topic Re: APM audit_admuser table in Administration and Deployment

APM audit_admuser table

kaziumair — Tue, 06 Jul 2021 11:17:35 GMT

Hi everyone,

I have to create an audit report containing information about user addition/deletion by admin . Does APM audit_admuser table capture the required information ? If not, can you suggest how I can obtain required information?

Thanks and Regards ,

Mohammad Umair Kazi

Re: APM audit_admuser table

gwootton — Wed, 07 Jul 2021 13:15:56 GMT

The APM table ARTIFACT.AUDIT_TRANSACTIONS is used by the Products\SAS Environment Manager\Audit Reports(Log Forensic)\ "User Accounts Added" and "User Accounts Removed" reports.

Re: APM audit_admuser table

kaziumair — Thu, 08 Jul 2021 11:49:22 GMT

Hi , thanks . Do you know how to update the artifact.audit_transactions table ? Actually ,I am able to see the records in the Audit_SASMeta_Metadataserver.log file , however when I access the audit_transactions table using data step in EG , it does not contain those records. Is there a way to update the table manually ?
Regards,
Mohammad Umair Kazi

Re: APM audit_admuser table

gwootton — Thu, 08 Jul 2021 12:10:40 GMT

These tables are updated by the nightly ETL runs of the Environment Manager Service Architecture Framework, which reads from the Audit_ log file you mention to update ARTIFACT.AUDIT_TRANSACTIONS, among others.

More information on the service architecture framework can be found here:

Understanding SAS Environment Manager Service Architecture
https://go.documentation.sas.com/doc/en/evcdc/2.5_M1/evug/n11z5dl1car9w4n17i8b4jutjre8.htm

When enabled, the Environment Manager agents run at midnight (by default) the script below on each host (except grid nodes):
12 am: <sas-config>/Levn/Web/SASEnvironmentManager/emi-client/bin/log_collect.sh

This script copies the log files from places like SASMeta/MetadataServer/AuditLogs to emi-client/LandingZone.

Then from these scripts run on the primary compute host:
1 am: <sas-config>/Levn/Web/SASEnvironmentManager/emi-framework/bin/log_centralize.sh
This copies the logs from the different host's emi-client/LandingZone to emi-framework/LandingZone on the compute host.

2 am: <sas-config>/Levn/Web/SASEnvironmentManager/emi-framework/bin/master_acm_etl.sh
This script updates the ACM tables by querying Environment Manager tables for data gathered by Environment Manager agents.

3 am: <sas-config>/Levn/Web/SASEnvironmentManager/emi-framework/bin/master_apm_etl.sh
This script reads the log files gathered into the ARTIFACT and KIT tables.

So if you wanted to manually update the tables you could run these scripts manually. Instead I would recommend checking to see why the automated runs are not occurring or are failing. The log files for these processes can be found in the emi-client/Logs and emi-framework/Logs directories.

Re: APM audit_admuser table

kaziumair — Thu, 08 Jul 2021 13:33:00 GMT

Thank you for your help .

Regards ,
Mohammad Umair Kazi

Re: APM audit_admuser table

kaziumair — Wed, 14 Jul 2021 05:50:32 GMT

Hi ,
Can you please give some clarity on the question below :
If an active directory user or an external user with SAS admin privileges adds/deletes user from SAS SMC , then will that be tracked by APM as well?

Re: APM audit_admuser table

gwootton — Wed, 14 Jul 2021 12:55:22 GMT

Yes.

Re: APM audit_admuser table

kaziumair — Wed, 14 Jul 2021 13:15:07 GMT

Thank you for help