was deleted:
db.getCollection('auditEvents').find({Entity:'AppInfo',Event:'update',NewValues:/isDeleted":true/})
The above query finds all results in the auditEvents collection where the Entity is AppInfo (workflows) that were updated to have their isDeleted flag to true - this is how workflows are deleted by the Gallery.
  1. You can then use the userId field to query against the users collection to find the details of this user (USER_ID should be replaced with the value of userId😞
db.getCollection('users').find({"_id" : ObjectId("USER_ID")})

Common Issues


Error: Line 1: Unexpected token ILLEGAL
The query you sent to MongoDB is invalid. Please ensure you have the exact queries mentioned above; pay special attention to the special characters and escape characters)
 
 

Additional Information

Help documentation - Audit Logs