Currently, you cannot audit SAS library Open objects such as dates, user IDs, or path information in the standard logging facility. As a workaround, the Application Response Measurement (ARM) infrastructure enables you to audit such objects or events by using messages from the ARM_DSIO subsystem.

Click the Hot Fix tab in this note to access the hot fix for this issue.

This hot fix adds a new logger category, Audit.Data.Dataset.Open, to the LOG4SAS Audit namespace. Sites that do not want to implement the entire ARM infrastructure can use this new logger category to audit Open events for SAS data sets. The Audit events produce output and data that are critical to the proper auditing of activities for SAS data libraries. The Audit events include the following information:

• Current Date and Time
• Active User ID
• SAS Libref name
• SAS Library Engine name
• SAS Library Member name
• SAS Library Member type
• SAS Library file physical path

In order to produce output that includes the information above, you must add appender and logger code to the log configuration file (logconfig.xml) for any server, or servers, being audited, such as the SAS^® Stored Process Server.

Note: You should make a backup copy of the logconfig.xml file before you modify the file. Type the correct path for your server in the fileNamePattern value. The following example shows the appender and logger code that should be added to the configuration file:

value="/SAS92/Lev1/SASApp/WorkspaceServer/Logs/Audit.Library_WorkspaceServer_%d_%S{hostname}_%S{pid}.log"

<!-- Audit.Library.Dsio File Appender Defintion -->  
 <appender name="AuditLibraryFile" class="FileAppender">
  <param name="Append" value="true"/>
  <param name="ImmediateFlush" value="true"/>
  <param name="fileNamePattern" 
value="<sasConfigDir>/Lev1/<SASApp>/<ServerName>/Logs/Audit.Library_<server>_%d_%S{hostname}_%S{pid}.log"/>
  <layout>
  <param name="ConversionPattern"
   value="DateTime=%d Userid=%u %m"/>
 </layout>
 </appender>
 
 <!-- Audit.Data.Dataset.Open logger definition -->
  <logger name="Audit.Data.Dataset.Open" additivity="false">
  <appender-ref ref="AuditLibraryFile"/>
  <level value="Trace"/>
 </logger>

The following example shows a sample of the logger output:

Use the code in the Full Code Tab to read the audit events from the log file.

For more information on loggers and appenders, you should consult the following publications:

Operating System and Release Information

/* The following is some sample SAS code used to read the resulting audit events from the log file: */
/* modify the filename statement with the path to the file containing the audit log  */
 
filename auditlog
'/sas92/audit/Audit_Library_WorkspaceServer_2010-12-16_STRATTON_444.log';
 data auditlib;
   infile auditlog recfm=V lrecl=512 pad missover;
   informat DateTime B8601DT23.3; format   DateTime datetime23.3; 
   length Userid        $ 80;     label    Userid='Userid';
   length Libref        $ 8;
   length Engine        $ 16;
   length Member        $ 32;
   length Membertype    $ 8;
   length OpenMode      $ 8;
   length Path          $ 1024;
   input DateTime= Userid= Libref= Engine= Member= Membertype= OpenMode= Path=;
   run;

DateTime=2011-04-12T09:41:51,420 Userid=sasdemo Libref=MYDATA Engine=V9 Member=CLASS MemberType=DATA Openmode=OUTPUT Path=\sas\test\data

A fix for this issue for Base SAS 9.21_M3 is available at: