Tag: SAS Usage Notes

Keyword Bookmark Search with SAS Support

I had noticed recently that when I searched for SAS documentation on Google I wasn’t finding the SAS 9.4 documentation pages I wanted. I tweeted about it, found others had the same issue, and that SAS are working to address it. In the interim, the answer was simple of course … search using support.sas.com instead. However, I’m impatient and am used to just typing my query in the web browser address bar (e.g. sas 9.4 iomserverappender) and then clicking on the first or second link in the search results (when the search query is unique enough). It’s very fast. Finding and clicking a bookmark, waiting for the page to load, locating the search field on the page, typing in the query, clicking the submit button, waiting for the search results page to load, and clicking on the right link …. well that’s quite a bit more work! ;) [#FirstWorldProblems]

So, I’ve switched to using another method where I can keep typing my SAS 9.4 documentation search in the browser address bar AND use support.sas.com at the same time. It might even work out better than before.

In Chrome/Chromium you can add search engines with keywords (right click over the address bar and select Edit search engines… from the context menu):

Chrome Search Engines with SAS Support

In Firefox you have keyword searches via bookmarks: Continue reading “Keyword Bookmark Search with SAS Support”

NOXCMD: NO eXternal CoMmanDs!

SAS® platform administrators can get quite familiar with the SAS NOXCMD option, usually when someone asks why their programs that used to work (in a different SAS version or execution environment) are now failing. Perhaps the programs ran ok with SAS Enterprise Guide 4.1 using a SAS 9.1.3 server but now fail with SAS Enterprise Guide 4.2 using a SAS 9.2 server. Maybe they were developing some code using SAS Display Manager (I know it’s no longer de rigueur but us old-timers will still confess to using it from time to time – some even quite proudly as a badge of honour!). When that code gets deployed in a stored process on a SAS 9.2 server it then starts failing (hmmm perhaps we should have been developing and testing it in SAS Enterprise Guide or SAS Data Integration Studio after all ;)). You may have seen logs with this error:

1          filename lscmd pipe 'ls -al /tmp';
ERROR: Insufficient authorization to access PIPE.
ERROR: Error in the FILENAME statement.

… or maybe this one:

ERROR: Shell escape is not valid in this SAS session.
1          %sysexec mkdir /tmp/test;

… these are the common error messages seen when trying to run external operating systems in a NOXCMD constrained environment.

If you do a Google search for these messages you might find these resources:

  • Chris Hemedinger’s blog post “Using the X and SYSTASK commands from SAS Enterprise Guide” from Nov 2009, where he also explained how to overcome it with a single workstation installation of SAS Enterprise Guide and Foundation SAS.
  • SAS Problem Note 41058: Unable to submit X commands from SAS® Enterprise Guide® connecting to a SAS® Metadata Server when running SAS® 9.2 or later. I noticed at the end of this SAS note it says “… the commands will execute on the metadata server and not on your local PC“. Whilst this would be the case if it were the SASMeta – Workspace Server (a workspace server restricted to metadata administrators that runs on the metadata server machine), it would only be the case for the SASApp – Workspace Server if the workspace server happened to be on the same machine as the metadata server. In many of the installations I see, the metadata server runs on its own dedicated machine, and so this is often not the case. To clarify, it runs the commands on the host machine that the SASApp – Workspace Server is configured to run on.

In the rest of this post I am going to provide some more info, from the platform administrator’s perspective, and try to offer some suggestions and pointers to additional resources that help you with the goal of trying to work with the NOXCMD option. Ideally we want to try to retain the security benefits by not turning it off for the entire user base, in a shared platform environment, when a subset of your users encounter it and perhaps try to persuade you to turn XCMD back on!

The NOXCMD option disables a number of SAS language features that allow the execution of operating system commands such as:

The SAS documentation for NOXCMD can be found under its positive alternative, the XCMD system option. Here are links to the relevant documentation for Windows and UNIX.

We have become more familiar with NOXCMD in recent years because the the SASApp – Workspace Server, SASApp – Pooled Workspace Server and SASApp – Stored Process Server in SAS 9.2 installations commonly have the XCMD option disabled (i.e. NOXCMD). This is the default setting in newly installed SAS 9.2 deployments for its security benefits. To allow the general SAS user community (such as SAS Enterprise Guide users) to execute operating system commands on the servers, a SAS platform administrator has to make a conscious decision to enable XCMD, preferably after careful consideration of the potential security consequences ;). Here is a screenshot fragment showing where XCMD can be turned on in the server’s Launch Properties tab. You get to this tab using the SAS Management Console 9.2 Server Manager plug-in via the Advanced Options button on the Options tab in the server’s properties dialog.

While you are in the SAS Management Console, you might also notice that the SASMeta – Workspace Server is different in that it has XCMD enabled by default. Normal SAS users can’t use the SASMeta – Workspace Server because metadata access controls make it visible only to metadata administrators (members of the SAS Administrators group).

If you schedule SAS jobs to run in batch you might also want to check the NOXCMD status of the batch servers: SASApp – SAS DATA Step Batch Server, SASMeta – SAS DATA Step Batch Server and any others you may have. The XMCD/NOXCMD setting for these servers are specified not in metadata but in the batch server scripts. On Linux, my batch server scripts are in /usr/local/SAS/ebiedieg/Lev1/SASApp/BatchServer/sasbatch.sh and /usr/local/SAS/ebiedieg/Lev1/SASApp/BatchServer/sasbatch.sh. The SASApp one has -noxcmd whereas the SASMeta one has -xcmd. These are the default settings for batch server deployments in recent SAS 9.2 releases. If you have an older SAS 9.2 release (pre M2), you might find that the SASMeta one is also -noxcmd. The NOXCMD constrained SASMeta – SAS DATA Step Batch Server in older SAS 9.2 releases caused problems with scheduled metadata backups as described in SAS Problem Note 34923: A metadata backup that is scheduled to run by using the SAS DATA Step Batch Server might fail to copy the configuration files and the journal files

So what can you do if your security plan doesn’t allow you to enable XCMD for the general SAS user community, but some of your users, or batch processes, are failing to run operating system commands because of it? A couple of possible options include:

  • using/suggesting native SAS language alternatives to operating system commands where possible;
  • creating a new special purpose application server and associated workspace and/or stored process servers that are restricted in visibility (via metadata access controls) to a subset of trusted users/developers. There is a good example of this approach in Jim Fenton & Robert Ladd’s SAS Global Forum 2010 paper 311-2010: A Practical Approach to Securing a SAS® 9.2 Intelligence Platform Deployment

I’ll try to suggest some native SAS language alternatives to operating system commands in future blog posts. If you have any favourites yourself feel free to leave a comment.

I hope this post has helped you find out more about the NOXCMD option and that you don’t always have to turn it off at the first sign of trouble. Remember people tasked with managing security have a reputation to uphold: when it comes to security the first answer is almost always “no”, or perhaps the more pragmatic “no, but how about this alternative more secure method instead…” ;)

SAS Platform Object Framework MakeFolder Metadata Utility

Back in July last year I posted MKDIRMD Macro: Creating Tree Folders in Metadata about a SAS macro I wrote to create tree folders in a SAS metadata repository using the SAS Open Metadata API. Just recently I discovered an alternative method using a utility already present in a SAS 9.2 installation: MakeFolder.

I stumbled on MakeFolder in passing whilst looking in the SASPlatformObjectFramework directory (which is /usr/local/SAS/SASPlatformObjectFramework/9.2 on my Linux machine). If you haven’t seen it before, that directory contains a number of tools such as the Batch Export and Import tools for batch migration/promotion of metadata and the ValidateServer utility mentioned in SAS Usage Note 42523: ValidateServer utility to check availability of SAS® 9.2 Business Intelligence servers. I noticed the SASPlatformObjectFramework directory contained a few other utilities too, including MakeFolder which sounded very much like it might, well, make a folder! Since there are already operating system commands to make file system folders I guessed it would probably make metadata folders and so be worth a closer look.

I couldn’t find any documentation for MakeFolder. A search on support.sas.com yielded nothing. The other SASPlatformObjectFramework utilities documented –help parameters so I thought I would try that out first. It displayed the following nice usage message: 

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder --help
usage: MakeFolder [options...] folderPath
options include:
 -profile <profile>     Metadata server connection profile.  Can be used in
                        place of the -host, -port, -user, and -password options.
 -user <userID>         User login identity. Required if -profile is not set or
                        if the profile does not contain connection credentials.
 -password <password>   User login password. Required if -profile is not set or
                        if the profile does not contain connection credentials.
 -host <hostname>       Metadata server host. Required if -profile is not set.
 -port <port>           Metadata server port. Required if -profile is not set.
 -?,--help              Print help information.
 -domain <domain>       User authentication domain
 -log <log-file>        Log file or directory.
 -makeFullPath          create intermediate folders if necessary

It all looked quite straightforward, so I tried it out in a development environment. Firstly to create a simple top level folder (/testsimple):

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword /testsimple
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
INFO  Folder /testsimple created.
MakeFolder has completed.

That worked fine and looking in the SAS Management Console Folders tab I could see the folder had been created.

There was also a -makeFullPath to create intermediate parent folders too. I first tried it out without -makeFullPath:

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword /test/multiple/levels
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
ERROR Parent folder /test/multiple/ does not exist.
MakeFolder has completed.

As expected, that produced an error message since I didn’t already have the /test/multiple parent folders. I ran it again, this time with the -makeFullPath parameter:

userid@host:~$ /usr/local/SAS/SASPlatformObjectFramework/9.2/MakeFolder -host localhost -port 8563 -user adminpaul@saspw -password thesecretpassword -makeFullPath /test/multiple/levels
INFO  *** Make Folder started on 26/05/2011 ***
INFO  Server localhost:8563, user adminpaul@saspw.
INFO  Folder /test/ created.
INFO  Folder /test/multiple/ created.
INFO  Folder /test/multiple/levels created.
MakeFolder has completed.

The folder and its parents were all created successfully.

MakeFolder indeed looks very useful. However, since I haven’t seen any official SAS documentation for it, I would err on the conservative side and, unless I hear otherwise, assume it’s not currently supported. Perhaps if someone from SAS Institute is reading they might be able to provide a bit more info about its status.

So now I know two ways to script the creation of metadata folders.

Handy SAS Usage Note for Troubleshooting UNIX Authentication

Whilst troubleshooting why LDAP based users couldn’t authenticate against a SAS Metadata Server configured for host authentication, I found this handy resource: SAS Usage Note 39891: Using PROC PERMTEST to diagnose UNIX host authentication issues in SAS® 9.2. The server in question already had correctly functioning LDAP host authentication via PAM, it was just that the SAS Metadata Server wasn’t able to authenticate the LDAP users. The usage note helped me fix the problem by leading me to the SASFoundation/SAS9.2/utilities/bin/sasauth.conf file where I found it had methods=pw instead of methods=pam (must have chosen the wrong options at install time). I actually didn’t need to run PROC PERMTEST this time but the usage note contains clear instructions on how to when required. Interestingly PROC PERMTEST doesn’t seem to appear in the Base SAS® 9.2 Procedures Guide.

Spreading the WORK load

I found a handy tip from Rafi in the discussion Allocating SAS WORK Libraries Dynamically in SAS 9.2 in the LinkedIn group SAS Architects/Administrators/Implementation Specialist. It explains how to use a variation on the SAS system option WORK= to spread work libraries over a number of I/O paths using either random or available space methods. This can potentially help you improve I/O performance for work libraries en-masse, and/or get access to more available space, by spreading those work libraries over a number of different devices.

This usage of the WORK= SAS system option is documented in a number of places: