This article includes information to help an administrator troubleshoot issues with auditing in SAS Visual Analytics 7.3, 7.4, and 7.5  For detailed information about auditing, see the "Key Actions Auditing" section of the SAS^® Visual Analytics Administration Guide. It contains the following sections:

• Overview
• About the EVDMLA Location
• Identifying the Problem
• Checklist
• Debugging and Troubleshooting
  • Enable Debug Logging
    • Pooled Workspace Server
    • SAS Visual Data Builder

Overview

The basic flow for auditing in SAS Visual Analytics is as follows:

1. SAS^® Visual Data Builder initiates a pooled workspace server session each time it is started. The session is held open indefinitely.  
2. SAS Visual Data Builder runs a service to extract audit records from the sas_audit and sas_audit_entry tables in the SAS^® Web Infrastructure Platform's SharedServices database.  The audit extraction service runs every 15 minutes.
3. At each execution, the audit extraction service updates two entries in the sas_preference table in the SharedServices database:

• va.auditRecord.lastTimestamp - This is a Java timestamp of when the extraction service last executed.
• va.auditRecord.lastAudits - This is a list of audit IDs that were pulled during the last extraction.

4. The pooled workspace server session uses the extracted records to create a table called audit_visualanalytics.sas7bdat in the <EVDMLA>/Append directory.
5. The autoload job appends the audit_visualanalytics.sas7bdat table to the audit_visualanalytics table in the SAS^® LASR™ Analytic Server.  The job also appends the records to the main audit data set in the <EVDMLA> directory.  This job runs every 15 minutes by default.  

Most users discover that there is a problem with auditing when they view the Administrator Overview report in SAS Visual Analytics. Specifically, the audit records might not be current, or the audit data might not be loaded. Failures could occur at any point during this flow, and it is important to identify which step is failing.  The information in this KB article helps you do that.  

About the EVDMLA Location

EVDMLA is the administrative reporting library. This KB article uses the shortcut <EVDMLA> to refer to the path on the compute tier where the EVDMLA library's autoload drop zone is located.  By default, this path is as follows:

<SAS config root>/Lev<N>/AppData/SASVisualAnalytics/VisualAnalyticsAdministrator/AutoLoad/EVDMLA

where <SAS config root> is the location of the SAS configuration directory, and <N> is the configuration level.    

This path can be changed. To determine the correct path at your site, follow these steps:

1. Launch SAS^® Management Console and log on with an administrative account such as sasadm@saspw.
2. From the Plug-ins tab, navigate to Data Library Manager ► Libraries.
3. Right-click Environment Manager Data Mart LASR,and select Properties.
4. Click the Extended Attributes tab.  
5. Check the value for the VA.AutoLoad.Location property.  

Note:  The VA.AutoLoad.Location path must be accessible from both the compute tier and the middle tier.

Back to previous

Identifying the Problem

When there is a problem with auditing, the failure typically occurs in one of these areas:

• Creating or updating the audit_visualanalytics.sas7bdat table in the <EVDMLA>/Append directory.
• Autoloading the audit table into the SAS LASR Analytic Server.
   

To determine which action is failing, consider your answers to these questions:

1. Does an audit_visualanalytics.sas7bdat file exist in the <EVDMLA>/Append directory?  

• If no, then this is a problem. Move on to the Checklist.  
• If yes, then move to step 2.  

2. Does the audit_visualanalytics.sas7bdat file in the <EVDMLA>/Append directory have a recent timestamp (within the past 15 minutes).  If you are unsure about this, open a report in SAS Visual Analytics. This action should create an audit record.  Wait 15 minutes and then check the audit_visualanalytics table again.  Was the table updated?  

• If no, then this is a problem. Move on to the Checklist.  
• If yes, then move to step 3.

3. Does the audit_visualanalytics.sas7bdat file in the <EVDMLA> directory exist?  

• If no, then the autoload job is either not scheduled or it failed to run. Confirm that it is scheduled and check the autoload logs in <SAS config root>/Lev<N>/Applications/SASVisualAnalytics/VisualAnalyticsAdministrator/EVDMLA/Logs.  
• If yes, then move to step 4.

4. Does the audit_visualanalytics.sas7bdat file in the <EVDMLA> directory have a recent timestamp? By default, the timestamp should be within the past 15 minutes.

• If no, then the autoload job is either not scheduled or it failed to run. Confirm that it is scheduled and check the autoload logs in <SAS config root>/Lev<N>/Applications/SASVisualAnalytics/VisualAnalyticsAdministrator/EVDMLA/Logs.  
• If yes, then move to step 5.  

5. Log on to SAS Visual Analytics Administrator and view the LASR Tables tab.  Is the audit_visualanalytics table loaded and does it show a recent timestamp for the last update?

• If no, then the autoload job is either not scheduled or it failed to run. Confirm that it is scheduled and check the autoload logs in <SAS config root>/Lev<N>/Applications/SASVisualAnalytics/VisualAnalyticsAdministrator/EVDMLA/Logs.  
• If yes, then the audit process appears to be working correctly.  
   

Checklist

If the audit_visualanalytics data set in the <EVDMLA>/Append directory is not being generated or updated, there are several potential causes. Verify that all of the items in the following checklist are true for your deployment.

1. You are not using a 7.3 or earlier release of the SAS^® Visual Analytics Administration and Reporting product. Typically, this product is an add-on for use with certain SAS^® solutions. It does not include the explorer component of a full SAS Visual Analytics license. In 7.3 and earlier, auditing is supported only if the explorer component is installed. Therefore, auditing does not work even if you follow the steps to enable it. 

Note: Beginning with 7.4, the auditing feature has been modified to allow auditing even when the explorer component is not installed. For this reason, you can enable auditing if you have the 7.4 or 7.5  release of SAS Visual Analytics Administration and Reporting. If you have release 7.4 but auditing is not working, then see SAS Note 62846.

2. The va.auditingEnabled property has been set to true in SAS Management Console, and the SAS^® Web Application Server has been restarted since setting that property.
3. At least one user has performed an auditable action such as opening a report.
4. SAS Visual Data Builder is accessible and appears to be functional.
5. For releases 7.3 and 7.4, the latest hot fix has been applied to avoid the pooled workspace server issue described in SAS Note 60776.
6. The SAS Spawned Servers account has Read/Write access to the <EVDMLA> directory. This account is used to launch the pooled workspace server. By default, this account is sassrv.
7. The user that starts the SAS Web Application Server has Read/Write access to the <EVDMLA> directory.
8. The sasadm@saspw account is still active and is not locked out. This account uses the pooled workspace server session to update the entries in the sas_preference table.  
9. The Environment Manager Data Mart LASR library exists in SAS Management Console, and the SAS System Services group has been granted ReadMetadata, WriteMetadata, Read, and Write permissions to the library.
10. The Environment Manager Data Mart LASR library still has the following settings, which are the default settings:
    • Name: Environment Manager Data Mart LASR 
    • Location: /Shared Data/SAS Visual Analytics/Autoload/EVDMLA
    • Libref: EVDMLA
    • Server Tag: EVDM
11. The size of the audit tables in the SharedService database is being managed according to documented best practices. For tips on managing size, see SAS Note 58589 and SAS Note 58599. 
12. The timestamp of the <EVDMLA>/audit_visualanalytics.sas7bdat data set is more recent than the timestamp of the <EVDMLA>/Append/audit_visualanalytics.sas7bdat data set. If audit_visualanalytics.sas7bdat in the Append directory has a more recent timestamp, then the extraction process does not run again until the <EVDMLA>/audit_visualanalytics.sas7bdat data set has a more recent timestamp.  
    
    For example, new audit records are not extracted in this scenario:
    
    <EVDMLA>/Append/audit_visualanalytics.sas7bdat Feb 14 17:22
    <EVDMLA>/audit_visualanalytics.sas7bdat        Feb 12 14:34
    
    Typically, the <EVDMLA>/audit_visualanalytics.sas7bdat is updated when the autoload job runs. So, if the copy of the data set in the Append directory is more recent, then autoload might not be functioning correctly. This problem can also occur if there is a time change on the server itself. For example, the time has changed due to daylight savings.
13. Your compute tier and your middle tier (where SAS Visual Analytics is deployed) are on the same physical machine. If they are on different machines and they are using the same operating system, then extra steps are required to enable auditing. For details, see the topic "Deployment Topology Considerations" in the SAS Visual Analytics Administration Guide.

Note: If your compute tier and your middle tier are on different physical machines, and they are using different operating systems, then auditing is not supported.

14. Windows only: Antivirus software is not blocking sas.exe processes.
15. If the com.sas logging component has DEBUG enabled for the SAS Visual Data Builder web application, this can cause the audit dataset to not be generated. Set this logging component back to the default WARN. 

Once a cause is identified, correct the problem and restart the SAS Web Application Server to re-initialize the audit extraction service.  If you are unable to determine the cause, move on to Debugging and troubleshooting.  
 

Debugging and Troubleshooting

1. If you are using release 7.3 or 7.4, ensure the latest hot fix is applied to avoid the issue described in SAS Note 60776.
2. Enable debugging for the pooled workspace server and SAS Visual Data Builder. Do not restart the SAS Web Application Server yet.  
3. Remove the audit_visualanalytics.sas7bdat data set from both the <EVDMLA> and <EVDMLA>/Append directories.  Removing the data sets forces the auditing process to pull all available audit records.
4. Restart the SAS Web Application Server. 
5. Log on to SAS Visual Analytics and open any report to ensure that an audit record is generated.
6. Within 15 minutes, the audit_visualanalytics.sas7bdat data set should be generated in the <EVDMLA>/Append directory.  
7. If it is not, review the following logs:

• SASVisualDataBuilder7.x.log - This log records the attempt to initialize a pooled workspace server session and indicates whether the audit extraction service is running.
• Pooled workspace server logs - These logs record any problems that might have occurred when generating the audit_visualanalytics.sas7bdat data set.  
• Object spawner logs - These logs confirm whether a pooled workspace server session was successfully initialized, if the session was terminated for any reason, and if the object spawner itself was restarted after the SAS Web Application Server started.  

8. If you experience performance issues after enabling auditing, see SAS Note 63853 about the size of transaction manager logs. This issue is directly related to Postgres access, and auditing drastically increases Postgres activity. 
    

Enable Debug Logging

Pooled Workspace Server

A pooled workspace server session is responsible for creating the audit_visualanalytics.sas7bdat data set.  Follow these steps to enable audit debugging in the pooled workspace server:

1. To find out which logconfig.xml file is used for logging, look at the value of the LOGCONFIGLOC property in the sasv9_usermods.cfg and sasv9.cfg file for the pooled workspace server. The CFG files are located in the <SAS config root>/Lev<N>/<SASApp server>/PooledWorkspaceServer directory, where <SASApp server> is the application server that SAS Visual Analytics uses. The default is SASApp. At your site, SAS Visual Analytics might be using an application server with a different name such as SASAppVA.
2. Make a backup of the logconfig.xml.
3. Open the active copy of the logconfig.xml file in a plain text editor, and search for the App.Program section. By default, it looks like this:
   
   <logger name="App.Program" immutability="false">
   <level value="Error"/>
   </logger>
    
4. Change "Error" to "Info" like this:
   <logger name="App.Program" immutability="false">
   <level value="Info"/>
   </logger>
    
5. Next, search for the App section. By default, it looks similar to the following:
   
   <logger name="App" immutability="false">
   <level value="Info"/>
   </logger>
    
6. Change "Info" to "Debug" using this code:
   
   <logger name="App" immutability="false">
   <level value="Debug"/>
   </logger>
    
7. Save the file. These settings take effect the next time the SAS Web Application Server is restarted because SAS Visual Data Builder starts a new pooled workspace server session. However, do not restart the SAS Web Application Server until you enable the SAS Visual Data Builder debugging, explained next.
    

SAS Visual Data Builder

SAS Visual Data Builder launches the service for audit record extraction.  Follow these steps to enable audit debugging in SAS Visual Data Builder:

1. Make a backup copy of the SASVisualDataBuilder-log4j.xml file. This file is located in the <SAS config root>/Lev<N>/Web/Common/LogConfig directory.
2. Open the active copy of the SASVisualDataBuilder-log4j.xml file in a plain text editor. Add the following sections just before the <root> tag at the end of the file. The sections must be added in this location.

<category additivity="false" name="com.sas.svcs.content.vdq.batch.audit"> 
    <priority   value="INFO"/>
    <appender-ref ref="SAS_CONSOLE"/>
    <appender-ref ref="SAS_FILE"/>
</category>
<category additivity="false" name="com.sas.lasr.authorization.audit"> 
    <priority   value="DEBUG"/>
    <appender-ref ref="SAS_CONSOLE"/>
    <appender-ref ref="SAS_FILE"/>
</category>
<category additivity="false" name="com.sas.bicommon.admin.services.server.impl.DesignerService"> 
    <priority   value="DEBUG"/>
    <appender-ref ref="SAS_CONSOLE"/>
     <appender-ref ref="SAS_FILE"/>
</category>

 

3. Save the file. These settings take effect the next time the SAS Web Application Server is restarted.