Service commands

This table lists the specific authorities required for the service commands.

Commands identified by (Q) are shipped with public authority *EXCLUDE. Commands shipped with public authority *EXCLUDE shows which IBM-supplied user profiles are authorized to the command. The security officer can grant *USE authority to others.

Command Referenced object Authority needed
For object For library
ADDTRCFTR11      
APYPTF (Q) Product library *OBJMGT  
CHGSRVA 3 (Q)      
CHKCMNTRC 3 (Q)     *EXECUTE
CHKPRDOPT (Q) All objects in product option 4    
Start of changeCPYFRMMSD 12 (Q)End of change Start of changeStream file, if it already existsEnd of change Start of change*WEnd of change  
Start of changeStream file path name prefixEnd of change Start of change*XEnd of change  
Start of changeStream file parent directory, if the stream file does not existEnd of change Start of change*WXEnd of change  
CPYPTF2(Q) From file *USE *EXECUTE
To-file8 Same requirements as the SAVOBJ command Same requirements as the SAVOBJ command
Device description *USE *EXECUTE
Licensed program   *USE
Commands: CHKTAP, CPYFRMTAP, CPYTOTAP, CRTLIB, CRTSAVF, CRTTAPF, and OVRTAPF *USE *EXECUTE
QSRV library *USE *EXECUTE
CPYPTFGRP2 (Q) Device description *USE *EXECUTE
To-file *Same requirements as the SAVOBJ command *Same requirements as the SAVOBJ command
From-file *USE *EXECUTE
Commands: CHKTAP, CRTLIB, CRTSAVF *USE *EXECUTE
Start of changeCPYTOMSD 12 (Q)End of change Start of changeStream fileEnd of change Start of change*REnd of change  
Start of changeStream file path name prefixEnd of change Start of change*XEnd of change  
DLTAPARDTA (Q)      
DLTCMNTRC 3 (Q) NWID (network ID) or line description *USE *EXECUTE
DLTPTF (Q) Cover letter file 4   *EXECUTE
PTF save file 4   *EXECUTE
DLTTRC (Q) RMVM command *USE  
QSYS Library *EXECUTE  
Database Files *OBJEXIST, *OBJOPR  
DMPJOB (Q)     *EXECUTE
DMPJOBINT (Q)      
DSPPTF (Q) Output file Refer to the general rules. Refer to the general rules.
Start of changeDSPPTFAPYI (Q)End of change Start of changeOutput fileEnd of change Start of changeRefer to the general rules.End of change Start of changeRefer to the general rules.End of change
DSPSRVA (Q)      
DSPSRVSTS (Q)      
DSPSSTUSR 19      
ENDCMNTRC 3 (Q) NWID or line description *USE *EXECUTE
ENDCPYSCN (Q) Device description *USE *EXECUTE
ENDSRVJOB (Q)      
ENDTRC (Q) QSYS Library *ADD, *EXECUTE  
Database files *OBJOPR, *OBJMGMT, *ADD, *DLT  
Commands: PTRTRC, DLTTRC *USE  
ENDWCH16 (Q) Watch sessions watching for a message within a job log17    
INSPTF9 (Q)      
LODPTF (Q) Device Description *USE *EXECUTE
LODRUN 2 RSTOBJ command *USE *EXECUTE
PRTCMNTRC 3 (Q) NWID (network ID) or line description *USE *EXECUTE
Output file Refer to the general rules. Refer to the general rules.
PRTERRLOG (Q) Output file Refer to the general rules. Refer to the general rules.
PRTINTDTA12,13 (Q)      
PRTTRC11(Q) QSYS Library *EXECUTE  
Database Files *USE  
DLTTRC command *USE  
Start of changeRCLAPPN20(Q)End of change Start of changeController descriptionEnd of change Start of change*USE, *OBJMGTEnd of change  
Start of changeDevice descriptionEnd of change Start of change*USE, *OBJMGTEnd of change  
RMVPTF (Q) Product library *OBJMGT  
RMVTRCFTR11      
RUNLPDA (Q) Line description *READ *EXECUTE
SAVAPARDTA 6 (Q) Commands: CRTDUPOBJ, CRTLIB, CRTOUTQ, CRTSAVF, DLTF, DMPOBJ, DMPSYSOBJ, DSPCTLD, DSPDEVD, DSPHDWRSC, DSPJOB, DSPLIND, DSPLOG, DSPNWID, DSPPTF, DSPSFWRSC, OVRPRTF, PRTERRLOG, PRTINTDTA, SAV, SAVDLO, SAVLIB, SAVOJB, WRKACTJOB, and WRKSYSVAL *USE *EXECUTE
Existing problem 7 *CHANGE *EXECUTE
SNDPTFORD 10 (Q) CRTIMGCLG *USE  
QUSRSYS   *ADD, *READ
SNDSRVRQS (Q)      
STRCMNTRC 11 (Q) NWID (network ID) or line description *USE *EXECUTE
Watched job17    
Trace exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
STRCPYSCN Job queue *USE *EXECUTE
Device description *USE *EXECUTE
Output file, if specified Refer to the general rules. Refer to the general rules.
STRSRVJOB (Q) User profile of job *USE *EXECUTE
STRSST 3 (Q)      
STRTRC (Q)11, 15 Watched job17    
Trace exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
STRWCH16 (Q) Watched job17    
Watch exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
TRCCNN11(Q) Watched job17    
Trace exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
TRCCPIC (Q)      
TRCICF (Q)      
TRCINT11 (Q) Watched job17    
Trace exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
TRCJOB (Q) Output file, if specified Refer to the general rules. Refer to the general rules.
Exit program, if specified *USE *EXECUTE
TRCTCPAPP11 (Q) Line description *USE  
Network interface *USE  
Network interface *USE  
Watched job17    
Trace exit program *OBJOPR and *EXECUTE *EXECUTE
Message queue *USE *USE
VFYCMN (Q) Line description 5 *USE *EXECUTE
Controller description 5 *USE *EXECUTE
Network ID 5 *USE *EXECUTE
VFYLNKLPDA (Q) Line description *READ *EXECUTE
VFYPRT (Q) Device description *USE *EXECUTE
VFYOPT (Q) Device description *USE *EXECUTE
VFYTAP14 (Q) Device description *USE, *OBJMGT *EXECUTE
WRKCNTINF (Q)      
WRKFSTAF (Q) QUSRSYS/QPVINDEX *USRIDX *CHANGE *USE
WRKFSTPCT (Q) QUSRSYS/QPVPCTABLE *USRIDX *CHANGE *USE
WRKPRB 1, 10 (Q) Line, controller, NWID (Network ID), and device based on problem analysis action *USE, *ADD *EXECUTE
WRKPTFGRP (Q)      
WRKPTFORD (Q) QESCPTFO and SNDPTFORD *USE  
WRKSRVPVD (Q)      
WRKTRC11 (Q)      
WRKWCH18 (Q)      
1
You need authority to the PRTERRLOG command for some analysis procedures or if the error log records are being saved.
2
All restrictions for the RSTOBJ command also apply.
3
You must have Service (*SERVICE) special authority to use this command.
4
The objects listed are used by the command, but authority to the objects is not checked. Authority to use the command is sufficient to use the objects.
5
You need *USE authority to the communications object that you are verifying.
6
You must have *SPLCTL special authority to save a spooled file.
7
When SAVAPARDTA is run for a new problem, a unique APAR library is created for that problem. If you run SAVAPARDTA again for the same problem to collect more information, you must have Use authority to the APAR library for the problem.
8
The option to add a new member to an existing output file is not valid for this command.
9
This command has the same authorities and restrictions as the APYPTF command and the LODPTF command.
10
To access options 1 and 3 on the "Select Reporting Option" display, you must have *USE authority to the SNDSRVRQS command. The following restrictions apply for the IMGDIR parameter:
  • You must have *X authority to each directory in the path.
  • You must have *WX authority to the directory that contains optical image.
11
To use this command, you must have *SERVICE special authority, or be authorized to the Service Trace function of IBM i through Application Administration in IBM Navigator for i. The Change Function Usage Information (CHGFCNUSG) command, with a function ID of QIBM_SERVICE_TRACE, can also be used to change the list of users that are allowed to perform trace operations.
12
To use this command, you must have *SERVICE special authority, or be authorized to the Service Dump Function of IBM i through Application Administration in IBM Navigator for i. The Change Function Usage Information (CHGFCNUSG) command, with a function ID of QIBM_SERVICE_DUMP, can also be used to change the list of users that are allowed to perform dump operations.
13
This command must be issued from within the job with internal data being printed, or the issuer of the command must be running under a user profile which is the same as the job user identity of the job with internal data being printed, or the issuer of the command must be running under a user profile which has job control (*JOBCTL) special authority.
14
You must have *IOSYSCFG special authority when the device description is allocated by a media library device.
15
If you specify a generic user name for the Job name (JOB) parameter, you must have all object (*ALLOBJ) special authority, or be authorized to the Trace Any User function of IBM i through Application Administration in IBM Navigator for i. You can also use the Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_ALLOBJ_TRACE_ANY_USER, to change the list of users that are allowed to perform trace operations.
16
To use this command, you must have service (*SERVICE) special authority, or be authorized to the service watch function of IBM i through Application Administration in IBM Navigator for i. You can also use the Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_SERVICE_WATCH, to change the list of users that are allowed to start and end watch operations.
17
Job control (*JOBCTL) special authority is needed if the job is running under a different user from the job user identity of the job being watched. All object (*ALLOBJ) special authority is needed if *ALL is specified for the watched job name, or if a generic user name is specified. A user that does not have *ALLOBJ special authority can perform the function if they are authorized to the Watch Any Job function of IBM i through Application Administration in IBM Navigator for i. You can also use the Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_WATCH_ANY_JOB, to change the list of users that are allowed to start and end watch operations.
18
To use this command, you must have service (*SERVICE) special authority, or be authorized to the service trace function and service watch function of IBM i through Application Administration in IBM Navigator for i. You can also use the Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_SERVICE_TRACE and QIBM_SERVICE_WATCH, to change the list of users that are allowed to perform trace operations.
19
You must have Audit (*AUDIT) and Security Administrator (*SECADM) special authorities to use this command.
Start of change
20
If you have *JOBCTL special authority, you do not need the specified authority to the object.
End of change