Blogging about all things SAS

March 6, 2010

SAS Access – Who plays nicely with who(m)

Filed under: Architecture and Administration, x - Notes to Self — Shane Gibson @ 9:59 pm

Just saw this post on Chris H’s blog here and I am replicating it so I can find it when I need it. (cause half my posts are there so I can find them when I need them)

If you want to know what version of SAS/Access works with what operating system and what release and what database etc, then look here:

http://support.sas.com/matrix/list?SAS=All&Engine=All&OS=All&googleTrack=on

February 13, 2010

Creating Information Map Libnames (9.1.3)

Filed under: Architecture and Administration, SAS 9.1 — Tags: , , — Shane Gibson @ 9:02 pm

If you want to use a Information Map as a data source for tasks such as DI Studio Jobs, Stored Processes, or building OLAP cubes, you can create a SAS Library that points to a folder that contains the Information Maps.

Each Information Map then gets treated as a table in the library.

To do this either use the following SAS code:

libname ImapLib sasioime
user=”username”
pw=”password”
metaserver=”servername”
metaport=8561
metarepository=”Foundation”
mappath=”/BIP Tree/InfoMaps/sales”

Of course you need to add your on environment settings for the variables.

Or you can create it in metadata by creating a libname with:

  • Create a generic libname
  • Type =  sasioime
  • Options = user=”username” pw=”password” metaserver=”servername” metaport=8561 metarepository=”Foundation” mappath=”/BIP Tree/InfoMaps/sales”

Issues to be aware of:

  • It is slow as you are going through multiple layers to get to the data (i.e Libname > Infomap > Query and Reporting Services > Libname > Data)
  • The user is hard coded for the libname
  • If the libname has fields defined with gaps in the names the SAS Libname will not show the column.

February 2, 2010

SAS 9.1.3 Client Metadata Profile Paths

Filed under: Architecture and Administration, SAS 9.1 — Tags: , — Shane Gibson @ 10:41 pm

I have been doing an install of SAS 9.1.3 clients on a a Citrix server (yes I know it is not supported) and all worked fine with Enterprise Guide etc but all the Java clients wouldn’t run.

Everytime they started up they couldn’t find some path and just gave an error saying path could not be found.

We troubled shooted it to the fact that we had changed the Citrix server layout from the last server and had used different drive mappings.  As part of this we had moved where the SAS Client Metadata Profile settings (.swa files) were stored.

So when SAS Data Integration Studio, Management Console etc started they looked for the .swa files in the location defined on the previous Citrix server (as the Citirix profile travels with the user across servers).

The fix was to edit the app.smc file in the users directory (for us C:\Documents and Settings\~user).  In that file is a line:

WorkspacePath=C:\\Documents and Settings\\~user\\Workspaces

Which defines where the Metadata profile files (.swa) are stored.

the other options (thanks SAS tech Support) is to put the following option on the clients .ini file (i.e C:\Program Files\SAS\SASManagementConsole\9.1\sasmc.ini):

-Duser.home=C:\SAS

This will then make all users access the .swa files under a workspace dir under this path.  But of course they all access the same ones, so lock them down so they can’t be changed.

Trick for young players on that one, make sure it is after the “-Dsas.app.class.dirs=” option as if you add it at the end it gets ignored for some reason.

And of course do it for each of the SAS clients.

One of the

October 19, 2009

SAS 9.1.3 I/O Errors on a Windows 2003 server

Filed under: Architecture and Administration, SAS 9.1 — Tags: , — Shane Gibson @ 10:10 pm

A while ago we had a major problem as a result of upgrading our Windows servers and operating system, where we started to get a large number of I/O errors when running our batch schedule.

In the end we fixed it by changing the Paged Pool Usage Maximum set from 80% to 40% on the servers as our Windows guru’s worked out that SAS was filling the Windows cache faster than Windows could clear it, causing the I/O errors.

SAS support also suggested we follow this instrauctions in this tech support note:

http://support.sas.com/resources/papers/IOthruSGIO.pdf

If you have struck another fix then let me know.

October 1, 2009

SAS 9.1 / WRS 3.1 – Changes to Metadata Roles takes it time

Filed under: Architecture and Administration, SAS 9.1, Web Report Studio, x - Notes to Self — Shane Gibson @ 7:00 pm

While researching and testing the default Web Report Studio metadata security I noticed this little trick for young players, which means changes to WRS/WRV Metadata Security for a user are not instantly applied/recognised in WRS/WRV.

Words from the SAS tech support note “Changes to SAS® Web Report Studio role memberships might not immediately be enforced“:

“SAS Web Report Studio analyzes role memberships every 30 minutes. So, for example, if you move a user from the WRS Report Author role to the WRS Report Consumer role, the user will continue to have author privileges until the next time that he logs in after the next role membership analysis is performed. ”

So effectively the WRS/WRV applications are caching the Metadata security to remove the need for the web server to query the Metadata Server each time a user logins.

So try not to be fast when testing your WRS Metadata security changes, else you will think you have done something wrong. And remember to logout and log back in after the cache has been updated.

You can update the LocalProperties.xml file to change the refresh time, and therefore make the changes appear sooner. Details on how to do this are in the SAS Tech Support note.

September 30, 2009

SAS 9.1 / WRS 3.1 Metadata Roles defined

Filed under: Architecture and Administration, SAS 9.1, Web Report Studio, x - Notes to Self — Tags: — Shane Gibson @ 7:29 pm

Researching definitions for each of the WRS default roles as part of the Advanced Metadata Security course.

The roles are documented in the SAS 9.1.3 Intelligence Platform: Web Application Administration Guide, Second Edition on page 130. What it says is:

“By default, everyone who can log on to SAS Web Report Studio can view, edit, and create new reports.

To implement security, each user of SAS Web Report Studio can be assigned to one or more standard roles. A user’s role assignments determine which SAS Web Report Studio menu items are available to that user.

  • By default, all SAS Web Report Studio users implicitly have the role. However, if you explicitly assign any members to the role, then only the explicitly-assigned members will have the role. This enables you to start using SAS Web Report Studio immediately after installation, yet still have the ability to restrict user access when locking down your deployment.

  • Each role is a superset of the preceding role. For example, members of the “WRS Report Author” role have all the permissions that apply to the “WRS Report Consumer”.

  • Once you explicitly assign members to a role, you must explicitly assign membersto each superset role. For example, if you assign members to the “WRS ReportAuthor” role, then all of the subsequent superset roles (in this example, “WRSAdvanced User”) also become explicitly-assigned roles. The reason is that WRSAdvanced User is a superset of WRS Report Author.

  • Once you explicitly assign members to a role, then any user who is not assigned to a role, or who has no metadata identity, can only view reports and manipulate reports (for example, select new data items to view in report objects).

WRS Report Consumer Users who have this role can view reports and manipulate report data in the View Report view. Users can copy, move, save, rename, or delete reports. Users cannot create new reports with the report builder or report wizard.
WRS Report Author *

In addition to the abilities assigned to WRS Report Consumers, users who have this role can create reports with the report builder or report wizard. Users can also schedule reports.
WRS Advanced User

In addition to the abilities assigned to WRS Report Authors, users who have this role can distribute reports. Users cannot create or delete recipient lists that are used for report distribution.
WRS Administrator

Users who have this role can perform all tasks that are associated with SAS Web Report Studio, including the ability to create and delete recipient lists that are used for report distribution.

This role provides full permissions to SAS Web Report Studio and should be safeguarded accordingly. This role provides application level administrator functionality. However, this role has no effect on metadata access (authorization) rights to report data.
WRS Prohibited

Users who have this role cannot log on to SAS Web Report Studio. Regardless of the user’s membership in any of the previous roles, if the user attempts to log on, the logon page displays the following error message: “This user is not allowed to access SAS Web Report Studio. Please contact your administrator.”

Some organizations might apply this role for users who are allowed to access some SAS applications but not SAS Web Report Studio. Alternatively, if an organization has multiple Web Report Studio installations, this role can be used to restrict some users from specific instances.

The corresponding metadata group entity is not created during installation. You must manually create the group in metadata if you want to use this user role.
*By default, WRS Report Authors can schedule reports, though you can change the default behavior and limit the scheduling feature to WRS Advanced Users. To do this, in your LocalProperties.xml file, specify true for the schedulingRequiresAdvancedUserRole property.

September 29, 2009

SAS 9.1.3 Metadata Security – Go ask your mother

Filed under: All Things Metadata, Architecture and Administration, SAS 9.1 — Tags: — Shane Gibson @ 4:33 pm

So i’m attending the advanced metadata security course for SAS 9.1.3 at the moment.

It is a complex area and really does my head in. But here is a way that (I think) I understand how it works.

There are two different rules that are applied to any metadata object:

1) Direct – When security is applied directly to an object (i.e in Management Console you HAVE ticked a metadata security box for the object, so its white or green)

2) Inherited – When security is not applied to an object, it is inherited (i.e in Management Console you have NOT ticked a metadata security box for the object, so its grey)

So here is how I think the rules for each of these works:

1) Direct – when Security is directly applied to an object.

The identity hierarchy model applies. This means it looks at the levels permissions have been applied to the object and whether it is applied as an ACT or ACE.

  • Permissions closest to user wins
  • A deny always wins over a grant, if at the same level (and type)
  • ACE’s always win over ACT’s

Or in something I can understand:

  • If you ask your mother and she says yes, then you ask your father and he says no, the answer is no (deny at same level)
  • If you ask your mother and she says yes, then you ask your grandfather and he says no, the answer is yes (permission closest to user)
  • If you ask you mother (ACE) and she says yes, then you ask your teacher (ACT) and she says no, then the answer is yes (ACE always wins)

2) Inherited – When security is not applied to an object

The inheritance model applies. This means every permission is placed in a bucket and if a grant is found anywhere, you have got it.

  • Levels don’t count
  • A single grant always wins over any and all denies
  • ACE’s vs ACT’s have no impact

Or using the same analogy:

  • You are at a family reunion, you yell out a question, somebody yells yes, the answer is yes

And the last thing I learnt was if somebody said no (i.e you can’t see something as a user) then if you ask why, the only answer you will get is “because I said so”.

Which means it is very very hard to find out what stopped you seeing it. Although I believe Paul at metacoda.com has some cool tools in the pipeline to help with this.

* Thanks to Adam Player for a great course and even better analogy's!

Does daylight savings effect LSF for you?

Filed under: Architecture and Administration, Scheduling — Tags: , — Shane Gibson @ 1:07 pm

NZ had the pleasure of day light savings on the weekend, where we were all lucky enough to lose an hours sleep.

A couple of sites reported their LSF schedules went a bit funny (good technical term that).

So if the clock on the servers automatically change at 3am and you have a job flow scheduled for 3am what happens?

Haven’t had time to test this but interested in anybody else’s experience.

August 19, 2009

Scheduling in SAS 9.2

Filed under: Architecture and Administration, SAS 9.2 — Tags: , , — Shane Gibson @ 9:55 pm

Suzanne posted a comment about the changes in LSF renewals that are about to happen.

Made me think about the new scheduling capability that has been bundled in SAS 9.2, so I did a little searching on the SAS Support site.

On the About Scheduling Servers page they provide a good overview of the different options which are available, which are:

  • LSF (Platform Process Manager)
  • Operating System (guessing Cron for Unix and Windows Scheduler)
  • In-Process scheduling server (which is a new part of SAS 9.2)

So what does the In-Process scheduling server cover?

Well according to most of the support pages it only refers to Web Report Studio, but back on the About SAS Scheduling page it mentions:

  • SAS Data Integration Studio
  • SAS Web Report Studio
  • SAS Marketing Automation
  • And custom SAS code

I notice Enterprise Miner models are missing, I am guessing you could schedule them as custom SAS code but I do wonder if it just wasn’t mentioned because EM 6.1 was released slightly after the initial 9.2 release.

Although I did check out the What new in Enterprise Miner 6.1 page and nothing was mentioned.

Ps. There is a great flow diagram (well ok the graphics aren’t that great but you know what I mean) on the Overview of the Scheduling Process page which shows how the new scheduling all hangs together.

It reminded me of the internal presentations SAS had on flow a transaction went through when it came to Authentication and Authorisation of the SAS environment. It was the only way I finally got to understand how it all hug together, so I am a great fan of process flow diagrams.

Which is one of the reasons I liked LSF because you could see a graphical flow, and its great to see the new SAS In-Process scheduling server has graphical process flow, and they look much sexier than the LSF ones (and yes this is important!). Check out an example of the Specifying Dependencies page

August 17, 2009

SAS Administration

Filed under: Architecture and Administration — Tags: , — Shane Gibson @ 10:28 pm

I am always amazed at how many people under estimate the level of administration that the SAS 9.x platform now requires.

I think it stems from the old SAS 8 environment that really managed itself.

But SAS 9.1 and 9.2 is a multi tier environment with lots of moving parts and so you really need a dedicated (even if it is only part time) administrator to make sure it is humming.

Thotwave have a great paper titled SAS® Administration, More relevant than ever that provides a good explanation of what this role needs to achieve.

And of course any administrator should also attend the SAS PA Fast course as well.

It also looks like in SAS 9.2 there are lots of great changes to make administrating the SAS environment easier.

Even if you decide to have one of your analytic or business users manage your environment, still send them on the training. It will save them a lot of time and you a lot of money.

Older Posts »

Powered by WordPress