Author: Paul Homes

SAS Platform Audit History: Options and Versions

Lately I have been looking at audit histories with the SAS® platform. This is to answer the “Who viewed/changed what and when?” type of question. The core support for this is provided by the SAS Logging Facility. Customizing logging for the many and varied SAS platform components across a distributed environment, collecting logs, processing them, and reporting from them is no simple task. So it was great when, with SAS 9.2, SAS Institute made available APM (SAS Audit, Performance and Measurement) that provided a customizable solution for this. Fast-forward to today, with SAS 9.4 M4, APM is now an integral part of SAS Environment Manager and it’s Service Architecture framework. Starting with SAS 9.4 M2, APM is now shipped and installed with SAS software so you no longer need to find it, download it, and install it. It just needs to be enabled if and when you want to use it. The old downloadable APM has since been deprecated and is no longer available as a separate download for SAS 9.2, 9.3 and early 9.4 maintenance releases (see SAS Usage Note 55248).

With all of that history, when dealing with different versions of the SAS platform, I often find myself wondering what are the APM options for this particular SAS version/maintenance combination. I’m writing this blog post to summarise what those options are for each of the common SAS versions I see. That way I don’t have to go and look it up each time :)

SAS Environment Manager Service Architecture: emi_init

Today, whilst trying to troubleshoot why a SAS Environment Manager Service Architecture configuration was no longer collecting and processing logs, I discovered a handy status option for the emi_init command. I’m posting the help output and status output here to remind me in future :)

Here’s the output from the emi_init help option showing all the other available options:

[sas@sas94m3lnx01 bin]$ ./emi_init.sh -h
usage: emi_init [options] [(--enable|--disable) ]
Initializes Service Architecture and/or enables components
Options:
 -d,--debug                     Enable debug output
    --disable <[APM,ACM,ALL]>   Components to disable (can't be used with
                                --enable)
    --enable <[APM,ACM,ALL]>    Components to enable (can't be used with
                                --disable)
 -f,--force                     Re-initialize and overwrite settings
 -h,--help                      Show usage information
 -i,--initialize                Initialize Service Architecture
 -k,--loadKits                  Load kits
    --resetDB                   Reset the Data Mart, purging all existing
                                ACM and APM data, non-recoverable
    --resetFlags                Resets all initialized and enabled flags
                                to false.
                                Note: This does not undo changes made
                                during initialization or component
                                enablement.
 -s,--status                    Show operational status
 -v,--verbose                   Enable verbose output
    --vafeed                Enable VA Feed
Exit status:
0  if OK
1  if minor issues are encountered
2  if an error is encountered
-1 for invalid usage

… and here’s some output from the emi_init status option:

[sas@sas94m3lnx01 bin]$ ./emi_init.sh -s
Service Architecture settings:
	Level Root Dir  : [/opt/sas94m3/config/Lev1]
	Base Dir        : [/opt/sas94m3/config/Lev1/Web/SASEnvironmentManager/emi-framework]
	Initialized     : [true]
	Enabled         : [true]
	APM Initialized : [true]
	ACM Initialized : [false]
	APM Enabled     : [true]
	ACM Enabled     : [false]
	VA Feed Enabled : [false]

You can find more information on emi_init and similar commands in the Performing Functions By Using a Command Line section of the SAS Environment Manager 2.5: User’s Guide

Suppressing SAS Workspace Server MVA_DSIO.OPEN_CLOSE and _DISARM Messages

This is just a very quick post to jot down the location of a SAS reference that I keep losing! I have the SAS Audit, Performance and Measurement (APM) package installed in my older SAS 9.4 M0 dev/test environment. The APM package is now deprecated as the functionality has moved into SAS Environment Manager (from 2.4). One of the effects of having APM installed is that my SAS Workspace Server logs have a huge number of lines that look like this: 

NOTE: MVA_DSIO.OPEN_CLOSE| _DISARM|         STOP| _DISARM| 2016-07-31T15:44:27,279+10:00| _DISARM| WorkspaceServer| _DISARM| | 
      _DISARM| | _DISARM| | _DISARM| 9854976| _DISARM| 12| _DISARM| 12| _DISARM| 320| _DISARM| 1840| _DISARM| | _DISARM| | _DISARM| 
      | _DISARM| | _DISARM| | _DISARM| | _ENDDISARM 
NOTE: PROCEDURE| _DISARM|         STOP| _DISARM| 2016-07-31T15:44:27,279+10:00| _DISARM| WorkspaceServer| _DISARM| | _DISARM| | 
      _DISARM| | _DISARM| 9854976| _DISARM| 12| _DISARM| 12| _DISARM| 728| _DISARM| 1840| _DISARM| | _DISARM| | _DISARM| | _DISARM| 
      | _DISARM| | _DISARM| | _ENDDISARM

Sometime I want to suppress those lines (without uninstalling SAS APM). I then remember there’s a SAS page that contains instructions on how to do it, and spend several minutes trying to find it. I keep looking for a SAS Usage Note, but instead it’s a gem at the end of the SAS APM FAQ page: “Why do the Enterprise Guide SAS logs contain messages related to MVA_DSIO.OPEN_CLOSE and _DISARM? How can these messages be eliminated from the SAS log for EG users?”.

Essentially you edit the workspace server’s logconfig.apm.xml and change the Threshold of the WSLogAppender to Error.

You’ll want to pay attention to the note in the FAQ that says it will disable the SAS DI Studio Job Statistics features. I don’t use that feature in this environment, but you might!

Next Up: SAS Enterprise Guide Custom Tasks Course in Sydney

I’m on my way back from SAS® Global Forum 2016 (#SASGF), where I heard all about the all new SAS Viya™ platform, and the next exciting thing on my agenda is attending Chris Hemedinger’s course Developing Custom Tasks for SAS Enterprise Guide in Sydney on 3-4 May (it’s also on in Melbourne on 5-6 May).

If you’re interested in extending SAS Enterprise Guide to create useful tools for SAS EG users in your organization then you won’t want to miss the opportunity to attend this course. It is written and delivered by the guy that literally wrote the book on SAS EG custom tasks after all!

Custom Tasks BookI first read Chris’ book Custom Tasks for SAS® Enterprise Guide® Using Microsoft .NET back in 2013 and wrote a blog post about it and how I found it useful in building a couple of custom tasks to query metadata: a Metadata Table Finder and Metadata Column Finder. Incidentally Metacoda provides these customs tasks for free if you want to use them with your SAS platform installation.

I’m looking forward to this course to find about more about creating custom tasks, fill in a few blanks, and generally pick Chris’ brains for a couple of days! :)

If you want to find out more about the course, or reserve a place, then I’d suggest you contact SAS Education soon via the contacts details on the course page.

Hope you see you there!

Tracing Permissions for SAS Metadata Security

SAS Global Forum 2016 is just over 2 weeks away, and I’m really excited about showing a Permissions Tracer feature we’ll be releasing in the next version of our Metacoda Security Plug-ins. Metacoda is a SASGF sponsor again this year and we’ll be showing a preview of this new version at our Metacoda stand in The Quad, so please stop and say hello if you’re going to be there too.

Metacoda Permissions Tracer
Metacoda Permissions Tracer

We’ve had some very positive feedback about how helpful our Identity and Object Permissions Explorers have been, so I’m looking forward to getting some feedback on this new feature too. One of the other reasons I’m excited is that this is something we’ve been building up to for several years as we’ve expanded our code base to help visualize the richness of the SAS metadata security model, including its interacting object inheritance paths, user identity hierarchies, and role-implied special conditions.

So what business problems does the Permissions Tracer solve? It expands on Continue reading “Tracing Permissions for SAS Metadata Security”