As part of its metric collection and publishing, the SAS Viya operations infrastructure uses three internal service IDs that are registered with the identities service. These IDs are internal service IDs and are not normally displayed in SAS^® Environment Manager.

• The sas.ops-agentsrv internal service ID is used by the SAS Viya operations agent server (sas-viya-ops-agent-default) and other commands (for example, sas-ops validate).
• The sas.ops-agent internal service ID is used by the SAS Viya operations agent (sas-viya-ops-agent-default).
• The sas.ops-agent internal service ID is used by components such as the sas-peek collector when executed by the SAS Viya operations agent server (sas-viya-ops-agentsrv-default).
• The sas.ops internal service ID is used by components such as the sas-peek collector when it is executed manually as the sas user ID.

In cases where these internal service IDs no longer can obtain valid OAuth tokens, various components of the SAS Viya operations infrastructure return errors.

When this issue occurs, the etl_driver.sas program that runs every five minutes might fail to connect to SAS^® Cloud Analytic Services (CAS). In addition, the rolloff.sas program, which runs nightly at 2:00 a.m., might fail to connect to CAS with this error. Also, the audit.sas program, which is called by the ev-genaudit task every 2.5 hours, might fail to connect to CAS. When this problem occurs, a message similar to the following is displayed in the etl_driver_yyyymmdd_run-ID_host-name_process_ID.pgmlog file. This file resides in the /opt/sas/viya/config/var/log/evmsvrops/evdm directory on the [Operations] host that is defined in sas_viya_playbook/inventory.ini.

When you do not have the credentials to connect with CAS, the authentication mechanism falls back to Kerberos and a Kerberos error is displayed. This fact does not mean that the etl_driver.sas, rolloff.sas, or audit.sas programs actually use Kerberos to connect to CAS. Instead, because these SAS programs connect to CAS by using the sas.ops-agentsrv internal service ID, this error can occur if the sas.ops-agentsrv internal service ID becomes deregistered.

When you execute the command /opt/sas/viya/home/bin/sas-ops validate -level 3 -verbose on any host as the sas user ID, the following error might be returned:

Because the sas-ops validate command uses the sas.ops-agentsrv internal service ID, this error can occur if the sas.ops-agentsrv internal service ID becomes deregistered.

When you manually execute the /opt/sas/viya/home/bin/sas-peek cas -level 3 command as the sas user ID on the CAS controller or on the backup controller, the following errors might be returned:

Even though the output in the EMI_LOG_LEVEL=DEBUG line returns the message OAuth client credentials found for sas.ops, that message is misleading. The Bad credentials error that is shown above means that the OAuth token that is found is not valid for the sas.ops internal service ID. This error can occur when the sas.ops internal service ID becomes deregistered.

The sas-viya-ops-agent-default agent schedules the CASMetrics task. This task calls the command /opt/sas/viya/home/bin/sas-peek cas -level 3. On CAS controller or the backup controller machines, the SAS Viya operations agent server (sas-viya-ops-agentsrv-default) might log errors in /opt/sas/viya/config/var/log/ops-agent/default/sas-ops-agent_yyyy-mm-dd_hh-mm-ss.log under either of the following circumstances:

• You modify the /opt/sas/viya/home/bin/sas-ops-agentclt script by using -loquacity 9 to start the sas-viya-ops-agent-default agent for extra logging.
• You turn on extra logging by submitting the command /opt/sas/viya/home/bin/ops-agent-cmd set -name ops-agent -- -debug true , which is not the default action.

The errors that occur are as follows:

When the command sas-peek cas -level 3 is scheduled to run by the sas-viya-ops-agent-default agent, it uses the sas.ops-agent internal service ID. As a result, if the sas.ops-agent internal service ID is deregistered, the errors that are shown above occur.

If you execute the following commands in an attempt to resolve all of the issues that are described earlier, no errors are returned:

However, when you submit the ops-util command with the token option, you still might see the following errors:

In this message, Bad credentials means that an OAuth token cannot be obtained for the given service ID.

To resolve these issues, submit the following commands as the sas user ID, but add the -force option:

To test whether an OAuth token can be obtained for the given ID, submit the following commands:

Note: You can add the -debug option, as shown below, for more verbose logging:

To avoid the need to reregister the service IDs in the future, submit the following commands as the sas user ID to modify the tasks that call ops-util and add the -force option. Making these modifications ensures that given IDs are registered with the identities service:

Click the Hot Fix tab in this note for a link to instructions about accessing and applying the software update.

Operating System and Release Information

Viya on Windows: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Windows Deployment Guide at

Viya on Linux: An update for this issue is available for SAS Viya 3.5. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.5 for Linux Deployment Guide at