Hi Jan,   Which versions of SAS & LSF are you using and on which platform? When you look through the logs can you see where most of the delay occurs?   Have you seen the following note?: SAS Problem Note 57577: You encounter delays when you start grid-launched workspace servers or when you sign on to the grid on the Windows platform Does it apply to your situation?   Cheers Paul ... View more

Hi Kal,   Step by step instructions for something of this scale (installing/configuring and using SAS Environment Manager with APM, or writing and scheduling robust/secure cross-platform multi-log parsing/reporting) would make for a very long SAS communities thread! 🙂   If you need more than general suggestions and pointers to relevant online docs, I'd recommend contacting SAS Professional Services or one of the SAS Partners in your region to see if they can help.   Regards Paul     ... View more

You may find the following SAS note helpful: SAS Problem Note 54366: The SAS® Web Application Server stops responding or errors occur when you restart the server ... View more

If you can't get SAS Environment Manager installed and APM enabled, another option would be to parse and report from the SAS Metadata Server log files yourself. You can report on both failed and successful logins. Here is an example of an EG connection where you can see the date/time, user id, client IP address and client app name:   2016-03-24T18:43:47,689 INFO [03754817] :sasdemo - New client connection (395863) accepted from server port 8561 for user sasdemo. Encryption level is Credentials using encryption algorithm SASPROPRIETARY. Peer IP address and port are [::ffff:192.168.0.123]:55883 for APPNAME=SAS Enterprise Guide.   ... and here's an example of a failed login:   2016-03-24T18:48:10,686 WARN [03755267] :sas - New client connection (399601) rejected from server port 8561 for user sasdemo. Peer IP address and port are [::ffff:192.168.0.123]:55886 for APPNAME=SAS Enterprise Guide.   If you want to go further and track their usage of SAS Workspace Servers (and SAS Stored Process Servers) you could also look at the SAS Object Spawners log files too. ... View more

What do you mean by "But if i assign SAS Adminstrator, then it works fine"? Do you mean when you log in as the "SAS Administrator" user (sasadm@saspw), an unrestricted administrator, or when you add the new user administrator as a member of the "SAS Adminstrators" group (which itself is usually a member of the "Metadata Server: User Administration" role, and gets granted additional permissions in key places via ACTs and ACEs).   Additionally, which user are you trying to get the new user administrator to modify? Restricted user administrators (members of the "Metadata Server: User Administration" role) do have limitations. For example they are limited in their ability to manage membership for the "Metadata Server: Unrestricted" role, and to manage individual unrestricted users - otherwise they could be in a position to promote themselves to unrestricted. Restricted user administrators can also be blocked from modifying an identity through an explicit denial of WriteMetadata on that identity. Are there by any chance any explicit/ACE denials (white background checked boxes) on the user that cannot be modified?   As LinusH mentioned it is difficult to help with permissions issues from a forum without all the necessary information. Posting screenshots of the tabs for the user administrator and the user they are trying to modify would be a good start (masking individuals names/logins if necessary). Even then it might be necessary to delve deeper and look at how the various admin users, groups and roles and ACTs may have been customized at your site. ... View more

The Subject Alternative Name (SAN) is meant to be different. It allows a single certificate to be used with multiple DNS names. A common example is a certificate for example.com that has a SAN for www.example.com so the server can be accessed using either name without triggering certificate validation errors. Another example is a server that might be accessed internally as server.example.net and externally as server.example.com (SAN). You can also have multiple SANs on a certificate. ... View more

You can but the question is do you really want to, and will your IT security team allow/support it? Providing shared credentials to a team of people means that you will have to change the password and re-notify everyone as soon as anyone in that team leaves the organization or moves out of the team into a different team. It also reduces your ability to audit access. You probably wont be able to determine who in the team did something on a particular date and time: you may know it was someone in the team, but might not be able to determine which person (without other hints such as client IP address cross-referenced with other systems audit logs).   Ideally each team member should have their own login. What is stopping you from doing this? Is it the overhead of managing the users in SAS, managing them in AD/LDAP, or something else? If you provide some more background on the problem and your constraints it would help people to offer alternative suggestions. ... View more

Which database is it? Which version of SAS are you running and on which platform? If the combination supports Integrated Windows Authentication (IWA) you may be able to abandon the use of a password in favour of IWA.  ... View more

Since I wrote those 2 blog posts there is now a third method too (for SAS 9.4 users): sas-make-folder as described in the SAS 9.4 Intelligence Platform: System Administration Guide section on Batch Tools for Metadata Management.   Apart from my (outdated) macro which would be used inside a SAS process (such as a SAS Workspace Server) that already has an authenticated connection to the SAS metadata server, the other batch options require the provision of credentials/tokens to the SAS metadata server so they can authenticate that the originator as a valid user and then verify they have permissions to perform the action.  The credentials can be provided using the -user and -password options (the password can be pwencoded) or a -profile option where the credentials are provided in a connection profile (such as one created with SAS Management Console). If you don't want to use a (pwencoded) password either on the command line or in a profile, and your environment is configured to support Integrated Windows Authentication (IWA), then you might attempt that as an alternative (I haven't tried it myself yet so cannot confirm whether works for the batch tools). ... View more