topic Users removed from accessing the library in Administration and Deployment

Users removed from accessing the library

ronnynch — Thu, 05 Jun 2025 08:32:05 GMT

Hi All,

I would like to ask if there is a log captured when a user access has been removed from a library or a user group? I have user reported that he suddenly not able to access to a library. Upon checking, it is confirmed that his does not have access to the library. Issue is, he insists that he has the access to the library previously. Do metadata logs capture the event where the user access was removed?

Thanks.

Re: Users removed from accessing the library

carl_sommer — Thu, 05 Jun 2025 15:35:41 GMT

(I assume you mean metadata permission changes, not file system or database system permission changes)

A great reference for this is the following SAS Global Forum paper from 2009:

Using SAS® 9.2 Metadata Security Reporting and Auditing Features

What you are most likely interested in is the Audit.Meta.Security.GrpAdm logger (which would note if a user was removed from a group, which would be how the access would be lost of the user was removed from a permitted group) , or the Audit.Meta.Security.AccCtrlAdm logger (which would be a directed change of permissions on an object, perhaps the folder that this table inherits permissions from)

For more details on metadata server loggers, see SAS Help Center: About Metadata Server Loggers

This paper also talks about using the %MDSECDS Security Report Macro to audit security changes.

Carl Sommer - SAS Technical Support

Re: Users removed from accessing the library

Sajid01 — Sun, 08 Jun 2025 13:00:40 GMT

Yes.
Typically changes to metadata server are captured in the metadata server logs.

Re: Users removed from accessing the library

Nigel_Pain — Mon, 09 Jun 2025 11:48:40 GMT

Here's an example entry from our metadata logs (suitably edited):

2025-01-09T16:36:16,945 INFO [31155358] 1567886:zzzzzzz@Dddddddd - Audit Public Object Type=User Name=XXXXXXXXXX ObjId=OOOOOOOO.AAAAAAA has been delete