Currently, you cannot audit SAS library Open objects such as dates, user IDs, or path information in the standard logging facility. As a workaround, the Application Response Measurement (ARM) infrastructure enables you to audit such objects or events by using messages from the ARM_DSIO subsystem.
Click the Hot Fix tab in this note to access the hot fix for this issue.
This hot fix adds a new logger category, Audit.Data.Dataset.Open, to the LOG4SAS Audit namespace. Sites that do not want to implement the entire ARM infrastructure can use this new logger category to audit Open events for SAS data sets. The Audit events produce output and data that are critical to the proper auditing of activities for SAS data libraries. The Audit events include the following information:
In order to produce output that includes the information above, you must add appender and logger code to the log configuration file (logconfig.xml) for any server, or servers, being audited, such as the SAS® Stored Process Server.
Note: You should make a backup copy of the logconfig.xml file before you modify the file. Type the correct path for your server in the fileNamePattern value. The following example shows the appender and logger code that should be added to the configuration file:
value="/SAS92/Lev1/SASApp/WorkspaceServer/Logs/Audit.Library_WorkspaceServer_%d_%S{hostname}_%S{pid}.log"<!-- Audit.Library.Dsio File Appender Defintion --> <appender name="AuditLibraryFile" class="FileAppender"> <param name="Append" value="true"/> <param name="ImmediateFlush" value="true"/> <param name="fileNamePattern" value="<sasConfigDir>/Lev1/<SASApp>/<ServerName>/Logs/Audit.Library_<server>_%d_%S{hostname}_%S{pid}.log"/> <layout> <param name="ConversionPattern" value="DateTime=%d Userid=%u %m"/> </layout> </appender> <!-- Audit.Data.Dataset.Open logger definition --> <logger name="Audit.Data.Dataset.Open" additivity="false"> <appender-ref ref="AuditLibraryFile"/> <level value="Trace"/> </logger>The following example shows a sample of the logger output:
DateTime=2011-04-12T09:41:51,420 Userid=sasdemo Libref=MYDATA Engine=V9 Member=CLASS MemberType=DATA Openmode=OUTPUT Path=\sas\test\dataUse the code in the Full Code Tab to read the audit events from the log file.
For more information on loggers and appenders, you should consult the following publications:
SAS® 9.2 Intelligence Platform: System Administration Guide, Second Edition, Chapter 8: Administering Logging for SAS ServersOperating System and Release Information
Product Family | Product | System | Product Release | SAS Release | ||
Reported | Fixed* | Reported | Fixed* | |||
SAS System | Base SAS | Microsoft® Windows® for 64-Bit Itanium-based Systems | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 |
Microsoft Windows Server 2003 Datacenter 64-bit Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2003 Enterprise 64-bit Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows XP 64-bit Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft® Windows® for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2003 Datacenter Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2003 Enterprise Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2003 Standard Edition | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2003 for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2008 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows Server 2008 for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Microsoft Windows XP Professional | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Enterprise 32 bit | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Enterprise x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Home Premium 32 bit | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Home Premium x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Professional 32 bit | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Professional x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Ultimate 32 bit | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows 7 Ultimate x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows Vista | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Windows Vista for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
64-bit Enabled AIX | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
64-bit Enabled HP-UX | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
64-bit Enabled Solaris | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
HP-UX IPF | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Linux | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Linux for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
OpenVMS on HP Integrity | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 | ||
Solaris for x64 | 9.21_M3 | 9.3 | 9.2 TS2M3 | 9.3 TS1M0 |
/* The following is some sample SAS code used to read the resulting audit events from the log file: */
/* modify the filename statement with the path to the file containing the audit log */
filename auditlog
'/sas92/audit/Audit_Library_WorkspaceServer_2010-12-16_STRATTON_444.log';
data auditlib;
infile auditlog recfm=V lrecl=512 pad missover;
informat DateTime B8601DT23.3; format DateTime datetime23.3;
length Userid $ 80; label Userid='Userid';
length Libref $ 8;
length Engine $ 16;
length Member $ 32;
length Membertype $ 8;
length OpenMode $ 8;
length Path $ 1024;
input DateTime= Userid= Libref= Engine= Member= Membertype= OpenMode= Path=;
run;
DateTime=2011-04-12T09:41:51,420 Userid=sasdemo Libref=MYDATA Engine=V9 Member=CLASS MemberType=DATA Openmode=OUTPUT Path=\sas\test\data
A fix for this issue for Base SAS 9.21_M3 is available at:
http://ftp.sas.com/techsup/download/hotfix/HF2/B25.html#42925Type: | Problem Note |
Priority: | medium |
Date Modified: | 2011-06-30 14:33:11 |
Date Created: | 2011-04-12 17:27:19 |