Limiting access to only view the job log.

michaeld · Post by **michaeld** » Tue Jul 10, 2007 9:03 am

Is there any way to limiting access in director to only be able to view the job log? We want our developer to be able to view the production job log, but not be able to run the jobs. So granting operator access is not an option. Does anybody know if this is possible? I can't think of any way to do it, but maybe someone has a good idea.

My approach is to create a web interface to dsjob.exe utilizing the -logsum and -logdetail commands. However, I wish it would be possible just to do it in datastage without any external scripts.

ray.wurlod · Post by **ray.wurlod** » Tue Jul 10, 2007 11:32 am

Add this user to a group to which the DataStage Operator role only is assigned, and to no group to which the DataStage Developer role is assigned for this project. Check the "operator can view full log" when configuring DataStage roles for this project.

michaeld · Post by **michaeld** » Tue Jul 10, 2007 11:35 am

view the production job log, but not be able to run the jobs. So granting operator access is not an option

An operator can run jobs. I do not want the user to be able to run jobs.

chulett · Post by **chulett** » Tue Jul 10, 2007 11:39 am

You'll need to find some other mechanism to deliver log information to them, something other than Director as you've already noted. I don't believe there is any such mechanism built into the Client tools that would allow log looking but not job running.

mctny · Post by **mctny** » Tue Jul 10, 2007 11:45 am

is there a limited number of jobs you don't want that operator to be able to run, or is it all the jobs? if it is the first case you can do some workaround.

chulett · Post by **chulett** » Tue Jul 10, 2007 12:17 pm

Such as?

mctny · Post by **mctny** » Tue Jul 10, 2007 12:22 pm

chulett wrote:Such as?

it will be a naive way but you can make the job aborted when he tries to run with his username. for other users the jobs can run without abort.

ray.wurlod · Post by **ray.wurlod** » Tue Jul 10, 2007 12:59 pm

The Operator role can only run released jobs. I'm prepared to bet you have none of these.

The Super Operator role has been introduced at version 8.0 to allow running of all runnable jobs.

chulett · Post by **chulett** » Tue Jul 10, 2007 1:02 pm

Ah... forgot about that little wrinkle. Usually that's considered a Bad Thing, but here... not so much.

'Super' Operator role, eh? Nice to know.

michaeld · Post by **michaeld** » Mon Jul 23, 2007 7:53 am

The Operator role can only run released jobs. I'm prepared to bet you have none of these.

Ray, I'm runing parallel jobs in windows. As far as I know there is no such thing as releasing parallel jobs. So, the operator can run them.

Any other ideas?

chulett · Post by **chulett** » Mon Jul 23, 2007 8:16 am

No, what it should mean is since the Operator role can only see 'released' jobs, there's nothing to see and thus nothing to run.