Hi All,
We are testing the audit logging on which dataset is been accessed under a defined library,
to achieve this we have enabled the Audit.Data.Dataset logging in the workspace server config logconfig.apm.xml with the following entries
<!-- Audit.Data.Dataset.Open logger definition -->
<appender name="AuditLibraryFile" class="FileAppender">
<param name="Append" value="true"/>
<param name="ImmediateFlush" value="true"/>
<param name="fileNamePattern" value="/sascommon/SAS/SASConfig/Grid1/Lev1/SASApp/WorkspaceServer/Logs/Audit.Library_server_%d_%S{hostname}_%S{pid}.log"/>
<layout>
<param name="ConversionPattern"
value="DateTime=%d Userid=%u Action=%E{Audit.Dataset.Action} Status=%E{Audit.Dataset.Status} Libref=%E{Audit.Dataset.Libref} Engine=%E{Audit.Dataset.Engine} Member=%E{Audit.Dataset.Member} NewMember=%E{Audit.Dataset.NewMember} MemberType=%E{Audit.Dataset.Memtype} Openmode=%E{Audit.Dataset.Openmode} Path=%E{Audit.Dataset.Path} Sysrc=%E{Audit.Dataset.Sysrc} Sysmsg=%E{Audit.Dataset.Sysmsg}"/>
</layout>
</appender>
<!-- Audit.Data.Dataset.Open logger definition -->
<logger name="Audit.Data.Dataset.Open" additivity="false">
<level value="Trace"/>
<appender-ref ref="AuditLibraryFile"/>
</logger>
We are able to get the log entries as below
DateTime=2020-03-18T10:49:00,558 Userid=kkxm303 Action=OPEN Status=SUCCESS, Libref=SASHELP Engine=V9, Member=ZIPMIL NewMember=, MemberType=DATA Openmode=INPUT, Path=/sascommon/SAS/SASHome/SASFoundation/9.4/sashelp Sysrc=0, Sysmsg=
But the problem is whenever we tried to call a dataset from a library for the first time , all the datasets under the library is being entered as open.
for example
if we type in and run a simple statement like "proc print data=sashelp.cars;run;"
we would get all the sashelp library datasets are logged in the log file as opened.
We are not sure what is the cause on this.Can any one suggest a solution.
We require to have only one log entry for the sashelp library member cars.
Hi Puru!
I tested your XML using your example of running PROC PRINT against SASHELP.CARS and got the expected single line when run from Base SAS.
DateTime=2020-03-18T11:40:07,920 Userid=grwoot Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=C:\Program Files\SASHome\SASFoundation\9.4\core\sashelp Sysrc=0 Sysmsg=
I tested connecting using Enterprise Guide to the local SAS instance, which added WORK:
DateTime=2020-03-18T11:44:52,980 Userid=grwoot Action=OPEN Status=SUCCESS Libref=WORK Engine=V9 Member=_PRODSAVAIL NewMember= MemberType=DATA Openmode=OUTPUT Path=C:\Users\grwoot\AppData\Roaming\SAS\EnterpriseGuide\EGTEMP\SEG-8736-3ffc61ae\contents\SAS Temporary Files\_TD9692_D7C638_\Prc2 Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:44:53,545 Userid=grwoot Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=C:\Program Files\SASHome\SASFoundation\9.4\core\sashelp Sysrc=0 Sysmsg=
Finally I tested as you described by modifying logconfig.apm.xml in a 9.4 M5 system with Enterprise Guide. This also added another SASHELP data set.
DateTime=2020-03-18T11:49:42,399 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=VOPTION NewMember= MemberType=VIEW Openmode=INPUT Path=/sas94/software/compute/SASFoundation/9.4/sashelp Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:49:42,804 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=WORK Engine=V9 Member=_PRODSAVAIL NewMember= MemberType=DATA Openmode=OUTPUT Path=/tmp/SAS_work456900006D8D Sysrc=0 Sysmsg=
DateTime=2020-03-18T11:49:43,172 Userid=sasdemo Action=OPEN Status=SUCCESS Libref=SASHELP Engine=V9 Member=CARS NewMember= MemberType=DATA Openmode=INPUT Path=/sas94/software/compute/SASFoundation/9.4/sashelp Sysrc=0 Sysmsg=
From your description, it sounds like your SAS session is accessing other datasets in SASHELP and the logger is writing this access out accordingly. What client are you using? If you do not access SASHELP at all, do you see any lines generated?
Thanks Puru,
Given it doesn't occur when running WorkspaceServer.sh -nodms it sounds like the issue lies in Enterprise Guide submitting additional code to the SAS session to access the datasets of SASHELP. What version of Enterprise Guide are you using? Do you have any startup code configured in Enterprise Guide to do this? If you only connect to the Workspace Server but do not submit any code accessing SASHELP, do you still see these lines (for example if you just ran proc setinit)? What if you use a different client, like SAS Studio? You may wish to call logconfig.trace.xml to generate a full Workspace Server log and determine everything happening in the SAS session. This process is described here:
The SAS Users Group for Administrators (SUGA) is open to all SAS administrators and architects who install, update, manage or maintain a SAS deployment.
SAS technical trainer Erin Winters shows you how to explore assets, create new data discovery agents, schedule data discovery agents, and much more.
Find more tutorials on the SAS Users YouTube channel.