On further investigation, looking at the process instances, there is a pattern on when they are going out:

9:22am (started by testid1)

9:23am (started by testid2)

10:00am (started by testid3)

then the same again at:

17:22

17:26

18:00

and finally

01:23am

01:26am

02:00am

and then this same timing (give or take a minute), occurs everyday.

What in the name of Guy Fawkes is going on here?

Hello,

You might have configured to start the workflow in the scheduler. That is the probability I see here.

Are you referring to the scheduler in K2 Process Portal for SharePoint 2010? I haven't seen anyone using that recently, especially since almost everyone I know is on SharePoint 2013 or SharePoint 2016 now.

How does your workflow normally starts? Did you make any changes recently? I'm thinking you may have a rule that starts the workflow somewhere in your form that you are not aware of.

Firstly, we don't have any Sharepoint integration

Secondly, we have never used the Process Scheduler, in fact i checked that before posting and there was no entries in there

Thirdly, I deleted all Active instances of the process yesterday.... Just came in this morning to find 3 emails (sent at 1:24am, 2:01am and 9:24am

Forthly, nobody else has access to this process or form, it's on a dev server....

What else could it be?

For the 3 emails i received, the serial number has the same 2 ending digits, but the first three are different:

1:24am - SN=468_48

2:01am - SN=470_48

9:24am - SN=471_48

Any ideas.... before i call in the K2 exorcists?

Mmm... spooky. Is this just happening on one particular workflow? or are there other deployed workflows that are just as haunted? What happens if you redeploy it?

As for the serial number, the digits before the underscore represents the process instance id, and the digits after the underscore represents the activity destination instance id (basically an id to identify whose task it belongs to). In short [Process Instance ID]_[Activity Destination Instance ID]

This might sound silly, but are the process instance id always different in the emails you're receiving? like you should be getting 472_48, 473_48, etc. next, at least then we would know it's not just an escalation email.

Or is there other custom batch jobs running that's kicking off new instances every 8 hours or so?  

Or perhaps another workflow that's looping an IPC and starting this new process as a result?

Or try purging the ghosts by restarting the servers. Otherwise just call in the K2 exorcists, they can see more with their trained sixth sense.

I found and removed the offending spirits... (no, not the vodka or irish whisky)

The culprit was Mr Microsoft... :-)

Basically we had three Internet Browser windows open on various Remote sessions which all had the Test form loaded. -The Test form has rules set on Initialize to do some stuff on the form and run the Workflow....

We were not touching the test form overnight, so that wasn't something we considered on our EMF radar, hence the reason why we were thinking it was spooky.

The only thing that i think was causing this is that randomly Microsoft refresh the browser themselves, hence this would trigger the form to refresh and start the workflow.

I closed down two of the IE windows and left it a day, this confirmed that no emails were sent from those users, so there you go, just in time before the witching hour...

Time for some pumpkin soup me thinks.

Your "Mr Microsoft" reminded me of Clue.

It was Mr. Microsoft on the remote session with the internet browser!

Glad you figured it out, I was so intrigued!

Hello SharpSharp1,

This is so good . GLad to see you got the cluprit .

Just wanted to add here i also been through these kind of scenario and the got resolved just by restarting the server or simply close the browser .

Regards,

Chiru