How to store library access by user

[dpmf]

Hi all,

Is there any way to save the library access by user?

I want to be able to gather info by day and user for any given library.

I use SAS 9.4 and we don't have SAS Log active / installed.

Best Regards,

Daniel

[Kurt_Bremser]

How is your SAS set up? Do you have a central BI Server, or distributed desktop installations?

[dpmf]

I'm a (new) sas Admin in a Telecom Company. I have access to the SAS server but every user has its SAS EG installed in the desktop.

I would want to have that config on the server side. We have one physical server with 7 App servers inside (sasapp, sasapp01, .... , sasapp06).

As per the help page https://blogs.sas.com/content/sgf/2015/09/30/part-1-auditing-data-access-who-did-what-and-when/ 

I do have a logconfig.apm.xml on each app server, folder /opt/sas/sasconfig/SASAPP/Lev1/SASAPP/WorkspaceServer/ but no 'Audit.Data.Dataset' logger specified.

Best Regards and thanks in advance,

Daniel

[Kurt_Bremser]

Basically, you can do what the blog post does with the Stored Process Server.

BUT:

the Stored Process Server runs with a generic userid (typically sassrv), so all STP instances can write/append to the same log file. Workspace servers run with individual users, so you need to take care of that.

My solution would be to create separate rolling logs for each user in a directory that has "other" write permission.

[dpmf]

Hi again,

So, i've tried to add this to the file logconfig.xml (it's this one that is eing called on sasv9)

<appender class="RollingFileAppender" name="TimeBasedRollingFile">
<param name="Append" value="false"/>
<param name="Unique" value="true"/>
<param name="ImmediateFlush" value="true"/>
<rollingPolicy class="TimeBasedRollingPolicy">
<param name="FileNamePattern" value="/opt/sas/sasconfig/sasappdv/Lev1/SASAppDV/WorkspaceServer/slogs/sasappdv_%u_%S{hostname}_%S{pid}.log"/>
</rollingPolicy>
<layout>
<param name="ConversionPattern" value="%d %-5p [%t] %X{Client.ID}:%u - %m"/>
</layout>
</appender>

<logger name="Audit.Data.Dataset.Open" additivity="false">
<appender-ref ref="TimeBasedRollingFile"/>
<level value="Trace"/>
</logger>

And i keep getting the error on ObjectSpawner_console.log:

ERROR: Invalid option value "/opt/sas/sasconfig/sasappdv/Lev1/SASAppDV/WorkspaceServer/logconfig.xml" for SAS option LOGCONFIGLOC.
ERROR: (SASXKRIN): KERNEL RESOURCE INITIALIZATION FAILED.
ERROR: Unable to initialize the SAS kernel.

and this one on the daily server log:

The launch of the server (SASAppDV - Workspace Server) process failed due to a problem with the processing of the SAS Logging Facility configuration file (LOGCONFIGLOC).

I gave chmod 777 to the 'slogs' folder and 'setfacl rwx' to all parties.

any tip about this??

Best Regards,

Daniel

[Kurt_Bremser]

What about the ownership and permissions of the logconfig.xml file itself?

[dpmf]

ownership is sas:sas_adm 

and permissions where -rw-r--r-- 1

changed it to 777 and didn't work 😞

[Kurt_Bremser]

I can only suggest to revert back to the original configuration. Restore the original config files, verify that the server starts, and then implement one small change after the other.

[dpmf]

Hi Kurt,

I had to undo that because i simply couldn't make it work. And i don't know XML or sintaxes to being able to insert only N lines each time...

I've opened a ticket to SAS support.

Thanks for your help!

Best regards

[dpmf]

Hi all,

I've changed the logconfig.xml to this, as per other thread similar to this on this site:

<appender name="AuditLibraryFile" class="FileAppender">
<param name="Append" value="true"/>
<param name="ImmediateFlush" value="true"/>
<param name="FilePermissions" value="A::u::rw-,A::g::rw-,A::o::rw-"/>
<param name="fileNamePattern" value="somepath/slogs/audit.dataset_%d_%S{hostname}_%S{pid}.log"/>
<layout>
<param name="ConversionPattern"
value="%d!%c!%u!jobid=%S{jobid} Action=%E{Audit.Dataset.Action} Status=%E{Audit.Dataset.Status} Libref=%E{Audit.Dataset.Libref} Engine=%E{Audit.Dataset.Engine} Member=%E{Audit.Dataset.Member} MemberType=%E{Audit.Dataset.Memtype} Openmode=%E{Audit.Dataset.Openmode} Path=%E{Audit.Dataset.Path} Sysrc=%E{Audit.Dataset.Sysrc} Sysmsg=%E{Audit.Dataset.Sysmsg} username=%S{user_name} " />
</layout>

</appender>

<!-- Audit.Data.Dataset.Open logger definition -->
<logger name="Audit.Data.Dataset.Open" additivity="false">
<appender-ref ref="AuditLibraryFile"/>
<level value="Trace"/>
</logger>

<!-- Audit.Data.Dataset.Delete logger definition -->
<logger name="Audit.Data.Dataset.Delete" additivity="false">
<appender-ref ref="AuditLibraryFile"/>
<level value="Trace"/>
</logger>

<!-- Audit.Data.Dataset.Rename logger definition -->
<logger name="Audit.Data.Dataset.Rename" additivity="false">
<appender-ref ref="AuditLibraryFile"/>
<level value="Trace"/>
</logger>

One good news is that the logs are being generated and with the message translated from the string above.

But it is recording ONLY when i expand the SASAPP server and not when I expand the library (that is the objective here).

It prints like this:

2019-07-24T11:46:17,472!Audit.Data.Dataset.Open!xaccc44!jobid=20230 Action=OPEN Status=SUCCESS Libref=WORK Engine=V9 Member=_PRODSAVAIL MemberType=DATA Openmode=OUTPUT Path=/saswork/sas02/SAS_work7A3400004F06.xxxx.xxxx.xx/SAS_work083C00004F06_xxxxx.xxxxx.xx Sysrc=0 Sysmsg= username=xaccc44

I guess that this ouput would be enough if instead of libref=WORK it printed the libref=library_libref.

It's probably just a "technicality" that i'm missing, but it's the first time with this kind of configurations and your help would be hugely appreciated.

Best Regards,

Daniel