Watch this Ask the Expert session to learn about Metacoda’s latest release – Metacoda Plug-ins 6.2.
Watch the Webinar
You will learn:
- How to perform log data queries quickly without leaving SAS Management Console.
- How to see very recent log entries.
- How it integrates with other Metacoda Plug-ins to examine and view:
- User activity for a selected user.
- Activity for a selected object.
- The underlying technology, architecture and prerequisites.
The questions from the Q&A segment held at the end of the webinar are listed below and the slides from the webinar are attached.
Q&A
Which versions of SAS 9.4 are your/these plugins available and supported?
The plug-ins work with all SAS 9.4 maintenance releases. Including M8. The demonstration was being done with SAS 9.4M8.
Does this require a separate license? If so, what is the cost?
Metacoda Activity Reviewer Plug-in is part of the Metacoda Security Plug-ins add-ons to SAS Management Console provided by Metacoda, a SAS partner. If you are interested in licensing, please contact Metacoda so we can provide a quotation for your environment. Licensing information can be found at https://www.metacoda.com/en/licensing/
What SAS software versions can you use the Metacoda Activity Reviewer Plug-in with?
This plug-in is in Metacoda Security Plugin 6.2 which supports SAS 9.3 and all maintenance versions of SAS 9.4. We used to support SAS 9.2 but dropped support for it with Metacoda Plug-ins 6.2 because we no longer have any customers running this old version of SAS.
Is there a daily batch process to make the log information available in the plug-in? How do I see something that happened just a few hours ago?
No, there is no daily batch process. The Fluent Bit software that runs on the SAS nodes is scanning those log files continuously. Once you have that software installed and running on those SAS nodes, it will be sending SAS log records to OpenSearch on a continuous basis, as log records are added to the SAS logs. The second part of the question was how do I see something that happened just a few hours ago; that will happen automatically. Fluent Bit software is sending the log records as they appear. So, you just go into the Activity Reviewer Plug-in, do your search, and you should see the log information within a matter of seconds, as you saw in the demo.
How does the Activity Reviewer Plug-in handle logs for a SAS Metadata Server cluster?
The Fluent Bit software is installed on each of the nodes in the metadata server cluster. Each of the logs are being tailed and those log records are being sent to OpenSearch and then intermingled. If you have a look in the Activity Reviewer Plug-in, you'll see the records for each of the cluster nodes are all interspersed. If you want to identify which log record comes from a particular node, there are some columns that you can select to easily show this. Additional columns include the host name of the metadata server that the log record came from, as well as the name of the log file in which you'd find that log record.
Can we do reporting, i.e., users who haven't logged in for the last 6 months?
There isn't summary reporting now. The reporting at the moment is purely on detailed log records. So, you could answer that question by looking for a particular user and searching for their connection log entries. If you see none, then you know that that user hasn't logged in. They're sorted in reverse chronological order, so the first one you see will be the most recent time they've logged in. In terms of generating a list of those users that haven't logged in in a certain period, we don't provide that functionality in the plug-in yet. It's certainly something you could do by querying the OpenSearch REST API using SAS code. But if it's a request that we get on a regular basis, then we'll certainly look at adding some reports to the plug-in.
Does it work in RHEL7?
Red Hat Enterprise Linux 7. Yes, it should work in Red Hat 7. This demo is being done with SAS running on CentOS 7. Metacoda Plug-ins should run in any environment where you can run SAS Management Console.
How secure is the Metacoda Plug-in? What is being done to address vulnerabilities?
That's an interesting question. Metacoda Plug-ins are hosted within the SAS Management Console. To address the security of the hosting environment, if you're running the latest version of SAS 9.4 Management Console, SAS 9.4 M8, it includes various updates to Java libraries to address recent security concerns. We don't ship any of those libraries as part of Metacoda Plug-ins because we rely on them being present in the SAS environment. Metacoda Plug-ins run in the SAS Management Console environment that is provided and accepts no incoming network connections. They only make outgoing network connections to the SAS Metadata Server and SAS Object Spawner. The plug-ins themselves should not be exploitable through any incoming network connectivity. You can be sure the Metacoda Plug-ins software you receive comes from us, and has not been tampered with, as we sign executable installers and JAR files using an Extended Validation (EV) code signing certificate in a hardware security token provided by a well-known Certificate Authority (CA). We also provide PGP/GPG signatures for our downloads signed using hardware security token hosted keys. We provide instructions on how to verify these in our documentation.
Recommended Resources
Metacoda website
SAS Environment Manager Service Architecture Framework
OpenSearch
fluentd
Moving from SAS®9 to SAS® Viya®
Move to Viya Board
Please see additional resources in the attached slide deck.
Want more tips? Be sure to subscribe to the Ask the Expert board to receive follow up Q&A, slides and recordings from other SAS Ask the Expert webinars.
Click image to register for webinar