Ability to view logs in Director but not start/stop jobs?
Moderators: chulett, rschirm, roy
Ability to view logs in Director but not start/stop jobs?
Hello,
Running Datastage 8.1 Enterprise Edition on Windows 2003.
I've seen in the Administrator Client Guide that the two user roles with access to the Director Client (Operator & Super Operator) both allow jobs to be started/stopped.
We would like, for SOX reasons, the ability for certain staff members to be able to view logs in Director but not have the ability to start/stop jobs in any way.
Is there any workaround for this requirement of ours?
Thanks,
David
Running Datastage 8.1 Enterprise Edition on Windows 2003.
I've seen in the Administrator Client Guide that the two user roles with access to the Director Client (Operator & Super Operator) both allow jobs to be started/stopped.
We would like, for SOX reasons, the ability for certain staff members to be able to view logs in Director but not have the ability to start/stop jobs in any way.
Is there any workaround for this requirement of ours?
Thanks,
David
You typically accomplish something like this by automating the exporting of job logs into a persistent store (say like an rdbms) and then allowing people to query that store. There's no way that I know of to allow logs to be viewed from the Director client but disallow the running of jobs.
Could be wrong, though.
Could be wrong, though.
-craig
"You can never have too many knives" -- Logan Nine Fingers
"You can never have too many knives" -- Logan Nine Fingers
-
- Participant
- Posts: 54607
- Joined: Wed Oct 23, 2002 10:52 pm
- Location: Sydney, Australia
- Contact:
-
- Premium Member
- Posts: 425
- Joined: Sat Nov 19, 2005 9:26 am
- Location: New York City
- Contact:
In IIS 8.1 world you can obtain a lot of those reporting/auditing in the Web Console for any activity that has been completed in any component of the suite .....
You can customize a report or a log view that can be saved in the metadata repository and accessed only by authorized users
Please note that IBM recommended to reversed the feature that allow the tool to saved DS Job logs in the metadata repository and continue using the old way...... so for this suggestion to work we should wait until IBM fix the issue ...
You can customize a report or a log view that can be saved in the metadata repository and accessed only by authorized users
Please note that IBM recommended to reversed the feature that allow the tool to saved DS Job logs in the metadata repository and continue using the old way...... so for this suggestion to work we should wait until IBM fix the issue ...
Julio Rodriguez
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses
Hmmm... I thought that was something they 'fixed' in the 8.x world. And added the Super Operator to boot. Ah well.ray.wurlod wrote:Operator role can not start most jobs. Operator role can only start "released" jobs, which almost nobody uses any more.
-craig
"You can never have too many knives" -- Logan Nine Fingers
"You can never have too many knives" -- Logan Nine Fingers
-
- Participant
- Posts: 3593
- Joined: Thu Jan 23, 2003 5:25 pm
- Location: Australia, Melbourne
- Contact:
You can view all the DataStage logs view Log Management in the Information Server console. I created a user with only "operational metadata user" and "metadata workbench user" rights. I can log into console and I see Home, Administration and Reporting tabs. On the Administration tabs I see Domain Management (my DataStage credentials only), Log Management - the ability to open, create and delete log views and Schedule Monitoring - the ability to see views of job schedules. You could setup a log view for example that just showed DataStage fatal errors, another that showed Warnings, another that showed both.
For DataStage log reports you add a category filter onto a log view for IIS-DSTAGE-RUN messages. To filter on a specific DataStage project you need to go into Context and enter the project name against DSProject.
There is a drawback. The interface is not as intuitive as Director. In fact I think it's woeful, you cannot set the sort order, change column orders or even change the width of columns. Filtering or finding specific jobs is difficult. The navigation between viewing a log view and changing the parameters of that log view is clunky and just plain unfriendly. You cannot view or filter on job category/folder, you cannot filter on wildcard job names etc.
For DataStage log reports you add a category filter onto a log view for IIS-DSTAGE-RUN messages. To filter on a specific DataStage project you need to go into Context and enter the project name against DSProject.
There is a drawback. The interface is not as intuitive as Director. In fact I think it's woeful, you cannot set the sort order, change column orders or even change the width of columns. Filtering or finding specific jobs is difficult. The navigation between viewing a log view and changing the parameters of that log view is clunky and just plain unfriendly. You cannot view or filter on job category/folder, you cannot filter on wildcard job names etc.
Certus Solutions
Blog: Tooling Around in the InfoSphere
Twitter: @vmcburney
LinkedIn:Vincent McBurney LinkedIn
Blog: Tooling Around in the InfoSphere
Twitter: @vmcburney
LinkedIn:Vincent McBurney LinkedIn
Thanks, this is all good stuff!
With our EE 8.1, I'm finding that if DSParams is set such that RTLogging=1 & ORLogging=0, then the logs are ONLY available via Director and not via the Web Console. On the other hand, if RTLogging=0 and ORLogging=1, then the logs are only visible via the Web Console and not via Director. Is this consistent with the behavior on others' systems??? (I want to confirm that Director can only display RT Logs and that Web Console can only display operational repository logs, and that they're each mutually exclusive.)
So right now, our Test environment is set to RTLogging so that we can use the rich functionality of Director, but in Production, it is set to ORLogging so that those who view the logs cannot start/stop jobs.
In the end, I am not fond of a.) Production being different from Test in this configuration and b.) Production using the method that IBM is recommending against (operational repository logging) due to performance reasons and possibly other factors.
Any more thoughts?
With our EE 8.1, I'm finding that if DSParams is set such that RTLogging=1 & ORLogging=0, then the logs are ONLY available via Director and not via the Web Console. On the other hand, if RTLogging=0 and ORLogging=1, then the logs are only visible via the Web Console and not via Director. Is this consistent with the behavior on others' systems??? (I want to confirm that Director can only display RT Logs and that Web Console can only display operational repository logs, and that they're each mutually exclusive.)
So right now, our Test environment is set to RTLogging so that we can use the rich functionality of Director, but in Production, it is set to ORLogging so that those who view the logs cannot start/stop jobs.
In the end, I am not fond of a.) Production being different from Test in this configuration and b.) Production using the method that IBM is recommending against (operational repository logging) due to performance reasons and possibly other factors.
Any more thoughts?
Seeing as how there are two separate options for logging, I would think they are not mutually exclusive - it's just that they are typically used in that manner. So I would therefor think you could have both if you really wanted and could take the 'performance hit' that I assume that would bring.
You are correct about which tool can display what.
You are correct about which tool can display what.
-craig
"You can never have too many knives" -- Logan Nine Fingers
"You can never have too many knives" -- Logan Nine Fingers
-
- Premium Member
- Posts: 425
- Joined: Sat Nov 19, 2005 9:26 am
- Location: New York City
- Contact:
If RTLogging=1 and ORLogging=0 the logs will be available in both Director and via the Web Console. If RTLogging=0 and ORLogging=1 only via DS Director .....
In our case we have all environment set equal, RTLogging=1 ORLogging=0, so we need to see logs in Director. main reason for this is that we want to avoid the risk of losing logs.
In the past even the job ran the logs only show up long after the job ran or not show up at all. Also we experience an increase in job run times when the amount of logs was considerable in the metadata repository, so we decide not to used this functionality until Big Blue fix the issue
In our case we have all environment set equal, RTLogging=1 ORLogging=0, so we need to see logs in Director. main reason for this is that we want to avoid the risk of losing logs.
In the past even the job ran the logs only show up long after the job ran or not show up at all. Also we experience an increase in job run times when the amount of logs was considerable in the metadata repository, so we decide not to used this functionality until Big Blue fix the issue
Julio Rodriguez
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses
In your second sentence, do you really mean Web Console?JRodriguez wrote:If RTLogging=1 and ORLogging=0 the logs will be available in both Director and via the Web Console. If RTLogging=0 and ORLogging=1 only via DS Director .....
Here's what's odd. Like I said, our Test environment has RTLogging=1 and ORLogging=0. But the logs are NOT visible in Web Console since we set the setting this way (I can still view old logs from when it *was* set to ORLogging). The new logs are ONLY available in Director. Maybe this is part of the problem with logs not showing up in Web Console at all? This is acting very squirrely.
-
- Premium Member
- Posts: 425
- Joined: Sat Nov 19, 2005 9:26 am
- Location: New York City
- Contact:
Sorry, I wrote it backward, here is how should be:
If RTLogging=1 and ORLogging=0 the logs will be available ONLY in Director. If RTLogging=0 and ORLogging=1 in DS Director and the Web Console..... for any job that run after you put this setting in DSParam. Old logs will still be available in the Web console ..
By the way you would like to remove the old logs from the metadata repository ... that could be affecting the overall job's performance and the tool itself
If RTLogging=1 and ORLogging=0 the logs will be available ONLY in Director. If RTLogging=0 and ORLogging=1 in DS Director and the Web Console..... for any job that run after you put this setting in DSParam. Old logs will still be available in the Web console ..
By the way you would like to remove the old logs from the metadata repository ... that could be affecting the overall job's performance and the tool itself
Julio Rodriguez
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses
ETL Developer by choice
"Sure we have lots of reasons for being rude - But no excuses