|
This topic describes incorrect output from RACF®. Generally, incorrect output can be missing
records, duplicate records, incorrect values, format errors, or meaningless
data.
Incorrect output could also be the improper issuing of an error
message, an abend code, a return code from a macro, or a wait-state
code. For example, an abend could be issued when no abend is needed,
or a message that should be issued is not issued. Another example
is message text that includes incorrect information.
Table 1. Troubleshooting
Table: Incorrect OutputSymptom |
Recommended Procedures for Incorrect
Output |
---|
Incorrect output: Improper access
to a protected resource with no message issued |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- Check the global access checking table for an entry describing
the resource. This step does not apply for z/OS or OS/390 z/OS UNIX System Services .
- Check for an installation exit for RACROUTE REQUEST=AUTH. This
step does not apply for z/OS or OS/390 z/OS UNIX System Services .
- Check the kind of RACROUTE request that was made. Compare it with
the level of protection of the resource. (Use LISTDSD or RLIST command
for the resource; use LISTUSER command for the user.) This step does
not apply for z/OS or OS/390 z/OS UNIX System Services .
- If the cause of the problem is not apparent, attempt to duplicate
the problem with another user doing the same kind of request. Try
another user with similar attributes and group associations. If the
problem can be duplicated, then determine which user attributes or
group associations cause the problem. This can help you define the
problem. If the problem cannot be duplicated with other users, try
to duplicate the problem with other resources protected like the original.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM®, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output:
Messages |
Action: - Make sure that you have all the error messages that were issued
for the user request, and make sure that message IDs are included
with the messages.
If a batch job produced the output, check that
the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had
the problem, check that the user profile had these options: PROFILE WTPMSG MSGID.
- Decide which of these types of messages applies:
- Macro error messages (MNOTEs)
- System error messages issued by RACF (messages
with prefixes of CST, HCP, ICH, IRR, and RPI)
- Decide what the nature of the message error is.
- Was the message valid but unexpected? See Messages troubleshooting table.
- Was the message itself incorrect; for example, did it contain
incorrect or unreadable data, or was an error message issued for a
non-error situation?
- If you had incorrect output from a RACF macro,
see Utilities for a list of common application
programming errors for RACF;
the results of some of these errors could appear to be incorrect output
from RACF.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
- For macro error messages (MNOTEs): Get a copy of the assembler
listing that contained the macro error message.
- For system error messages issued by RACF:
Get a copy of the part of the job log or system log that contained
the message. (The IBM support
center might also need to check messages that preceded the error message
in the log.)
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output:
Incorrect abends |
Action: - Check whether any error messages were issued in response to the
user request and make sure that message IDs are included with the
messages.
If a batch job produced the output, check that the job
statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem,
check that the user profile had these options: PROFILE WTPMSG MSGID.
- Decide what the nature of the abend error is.
- Was the abend valid but unexpected? Go to Abend troubleshooting table.
- Was the abend not documented? Go to Documentation troubleshooting table.
- Was the abend itself incorrect? For example, was the abend issued
for a non-error situation?
- If you had incorrect output from a RACF macro,
see Utilities for a list of common application
programming errors for RACF;
the results of some of these errors could appear to be incorrect output
from RACF.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
To Get the Dump Output and Analysis Results:
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output:
Improperly formatted output from RACF LIST
commands (LISTDSD, LISTGRP, LISTUSER, RLIST, and RACLINK LIST) |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- Decide what caused the incorrect output:
- The data read by the command (the RACF database).
If this is the case, see the table entry for the RACF database.
- RACF's processing of the command request
- If the database should have been updated by a command that was
issued on another system in the RACF remote
sharing facility (RRSF) network, check the status of the connection
with a TARGET LIST on this system and the originating system. Also,
check the RRSFDATA profiles on the originating system.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
You can capture the output by executing
the command in a batch job, or under the session manager, or in a
CLIST in which you trap the output from the command.
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output:
Improperly formatted reports (from DSMON or RACF report writer) |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the improperly formatted report.
You need it to analyze the problem or report the problem to IBM.
- Check whether the problem is caused by RACF in generating the report or by bad data
used as input to the report:
As a check on the RACF report writer, you can print (or display)
the SMF (system management facility) records using the access method
services PRINT command with DUMP specified.
As a check on DSMON,
use the RACF LIST commands
to check the profiles that seem to be reported incorrectly by DSMON.
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output:
SMF records (types 80, 81, or 83) |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- If the RACF SMF data unload
utility leads you to suspect that the SMF (system management facilities)
records are not valid, check to make sure that the SMF records are
at fault, not the utility.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
For SMF records (type 80 or 81):
|
Incorrect output:
The RACF database (this includes
profiles, index blocks, and inventory control block) |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- These RACF functions affect
the RACF database:
- RACF commands that add,
alter, or delete profiles (such as ADDUSER, ALTUSER, DELUSER, RDEFINE,
RALTER, and RDELETE)
- BLKUPD command
- RVARY and SETROPTS commands
- IRRUT400 utility
- RACF macros: RACDEF, RACINIT,
ICHEINTY, ICHETEST, ICHEACTN, and RACXTRT (with ENCRYPT or TYPE=REPLACE
specified)
- If the database should have been updated by a command that was
issued on another system in the RACF remote
sharing facility (RRSF) network, check the status of the connection
with a TARGET LIST on this system and the originating system. Also,
check the RRSFDATA profiles on the originating system.
- If you had incorrect output from a RACF macro,
see Utilities for a list of common application
programming errors for RACF;
the results of some of these errors could appear to be incorrect output
from RACF.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM. Run the IRRUT200 utility and the BLKUPD
command to get a description of the RACF database.
See z/OS Security Server RACF System Programmer's Guide for
a description of how to use IRRUT200, and Block Update command for a RACF database (BLKUPD) for
a description of how to use BLKUPD.
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
Incorrect output: RACF subsystem |
Action: - Check for any messages that might have been issued by the RACF subsystem.
- Refer to z/OS Security Server RACF Messages and Codes.
- If the RVARY command, along with other commands, is not working,
then the subsystem is also not working correctly.
- Check to see if the subsystem initialized correctly; if it did
not, check for an install problem and get a system console log (SYSLOG).
- If a userid.RRSFLIST data set is missing output,
or contains incorrect output:
- Issue the SET LIST command and verify that:
- Automatic direction or password synchronization is active for
the type of request for which output is missing.
- The OUTPUT keyword specifies the user ID that should be receiving
the missing output.
- The correct level of output is specified (ALWAYS, WARN, or FAIL).
- Check the RRSFDATA profiles and access lists and make sure that
the requests are really being directed.
- Check the TSO PREFIX specification for the user ID that is missing
the output. If it is set to something other than the user ID, the
RRSFLIST data set might have a different name than you expect.
- Issue the TARGET LIST command on both nodes involved, and make
sure that they are both operative-active, and that requests are not
queued in one of the INMSG or OUTMSG data sets.
- Check whether anyone stopped the RACF subsystem
address space, or used the TARGET command to purge an INMSG or OUTMSG
file while a request was active. These actions can cause requests
and output to be lost.
- Check for TSO TRANSMIT messages to the user ID that is missing
the output. If there was an error processing the RRSFLIST data set
a message should have been sent. Check the console log too.
- Make sure that the RRSFLIST data set is allocated with the proper
DCB parameters and is not full. If in doubt, you can delete or rename
it and let RACF create another
one.
- If an abend occurred, get a copy of the system dump that was taken.
- If the abend did not generate a system dump, and the problem is
reproducible, obtain a system dump. See Obtaining a system dump.
- Format the system dump. See Formatting a system dump.
Action |
Incorrect output:
Return or reason code from a RACF macro
or utility |
Action: - Check whether any error messages were issued for the user request
and make sure that message IDs are included with the messages.
If
a batch job produced the output, check that the job statement had
MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that
the user profile had these options: PROFILE WTPMSG MSGID.
- Decide if the return or reason code is:
- See Utilities for a list of common application
programming errors for RACF;
the results of some of these errors could appear to be incorrect output
from RACF.
- See Performing a preliminary search for a matching problem.
If you do not find a
matching problem, you need to collect problem information to report
to IBM, using the procedures
in the remainder of this list.
- Get a printed or online copy of the incorrect output. You need
it to analyze the problem or report the problem to IBM.
Note: If the macro return code or reason
code was incorrect, request a system dump from a RACF macro request that produced the incorrect
output when RACF returns control.
To Get the Dump Output and Analysis Results:
- See Searching for a matching problem.
- See Reporting RACF problems to IBM.
|
|