You need to configure SAS Server Logging for the server type(s) you wish to capture this information from.
<!-- START ESM Agent custom events Logger -->
<logger name="Audit.Data.Dataset" additivity="false">
<appender-ref ref="TimeBasedRollingFile"/>
<level value="Trace"/>
</logger>
<!-- END ESM Agent custom events Logger -->
Make sure the appender ref in the snippet above matches the configuration in your server log XML configuration file.
Keep in mind that each added logger will increase the number of events captured and stored, and that will increase the ESM database size. Because of this, make sure you only add the custom loggers you really need in your environment. For instance:
Once you have decided what you need, follow the steps below:
# | Marker | Log line filter | Tag Text | Tooltip Text | Marker Color |
1 | DATA Step |
.*NOTE:\sDATA\sstatement\sused.*
|
D | DATA |
#23B87C
|
2 | PROC Step |
.*NOTE:\sPROCEDURE\s(?<proc>[^\s]+).*
|
P |
PROC ${proc}
|
#23B87C
|
3 | Step Timing |
.*(?<type>real|cpu)\stime[\s]+(?<duration>.*)
|
T |
${type} ${duration}
|
#C7B660
|
4 | Dataset Read | .*Libref=(?<library>[^\s]+)\sEngine=(?<engine>[^\s]+)\sMember=(?<table>[^\s]+)\sMemberType=(?<type>[^\s]+)\sOpenmode=INPUT\sPath=(?<path>[^\s]+).* | DR |
DR ${library}.${table} [${engine}|${path}]
|
#1F6EB8
|
5 | Dataset Write | .*Libref=(?<library>[^\s]+)\sEngine=(?<engine>[^\s]+)\sMember=(?<table>[^\s]+)\sMemberType=(?<type>[^\s]+)\sOpenmode=OUTPUT\sPath=(?<path>[^\s]+).* | DW |
DW ${library}.${table} [${engine}|${path}]
|
#1F6EB8
|
6 | Dataset Update | .*Libref=(?<library>[^\s]+)\sEngine=(?<engine>[^\s]+)\sMember=(?<table>[^\s]+)\sMemberType=(?<type>[^\s]+)\sOpenmode=UPDATE\sPath=(?<path>[^\s]+).* | DU |
DU ${library}.${table} [${engine}|${path}]
|
#1F6EB8
|
Start a new SAS session and run some code. For instance:
data cars; set sashelp.cars; run;
proc means data=cars; var msrp; run;
proc freq data=cars; run;
The configuration above will scan all the log files ESM is aware of for the configured regular expressions and generate events from them. This means if the Agent is properly configured, it will detect the log file for Batch sessions and generate events for them as well. The only thing to keep in mind with the default configuration is that since by default Batch Server writes the standard SAS log output to the logfiles, Dataset Access logger is not enabled, so there will be no Data Access events for the Agent to capture. In other words, if you stop here you will only get DATA/PROC steps information for Batch sessions.
Great! Here is what you will need to do:
<!-- START ESM Agent custom events Logger -->
<logger name="Audit.Data.Dataset" additivity="false">
<appender-ref ref="BatchFileAppender"/>
<level value="Trace"/>
</logger>
<!-- END ESM Agent custom events Logger -->
Sure thing. They will be in the esm_events_logevents.csv file. See examples from the code snippet used below:
session_id,time_stamp,pod_id,container_id,hostname,esm_user,event_type,event_level,message,line,log_file_name
1124733630023348001,2023-07-25 18:36:09.159,,,gtp-sas9-vm,hedanc,logEvent,other,DATA,837,
1124733630023348001,2023-07-25 18:36:09.159,,,gtp-sas9-vm,hedanc,logEvent,other,DR WORK.CARS,857,
1124733630023348001,2023-07-25 18:36:09.159,,,gtp-sas9-vm,hedanc,logEvent,other,DW WORK.CARS,834,
1124733630023348001,2023-07-25 18:36:09.158,,,gtp-sas9-vm,hedanc,logEvent,other,DR SASHELP.CARS,831,
session_id,time_stamp,pod_id,container_id,hostname,esm_user,event_type,event_level,message,line,log_file_name
1124733630023348001,2023-07-25 18:37:40.543,,,gtp-sas9-vm,hedanc,logEvent,other,PROC MEANS,895,
1124733630023348001,2023-07-25 18:37:40.542,,,gtp-sas9-vm,hedanc,logEvent,other,DR WORK.CARS,891,
session_id,time_stamp,pod_id,container_id,hostname,esm_user,event_type,event_level,message,line,log_file_name
1124733630023348001,2023-07-25 18:38:22.513,,,gtp-sas9-vm,hedanc,logEvent,other,DR WORK.CARS,948,
1124733630023348001,2023-07-25 18:38:22.513,,,gtp-sas9-vm,hedanc,logEvent,other,PROC FREQ,952,
Useful
This worked fine. But when I try to extract the data using esm-maintenance utility, I can't find the csv file 'esm-events-logevents'. Do I need to configure a file to get this output? Thanks.
Hi @RGarrido. You must use the latest version of the esm-maintenance utility to get the esm-events-logevents.csv file.
If you are using it to extract data from an older ESM Server version, make sure you modify line 3 of the vars.yml file removing the #
at the start of the line before you run the utility. More details can be found here: https://us.docs.boemskats.com/2022.x/administration/common-tasks/#extract-data
Thanks,
Henrique.
Thanks for the info. I got it working. Totally informative added info for monitoring usage.
Are you ready for the spotlight? We're accepting content ideas for SAS Innovate 2025 to be held May 6-9 in Orlando, FL. The call is open until September 25. Read more here about why you should contribute and what is in it for you!
Data Literacy is for all, even absolute beginners. Jump on board with this free e-learning and boost your career prospects.