Prevent Users from Sending in Data - BPC 10 MS

[Former Member]

Hi,

We are looking for a way to prevent all users from sending in data after a specific time of the night (ex. 8pm EST), even if they are already logged into the system.  We do not want to take the system offline, as we have lots of scripts running between 8pm and Midnight.  Ideally, we'd like a message to pop up, for anyone who tries to login after 8pm or tries to send either via the EPM ribbon Send button or any custom VBA form buttons that we have which execute the EPMSubmitData function.

We're open to various options but ideally looking for a simple way without having to modify every template, or changing any server settings or custom SSIS packages.

Thanks in advance!

Brian

[Former Member · Accepted solution]

I'm not sure, but can't you write a stored procedure to

copy the current workstatus table to a tmp workstatus table

update the work status table to a locked status

Create a script logic to call this stored procedure

Create a package to call this script logic

Schedule that package to run daily at 8pm

duplicate this procedure to reverse the work status tables (copy the tmp workstatus back in the work status table) and schedule that package at 7 am

(OR you could kindly ask them and say that the BPC audit will reveal that they did work after 8pm 🙂 )

Does this seem a possible solution path towards your business case?

Kind regards,

christophe

[Former Member · Accepted solution]

Thanks Christophe,

I wish it was that simple, but we've politely asked our approximate 1000 users to refrain from submitting after 8pm, and they swear they don't, yet the audit tells another story... 😉

The work status is a good idea, but still won't work for us, as we have many of the users setup in the Dimensions to override the work status based on specific team security.

Any other suggestions utilizing a way to prevent user submissions via templates, while not taking the system completely offline since we'll have scripts running overnight?

Regards,

Brian

[Former Member · Accepted solution]

Hi Brian,

update the owner property in the driving dimension for the work status as well in a similar way. replace all values by sys_admin and at day break set the original values back.

Also, try and run the scripts closer to 7 am.. and free the night to take it offline..

Maybe you could write VBA to prevent the sending operations if time > 8pm. Then, you also have to protect that worksheet and strip them from rights to create templates themselves.. So, not ideal as well.

Last option, not the best one I admit. Run a full optimize at 8pm. clear FAC2 and FACWB before execution of the nighlty scripts, run the scripts and end with full optimize. At 7 am. start the day with a clear of the FAC2 and FACWB..

-- or copy the values to a tmp table to verify what has been done...

no other suggestions I can give right now.

[Former Member]

Hello Brian,

You may prevent users from writing to the selected members or views by using the member access profile in administration console and creating a profile with read only privileges.

Please let me know if I might assist.

Best Regards,

Hamda.

[former_member186498]

Hi Brian,

why you don't want to use appset status feature?

I think this is the bpc solution, for users system is not available and admin can continue to work also with packages and you if you need you can test if the system is available or not adding a simple select on the tbldefault, so you can stop or send data also from excel.

Regards

     Roberto

[Former Member]

Hi Roberto,

When we take the system offline, it does prevent users from logging in or submitting if they were already logged in, however you are not able to run any data manager packages... it states in the package log which goes to failure, that the environment is offline.

Did you expect it to still allow the ability to run packages while offline?  Maybe there's another setting somewhere we need to enable?

Thanks,

Brian

[former_member186498]

Hi Brian,

I tried now and I'm able to run standard full optimize with data compress and index and also custom packages when appset is offline also if it's as "user package" it's sufficient that I'm an administrator with offlineAccess task (have you too this task?), another change in behaviour from 7.5 to 10?

Verify that your package is "admin package" maybe now only if admin package they can run.

When we take the system offline, it does prevent users from logging in or submitting if they were already logged in.

yes this is true but they receive a message that system is not available, they can read data, not always they can receive also "evdre encountered an error ..." message, but if they send data they will receive an error.

Remember that as per security guide if you have offlineAcces you should be able to send data.

Regards

     Roberto

[Former Member]

Hi Roberto, I work with Brian and we have tried having a package that is checked for admin only and take the system off line.  When we run it, it fails for being offline.  Is there a setting somewhere else where we can enable this? Thanks, Tracey

[Former Member]

Hi Roberto,

I am checking our Task profiles now and we have all access I believe, but where specifically is this "offlineAccess" task configuration controlled from?

Thanks!

[Former Member]

Hi Brian

Here is a quick and dirty method that comes to mind:

You could schedule a task to stop the Send Governor service on the appserver(s) at 8 PM and then restart it whenever you want to allow the users to send again.

Please note that any DM packages that are writing to the WB table in that interval will fail. If the DM packages are writing to the FAC2 table or FACT table then this should not be an issue.

Make sure you test this solution before implementing it as I can't forsee what other implications may have ion your particular scenario.

Stefan

[former_member186498]

Hi Tracey and Brian,

sorry OfflineAccess was the name of the task in 7.5 version it should correspond to

As system administrators you should have this task and also "Run Admin Packages" task so probably this change the behaviour, in my version is possible to run packages as admin when the appset is offline in this version seems not possible.

Have you tried setting package as "admin package"?

Regards

     Roberto

[Former Member]

Thanks Roberto,

We definitely are able to log in as administrators, but even where packages are setup as Admin, User or both, we get the same error about the AppSet being offline:

Total Step:    1

Execute formulas:     Failed in 1 seconds

Default Formulas:     completed  in 1 sec

[Message]

--------------------------------------------------------------

Execute formulasError

current AppSet status is OFFLINE

Ultimately, we were hoping there was functionality that worked as your saying it should, where if we bring the system offline, Admins can still run Packages while the rest of the user population would get an error on trying to log in, or if they were already in and tried to send data.

We knew it was a longshot without specific customizations... unless there's another setting somewhere in BPC MS v10 that can accomodiate this via delivered functionality.

We have teams/tasks/dimension owner properties and work status already configured... yet we are looking for a low maintenance solution that would be utilized for approximately 4 months at the end of each calendar year.

[former_member186498]

Hi Brian,

this change from previous versions seems a bug why you not open an incident to SAP?

A possibility is to follow the idea of Stefan or to create a query that update backup a copy of the involved table(s) and after delete all user from the teams so they will loose all rights.

After finished the admin activities another query that restore the old table(s).

You can also launch these queries from custom packages that you can schedule.

Regards

     Roberto