---
title: View execution history
description: See every AlertZero Worker run, including failures.
url: https://www.elastic.co/docs/solutions/security/alertzero/view-execution-history
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Preview
  - Elastic Stack: Planned
---

# View execution history
Each time a Worker runs, Kibana records the run. Use the execution history to check that a Worker is running on schedule, to see what a run did, and to find out why a run failed. The history includes scheduled runs and runs that you [start yourself](https://www.elastic.co/docs/solutions/security/alertzero/run-worker-on-demand).

## Before you begin

- Turn on the [**Show managed workflows**](https://docs-demo.elastic.dev/docs/reference/kibana/advanced-settings#kibana-workflows-settings) advanced setting. Because each Worker is a [managed workflow](https://www.elastic.co/docs/explore-analyze/workflows/managed-workflows), you can't see its runs while managed workflows are hidden. Refer to [Set up Workflows > Show managed workflows](/docs/explore-analyze/workflows/get-started/setup#workflows-managed-visibility).
- Make sure your role includes the privilege to read the executions of managed workflows. Refer to [Grant access to AlertZero > Let administrators set up and manage Workers](/docs/solutions/security/alertzero/alertzero-privileges#alertzero-admin-access).


## View a Worker's runs

1. Find **Watches** in the navigation menu or use the [global search field](https://www.elastic.co/docs/explore-analyze/find-and-organize/find-apps-and-objects).
2. Open the Watch that contains the Worker.
3. In the Worker's settings, select **View executions**. The Worker's execution history opens in the workflow editor.
4. Select a run to see its logs, including what each step did.

If a run fails, open it and find the step with the error indicator to see what went wrong. For troubleshooting steps, refer to [Monitor workflow execution](https://www.elastic.co/docs/explore-analyze/workflows/authoring-techniques/monitor-workflows).
To see what a run produced, such as proposed actions, refer to [Work in AlertZero](https://www.elastic.co/docs/solutions/security/alertzero/work-in-alertzero).
<note>
  Runs that you start from the workflow editor are test runs. They're saved with a flask `flask` badge, so you can tell them apart from scheduled runs and from runs that you start from the workflow list. Refer to [Use the YAML editor > Test runs and production runs](/docs/explore-analyze/workflows/authoring-techniques/use-yaml-editor#workflows-test-vs-production-runs).
</note>