A question that comes up regularly when demonstrating the Metacoda Activity Reviewer plug-in is “Can it be used to view/audit users access to SAS tables in a SAS 9 platform?”. I have recently shown that it can by making use of a standard SAS 9 logging feature.
The SAS platform provides the ability to log access to SAS tables/datasets as documented in the SAS® 9.4 Logging: Configuration and Programming Reference section About Audit Messages for SAS Library Access at https://go.documentation.sas.com/doc/en/bicdc/9.4/logug/n0t22zxpm45zpyn16235oxno43u2.htm
Here are some example log lines collected when the sasdemo user accessed and manipulated the hr.salaries SAS dataset:
2026-06-27T13:21:04,166 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES Memtype=DATA Engine=V9 NewMember= Openmode=OUTPUT Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:23:04,618 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES Memtype=DATA Engine=V9 NewMember= Openmode=INPUT Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:28:03,276 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES Memtype=DATA Engine=V9 NewMember= Openmode=INPUT Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:28:03,276 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES2 Memtype=DATA Engine=V9 NewMember= Openmode=OUTPUT Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:30:09,816 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES Memtype=DATA Engine=V9 NewMember= Openmode=INPUT Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:30:09,817 TRACE [00000005] (Audit.Data.Dataset.Open) :sasdemo - Audit Dataset Action=OPEN Status=SUCCESS Libref=HR Member=SALARIES Memtype=DATA Engine=V9 NewMember= Openmode=UPDATE Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:31:47,552 TRACE [00000005] (Audit.Data.Dataset.Rename) :sasdemo - Audit Dataset Action=RENAME Status=SUCCESS Libref=HR Member=SALARIES2 Memtype=DATA Engine=V9 NewMember=SALARIES3 Openmode= Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=
2026-06-27T13:33:21,319 TRACE [00000005] (Audit.Data.Dataset.Delete) :sasdemo - Audit Dataset Action=DELETE Status=SUCCESS Libref=HR Member=SALARIES3 Memtype=DATA Engine=V9 NewMember= Openmode= Path=/opt/sas94m9/config/Lev1/SASApp/Data/hr Sysrc=0 Sysmsg=The SAS 9 Workspace Server logging configuration can be updated to capture these log messages in workspace server log files which can be ingested via Fluent Bit and sent to OpenSearch for storage and querying. That makes them available for viewing in the Metacoda Activity Reviewer plug-in inside SAS Management Console.
If you already have access to the Metacoda Activity Reviewer plug-in, we have written up a support note that Metacoda customers can use to see what is required to configure SAS Workspace Server logging and Fluent Bit to make these data audit log records visible in the Metacoda Activity Reviewer plug-in. If you have a Metacoda Customer Portal login you can view the note at SN-00038: Activity Reviewer Plug-in – Dataset Auditing
If you would like to find out more about the Metacoda Activity Reviewer plug-in, and how to configure things to make SAS table access audit log records available, contact us at Metacoda.