To determine who started a job run in Databricks, you can use the Audit Logs feature by enabling workspace-level events and analyzing the runStarted events. Look for the userIdentity field within these logs, which identifies whether the run was triggered by a user or a service principal (e.g., using curl). Ensure that the audit log retention period and permissions are properly configured in AWS CloudTrail or your logging system to capture these details. If userIdentity is unclear, cross-check with Databricks job execution details or enable job tags for easier tracking.

The system table solution works only when the job is manually triggered each time. I have a job which is triggered using the job scheduler on databricks. So once someone resumes the trigger, the job goes into execution. After this, the audit tables display null values as the 'run by' and 'run as'.
I am unable to know who changed the trigger from 'Paused' to 'Resume'. How can we find out who started the job?

News on this feature?

Any update on this feature ?