Who's accessing my SAS Visual Analytics reports?

[#1]

Auditing capabilities available in SAS Viya are essential for understanding user behavior and ensuring that resources are used appropriately. In this post, we'll demonstrate a method of tracking and viewing user access to SAS Visual Analytics reports using audit data in SAS Viya.

In SAS Viya, the Audit service is responsible for the capture and storage of records relating to user activity. By default, the Audit service does not capture successful 'read' events, so to capture information about who accessed a report, a simple change is first required to the sas.audit.record configuration instance in SAS Environment Manager's Configuration area.

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

The audit.recording.level property can be adjusted to specify which events to capture. To enable the capture of successful 'reads', change the audit.record.level to a setting of High.

Note, though, that this can significantly increase the volume of data that is captured and stored. Your mileage may vary, but it’s important to balance capturing detailed information with managing storage requirements. One option is to define the service.list property, where you can specify a comma-separated list of application/service names for which successful 'read' events will generate audit records. It might also be prudent to adjust the retention periods for audit records.

Once that's done, the next time a user accesses a report, an audit record is created. In fact, many audit records are created. Suppose a user has viewed the sample Warranty Analysis report. The sas-viya --output text audit list --details command will return something like:

ID                                     Time Stamp                 Type       Action   State     Description   User ID   Application   Remote Address   Administrative Action   URI
312c1b34-59b8-4fd9-97c8-016f9cb2ded2   2024-05-23T06:17:02.788Z   resource   read     success                 Ahmed     reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Retail Insights.report
31d36d6b-6867-4840-b044-80b09a76c043   2024-05-23T06:17:02.69Z    resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Warranty Analysis.report
ceb2fadb-0bf2-4720-8e41-1eebb69a42c1   2024-05-23T06:17:02.596Z   resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Water Consumption and Monitoring.report
4174fd1e-e0c9-498d-9394-a7ba955d58b1   2024-05-23T06:17:02.512Z   resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Warranty Analysis.report
2841747c-fcdc-42b3-97cb-38bbcacd2bbd   2024-05-23T06:17:02.415Z   resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Retail Insights.report
c8e2e71c-dc49-4acf-bef4-42f57f27d1d1   2024-05-23T06:17:02.33Z    resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Warranty Analysis.report
bd9a5747-3871-470c-8010-3cbfe4c87ef1   2024-05-23T06:17:02.22Z    resource   read     success                 geladm    reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Warranty Analysis.report
0540029e-08fe-4e59-9383-14cd2e7e40e7   2024-05-23T06:17:02.104Z   resource   read     success                 Ahmed     reports       127.0.0.1        true                    /Products/SAS Visual Analytics/Samples/Warranty Analysis.report
1417b61c-657a-4015-87d8-1b77a15bcb69   2024-05-23T06:16:42.226Z   resource   read     success                 Ahmed     reports       10.42.1.39       false                   /Products/SAS Visual Analytics/Samples/Warranty Analysis.report

Note that not only does Warranty Analysis appear multiple times as a successful read event, but other reports that we didn't open are also listed. This is because a "read" action is more than just the act of opening a report in SAS Visual Analytics. For example, when report thumbnails are rendered, these are also registered as "read" actions for the user, even if that user never actually opened the reports at that time.

How then do we differentiate between "reads" when a user physically opens a report and these other "reads"? To do so, we can use the RemoteAddress field (which is shown when the --details flag is added to the CLI command). The report that uniquely identifies the actual user action of opening the report contains the the podIP of the sas-folders pod as the value for the RemoteAddress field. We can get that with the command:

kubectl get pod -l app=sas-folders -o custom-columns=NAME:metadata.name,IP:status.podIP

In my lab environment, that matches the last record displayed in the output above. The CLI command used to query the audit data could be modified to include a filter such that RemoteAddress equals the IP address of your sas-folders pod. Note that this behaviour is slightly different to the behaviour in SAS Viya 3.x.

Auditing the usage and access of SAS Visual Analytics reports is a critical aspect of managing and securing your SAS Viya environment. By leveraging the detailed audit data available, you can effectively monitor report access and usage and swiftly address any issues that arise. Implementing robust auditing practices not only aids in compliance but also promotes accountability and transparency within your organization.

For more information on auditing in SAS Viya, refer to the official SAS documentation.

Find more articles from SAS Global Enablement and Learning here.