Incorrect output troubleshooting table

This topic describes incorrect output from RACF®. Generally, incorrect output can be missing records, duplicate records, incorrect values, format errors, or meaningless data.

Incorrect output could also be the improper issuing of an error message, an abend code, a return code from a macro, or a wait-state code. For example, an abend could be issued when no abend is needed, or a message that should be issued is not issued. Another example is message text that includes incorrect information.

Table 1. Troubleshooting Table: Incorrect Output
Symptom	Recommended Procedures for Incorrect Output
Incorrect output: Improper access to a protected resource with no message issued	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. Check the global access checking table for an entry describing the resource. This step does not apply for z/OS or OS/390 z/OS UNIX System Services . Check for an installation exit for RACROUTE REQUEST=AUTH. This step does not apply for z/OS or OS/390 z/OS UNIX System Services . Check the kind of RACROUTE request that was made. Compare it with the level of protection of the resource. (Use LISTDSD or RLIST command for the resource; use LISTUSER command for the user.) This step does not apply for z/OS or OS/390 z/OS UNIX System Services . If the cause of the problem is not apparent, attempt to duplicate the problem with another user doing the same kind of request. Try another user with similar attributes and group associations. If the problem can be duplicated, then determine which user attributes or group associations cause the problem. This can help you define the problem. If the problem cannot be duplicated with other users, try to duplicate the problem with other resources protected like the original. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM®, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: Messages	Action: Make sure that you have all the error messages that were issued for the user request, and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. Decide which of these types of messages applies: Macro error messages (MNOTEs) System error messages issued by RACF (messages with prefixes of CST, HCP, ICH, IRR, and RPI) Decide what the nature of the message error is. Was the message valid but unexpected? See Messages troubleshooting table. Was the message itself incorrect; for example, did it contain incorrect or unreadable data, or was an error message issued for a non-error situation? If you had incorrect output from a RACF macro, see Utilities for a list of common application programming errors for RACF; the results of some of these errors could appear to be incorrect output from RACF. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. For macro error messages (MNOTEs): Get a copy of the assembler listing that contained the macro error message. For system error messages issued by RACF: Get a copy of the part of the job log or system log that contained the message. (The IBM support center might also need to check messages that preceded the error message in the log.) See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: Incorrect abends	Action: Check whether any error messages were issued in response to the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. Decide what the nature of the abend error is. Was the abend valid but unexpected? Go to Abend troubleshooting table. Was the abend not documented? Go to Documentation troubleshooting table. Was the abend itself incorrect? For example, was the abend issued for a non-error situation? If you had incorrect output from a RACF macro, see Utilities for a list of common application programming errors for RACF; the results of some of these errors could appear to be incorrect output from RACF. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. To Get the Dump Output and Analysis Results: Use the procedures described: Obtaining a system dump, if you need to request a dump Formatting a system dump Validating input. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: Improperly formatted output from RACF LIST commands (LISTDSD, LISTGRP, LISTUSER, RLIST, and RACLINK LIST)	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. Decide what caused the incorrect output: The data read by the command (the RACF database). If this is the case, see the table entry for the RACF database. RACF's processing of the command request If the database should have been updated by a command that was issued on another system in the RACF remote sharing facility (RRSF) network, check the status of the connection with a TARGET LIST on this system and the originating system. Also, check the RRSFDATA profiles on the originating system. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. You can capture the output by executing the command in a batch job, or under the session manager, or in a CLIST in which you trap the output from the command. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: Improperly formatted reports (from DSMON or RACF report writer)	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the improperly formatted report. You need it to analyze the problem or report the problem to IBM. Check whether the problem is caused by RACF in generating the report or by bad data used as input to the report: As a check on the RACF report writer, you can print (or display) the SMF (system management facility) records using the access method services PRINT command with DUMP specified. As a check on DSMON, use the RACF LIST commands to check the profiles that seem to be reported incorrectly by DSMON. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: SMF records (types 80, 81, or 83)	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. If the RACF SMF data unload utility leads you to suspect that the SMF (system management facilities) records are not valid, check to make sure that the SMF records are at fault, not the utility. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. For SMF records (type 80 or 81): Use the RACF SMF data unload utility to list the contents of the RACF SMF records. See z/OS Security Server RACF Auditor's Guide for more information. As a check on the RACF SMF data unload utility, you can print (or display) the record using the access method services PRINT command with HEX specified. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: The RACF database (this includes profiles, index blocks, and inventory control block)	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. These RACF functions affect the RACF database: RACF commands that add, alter, or delete profiles (such as ADDUSER, ALTUSER, DELUSER, RDEFINE, RALTER, and RDELETE) BLKUPD command RVARY and SETROPTS commands IRRUT400 utility RACF macros: RACDEF, RACINIT, ICHEINTY, ICHETEST, ICHEACTN, and RACXTRT (with ENCRYPT or TYPE=REPLACE specified) If the database should have been updated by a command that was issued on another system in the RACF remote sharing facility (RRSF) network, check the status of the connection with a TARGET LIST on this system and the originating system. Also, check the RRSFDATA profiles on the originating system. If you had incorrect output from a RACF macro, see Utilities for a list of common application programming errors for RACF; the results of some of these errors could appear to be incorrect output from RACF. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. Run the IRRUT200 utility and the BLKUPD command to get a description of the RACF database. See z/OS Security Server RACF System Programmer's Guide for a description of how to use IRRUT200, and Block Update command for a RACF database (BLKUPD) for a description of how to use BLKUPD. See Searching for a matching problem. See Reporting RACF problems to IBM.
Incorrect output: RACF subsystem	Action: Check for any messages that might have been issued by the RACF subsystem. Refer to z/OS Security Server RACF Messages and Codes. If the RVARY command, along with other commands, is not working, then the subsystem is also not working correctly. Check to see if the subsystem initialized correctly; if it did not, check for an install problem and get a system console log (SYSLOG). If a `userid`.RRSFLIST data set is missing output, or contains incorrect output: Issue the SET LIST command and verify that: Automatic direction or password synchronization is active for the type of request for which output is missing. The OUTPUT keyword specifies the user ID that should be receiving the missing output. The correct level of output is specified (ALWAYS, WARN, or FAIL). Check the RRSFDATA profiles and access lists and make sure that the requests are really being directed. Check the TSO PREFIX specification for the user ID that is missing the output. If it is set to something other than the user ID, the RRSFLIST data set might have a different name than you expect. Issue the TARGET LIST command on both nodes involved, and make sure that they are both operative-active, and that requests are not queued in one of the INMSG or OUTMSG data sets. Check whether anyone stopped the RACF subsystem address space, or used the TARGET command to purge an INMSG or OUTMSG file while a request was active. These actions can cause requests and output to be lost. Check for TSO TRANSMIT messages to the user ID that is missing the output. If there was an error processing the RRSFLIST data set a message should have been sent. Check the console log too. Make sure that the RRSFLIST data set is allocated with the proper DCB parameters and is not full. If in doubt, you can delete or rename it and let RACF create another one. If an abend occurred, get a copy of the system dump that was taken. If the abend did not generate a system dump, and the problem is reproducible, obtain a system dump. See Obtaining a system dump. Format the system dump. See Formatting a system dump. Action
Incorrect output: Return or reason code from a RACF macro or utility	Action: Check whether any error messages were issued for the user request and make sure that message IDs are included with the messages. If a batch job produced the output, check that the job statement had MSGLEVEL=(1,1) specified. If a TSO/E user had the problem, check that the user profile had these options: PROFILE WTPMSG MSGID. Decide if the return or reason code is: Incorrect Undocumented. See Documentation troubleshooting table. See Utilities for a list of common application programming errors for RACF; the results of some of these errors could appear to be incorrect output from RACF. See Performing a preliminary search for a matching problem. If you do not find a matching problem, you need to collect problem information to report to IBM, using the procedures in the remainder of this list. Get a printed or online copy of the incorrect output. You need it to analyze the problem or report the problem to IBM. Note: If the macro return code or reason code was incorrect, request a system dump from a RACF macro request that produced the incorrect output when RACF returns control. To Get the Dump Output and Analysis Results: Use the procedures described in these areas: Obtaining a system dump, if you need to request a dump Formatting a system dump Validating input. See Searching for a matching problem. See Reporting RACF problems to IBM.