A New Lens on Platform Usage in SAS Viya
With the Stable 2025.06 version of SAS Viya, administrators now have access to a new asset for auditing platform usage: the User Activity Insights report. This report supersedes the existing User Activity Report and is part of a broader initiative to enhance the SAS Viya auditing framework. Let's take a closer look at this new report and see how it can help administrators more easily visualise user behaviour.
The User Activity Insights report is a new SAS Visual Analytics report designed to help administrators better understand how users are interacting with the SAS Viya platform. Unlike the existing User Activity Report, which is based on detailed audit records from the SystemData.AUDIT CAS table, this new report is built on activity records from the AUDIT_ACTIVITIES CAS table. Activity records are higher-level summaries of user behavior, offering an intuitive view of platform usage patterns.
The Audit service periodically copies selected audit and activity records from the audit database into CAS. The settings are configurable in SAS Environment Manager, where administrators can choose the types of records that are loaded, and the frequency at which they are loaded (and more!). These records are then used as the data source for the User Activity Insights report (and previously, the User Activity report).
The report is available to all members of the SAS Administrators group by default. It can also be copied and customised as required. It is located in SAS Content > Products > SAS Environment Manager > Dashboard Items, where its predecessor, the User Activity report, also currently lives until it is officially deprecated. The new report provides a more focused and useful view of user activity.
Let's take a look at some of the visualisations the new User Activity Insights report offers. It includes several tabs, each offering a different perspective on user behavior. Here are some examples:
User Activity Analysis
Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.
- Active User Bar Chart: Displays the most active users based on the number of actions performed.
- Count of User IDs: Shows the total number of unique users active during the selected time window.
- Actions Done by Users: A horizontal bar chart showing which users performed which types of actions (e.g. read, create, update, delete).
- Users and IP Address Bubble Chart: Maps user activity to IP addresses, with bubble size indicating volume of actions.
Application Analysis
- Application and Service Table: Lists services and their usage frequency.
- Top Actions per Application: A bar chart showing the most common actions across applications.
- Application Activity Line Chart: Tracks application activity over time to identify usage trends.
Service and Authorization Analysis
- Audit Actions Related to Audit Type: A stacked bar chart showing successful and failed actions by type.
- Total Count of Success and Failure: Summary metrics showing the number of successful and failed actions, as well as unauthorised access attempts.
- Service and Application Filters: Allows filtering by service, application, and user ID.
Success/Failure Rate
- Failure Over Time Area Chart: Shows the frequency of failed actions over time.
- Success Over Time Area Chart: Displays successful actions over the same time range.
- Interactive Filters: Filter by service name, application, or IP address.
Object Activity Analysis
- Most Accessed Object Types: A bar chart showing which object types (e.g. reports, folders) are accessed most frequently.
- Top Accessed Objects by Type: A treemap showing the most frequently accessed individual objects.
- Top Actions on Objects: A bar chart showing the most common actions performed on objects.
- Success and Failure Donut Charts: Circular charts showing the frequency of successful and failed actions by object type and action.
Session Analysis Description
- Session ID and Correlator Table: Displays a list of session IDs and correlators, helping administrators "trace" user sessions and match actions across services.
- Frequency of Application Bar Chart: Shows how often different applications were used during the selected time window, highlighting which tools are most actively used. In some cases, "missing" may appear when application metadata is unavailable.
- User ID Word Cloud: A visual representation of user activity, where the size of each user ID reflects the frequency of their actions. This provides a quick, intuitive view of the most active users.
- Frequency of Object Type Bar Chart: Highlights which object types (e.g. AuthorizationRules) are most frequently involved in user actions.
- Actions in Sequence Table: A chronological table showing the sequence of actions performed, including timestamps, action types, associated applications, and object types.
There are lots of options for drilling and filtering the displayed visuals and viewing the detailed data in the report.
If you're new to auditing in SAS Viya, check out my earlier post, which provides an overview of the original User Activity Report and the foundational concepts behind the Audit service.
With the addition of the User Activity Insights report, SAS Viya empowers administrators with deeper visibility into user behaviour and system usage. Watch this space for more features coming soon.
Find more articles from SAS Global Enablement and Learning here.
