Common Usage Problems with RACF Macros and Utilities

This section provides advice for resolving problems that might result when using the RACF® macros and utilities. The problems described here might appear at first to be errors in RACF.

Note: Advice for resolving coding problems is in z/VM: RACF Security Server System Programmer's Guide.

IRRUT100 Utility

Error:: Assuming the utility is in a loop because it runs a long time. This utility reads every profile in the RACF database and usually takes a long time to run.
Action:: Run the utility when the system is not heavily used and allow it to continue running until completion.

IRRUT200 Utility

Error:

Not specifying valid MAP or INDEX options when using z/VM®.

Action:

The MAP and/or INDEX options must be specified in the RACVERFY FILE file. Also, these options must be specified in separate records in the file. For example:

MAP
INDEX
END

Error:

Assuming the RACF database contains no errors because the utility runs without error. The utility will not find all errors on a RACF database. Errors may exist within profiles and could result in message IRR407I.

Action:

If the utility does not find any errors, list the profiles involved using the appropriate RACF command. Look for error messages such as NO CONNECT ENTRY FOUND or invalid data in fields such as OWNER.

Use the RACF commands to list and correct the profiles, if possible. If the commands fail, use BLKUPD to correct or delete the profiles.

Error:

Running the utility against an active output database. Even if there are no other users on the system, other system tasks and applications may be accessing the RACF database. If any changes are made to the database, the output of the utility will not be reliable.

Action:

Enter the RVARY INACTIVE or RVARY SWITCH command before running the utility.

Error:

Assuming the run of the utility failed because a nonzero return code was received.

Action:

The return code returned is the highest return code encountered while processing the RACF database. A nonzero return code does not mean the utility failed. See z/VM: RACF Security Server Messages and Codes for details.

IRRUT400 Utility

Error:: Do not use this utility to merge RACF databases from separate systems.
Action:: Use it only for merging back together a database from one system.
Error:: Ignoring return code 4 or return code 8 on IRRUT400 MERGE. These return codes can indicate that duplicate profiles were found. Ignoring them can result in profile conflicts.
Action:: Check the duplicate profiles on each of the input databases to determine which ones are desired on the output database. Use the RACF commands to delete the unwanted ones and rerun the IRRUT400 MERGE.
Error:: Running the utility against an active RACF database. Even if there are no other users on the system, other system tasks and applications may be accessing the RACF database. If any changes are made to the database, the output of the utility will not be reliable.
Action:: Enter the RVARY INACTIVE or RVARY SWITCH command before running the utility.
Error:: RACF manager return code X'50' (decimal 80) trying to access the RACF database. This return code means that you attempted to update a RACF database that has had the utility run against it with the LOCKINPUT keyword specified.
Action:: The LOCKINPUT keyword makes the input database unusable for system updates. It should be used with caution.
If you want to unlock your RACF database, use the UNLOCKINPUT parameter of IRRUT400 or IRRDBU00.

IRRDBU00 Utility

Error:

RACF manager return code X'50' (decimal 80) from other tasks trying to access the RACF database. This return code means that they attempted to update a RACF database while the utility was executing with the LOCKINPUT keyword specified.

Action:

The LOCKINPUT keyword makes the input database for the utility temporarily unusable for system updates. It should be used with CAUTION.

Do not try updating until the utility is finished running with LOCKINPUT. Run the utility at a different time when updates are not needed, or run it against a copy of the RACF database—not against the active database.

Error:

I/O error while reading the database; your data set has slipped into secondary extents. The following console messages appear:

 13.31.20 JOB00019 *IRR401I 500 ABEND DURING RACF PROCESSING OF
                    NEXT REQUEST FOR ENTRY MURPHYB
 13.31.20 JOB00019  IRR401I 500 ABEND DURING RACF PROCESSING

The following messages appear from SYSPRINT:

 IRR67122I *** Utility ESTAE error routine in control. ***
 IRR67124I Profile processing DID NOT finish before the abend.
           Output is NOT complete.
 IRR67120I 500 abend during utility processing. Reason code 0000.
 IRR67125I Utility ESTAE error routine will now attempt clean-up
           processing.
 IRR67121I The module in control at time of abend was IRRDBU03.

Action:

Reallocate the database that is causing the problem as a single extent. Recopy the data.

Error:

Not all of your data is unloaded. Entire classes are missing.

Action:

If you have imported a database from another system, you must use the class descriptor table from that system. IPL your system with the class descriptor table associated with the imported database.

Error:

Fields are missing or field offsets are incorrect in the output database.

Action:

Ensure that you have the current level of templates for the input database. Run IRRMIN00 with PARM=UPDATE and the current level of templates.