Very interesting ! My college from SOC send me soon queries about user activity , such as suspicious querying by users. Do you have some custom script examples for analysing availability and security such as disk usage ? We also going to use Teradata DBQL/PDCR logs and Linux nmon logs, but that's not available yet..
i used custom scripts to populate my sas logs. You can track stuff like disk usuage by users on the SAS work or SAS data spaces. I use it for admin tasks such as cert expiration, start up of sas, shutdown of sas. From an admin point of view that was how far i was able to go with it. With VA available not sure how much deeper i can suggest.
Hi,
Are you any further with ingesting (by the forwarder) and tieing together fields of different SAS log jobs ? allready experience with SAS and DB Connect ?
I know its an old topic but did you get it to work? I'm doing it right now, the basic stuff untill now, like Logins, libname mapping, sas compress effect, sas procs used, errors...
