SubsetFilterBySecurity - Rule [threads/tm1top]

Post Reply
User avatar
yyi
Community Contributor
Posts: 117
Joined: Thu Aug 28, 2008 4:42 am
Location: Sydney, Australia

SubsetFilterBySecurity - Rule [threads/tm1top]

Post by yyi » Tue Dec 04, 2018 3:20 am

Hi,

Does anyone know what this means? it's holding up the server and I'm not sure what's causing it except it happens when opening an excel template with an activeform. Function = SubsetFilterBySecurity, Object Type = Rule.


Thanks!
win2012 svr: tm1 v10.2.2 x64, client v10.2.2 x64/PA 2.0, win10, excel 365.

User avatar
paulsimon
MVP
Posts: 651
Joined: Sat Sep 03, 2011 11:10 pm
OLAP Product: TM1
Version: PA 2.0.5
Excel Version: 2016
Contact:

Re: SubsetFilterBySecurity - Rule [threads/tm1top]

Post by paulsimon » Tue Dec 04, 2018 11:05 pm

Hi

Can't say for sure by I would guess that you have rules in an }ElementSecurity cube, that vary the security rights to see elements in the dimension by Security Group. This implies that it is taking a while to evaluate these rules so that it can filter down the list of elements that it will show according to the groups that the user is in.

Things that might cause this :

a) If your users are in multiple security groups then the system will need to evaluate the rules for each group and then give the highest level of access, so if in one group they have NONE access but another they have READ then they will be able to see the element but if both groups have NONE access then the element will not be shown.

b) Do you have a skipcheck at the top of the rules in the }ElementSecurity cube? There is no reason not to, since security rights are text which will not consolidate. If you have PrivilegeGenerationOptimization set in your TM1S.CFG then you will need to use FEEDSTRINGS and feed the security rules or they won't work. For this reason we tend not to use that option as feeding security rules is not always that easy.

c) Have you recently upgraded to PA 2.0? This seems to have a much higher overhead on security rules than previous versions. I haven't noticed an issue so much on }ElementSecurity but then we don't have huge dimensions ie our biggest that has security is only a few thousand elements, whereas other systems I have worked on in the past have had over 100,000 elements. I have however noticed an issue with }CellSecurity rules, but that won't be the cause of your particular issue. I suggest you look at your system and see whether some or all of the security rules in your }ElementSecurity cube can be replaced with a TI that puts in the security rights. We use some generic TIs that apply the security to a copy of the dimension first, and then another TI applies only the changes to the main dimension.

d) If you can't replace the rules with TI loaded access rights, then see whether the rules can be simplified. PA does not seem to cache results that require a dimix in the rule.

Regards

Paul Simon

User avatar
yyi
Community Contributor
Posts: 117
Joined: Thu Aug 28, 2008 4:42 am
Location: Sydney, Australia

Re: SubsetFilterBySecurity - Rule [threads/tm1top]

Post by yyi » Thu Dec 06, 2018 4:56 am

Thanks Paul,

I checked out your suggestions and it turns out the thread (function, obj type) info might be a red herring. It became a problem when the data dir was upgraded to PA 2.0 from 10.2.2, the activeform that was using an mdx statement in the TM1RptRow( ) was not working like it did in 10.2.2. It was failing on the TopCount( .. ) portion of the statement. So I took out that part of the query and put it in a separate cell using TM1RptFilter( ) referencing TM1RptView( ). This has solved the problem but it doesn't explain why the mdx statement for topcount failed in PA & not in 10.2.2 :roll:
win2012 svr: tm1 v10.2.2 x64, client v10.2.2 x64/PA 2.0, win10, excel 365.

Post Reply