How to know, who started a job run?

[MrJava]

Hi there!

We have different jobs/workflows configured in our Databricks workspace running on AWS and would like to know who actually started the job run? Are they started by a user or a service principle using curl?

Currently one can only see, who is the owner and who created the job config but not who triggerd an actual run.

I tried to find something in the audit logs we have activated for the jobs but was not successful.

Any hints are highly welcome!

[mcveyroosevelt]

To determine who started a job run in Databricks, you can use the Audit Logs feature by enabling workspace-level events and analyzing the runStarted events. Look for the userIdentity field within these logs, which identifies whether the run was triggered by a user or a service principal (e.g., using curl). Ensure that the audit log retention period and permissions are properly configured in AWS CloudTrail or your logging system to capture these details. If userIdentity is unclear, cross-check with Databricks job execution details or enable job tags for easier tracking.