"IOM call failed. Internal server exception: access violation" occurs in SAS® Metadata Server


An issue can occur in which SAS Metadata Server and the environment become unresponsive at random. As a result, the following error occurs in the SAS Metadata Server log:

2026-01-14T12:01:15,928 ERROR [03042428] :sasadm@saspw - IOM call failed. Internal server exception: access violation.
2026-01-14T12:01:15,930 ERROR [03042428] :sasadm@saspw - Failed to process peer request.

This issue might occur in software versions at SAS® 9.4M8 (TS1M8) and later. 

Cause

The SAS 9.4M8 environment relies on OpenSSL, whereas earlier versions relied on the SAS/SECURE™ software.

After an Upgrade in Place (UIP), SAS/SECURE is likely left in the SASHome directories. 

Prior to SAS 9.4M8, the cryptographic libraries that SAS/SECURE used were delivered as part of the SAS installation. However, starting with SAS 9.4M8, SAS requires you to install supported cryptographic libraries on the SAS® Foundation operating system where SAS 9.4M8 is installed.

SAS uses the cryptographic libraries that are installed and configured on the operating system to provide encryption for data in motion and data at rest.

Workaround

Set Environment Variables for the OpenSSL Libraries

The example below demonstrates that SAS/SECURE is installed in the sasexefolder:

SASHome/SASFoundation/9.4/sasexe$ ls libcrypt* libssl* |wc
ls: cannot access 'libcrypt*': No such file or directory
ls: cannot access 'libssl*': No such file or directory
      0       0       0

If files (that is, counts) are returned, then SAS/SECURE is likely still installed. You can confirm this installation with SAS® Deployment Manager.

Here is an example:

$ openssl version -a
OpenSSL 1.1.1k  FIPS 25 Mar 2021

The output above shows that OpenSSL 1.1.1 is installed. 

If SASFoundation/9.4/sasexe still contains old libcrypto/libssl modules, those modules likely made it into the LD_LIBRARY_PATH.

In this scenario, you could add the following lines to <SASHome>/SASFoundation/9.4/bin/sasenv_local to force the correct libraries.

export TKESSL_OPENSSL_LIB=/usr/lib64/libssl.so.1.1
export TKERSA2_OPENSSL_LIB=/usr/lib64/libssl.so.1.1
export TKECERT_CRYPTO_LIB=/usr/lib64/libcrypto.so.1.

Note: Different versions of OpenSSL contain different libraries.