z/OS Security Server RACF System Programmer's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Refreshing SETROPTS RACLIST processing

z/OS Security Server RACF System Programmer's Guide
SA23-2287-00

SETROPTS RACLIST(classname) REFRESH deletes the existing RACLIST data space and loads the BASE, SESSION, and ICSF segments of the discrete and generic profiles from the RACF® database into a new data space. If the RACGLIST class is active and contains a profile named classname, the contents of the data space are written to the database as classname_nnnnn profiles, rebuilding them if they already existed, creating them if not.

SETROPTS RACLIST(classname) REFRESH can also be used to refresh classes RACLISTed by RACROUTE REQUEST=LIST,GLOBAL=YES. The scope of a RACLIST REFRESH command is the class that is named on the command plus any other classes that share the same POSIT value. See z/OS Security Server RACF Security Administrator's Guide for more information.

Because SETROPTS RACLIST loads only the BASE, SESSION, and ICSF segments into the data space, if you delete a profile, you should issue a SETROPTS RACLIST(classname) REFRESH command immediately. If you do not, the copy of the segments in the data space and the segments in the database do not match, and might cause unexpected results. For example, if you delete a profile, all of its segments are deleted from the RACF database, but until you issue a SETROPTS RACLIST(classname) REFRESH command, the copy of the original segments remains in the data space. From RACF's point of view, the profile still exists, because the segments are still in the data space, but if RACF tries to reference a non-base segment for the profile, it no longer exists in the database.

The following example shows how to refresh SETROPTS RACLIST processing for the DASDVOL and TERMINAL classes:
SETROPTS  RACLIST(DASDVOL  TERMINAL)  REFRESH

If only BASE, SESSION, and ICSF segment information is updated, wait to issue the SETROPTS RACLIST(classname) REFRESH command until you want the changes to take effect. If these segments are updated with other segments, issue a SETROPTS RACLIST(classname) REFRESH command immediately.

For some classes, selected profile data is kept in storage. Changes to these profiles might not be active until a refresh is done. A SETROPTS RACLIST(classname) REFRESH ensures that profile data is consistent. An example of this type of classe is PTKTDATA.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014