@huntdoug has given the correct answer. You can either install / configure the auditing and logging / EM service architecture - which records much more detailed information, or you can look at the metadata server log for basic connection info.
I had to do this for someone just a few days ago and they didn't have the the full auditing and logging installed, so I analysed the metadata server log. using this simple program - it may not be perfect, so check your results:
*reads in metadata server log and attempts to determine who connected.;
filename mdlog "/Path to the metadata server log/sasmeta......log" ;
data connections;
length userid $32;
format time time. date date.;
infile mdlog ;
input @1 date yymmdd10. @12 time time8.;
userid=scan(_infile_,4,':');
userid=strip(scan(userid,1,'-'));
/*
Sample data
2021-03-29T23:43:35,642 INFO [133178522] :sastrust@saspw - Request made to cluster SASMeta - Logical Metadata Server (A5L3816M.AX000001).
2021-03-29T23:43:35,642 INFO [133178522] :sastrust@saspw - Redirect client in cluster SASMeta - Logical Metadata Server (A5L3816M.AX000001) to server SASMeta - Metadata Server (A5L3816M.AZ000001) at sasmeta.xyz.co.nz:8561.
2021-03-29T23:43:35,652 INFO [133178526] :sasevs@saspw - New client connection (6181722) accepted from server port 8561 for SAS token user sasevs@saspw. Encryption level is Everything using encryption algorithm AES. Peer IP address and port are [10.123.456.789]:56444 for APPNAME=/SASAuthorizationServices - Web Infra Platform Identity Services 9.4.
*/
if userid not in('svc_sas_prod','sasevs@saspw','sasadm@saspw','sastrust@saspw','svc_lasradm_prod');
run;
*unique users;
proc sort data=connections out=uniqueusers nodupkey;
by userid;
run;
And I only had to report on connections for one week, so I just ran this 7 times to analyse the 7 daily metadata log files, so clearly this could be enhanced to automate processing of a range of logs.
Unfortunately, it only reports who connected to the SAS System, not what they did.
To implement more comprehensive auditing and logging can be a reasonable amount of work to set up. If you set up workspace server logging (for example, every EG session has the log saved to disk), this can consume lots of disk space, so you need to consider retention periods, automated archiving etc. Typically a dedicated log disk volume is set up of maybe 100 or 200GB in size just to store logs.
Auditing and logging seems to be a requirement more and more these days. I've had to set this up for a number of government sites to comply with increased security requirements.
