Welcome to MSDN Blogs Sign in | Join | Help

Brian Smith's Project Support WebLog

What's new and upcoming in the world of Microsoft Office Project Support (PSS).
Microsoft Office Project Server 2007 and SQL Server 2005 Analysis Services - Building Cubes

Following on from my permissions piece with Project Server I will extend this logic to the service accounts and permissions to get a successful cube build.  I'll start with an explanation of what goes on when building cubes which should help any troubleshooting you do.

When you click on Build Cube then this kicks of a sequence of events starting with the save of any new or changed data in the cube settings - such as the server or cube name.  Next a job will be placed on the Project Server queue requesting a cube build.  This job will be picked off the queue and processed by the Microsoft.Office.Project.Server.Queuing.exe process, which will spawn the ProjectServerOLAPCubeGenerator.exe process. Both of these processes will be running under the identity of the admin account of the SSP - in my last posting this is the SSPAdmin.  So this user needs to be an admin within Analysis Services so it can communicate through DSO to Analysis Services.  This permission is added through a SQL Management Studio connection to Analysis Services by right-clicking the instance name and then selecting Properties, selecting the Security tab and then adding the user (a restart of the Analysis Services service at this point will also unsure the running instance is aware of the permission change) .  This process also needs to access the repository of meta data used to define the cubes.  This repository is detailed in KB 921116 (as are some other pre-requisites for multi server environments) and is in a share on the Analysis Services server called MSOLAPRepository$.  If you have a single server then the share will not be used - instead the direct directory location of C:\Program Files\Microsoft SQL Server\MSSQL.X\OLAP\DSO9. (The X will be a number relating to the installation of analysis services).  Therefore SSPAdmin, or your equivalent service account will need read and write access to this directory - and if you are in a multi server environment then also read/write access via the share.

The next activity in the cube building process is the Analysis Services executable - MSMDSRV.exe -  actually building the cube based on the instructions given by the ProjectServerOLAPCubeGenerator.exe process.  This executable runs under the identity of the account running the SQL Server Analysis Services (MSSQLSERVER) (or named instance) service.  I'll refer to this account as ASAdmin  So this account needs to be able to read the reporting database of the Project Server instance, which is in effect the staging tables for the cubes.  Adding a login to SQL Server for ASAdmin with datareader role on ProjectServer_Reporting (or whatever reporting database name you are using) achieves this.  That should be all you need to get a cube building.

So basically the SSPAdmin needs to be an admin in Analysis Services with read/write access to the repository.  ASAdmin needs datareader access to the reporting database.

Also remember - when building a cube your application server is talking to/from your SQL Server Analysis Services server - when viewing or building views in Project Web Access your client PC is talking directly to your Analysis Services server (and each client needs the ASOLEDB 9.0 components).  Make sure any firewalls allow for this traffic.

The default instance of Analysis Services will normally be listening on port 2383.  If you have named instances then the SQL Browser service will need to be running on the server to tell give clients a port for the named instance.  The SQL Browser is normally on port 2382.

Named instances of Analysis Services will have other dynamically allocated ports. These can be discovered by looking in the configuration file for SQL Server Browser.  Open the msmdredir.ini file located at %Program files%\Microsoft SQL Server\90\Shared\ASConfig and look at the <Instances> section in it.  On 64 bit machines this may be in the Program Files (x86) directory.
Here is an example:-

<Instances>
     <Instance>
         <Name>AS2005</Name>
         <Port>1259</Port>
     </Instance>
 </Instances>

and would mean your AS2005 instance is listening on port 1259.

For my next post, rather than cluttering this one, I will show a variety of the errors from both ULS logs and Event logs that can appear if the above settings are not in place.

Technorati Tags:

Posted: Tuesday, February 13, 2007 10:02 PM by BriSmith

Comments

Alejandro said:

Thanks a bunch for posting this, actually this is the most useful information on Internet that i've found about this issue, I have only 1 question, the owner of the process ProjectServerOLAPCubeGenerator.exe is NETWORK SERVICE. Are there any problems, if I give permissions to this user? (beside a bad design, hehe)

# February 22, 2007 11:43 AM

BriSmith said:

Hi Alejandro,

I must admit to a strong preference to named service accounts to handle specific functions - but apart from "bad design" as long as the account has the right permissions set and can communicate with any other servers they need to then it will work.

Thanks for your feedback.  I'm trying to post information that people will find useful.

Brian.

# February 22, 2007 12:13 PM

JCano said:

Great information about SSAS 2005. I've a question and a little problem.

The question is if I need to buy the Enterprise Edition of SQL Server 2005 for enabling portfolio analyzer views on the internet/extranet (I think in SQL 2000 it was needed, isn't it?)

The problem I've is creating calculated members from PWA, it always show me an error saying that the member has a bad name (or it also exists). I've tried to create a memeber with a simple MDX expression (the one shown in the Project Server SDK of Availability = [Capacity]-[Work]). Tried with another ones and have the same problem. Maybe I forgot to configure somethung in Analysis Services?

Thanks

# February 28, 2007 3:53 AM

Liliya.kantor said:

Hi Brian,

I have Analysis Services running under SQLAdmin account, and SSP administrator is SSPAdmin. In order to enable cube building, I had to make both SQLAdmin and SSPAdmin accounts as administrators within Analysis Services. Also I had give SQLAdmin, SSPAdmin, and PS administrator permissions to read/write access to the DSO9 share. Only this setup allows successful cube building on my server. Do you possibly have any idea why my setup requires so many accounts to be added to various places unlike your description of the process? I would greatly appreciate if you could enlighten me on this matter.  

Thanks, Liliya

# April 15, 2007 2:29 AM

BriSmith said:

Hi Lillya,

The only permission that seems un-necessary is the PS admnistrator on the DS09 share.  I would expect the SQLAdmin to need to be in the OLAP administrator and have permission on DS09, and the SSPAdmin likewise.  Let me know if I am missing something here and if you think other permissions shouldn;t be needed.

Best regards,

Brian.

# April 15, 2007 8:07 PM

Liliya.kantor said:

Hi Brian,

Thank you for your reply.

This is really strange but in addition to the SSPAdmin and SQLAdmin (AS service logon account) I do need to add Project Server instance administrator to the share. Otherwise I am getting the following error when building the cube:

Failed to build the OLAP cubes. Error: Analysis Services session failed with the following error: Failed to delete the Olap database: PWA_AnalysisServices. Error: Your permissions on the server computer do not allow you to administer this Analysis server. Error:

I didn't find any explanations why this happens. But if I add PS instance administrator to the Share the error goes away.

Thank you,

Liliya

# April 15, 2007 10:52 PM

BriSmith said:

I haven't seen this one.  I would check for any configuration settings such as adding extra dimensions, measures or MDX statements.  

# July 16, 2007 6:22 PM

Dave808K said:

Liliya, try to set the DSO\RemoteLocksDirectory value on the analysis server to \\yourserver\MSOlapRepository$\.  This was the only thing that worked for us after trying to permission everything every which way.

# September 4, 2007 2:40 PM

John Smith said:

For info:

After reading through this and many many other articles, the only way I could get the cube to build was to make the service account a local admin on both the PWA and SQL servers.

# September 14, 2007 5:11 AM

BriSmith said:

Hi John, thanks for this feedback.  Although that probably confers the right permissions you should be able to get the cube to builds as long as the service account for the SSP is an admin in Analysis Services, the service account for Analysis Services has datareader permissions for the reporting database and the repository is available read/write for both.  Making the user an admin is more permissions than it really needs.

Brian.

# September 14, 2007 1:26 PM

Claudio Hidetoshi said:

Hi Brian,

can I extend PS2007 database in Analysis Services, creating more two cubes ?

i.e: PS2007 14 cubes and I want to add more 2 cubes with information about fields with formula and information from other databases (HR and SAP).

Is it possible ? Or I must have to build another database to put the two cubes ?

Thanks,

Cláudio Hidetoshi

Rio de Janeiro - Brazil

# December 11, 2007 7:15 AM

BriSmith said:

Hi Cláudio,

As we always re-build the entire cube you would probably need to also re build/link to your other data. I think Analysis Management Objects would be the tool to use - see Christophe's posting http://blogs.msdn.com/chrisfie/archive/2007/08/06/customizing-analysis-services-cube-using-analysis-management-objects-amo.aspx for details.

Best regards,

Brian.

# December 11, 2007 12:23 PM

Dave said:

Hi Brian,

I am having trouble building a cube in Project server 2007. I get the 7682 Event viewer error in the event log.

I have configured an OLAP respository using a SQL Server 2005 database (called Analysis Services Repository) as per option 2 in the technet arcticle "requirements for using SQL Server 2005 Analysis Services with Project Server 2007 cude building services". The installation of WSS I am working with has NETWORK SERVICE as the SSP service account. I have followed your instructions "SSPAdmin needs to be admin in analysis services" but I'm not sure what I have to do here. I have tried setting the user mapping for the NETWORK SERVICE account to a number of db_ roles but to no avail. I have also tried adding a server role for the account, and restarted the analysis service after each change.

Finally I added the NETWORK SERVICE account to the administrators group for the server. The cube built sucessfully after this.

Could you tell me which server role and or database role I have to grant the NETWORK SERVICE account for the repository database or any other database if I totally missing the point?

Cheers

Dave..

# January 15, 2008 8:04 PM

BriSmith said:

Hi Dave,

I think the piece you are missing is to open SQL Management Studio, Connect to Analysis Services, Right Click the server name and go to Properties, then click the option in the left pane for Security and add your user there.  It is a bit vague and not as straight forward as adding to groups was for SQL Server 2000 AS.

Brian.

# January 16, 2008 7:30 PM

david_s said:

Hi Brian,

thanks for the swift reply the I have already added the NETWORK SERVICE account to the Security page of the Analysis Services properties in SQL Management Studio. Any other tips?

Cheers

Dave..

# January 17, 2008 3:24 AM

BriSmith said:

Hi Dave,

If you have restarted AS, then I would check the logs for other clues, and try SQL Profiler to see where the process is breaking down.  Making sure all components are at the same relase level is also important.

Best regards,

Brian.

# January 17, 2008 1:07 PM

david_s said:

Hi Brian,

I have removed the NETWORK SERVICE account from the administrators group and now I get this error.

[21/01/2008 11:48 AM] Analysis Services session failed with the following error: Failed to connect to the Analysis Services server VSPROJECT\OFFICESERVERS. Error: A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running.

===== Process Completed =====

[21/01/2008 11:48 AM] Failed to build the OLAP cubes. Error: Analysis Services session failed with the following error: Failed to connect to the Analysis Services server VSPROJECT\OFFICESERVERS. Error: A connection cannot be made to redirector. Ensure that 'SQL Browser' service is running.

After some more googling I think the problem is related to using a local machine account. This article also describes a smiliar problem.

http://www.msdner.net/dev-archive/20/19-83-207541.shtm

If I try to use the SQL Profiler to connect to the analysis service I get the same error.

What do you think?

Cheers

Dave

# January 20, 2008 9:21 PM

BriSmith said:

Hi Dave,

You are using a named instance of Analysis Services and this works on a random port.  The SQL Browser service is used for other connections to discover what port is used.  I assume that removing that account from the administrators group has either stopped SQL Browser from working - or it just cannot do its job.  I would check which of these is true and either give network service the permissions it needs - or assign a different account to run SQL Browser.

Best regards,

Brian.

# January 21, 2008 4:45 PM

Scott said:

Brian,

You mentioned above that when viewing or building cubes in PWA that the client machine is talking directly to Analysis Services via the OLEDB 9.0 component.  Does this mean that each end user needs permissions on Analysis Server?  I'm seeing a situation where the end users can only successfully connect if they are added to the "ProjectServerViewOlapDataRole" for the OLAP cube or are added at the Analysis Server Properties level.  

Scott

# February 5, 2008 12:55 PM

BriSmith said:

Yes Scott, users will need permissions on the cube.  The "properties" level shouldn't be needed as this is more of an admin permission.

Brian.

# February 5, 2008 1:24 PM

Scott said:

Thanks Brian.  So are the users supposed to be added manually?  I tried adding a group manually, but then when I re-built the cube the group had been removed and replaced with the users listed explicitly.

# February 5, 2008 2:14 PM

BriSmith said:

Project users should get added - but if you need other users outside of your PWA users to see the data then these will need to be added manually - and yes the cube rebuild will push them out again.  I think Analysis Management Objects can be coded to add these back after a cube build.  I think Christope posted on this (see links on the left of my blog)

# February 6, 2008 4:30 PM

David said:

Hi Brain

I am using a 2005 SQL server with project server 2007, they are both on the same server but when i try to build a cube it gives me the error of:

26/03/2008 14:01] Failed to build the OLAP cubes. Error: Analysis Services session failed with the following error: Failed to connect to the Analysis Services server projectserver. Error: Automation error

The system cannot find the file specified.

I have done and checked all the info that you have given but to no luck, can you please help me to get this working?

# March 26, 2008 12:33 PM

Daan said:

I have the same problem as David.

# April 1, 2008 6:45 AM

David said:

HI Brain

I think the file that it is looking for is one called a '00010004.bsd' do you have any idea what that is?

# April 4, 2008 9:50 AM

Daan said:

Hi David,

According to MS we had to uninstall the SQL feature packs we had and reinstall them again. That fixed the problem for us.

# April 4, 2008 6:48 PM

David said:

Hi Daan

Did you have SP1 installed on your SQL server?  And does the uninstalling of the SQL feature packs affect SQL database or project server at all?

Thanks for your help in this...

# April 7, 2008 5:34 AM

David said:

Hi Daan

What does the SQL feature pack consist of?

Microsoft SQL Server 2005 Books online

Microsoft SQL Server native Client

Microsoft SQL Server Support files

Microsoft SQL Server VSS writer

MSXML 6.0 Parser

SQLXML4

Are these all the programs that i would have to uninstall and reinstall again?

Thanks

# April 7, 2008 5:55 AM
Leave a Comment

(required) 

(required) 

(optional)

(required) 

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS

Page view tracker