Hey all,

Currently, we've implemented a way to log what procedures have ran at what time and by what user by including the following procedure at the top of whatever procedure we want to log:

-* File: IBFS:/serverName/EDA/EDASERVE/APPPATH/baseapp/fexlog3.fex
-* To reference this file within a procedure you want to log having been ran, type the
-* following at the top of the procedure:
-*   "-INCLUDE IBFS:/EDA/EDASERVE/baseapp/fexlog3.fex"

-DEFAULTH &LOG = 'ranfexlog.log';

-GOTO setname.&fexname.EXIST;
-setname.0
-SET &fexname = IF &FOCFOCEXEC CONTAINS 'ADHOCRQ' THEN 'ADHOCRQ' ELSE TRUNCATE(&FOCFOCEXEC);
-setname.1
-SET &fexname = TRUNCATE( &fexname );

-SET &HOUR = EDIT(&TOD, '99$$$$$$');
-SET &MIN = EDIT(&TOD, '$$$99$$$');
-SET &TIME = &HOUR | ':' | &MIN;

FILEDEF LOGFILE DISK \\serverName\userfiles\&LOG (APPEND
-RUN

-SET &LOGGED = &DATEMDYY | ' | ' | &TIME | ' | ' | &IBIMR_user | ' | ' | &fexname;
-SET &OUT1 = PUTDDREC('LOGFILE', 7, &LOGGED, &LOGGED.LENGTH, 'I1');
-SET &OUT1 = CLSDDREC('I1');
-End

This solution works if we -INCLUDE the above code into the procedures we want logged. We don't want to have to count on our users including this every time they create something (if they ever have access to code in the first place), or us having to add it to anything that is created periodically.

Does anyone here know if there is a location we could add this code (or something that does similar) to be able to ensure we get a log for everything that is ran within our environment regardless of having this code included or not in the procedures that run? Or is there a way we can access this kind of reportable data and build actual reports/graphs/dashboards/portals for it?

Any suggestions/ideas/help will be much appreciated!

Thanks in advance!

This message has been edited. Last edited by: CoolGuy,

Add it as part of the _universal_profile, I think that it should work since _universal_profile is executed every time.

MartinY,

Thanks for the suggestion! Where would I go to find this _universal_profile? haha Sorry. Kind of new to some things still. Appreciate your help though!

Thought it was _site_profile in site.wfs.
Get to it via the Admin Console, Custom Settings:
_site_profile=&_site_profile\EX LOG_PGM
_site_profile=&_site_profile\n-RUN

Not sure if this is the correct syntax...

Tom Flynn,

Adding the following to Custom Settings results in fexlog3 (the logging procedure) being logged instead of actual content being ran getting logged:

_site_profile=&_site_profile\EX fexlog3 IBIMR_user=&IBIMR_user, PASSTHRU=ON
_site_profile=&_site_profile\n-RUN

At first &IBIMR_user wasn't getting passed even though I set it to pass through above with:

<SET> IBIMR_user (pass)

So, I added it in the _site_profile lines and things ran again. It was just that I was getting a log for fexlog3 being ran instead of the content I ran.

Do you know if/what I'm doing wrong? Maybe it's executing fexlog3 after executing the content I run? Hence why it is logging fexlog3 and not the content being ran?

Thanks for your help!

Maybe it needs to be a -INCLUDE instead of EX.
Again, this has been awhile since I've done this.
I'm sure a quick call to IBI will straighten out the syntax, or, maybe someone else knows...

Good call. Will try that. Yes, IBI may be able to help. Will try them next.

Thanks again!

Switching EX with -INCLUDE ends up not logging anything. Whether I execute fexlog3 from the site profile or the universal profile with EX it then commences logging that fexlog3 has been ran when content without fexlog3 included is ran.

UPDATE: Opened a case.

This message has been edited. Last edited by: CoolGuy,

Put the routine in baseapp on the reporting server and put a -INCLUDE in edasprof.

In the Reporting Server Console:
1. Click on Workspace
2. Configuration File
3. Right click Server Profile and Edit
4. Add your -INCLUDE in the appropriate place.
5. Click Save

We put DEFINE functions there, set && Global Variables, etc

jgelona,

I tried sticking:

-INCLUDE IBFS:/EDA/EDASERVE/baseapp/fexlog3.fex

into edasprof like you said, but I haven't gotten it to work.

Do you know where I should stick the -INCLUDE exactly? I tried the bottom and it did nothing. I then tried the top, and then nothing would run. So, I've taken it out for now. Any additional insights that you might have for this possible solution?

Thanks for your help!

I don't use "IBFS:/EDA/EDASERVE/baseapp/fexlog3.fex" in the edasprof, all I have is stuff like this:

-INCLUDE udateadd
-INCLUDE udatemov
-INCLUDE getfy
-RUN

They can go anywhere.

edasprof is treated and executed like a standard fex, so coding requires you to following the rules of a standard fex.

I have mine organized as follows:

• APP PATH
  
• Database Connections
  
• SET statements (i.e. SET FILECASE=LOWER SET XFOCUS=ON etc.)
  
• FILEDEF for holiday file
  
• -SETs for Global Variables
  
• -INCLUDEs for DEFINE Functions
  

jgelona,

Thanks for the additional information. I tried sticking the -INCLUDE where you had them, and even changed the syntax to how you were doing it, and nothing happens. Things still run, but I don't get any log like I was hoping for.

Do you have to stop and then restart the reporting server before the added -INCLUDEs take effect? Or do you have to add the changes after stopping the reporting server and then restart it for it to work at all? Wish these suggestions of yours would work for me.

Thanks for your help jgelona!

UPDATE on my opened case:

Alan Mark from IBI states (in regards to adding

_site_profile=&_site_profile\EX fexlog3 IBIMR_user=&IBIMR_user, PASSTHRU=ON
 _site_profile=&_site_profile\n-RUN

to the Custom Settings file:

quote:

You'll need to look into purchasing Resource Analyzer/Resource Governor for the
Reporting Server. Your Sales contact is: Bruce Lambrecht and his number is
(720)200-3686.

The approach you are taking can never work in the way you want. The executing
procedure of your code IS fexlog3.

Does anyone here know if there is a way to log what procedures have ran when and by who without having to buy yet another add-on "product" from IBI?

You can do a search on user tracking. There are several threads covering this.

I have my own method that I developed years ago. It works well for us because we still use dashboards and almost every bit of code we have is stored on the reporting server, so I'm not sure how well it will work for you. Basically I have a FOCUS database and a little program that is -INCLUDE'd in every fex we want to track. It also handles our security. That said, I don't see any reason it wouldn't work in a portal with modification. It is just FOCUS code. Maybe this will give you some ideas.

FILENAME=DB_USER, SUFFIX=FOC,$
$
$  Dashboard User History
$
SEGMENT=SEG01, SEGTYPE=S2, $
  FIELD=DTTM     ,, HYYMDm,$
  FIELD=USERID   ,, A10   , INDEX=I,$
  FIELD=RPTID    ,, A32   , INDEX=I,$
  FIELD=OUTPUTFMT,, A12,$
  FIELD=USERTYPE ,, A1 ,$
  FIELD=ALLOWED  ,, I1 ,MISSING=ON,$  Access Allowed?  0-No, 1-Yes
  DEFINE RUNDT/YYMD=HDATE(DTTM,'YYMD');


 MODIFY FILE DB_USER
 FIXFORM RPTID/32
 COMPUTE
   DTTM=HGETC(10,'HYYMDm');
   OUTPUTFMT='&OUTPUT.EVAL';
   USERID='&RUSER.EVAL'; (This is the userid passed by Kerberos to the client then passed to the Reporting Server)
   USERTYPE='&&WORKERTYP.EVAL';  (This is output from CHECKGRP below)
   RPTID=UPCASE(32,RPTID,'A32');
   ALLOWED=&ACCESS;
 GOTO INSERT
-*
 CASE INSERT
 MATCH DTTM USERID
    ON NOMATCH INCLUDE
    ON NOMATCH GOTO EXIT
    ON MATCH TYPE "Duplicate Record: <DTTM><USERID>"
    ON MATCH COMPUTE DTTM=HADD(DTTM,'MS',1,10,'HYYMDm');
    ON MATCH GOTO INSERT
 ENDCASE
-*
 DATA
&DTLPGM
 END
-RUN


(example of how to use - this is the program executed from the dashboard)

-* File open_yi781.fex
-INCLUDE CHECKGRP  (this is one of a few programs that checks to see if user access is allowed)
-SET &DTLPGM=YI781;
-SET &OUTPUT=EXCEL;
-INCLUDE DB_USER
-RUN
-* G is for Guest, Only non guest security can view this report
-IF &&WORKERTYP EQ G THEN GOTO EXTROUTINE;
-HTMLFORM OPEN_YI781
-EXIT
-*
-EXTROUTINE
-INCLUDE YI722_NOTAUTHORIZED
-RUN

jgelona,

quote:

Originally posted by jgelona:
a little program that is -INCLUDE'd in every fex we want to track.

With our scenario, we need to be able to track our users and what they are doing without having to include anything in the procedures, etc. that run. If we relied on having to -INCLUDE a logging procedure into every fex we needed to log, we wouldn't be able to catch new content that our users are creating and running as it happens. We may not ever notice every bit of new content that crops up over time.

Thank you though for your example of how you have been implementing logging and security for your users. I'm not too good/experienced with how MODIFY, FIXFORM, & MATCH work as of yet, but from what I see, your OPEN_Y1781 is either populated if the user belongs to a non-guest USERTYPE and if they are not, they get taken to probably a message saying they aren't authorized to view the report. Neat way of doing things. I've got similar logic that checks if a request has any data come back, and if not displays a message stating there is no data to return.

Master file profiling seems to be a nice feature that IBI has added to help secure things, but if there are joins made by the user to a profiled data source and the profiling isn't set up to utilize a DBAFILE, the profile is never executed supposedly. A lot of little possible security holes with that feature set still I think.

We've currently got a user filtering fex that gets a list of stores that an Active Directory user has assigned them via SQL out. That is stored in a string and then used in a screening filter to allow only the stores they have assigned them to show up in any request against a given data source that the screen is included within. The trouble with that is that if a user creates their own report procedure against that data source without that screen included, they could see information we don't want them to see.

There's this whole need to acquire security for a data source description that a user has access to due to it being in the app directory their assigned group can view. We thought about creating individual app directories for specific users or departments, but that would open up the possibility for a specific user or dept needing a data source that other users/depts have access to eventually, and the need to duplicate master files which we don't want because of how app path search works (first one hit gets used). And creating all sorts of business views or modified data sources in MS SQL Server for one time use reports, etc. isn't feasible, let alone cannot be done if the end users needs live/real-time data versus historic data.

Somehow, IBI is logging user stats without the need to -INCLUDE that fact into users' content. I need to learn how...
(Proof: Admin Console -> Diagnostics -> Traces -> Procedure -> procedure.log)

In my case, I could -INCLUDE DB_USER in edasprof and everything would be tracked, even report caster jobs. BTW, in our environment, users can't create anything, they wouldn't have a clue how and have no desire to do it which is one of the reasons we've never ventured into portals. If users create anything it is by using the excel documents they get. They can't create anything in WebFOCUS.

Thanks for the additional information jgelona!