A client of ours is encountering an issue where there seem to be 'ghost' submissions of one of their Forms Business Processes. These submissions are terminated by Forms. Some of these occur after working hours when none of the users are in the system. See screenshot below of the terminations.
The affected form is not Public. The users had to login to forms to access the Form for submission. What I noticed about the terminated forms are that they don't contain any field data and show multiple terminations of submissions by the same set of users with same Start time and Last Updated Time.
This is the corresponding IIS logs for this duration... Shortened it. Any ideas on this?
#Software: Microsoft Internet Information Services 8.0
#Version: 1.0
#Date: 2017-03-26 06:57:02
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2017-03-26 06:57:02 10.0.0.12 GET /forms/form/print/8060/99/60/-1/7 authkey=65e5e611-21fd-4f2f-9e43-626253411cd0&IAS=true 80 - 10.0.0.12 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/534.34+(KHTML,+like+Gecko)+wkhtmltopdf+Safari/534.34 - 200 0 0 16770
2017-03-26 06:57:02 10.0.0.12 GET /forms/form/print/8057/99/60/-1/7 authkey=045301aa-7c62-475d-81b8-97d57ea767b6&IAS=true 80 - 10.0.0.12 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/534.34+(KHTML,+like+Gecko)+wkhtmltopdf+Safari/534.34 - 200 0 0 16801
2017-03-26 06:57:02 10.0.0.12 GET /forms/form/print/8055/99/60/-1/7 authkey=0aab6dbf-3aac-48c9-a866-925615c9fab2&IAS=true 80 - 10.0.0.12 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/534.34+(KHTML,+like+Gecko)+wkhtmltopdf+Safari/534.34 - 200 0 0 16817
2017-03-26 06:57:02 10.0.0.12 GET /forms/form/print/8058/99/60/-1/7 authkey=431a1c28-6604-459e-9ca3-daa914e1fe1f&IAS=true 80 - 10.0.0.12 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/534.34+(KHTML,+like+Gecko)+wkhtmltopdf+Safari/534.34 - 200 0 0 16817
2017-03-26 06:57:02 10.0.0.12 GET /Forms/styles/stylecss v=ep7m_rjlr8r4z9mqOY6SvdEePHXpNPrJheP3ydgySg81 80 - 10.0.0.12 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/534.34+(KHTML,+like+Gecko)+wkhtmltopdf+Safari/534.34 http://xxx.xxx.xxx/forms/form/print/8055/99/60/-1/7?authkey=0aab6dbf-3aac-48c9-a866-925615c9fab2&IAS=true 200 0 0 15