3 Replies Latest reply on May 23, 2016 5:17 AM by Zaheer Ahmed

    Monitoring Tableau Server Full Data Download

    Zaheer Ahmed

      Hello,

       

      We recently started using Tableau Server. We want users to be able to connect to the data set, create reports and visualizations.  But we don't want to allow users to pull down underlying data just summary data. However, Tableau current security model doesn't deny content owner from downloading underlying data (despite with explicitly deny permission of 'Download Full Data').

       

      So we have to compromise it, and follow the monitoring approach with warning users that they are not supposed to download underlying data.

       

      We want some monitoring mechanism in place so that we could audit trail the user activities. But we could not find users' action that record 'full data download' request in the Tableau Server Admin data dictionary.

       

      Moreover, we couldn't find any reference to full data download in the logs files after setting logging level to trace.

       

      Also had investigated Tableau Server underlying PostgreSQL database but didn't find 'Full Data Download' event in its 'historical_event_types' table.

       

      How can we monitor/track users if they do full data download from a worksheet/view?

       

      We would highly appreciate any workaround/idea to achieve this requirement.

       

       

      Cheers,

       

      Zaheer

        • 1. Re: Monitoring Tableau Server Full Data Download
          Jennifer Lynch

          I am a little confused about your question.  There is one content owner, bu you said above that you want to restrict multiple users from downloading underlying data. Can you please clarify this a bit more?

           

          Also, are you trying to restrict the full data from the actual content owner?

           

          If so, this seems a bit odd since they would have had access to it when they built the workbook.

           

          Thanks!

          • 2. Re: Monitoring Tableau Server Full Data Download
            Russell Christopher

            Hi Zaheer -

             

            As Jennifer mentioned, this request is a bit out of the ordinary - generally the content owner will be the same person who initially created the workbook (and therefore had complete permissions on the data to begin with).

             

            Sometimes ownership will be changed post-publish, however. Or the "open analytic" culture hasn't caught on strongly enough. Anyway, if this is a requirement, you can find the information, but it takes some heavy lifting on your part.

             

            The query below is something I put together for a different customer who had the same question. It is unsupported and it relies on certain flags in the system tables that could change in the future. Use at your own risk

             

            In essence, it looks for looks for someone doing a "View Data" and then rendering the information to a csv file - which is what happens when you download the data in question. This query should give you a good feel for the tables and flags in question, and you can take if from there.

             

            SELECT

                            r.created_at,

                            r.user_id as "User ID - Site",

                            u.system_user_id as "User ID - System",

                            su.name as "User Name",

                            su.friendly_name as "Friendly Name",

                            r.user_ip,

                            r.site_id,

                            r.currentsheet,

                            r.session_id,

                            r.vizql_session

            FROM

                            http_requests vd

            INNER JOIN

                            http_requests r

            ON

                            vd.vizql_session = r.vizql_session

                            INNER JOIN

                                            users u

                            ON

                                            r.site_id = u.site_id AND  r.user_id = u.id

                            INNER JOIN

                                            system_users su

                            ON

                                            u.system_user_id = su.id

            WHERE

                            r.action = 'show' AND -- Begin Rendering

                            vd.action = 'vud' AND -- View Data

                            vd.http_request_uri like '%csv=true%' – View Data AND Download it

            ORDER BY

                            r.created_at

            1 of 1 people found this helpful
            • 3. Re: Monitoring Tableau Server Full Data Download
              Zaheer Ahmed

              Hi Russell,

               

              Thank you for providing the solution that seems fulfill our monitoring data download request but with the caution of any future changes. That mean we will have to be careful when upgrading Tableau Server.

               

              I agree with Jennifer and you that the requirement is bit odd but we have to comply with the data governance rules.

               

              Again, I would highly appreciate you for resolving our problem.

               

              Cheers,

               

              Zaheer