Sample Code to Look for Log Files and Build an Audit Report Data Set

Here is a sample SAS program that creates an audit report data set from your audit log data:

/* Specify the directory where your log files are saved. */

%let logdir=your-log-directory;

/* Specify a directory to save the audit data. */

libname audit "your-audit-data-directory";
 
/* Expand a passed in directory name and find all the filenames.  */

%macro findfiles(logdir);
   data filelist (keep=directory logfile hostname pid);
      format directory logfile $512. hostname $80. pid $8.;
      directory="&logdir.";
      rc=filename("ONE","&logdir.");
      if rc ne 0 then do;
         msgLine="NOTE: Unable to assign a filename to directory &logdir.";
         put msgLine;
         end;
        else do;
           did=dopen("ONE");
           if did > 0 then do;
              numfiles=dnum(did);
	            put numfiles=;
              do i=1 to numfiles;
                 logfile=dread(did,i);
                 hostname=scan(logfile,-3,'_.');
                 pid=scan(logfile,-2,'_.');
                 output;
               end;
           end;

          /* close the open filename and data set pointer */

          rc=filename("ONE");
          did=dclose(did);
      end;
   run;
%mend;
 
/* Read through a data set of Directory name and filenames and read the audit logs.*/

%macro readfiles(list);
   %let dsid = %sysfunc(open(&list));
   %if &dsid %then %do;
      %syscall set(dsid);
      %let nobs =%sysfunc(attrn(&dsid,nlobs));
      %do i=1 %to &nobs;
         %let rc=%sysfunc(fetch(&dsid));
         %let ldir=%sysfunc(getvarc(&dsid,%sysfunc(varnum(&dsid,DIRECTORY))));
         %let lfile=%sysfunc(getvarc(&dsid,%sysfunc(varnum(&dsid,LOGFILE))));
         %let host=%sysfunc(getvarc(&dsid,%sysfunc(varnum(&dsid,HOSTNAME))));
	 %let pid=%sysfunc(getvarc(&dsid,%sysfunc(varnum(&dsid,PID))));
         filename auditlog "&ldir.\&lfile."; 
	 data auditlib;
       infile auditlog recfm=V lrecl=512 pad missover;
       informat DateTime B8601DT23.3; format   DateTime datetime23.3; 
       length Userid        $ 80;     label    Userid='Userid';
       length Libref        $ 16;
       length Engine        $ 16;
       length Member        $ 32;
       length MemberType    $ 16;
       length OpenMode      $ 16;
       length Path          $ 4096;
       length Hostname      $ 80;
       length Pid           $ 8;
       input DateTime= Userid= Libref= Engine= Member= MemberType= OpenMode= Label= 
             Path=;
       
      /* Populate values that will come from log filename */
 
       Hostname=trim("&Hostname."); 
	     Pid=trim("&Pid.");
    run;
	
    proc append base=audit.file_opens data=auditlib; run; 
	 %end;
    %let rc = %sysfunc(close(&dsid));
    %end;
 
%mend;
 
/* Look for files to process in a directory. */

%findfiles(&logdir);

/* Read the log files to produce a data set for reporting. */

%readfiles(filelist);