Advance with Assist shares quick solutions to common challenges encountered by the InterWorks Assist on-demand team.

Question: We have a user whose role changed from a Creator to a Viewer overnight, but no one thinks they did it accidentally. Any way to tell who did this?

Fun times for server administrators here… I’ve seen this question come across Assist a couple times now, so I thought I’d write a quick blog about the answer. The good news is there is a way to get at this information, and it’s contained within the audit tables of the Tableau repository.

Solving with a Table Audit

First, you need to grant access to the read-only user for the Tableau server Repository. For more detail there, check out this resource from Tableau. After you’ve allowed access to your Server repository, the next step is the table to use. In this instance, we want the Historical_Events table. Here are some Tableau resources on the Repo Dictionary and Historical Events.

Within this table, you’ll find what Tableau refers to as the “heart” of the cluster devoted to auditing. The Historical Event Type ID shows the type of event and is linked to other relevant information. For our scenario, the user committing the change and the user being changed are found within two fields:

• hist_actor_user_id
• hist_target_user_id

Linking this events table to the Historical Event Types table is the next step. Historical_event_type_id connects the two for which you can find the Event Name of “Update User Site Role”:

In my workbook, I’ve renamed the field to Action, but you can see I have the ability to find this event using these tables:

Hope this helps you with your Server Admin audits, as this is only one event captured in these tables.