I run a SHARE server with this program:
options comamid=tcp;
%let TCPSEC=_secure_;
proc server
id=XXXXXX
noalloc
clientid=security
acctlvl=(data user)
log=(bytecount query)
msgnumber
oapw="XXXXXXX"
;
run;
from this script:
/sas/SASFoundation/9.4/sas -sysin $HOME/sas/share_server.sas -config /location/sas/sasv9.cfg -noterminal -unbuflog -log "/location/sas/log/share_server_%Y%m%d.log" -logparm "rollover=auto open=append write=immediate" -memsize 1G -sortsize 512M
and I read this daily log into SAS with
%let day_session=999999;
proc format library=work;
value $ eventart
'043007' = "Unable to perform Request"
'043021' = "User Logon"
'043022' = "Disconnect"
'043069' = "Library Access"
'04306A' = "Library Release"
'0430A9' = "Proc Operate/Stop"
'043113' = "User is executing ..."
'043131' = "Server Startup"
'043132' = "Server Termination"
'04314C' = "Work Task Creation"
'04314D' = "Work Task Termination"
'043150' = "Usage Statistics Server"
'043151' = "Usage Statistics"
'043169' = "Connect to SQLVIEW"
'04316D' = "User issued SELECT"
'04316E' = "Request Error"
'04316F' = "User executed RESET"
'043171' = "Disconnect from SQLVIEW"
'03F051' = "Unable to clear library"
other = "Undefined"
;
run;
/* Einlesen des Logs aus dem SAS SHARE Server
Der erste Teil des Logs der SAS-Session bis zum Auftreten der Zeilen
aus PROC SERVER wird überlesen.
Einzelne Events beginnen immer mit einem Timestamp und einem 6stellig
hexadezimalen Eventcode. Im Event-Text findet sich die UserID und die
fortlaufende Sitzungsnummer.
Server Start und Shutdown wird als Sondersession mit 999999 gekennzeichnet;
das ermöglicht den Aufbau einer Tagessummenzeile (der Server wird täglich
neu gestartet) */
data sharelog (
keep=
zeitpunkt eventart eventart_text
zeile userid session bytes
tagesdatum
compress=yes
);
infile in truncover;
retain
ab_hier 0
zeitpunkt
eventart
zeile
oldzeit
;
length
zeile1 $ 254
zeile2 $ 30
zeile $ 1024
eventart $ 6
eventart_text $ 25
;
format
zeitpunkt datetime22.3
userid $8.
session 8.
bytes commax12.
;
input zeile1 $254.;
i = index(zeile1,"SAS server XXXXXX started");
if
i > 0
or (
ab_hier = 0 and substr(zeile1,10,1) = ':' and substr(zeile1,13,1) = ':' and
substr(zeile1,16,1) = ':'
)
then do;
ab_hier = 1;
if not (
substr(zeile1,10,1) = ':' and substr(zeile1,13,1) = ':' and
substr(zeile1,16,1) = ':'
)
then zeile = zeile1;
/* Bedingung wg. Wiederaufsetzen bei Neustart des Servers am Tag */
end;
if
ab_hier = 1 /* Einleitung ist vorüber */
and index(zeile1,"The SAS System") = 0 /* Seitenüberschrift ausfiltern */
then do;
if
(substr(zeile1,10,1) = ':' and substr(zeile1,13,1) = ':' and substr(zeile1,16,1) = ':') or
index(zeile1,'PROCEDURE SERVER used') > 0
then do; /* neuer Event */
if zeitpunkt ne . /* ersten Leerdurchlauf ausfiltern */
then do; /* Event abschliessen und ausgeben */
eventart_text = put(eventart,$eventart.);
select (eventart);
when ('006002') do; /* Crash eines Tasks */
end;
when ('043007') do; /* Unable to perform Request */
i = index(zeile,"of user");
if i = 0 then i = index(zeile," User:");
zeile2 = substr(zeile,i+8);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043021') do; /* User Logon */
zeile2 = substr(zeile,6);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043022') do; /* Disconnect */
zeile2 = substr(zeile,6);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043069') do; /* Library Access */
i = index(zeile,"of user");
zeile2 = substr(zeile,i+8);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('04306A') do; /* Library Release */
i = index(zeile,"of user");
zeile2 = substr(zeile,i+8);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('0430A9') do; /* Proc Operate/Stop */
i = index(zeile,"from user");
zeile2 = substr(zeile,i+10);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043113') do; /* User is executing ... */
zeile2 = substr(zeile,6);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043131') do; /* Server Startup */
session = &day_session;
end;
when ('043132') do; /* Server Termination */
session = &day_session;
end;
when ('04314C') do; /* Work Task Creation */
end;
when ('04314D') do; /* Work Task Termination */
end;
when ('00B325') do; /* Error */
end;
when ('043150') do; /* Shutdown Statistics */
session = &day_session;
i = index(zeile,"ferred:");
zeile2 = left(substr(zeile,i+7));
faktor = 1;
i = indexc(zeile2,'K');
if i > 0
then do;
faktor = 1024;
zeile2 = substr(zeile2,1,i-1);
end;
i = indexc(zeile2,'M');
if i > 0
then do;
faktor = 1024*1024;
zeile2 = substr(zeile2,1,i-1);
end;
i = indexc(zeile2,' ');
zeile2 = substr(zeile2,1,i-1);
bytes = input(zeile2,comma30.) * faktor;
end;
when ('043151') do; /* Usage Statistics */
i = index(zeile,"for user");
zeile2 = substr(zeile,i+9);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
i = index(zeile,"ferred:");
zeile2 = left(substr(zeile,i+7));
faktor = 1;
i = indexc(zeile2,'K');
if i > 0
then do;
faktor = 1024;
zeile2 = substr(zeile2,1,i-1);
end;
i = indexc(zeile2,'M');
if i > 0
then do;
faktor = 1024*1024;
zeile2 = substr(zeile2,1,i-1);
end;
i = indexc(zeile2,' ');
zeile2 = substr(zeile2,1,i-1);
bytes = input(zeile2,comma30.) * faktor;
end;
when ('043169') do; /* Connect to SQLVIEW */
i = indexc(zeile,'(');
userid = substr(zeile,1,i-1);
zeile2 = substr(zeile,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('04316D') do; /* User issued SELECT */
i = indexc(zeile,'(');
userid = substr(zeile,1,i-1);
zeile2 = substr(zeile,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('04316E') do; /* Request Error */
zeile2 = substr(zeile,6);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('04316F') do; /* User executed RESET */
i = indexc(zeile,'(');
userid = substr(zeile,1,i-1);
zeile2 = substr(zeile,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('043171') do; /* Disconnect from SQLVIEW */
i = indexc(zeile,'(');
userid = substr(zeile,1,i-1);
zeile2 = substr(zeile,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('03F051') do; /* Unable to clear library */
zeile2 = substr(zeile,6);
i = indexc(zeile2,'(');
userid = substr(zeile2,1,i-1);
zeile2 = substr(zeile2,i+1);
i = indexc(zeile2,')');
session = input(substr(zeile2,1,i-1),5.);
end;
when ('04300E') do; /* SERVER TERMINATION */
session = &day_session;
end;
when ('0430DC') do; /* Invalid type */
end;
otherwise do;
put 'Bomb';
put eventart=;
end;
end;
tagesdatum = "20&ja&mo&ta";
oldzeit = zeitpunkt;
output;
end;
if index(zeile1,'PROCEDURE SERVER used') > 0
then ab_hier = 0;
else do;
zeile = substr(zeile1,31);
zzeitpunkt = substr(zeile1,1,22);
zeitpunkt = input(zzeitpunkt,datetime22.3);
if timepart(zeitpunkt) = '00:00:00.000't
/* Fehlerkorrektur bei falschem SHARE-Log */
/* Wir "borgen" uns den Zeitpunkt vom letzten Event */
then zeitpunkt = oldzeit + .001;
eventart = substr(zeile1,24,6);
end;
end;
else do; /* Folgezeile */
zeile = trim(zeile) !! ' ' !! zeile1;
end;
end;
run;
You will have to translate German comments to understand what's going on.
&ja, &mo and &ta define the day of the run, with a 2-digit year (owed to how we get the date from the mainframe control-M)
You can extract the used library from the variable zeile after the keyword "from" if the words "has issued" can be found.
