Audit Logging

[Puru867]

Hi All,

We are testing the audit logging on which dataset is been accessed under a defined library,

to achieve this we have enabled the Audit.Data.Dataset logging in the workspace server config logconfig.apm.xml with the following entries  

<!-- Audit.Data.Dataset.Open logger definition -->
<appender name="AuditLibraryFile" class="FileAppender">
<param name="Append" value="true"/>
<param name="ImmediateFlush" value="true"/>
<param name="fileNamePattern" value="/sascommon/SAS/SASConfig/Grid1/Lev1/SASApp/WorkspaceServer/Logs/Audit.Library_server_%d_%S{hostname}_%S{pid}.log"/>
<layout>
<param name="ConversionPattern"
value="DateTime=%d Userid=%u Action=%E{Audit.Dataset.Action} Status=%E{Audit.Dataset.Status} Libref=%E{Audit.Dataset.Libref} Engine=%E{Audit.Dataset.Engine} Member=%E{Audit.Dataset.Member} NewMember=%E{Audit.Dataset.NewMember} MemberType=%E{Audit.Dataset.Memtype} Openmode=%E{Audit.Dataset.Openmode} Path=%E{Audit.Dataset.Path} Sysrc=%E{Audit.Dataset.Sysrc} Sysmsg=%E{Audit.Dataset.Sysmsg}"/>
</layout>
</appender>

<!-- Audit.Data.Dataset.Open logger definition -->
<logger name="Audit.Data.Dataset.Open" additivity="false">
<level value="Trace"/>
<appender-ref ref="AuditLibraryFile"/>
</logger>

We are able to get the log entries  as below

DateTime=2020-03-18T10:49:00,558 Userid=kkxm303 Action=OPEN Status=SUCCESS, Libref=SASHELP Engine=V9, Member=ZIPMIL NewMember=, MemberType=DATA Openmode=INPUT, Path=/sascommon/SAS/SASHome/SASFoundation/9.4/sashelp Sysrc=0, Sysmsg=

But the problem is whenever we tried to call a dataset from a library for the first time , all the datasets under the library is  being entered as open.

 for example

if we type in and run a simple statement like "proc print data=sashelp.cars;run;"

we would get all the sashelp library datasets are logged in the log file as opened.

We are not sure what is the cause on this.Can any one suggest a solution.

We require to have only one log entry for the sashelp library member cars. 

[gwootton]

Hi Puru!

I tested your XML using your example of running PROC PRINT against SASHELP.CARS and got the expected single line when run from Base SAS.

DateTime=2020-03-18T11:40:07,920 Userid=grwoot Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=C:\Program Files\SASHome\SASFoundation\9.4\core\sashelp Sysrc=0 Sysmsg=

I tested connecting using Enterprise Guide to the local SAS instance, which added WORK:

DateTime=2020-03-18T11:44:52,980 Userid=grwoot Action=OPEN Status=SUCCESS Libref=WORK Engine=V9 Member=_PRODSAVAIL NewMember= MemberType=DATA Openmode=OUTPUT Path=C:\Users\grwoot\AppData\Roaming\SAS\EnterpriseGuide\EGTEMP\SEG-8736-3ffc61ae\contents\SAS Temporary Files\_TD9692_D7C638_\Prc2 Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:44:53,545 Userid=grwoot Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=C:\Program Files\SASHome\SASFoundation\9.4\core\sashelp Sysrc=0 Sysmsg=

Finally I tested as you described by modifying logconfig.apm.xml in a 9.4 M5 system with Enterprise Guide. This also added another SASHELP data set.

DateTime=2020-03-18T11:49:42,399 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=VOPTION NewMember= MemberType=VIEW Openmode=INPUT Path=/sas94/software/compute/SASFoundation/9.4/sashelp Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:49:42,804 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=WORK Engine=V9 Member=_PRODSAVAIL NewMember= MemberType=DATA Openmode=OUTPUT Path=/tmp/SAS_work456900006D8D Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:49:43,172 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=/sas94/software/compute/SASFoundation/9.4/sashelp Sysrc=0 Sysmsg=

From your description, it sounds like your SAS session is accessing other datasets in SASHELP and the logger is writing this access out accordingly. What client are you using? If you do not access SASHELP at all, do you see any lines generated?

[Puru867]

Hi gwootton,

Good Day !!
Thanks for pitching in !! 😊

I am trying it from EG.
In EG also this happens when we type proc statement for the first time and execute the code. It looks like it is trying to read all the tables under the library for auto suggesting the tables under the library while typing the code.
But this would be a fail case for us , since the users may type the code in EG trying to access only the single table, but the log would have captured all the tables under the library as accessed.
The WORK library entry is fine to be captured , which can be later filtered using filter tag in the xml appender configuration if needed.

I have also tested with other library by declaring with a libname statement. This also having the same behavior.




i also tried directly executing Workspace.sh -nodms with the proc statement , i am getting only the single entry in the log with member as CARS
similar to this.
DateTime=2020-03-18T10:49:00,558 Userid=kkxm303 Action=OPEN Status=SUCCESS, Libref=SASHELP Engine=V9, Member=CARS NewMember=, MemberType=DATA Openmode=INPUT, Path=/sascommon/SAS/SASHome/SASFoundation/9.4/sashelp Sysrc=0, Sysmsg=

[gwootton]

Thanks Puru,

Given it doesn't occur when running WorkspaceServer.sh -nodms it sounds like the issue lies in Enterprise Guide submitting additional code to the SAS session to access the datasets of SASHELP. What version of Enterprise Guide are you using? Do you have any startup code configured in Enterprise Guide to do this? If you only connect to the Workspace Server but do not submit any code accessing SASHELP, do you still see these lines (for example if you just ran proc setinit)? What if you use a different client, like SAS Studio? You may wish to call logconfig.trace.xml to generate a full Workspace Server log and determine everything happening in the SAS session. This process is described here:

SAS® 9.4 Intelligence Platform: System Administration Guide - Create a Log File for Workspace Server...