jakarman Tracker

Betreff: Einlesen einer (verdammt) kleinen Zahl

jakarman — Tue, 02 Jun 2020 11:56:39 GMT

Einlesen wird schon ein antwort bekommen.
Die frage ist welche genauhigheit benotigt ist. Ich sehe en lange reihe ciffern. Bei 12 - vorsicht.

http://de.saswiki.org/images/c/cc/20_KSFE_2016_Lehrkamp_-_Nicht_jede_Zahl_ist_das_was_sie_zu_sein_scheint.pdf

Betreff: ERROR: A parallel process did not start. Exiting loop.

jakarman — Fri, 16 Aug 2019 10:39:38 GMT

Das met die log-files ist eine gute. Die standard weise mit SAS datasets fur logiles wird jeder parallel bearbeitiung einer job frustrieren.
Besser ist ein eigener vortgang wie es geht gut entwerfen.

Betreff: Export to STATA, in der Textvariablen werden die Umlaute nicht übernommen

jakarman — Tue, 14 May 2019 14:00:18 GMT

Die "R�ckgradverkr�mmung" fremde karakter sind in utf-8 angedeutet as replacement karakter.
Mit Wlatin1 geht es um einzele-byte nur die decimal order karakter 32 - 127 sind gleich in utf-8.
utf-8 benuts 1-4 bytes für eine karakter. Klar ist das die transcoding zwischen die unterschiedliche encodings nicht gut gegangen is.

Das einfachste wurde ein sas session utf-8. Eguide ist utf-8 aber nicht die sas-session.
https://blogs.sas.com/content/sgf/2017/05/19/demystifying-and-resolving-common-transcoding-problems/

Betreff: Format umwandeln - Text in Zahl

jakarman — Fri, 03 May 2019 11:39:35 GMT

Wenn es sich um eine DBMS-Datenbank handelt, stellen Sie sicher, dass die Schlüssel vom DBMS verarbeitet werden können.

Wenn Sie versuchen, die Schlüssel in SAS zu konvertieren, bringen SQL-Einschränkungen alle Daten auf den SAS-Computer.
Die Leistung der Verarbeitung wird durch die Übertragung von Daten drastisch beeinträchtigt. Wenn es gelingt.

Bei kleinen Dateien, bei denen alles in den Speicher passt, reicht jeder Code aus, der funktioniert.

Betreff: XML Struktur in SAs einlesen

jakarman — Thu, 14 Mar 2019 13:48:37 GMT

Meine Entschuldigung mit die link, wird nachschauen.

Die Mapper kommt normalweise mit SAS Depot mit. Ein lokale Installation macht es möglich alles darauf zu setzen.

Die Verarbeitung mit XML ist offen nicht bekannt und dann passiert es das es nicht dabei installiert ist.

Die SAS deployment manager ist dat Installation Programm das alle teilen die Software Installation organisiert.

Ihren link ist ein anderen Möglichkeit. Ich sehe Linux und Windows Versionen.

Ohne etwas vom SAS auf eine Rechner zu haben soll es damit auch gelingen ein map file zu generieren. (SAS UE).

Das Profess ist ziemlich einfach wenn die XML Datei einfache Strukturen hat.

1/ XSD (ein Metadaten Beschreibung des XML im XML Struktur) oder

XML , die Datei benutzen als Beispiel. Special Aufmerksamkeit für Ausnahmen benötigt

2/ Mit die MAP-file das XML File verarbeiten mit Resultat ein SAS dataset.

Angesehen das das Resultat ein SAS-dataset möglich ein Teil des originalen XML ist, ist zurückschreiben nicht möglich

Betreff: XML Struktur in SAs einlesen

jakarman — Thu, 14 Mar 2019 13:59:05 GMT

Es sieht aus das die XML met vbs im html umgesetzt wird,

XML aufbereiten ist am einfachsten mit die mapper.

https://documentation.sas.com/?docsetId=engxml&docsetTarget=p1cji2td43rru1n1wi0c3a6n0q9f.htm&docsetVersion=9.4&locale=en
Mit die mapper bekommen sie auch die LIbname xml code und mapfile.

14/3 Die link Functioniert bei mir.

SAS® 9.4 XMLV2 and XML LIBNAME Engines: User’s Guide

What Is SAS XML Mapper?

SAS XML Mapper is an XMLMap support tool for the XMLV2 and XML engines. Based on Java, SAS XML Mapper is a stand-alone application that removes the tedium of creating and modifying an XMLMap.

SAS XML Mapper provides a graphical interface that you can use to generate the appropriate XML elements. SAS XML Mapper analyzes the structure of an XML document or an XML schema and generates basic XML syntax for the XMLMap.

The interface consists of windows, a menu bar, and a toolbar. Using SAS XML Mapper, you can display an XML document or an XML schema, create and modify an XMLMap, and generate example SAS programs.

SAS XML Mapper Application

Importing an XML Document with Numeric Values

This example imports the XML document Precision.XML, which was exported in Exporting Numeric Values. This example illustrates how you can change the behavior for importing numeric values.

The first SAS program imports the XML document using the default behavior, which retrieves parsed character data (PCDATA) from the element:

libname default xml 'C:\Output\precision.xml';

Ein blog: https://blogs.sas.com/content/sgf/2016/06/24/tips-for-reading-xml-files-into-sas-software/

Betreff: ERROR: A parallel process did not start. Exiting loop.

jakarman — Tue, 22 Jan 2019 22:25:25 GMT

Es gibt mehrere moglichheiten wie ein parallel process gestartet wird
- SAS/Connect (lauft auf server)
- SAS Grid (lauft miet mehrere servers)
Einiges wird beim installieren configuriert es geht um die software auf die server .

Das manul (leider english);
http://support.sas.com/documentation/cdl/en/etlug/67323/HTML/default/viewer.htm#n01x9nu3lsgx7ln13dddo03t2mdo.htm

Gibt es auch ein endloop im ihren flow?

Re: Which SAS9 Permission Wins?

jakarman — Wed, 22 Nov 2017 20:09:29 GMT

David, "it is perfectly and consistently clear that they to not recommend mixing code/data by the DI-developers in the same folders. And nor would I. I wonder what you can mean?" The Danish best practices is having a nice rule setting how to architect something.
But what is in the example (2009) is the organisation of the Danish office focussed on their structure.
What happened in that time (210) as (not SAS) architects did not understand that difference to the client local situation is trying to copy (the example) and that organisation into the local situation. It was followed by subfolders as of step 1,2,3 of some development process actions and getting data and code artifact being mixed up. Having the requirements for release manager later getting a lot of growing exceptions. The situation getting unsolvable as at some point far too much of exceptions being needed with unpredictable behavior.

Making a clear statement: determine local client requirements starting with security of artifacts not working with tools would solve a lot.

I see you are in that direction, we can agree on that. .

"However, which one is used is undefined. It is deterministic: it is always the same one, of you connect multiple times - so it is certainly not random."

That was the key behavior as previous described deleting and adding the same definitions was showing that. I am indicating it as random as at the moment someone is updating that (delete/adding eg groups) and it is not getting the same results as the internal order is different. It realyy happened that way ne department new group name and …. .
I my first case it was on folder access and as far I am remembering it in the inheritance of subfolders with multiple access right groups in the same distance but with different rights and there were different denies added as argument for auditing being more clear.

In the second one also many organisational groups and is this one global tool roles mixing up access rights allow and denies on the same distance. (because you are Eminer / Eguide / DI user you have right to and not) Because you are part of that and that department getting access right to .. and not to ..

I would like to reinvest such things again but as not having the needed access rights now (admin rights local isolated SAS environment) it is for the time being not possible.

For some surprise experienced some time: adding authdomains by some normal user (login manager) should that be possible?
The DI failed access needing too mucht richts was at 9.1.3 and was confirmed by sas support, should be fixed now.
At that moment and existing user could work on folders getting more restricted a new user crashed on security. Only after a first login with higher admin levels at the user it worked thereafter it could set more restricted again. No change on folder security in between was done. The only conclusion is some invisible administration was done at the first usage.

Re: Which SAS9 Permission Wins?

jakarman — Mon, 20 Nov 2017 21:41:45 GMT

Well Paul SAS metadata is not that long present as being working in IT and SAS (technical based) far longer as that.
The most difficult things is getting data information security according policies wheras the ISO27002 is the challenging but basic one.
Do you have those references? As there we go.

The need is building an environment whereas all this with code/business logic and data should well seperated for daily business usages and at the same time release-management (code promotions version controlled) . And data manipulations by somebody else being prepared (segregation of duties). The testing should be done that all needed access is granted and time the required denies should be active.

Even the famous Danish "best practice" never getting correct as of the mixing of code/data by the DI-developers grouping ignoring those other activities. This may be the whole issue as the random security behavior was always in that settings.
I cannot create an example of that as not having acces at that level now.
Mu question: Do you have that kind of structures to that level of compliancy (Iso27002) underpinned and audited?

Som frustrations from the past:

- The dynamic prompt random behavior was nicley replayable but even with that shown to SAS staff they still not seeing the issue.

That was a result of parallel testing multiple goups of persons sharing logic but wiht segregated data to be chosen as option.
- Getting the shared server to work on Aix it was working at first sight well (user/password checked) that found by surprise that without password all was accepted. Surely not the way but the only answer "upgrade to the next release" (still B at that moment).

Re: AD Account is locked at SAS Server

jakarman — Mon, 20 Nov 2017 21:18:56 GMT

Michael, yep that is the terrible thing we struggled quite a lot on that.
The updates time-outs on the OS and the SAS were done seperately not aligned to each other.

The pw checking was calling the OS and the OS being redirected to LDAP (AD) for only normal users as service accounts being local.

When this is also you case testing / validating will get more easy. Have at least two accounts availiable.
One being getting locked and at every attempt increasing the time (accumulating). The other as normal user just logging in an measuring the time in responding for normal usage.
Having a test for infra validation of a sas installation available you can try those settings in the sasauth.conf on that scenario changing values and just replay the user-locking and changing passwords. That environment should be very similar to the real one. A stand alone one on a desktop will not do that job.

Re: AD Account is locked at SAS Server

jakarman — Sat, 18 Nov 2017 20:07:26 GMT

Michael, with the omaconfig you have reviewed the internal account definitions
With that you can validate passwords against LDAP/Kerberos/AD but there is no immediate connection to the OS security itself.

It is a kind of working in ignoring security at het data/os-level and combine those to a shared grouped account that is maintained and owned by SAS. I hope SAS institute is not responsible or if they are. Anyway that way of working should be described well as losing auditablity traceablity by normal tools for that. --- high profile user, hurts ----

For unix security technical way of working, there are many options:
http://support.sas.com/documentation/installcenter/en/ikfdtnunxcg/66380/PDF/default/config.pdf review PAM / sasauth.
Getting into LDAP/AD depending on the size of the company there can be many LDAP/AD servers.
Updating the password in a windows environment and expecting it immediately active can be frustrating. At windows you get the immediate response of the update password as you are being connected to that one.
https://blogs.technet.microsoft.com/kenstcyr/2008/07/05/understanding-urgent-replication/   Normally it should be implemented well but you never know.

There is an other weird behavior of the sasauth module. It is that module checking the password while runnig at root-level.
What will happen when validating a user/password combination when there are delays/lock wait policies being activated at the AD origin. Will the user account behave als normal Windows or will there happen something different?
The latter having seen happening. Trying a locked out user several times and the delay time went ever up never being reset by a correct login. You must be very patient and confident to see the login happening after an hour or so.

Re: Which SAS9 Permission Wins?

jakarman — Wed, 15 Nov 2017 19:13:06 GMT

You don't mention ACEs in the proposal, but given you say your ACTs only grant, I am assuming an implied use of ACEs to deny permissions (to PUBLIC or SASUSERS) when you need to hide/protect folders. Is this correct?

Yes they are the exceptions to do at a high level as possible so no need to adjust them afterwards.
The default installation is/was open for public/guest by default causing real security audit issues.

However any access controls on the parent will still have an indirect effect. Without any direct access controls on the subfolder, the effective permissions on the subfolder will be the same as the parent folder (except for any potential WMM on parent > WM on child related differences).

I am sorry, but real life experiences (9.4m3 latest) seen this not being true. Not anything set at subfolders and behaving differently wiht a far too complicated setting on the parent

There is no random effect. When there are conflicts the outcome is determined. It might appear to be unpredictable without a full knowledge of the implementation and precedence rules.

I left a detailed situation example away because it is rather complicated. But here it comes.
Suppose the conflict is in the "closest group" access ones, there is no clear definition order of that. Also this one real life experience and only being proven by removing and adding exactly the same rules in a different order.

The same kind of pitfall experienced by the way with dynamic prompts. When the library and you have several different of those for different apps-servers and the prompt is searching the app-server the app-server selection is by-passed and the first in a technical order is opened, No problem when there is only one app-server and one library definition but with parallel groups you get surprised.

Re: Which SAS9 Permission Wins?

jakarman — Sun, 12 Nov 2017 19:24:09 GMT

https://www.owasp.org/index.php/Security_by_Design_Principles There are lot principles for security in that.

“The need for application security in the form of security architecture is every bit as great as in building or bridge construction.”

I would like to start with one I propose and than going to what is often happening.

My proposal:

- start with a folder structure categorization (containers) on projects/applications

- Within those containers segregate on the artifacts like Jobs(DI) Tabels(DI) Miner (models and the pointers to the externals stored EM projects) flows deployedjobs etc.
- When there is some information flow that needs segregation within that project define additional folders.

This can happen in data science projects having different flows for delivering the data as modelling purpose or as scoring purpose.

In the latter one there is some parallel development in cooperation to solve.

- Having all those folders define for each two ACT definition one for read-only purpose and one for updating maintenance.

- Having the ACT’s only giving grants and never denials.
- As last: never (only some exceptions) define access for users or groups by explicitly on those folders/resources only do it by maintaining the rights by groups membership at the ACT’s. For the high privileged accounts (project limited least privileges) it can be dedicated non personal accounts.

The result:

- a very simple way to implement maintain.

- I can’t see any mistakes or confusions when strictly doing this.

The challenge to explain to others is that obviously hidden layer by ACT’s.

Another challenge is the an additional clear need for the sponsor / line of business as it not visible in this concept.

Heaving multiple line of business sharein something is no issue at all as those groups can mentioned in the ACT’s

The common approach I often seeing.

- start with folder structure naming the lines of business unit.

- put all kind of different artifacts mixed in some folders. This is a result of following the ownership named conform the business-line

- have the smart IT add some denials/ grants named like DI-developer Modeler or whatever.

The result:

- The complexity is becoming a headache as

. requirements of securing artifacts are coming in.

. additional business lines are also allowed to use some parts, security to be changed

With this the temptation of using explicit ACE’s on each folder/artifact is that is going to be used.

The first will look to be working and more will come in adding more complexity as humans are able to understand.

In the last situation:

Now add some subfolder or going to move some things.

Look at the precedence the settings explicit have priority on the ACT’s an the inherited.
In the new folder everything is inherited there is no automatic copy of all ACE’s.

The new folder is seeing groups like Act’s and all stuff as inherited the on the Item box is vanished.

Will the security give the same results?

An other is having this one: “then the access control for the group the user is more closely a member of will win”
Having conflicts in right that are as equal in distance there will be a random affect (unpredictable undefined outcome).

I have seen this kind of issues in real life even more weird ones.
The owasp never got really to life

Re: Which SAS9 Permission Wins?

jakarman — Sat, 11 Nov 2017 14:14:56 GMT

In this approach there is a major pitfall, those are:
-The ordering of security settings is easily different as of the setting on the item (artifact) explictly or being inherited.

- outsmarting some nasty and dumb expected grouping on items work by adding roles and other levels will make it worse.
When the security and/or work for promoting is very complicated most likely the grouping and ordering of artifacts ha been done in a wrong way. In that case the advice should be redesiging that area.

I like the concept of using only some ACT's protecting grouped way of artifacts of the same security classification and same security rights. There is no problem on then number of ACT's (well designed naming convention) or is there. So what is the issue sticking to that?

Betreff: SAS Enterprise Guide Datum letzte Änderung im Server-Fenster

jakarman — Fri, 04 Aug 2017 17:01:40 GMT

Geht es um ganz schnell mit wenig system belastung information uber tabellen ansichtlich zu machen dan:
- schau mal an attrn/atrrc fucntionen. Die greifen am tabellen information selbst an.

http://support.sas.com/documentation/cdl/en/lefunctionsref/69762/HTML/default/viewer.htm#p12uchp7hm5h2zn1om2ut816af7h.htm

- Mit externe DBMS tabellen ist ein count(*) ohne etwas zu filteren sehr schnell weil es das dictionary.tables benutz

Accessing SAS tabellen und external dbms tabellen wirden schrecklich langsam.

http://support.sas.com/documentation/cdl/en/lrcon/69852/HTML/default/viewer.htm#p00cato8pe46ein1bjcimkkx6hzd.htm

Re: Activate Properties for Files and Folders in Enterprise Guide

jakarman — Fri, 28 Jul 2017 16:30:51 GMT

please add the oredering option and more like common OS capabilties too.

Betreff: Bibliotheken werden bei der Definition einer Eingabeaufforderung nicht angezeigt

jakarman — Fri, 25 Nov 2016 16:25:14 GMT

Es seht aus wie die SAS metdatabeschreibung vom datei im SAS metdataserver fehlt.
De weise ist schwierig im understandnies da die wirkliche physichen bilbitheken da sind. Die bibiltheken sollen wie DI (DataIntegration Studio) im SAS metadata server importier wirden.

http://support.sas.com/documentation/cdl/en/lrmeta/70119/HTML/default/viewer.htm#p1cqb9ofazns8pn1by7t2smnimsf.htm

Die biblotheek (libref/libname) soll da sein.
Biite vorischt met dat dynamisch zuweisen. De Eingabebeauffordering wird vorher das beobte program gestartet. Es darf im besondere conditionen unerwarted ein anderes appserver proces sein.

Re: MP connect on SAS EG

jakarman — Wed, 23 Nov 2016 18:03:33 GMT

I was aiming at job-flow connections lines between those programs / tasks.
I has the first preference in starting jobs/taks.

I used it heavily with program-nodes, that is working well.
The generated task like query builders are behaving badly. For these reasons:

- There are no options to switch it dedicated to parallel yes/no.

- the assumption is having macro-s and datasets available in the current front proces. These are gone missing when running parallel as it are new sessions not sharing anything.

Re: MP connect on SAS EG

jakarman — Mon, 21 Nov 2016 20:56:10 GMT

You have lines between them as in the first and second scenario.
Then in both cases it should run parallel, at least I didn't see any other behavior.

Betreff: Zugriffrechte auf Bibliotheken bzw. physische Verzeichnisse

jakarman — Mon, 21 Nov 2016 20:48:56 GMT

Das erste zum prüfen wurde das libname statement mit EGuide sein (letzten tip Sebastian).
Ich wurde ein volles server-name "\\Server.betrieb.de\Alias\directory" versuchen am gleichen server wie die WS (no 1).

Dan ein name ausenseites das WS aber im geleichen AD domain. Wenn der fehlt dan ist die AD trust ein problem (ersten tip Sebastian).

Es gibt een note irgendwo dat nicht die user der benutzer angrechnet wirdt fur die uri verbindung aber die server-machine-id.
Ein volle server-name geht am SMB protocol vorbei das ausgeschalted sein kan.

Wird die meta-autoinit benutztz dan wird vielleciht die SAS metadata und die libname processing nicht mit de gewunste AD benutzer statt aber mit die sas-server-identiteit und sastrust sasservices. Diese vergang habe ich mal mit erstaunen beobachted.