The LOCKINPUT parameter

This value ensures that the RACF® database used as input is not updated by other jobs while the utility is running.

Note: Statistics are updated.

If you run against an active RACF database, LOCKINPUT is recommended.

Specifying LOCKINPUT means updates are no longer allowed to an input data set until the utility ends. If the RACF database is locked and users logging on attempt to change their user profiles, the logon might not be allowed, depending on the change. Users might be unable to:

Change the password or password phrase
Specify a correct password or password phrase after specifying an incorrect one
Successfully complete the first logon of the day

If you run IRRDBU00 and use LOCKINPUT, any activity that tries to update the RACF database (such as users logging on and changing passwords or batch jobs allocating new data sets requiring the creation of RACF profiles) fails with either an ABEND483 RC50 or ABEND485 RC50.

When using LOCKINPUT against an active database, do not schedule maintenance that runs past midnight. If RACF is not running in data sharing mode and the RACF database remains locked past midnight, new jobs cannot be submitted and users cannot log on unless you disable the gathering of logon statistics by issuing a SETROPTS NOINITSTATS command. All steps that require a locked database must be performed on the same calendar day. This is because RACF updates both primary and backup logon statistics each day.

The database unload utility unlocks the RACF database after processing with LOCKINPUT specified if the database was unlocked when the utility started. The unload utility output is for report generation and does not replace the input database, which is your primary, active, RACF database.

This is different from the IRRUT400 utility, which keeps the input database locked and creates a new output database. This is done to maintain integrity between the input database and the output database.