For auditing purposes use audit tools. The complete one is on the OS level. A start cab be made wit sas using the apm tools. Look at SIEM concepts for generic background.
Sas is an application for the os level it is a mistake trying to overrule that although I see Carry persons thinking that way.
Please specify your logical question more detailed.
I am assuming operational or regulations as original trigger.
---->-- ja karman --<-----