OA68434: REMOVE THE SERIALIZATION CAPABILITY ON SYSZRACF FROM ZSECURE TO AVOID POTENTIAL ENQUEUE DELAYS 25/08/29 PTF PECHANGE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Remove the serialization capability on SYSZRACF from zSecure to
  avoid potential enqueue delays.
  
  When working normally at the UJ97044 code level, the shared
  enqueue used by C2POLICE should only be in effect for seconds,
  and should not create a negative impact. However, due to the
  potential for an enqueue to persist for longer than intended,
  zSecure Development have decided to mark UJ97044 as PE. This
  APAR will be used to not only remove the specific serialization
  request for the C2POLICE started task, but remove the
  serialization capability on SYSZRACF from zSecure entirely,
  because of its potential in some cases to cause very
  impactful negative consequences.
  

Local fix

• Please adjust C2PSALLC and C2PSPAS1 skeleton members in the
  SCKRSLIB library of zSecure installation by removing the
  'syszracf' argument from the following line:
  
  option
  serialization(wait,enq(ckrdsn,sysdsn,syszracf),maxwait(30))
  
  You must then re-Verify and reFresh the alert configuration from
  
  
  SE.A.A.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Admin, Audit, and Alert     *
  *                 exploiting zSecure's ENQ serialization       *
  *                 option for a resource identified by the      *
  *                 SYSZRACF qname as provided by the PTF        *
  *                 UJ97044 for APAR OA67471.                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: zSecure product might cause a z/OS      *
  *                      system lock due to RACF Database ENQ    *
  *                      contention in sysplex environment.      *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided and review the        *
  *                 documentation updates.                       *
  ****************************************************************
  When a SYSZRACF value for the ENQ serialization option is
  supplied to the zSecure CARLa engine (CKRCARLA), it might cause
  z/OS system lock due to RACF Database ENQ contention in sysplex
  environment.
  

Problem conclusion

• zSecure CARLa engine (CKRCARLA) has been modified, so that its
  ENQ serialization option for a resource identified by the
  SYSZRACF qname is removed. Please note the documentation changes
  as provided by the APAR tracking comment data.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ97976

Modules/Macros

• C2PSALLC C2PSPAS1 CKQCEFJD CKQCEFP  CKQCEFPD CKQSPEC  CKQSPECL
  CKRADSN  CKRCLOSE CKRENQ   CKRINP@  CKRMAIN  GKRADSN  GKRCLOSE
  GKRENQ   GKRINP@  GKRMAIN
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R310 PSY UJ97976

     UP25/09/06 P F509 ­

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.