PK86672: RAS: WITH RAS SECURITY ENABLED,A RACF SETUP ERROR FOR MPP REGIONUSERID ( TIMS|TRANSACTION CODE ) PRODUCES TOO MANY ICH408I

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Customer had several indicidents where MPP region was started
  with a userid which did not have RAS RACF ( TIMS | entity
  transaction code ) access to a high volume transaction it
  was otherwise eligble ( class, etc ) to process. The ICH408I
  RACF messages produced as a result of PQ90775 are needed in
  most cases to diagnose the cause of the region setup issues,
  but for high volume situations the number of ICH408I messages
  is a threat to the z/OS image. A means of threshold suppression
  of these messages is needed.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All IMS V10 users using RAS security         *
  ****************************************************************
  * PROBLEM DESCRIPTION: RAS: With RAS security enabled an       *
  *                      unauthorized dependent region can       *
  *                      produce too many ICH408I messages       *
  *                      when a protected TIMS transaction       *
  *                      is scheduled in the region.             *
  ****************************************************************
  * RECOMMENDATION: INSTALL CORRECTIVE SERVICE FOR APAR/PTF      *
  ****************************************************************
  When RAS security is enabled and there is a RACF definition
  error for a dependent region userid which leaves the region
  unauthorized to process a schedulable RACF protected (TIMS)
  transaction, the resulting RACF ICH408I messages can flood
  the console and make it impossible to monitor or manage the
  system and may cause an outage due to WTO buffer shortages.
  
  However, some ICH408I messages should appear on the console
  because they are needed to resolve the RACF authority issue
  for the dependent region.
  
  Currently, the RACF ICH408I messages are issued as a result
  of calling the RACROUTE macro with the MSGSUPP=NO parameter.
  

Problem conclusion

• GEN:
  KEYWORDS:
  
  *** END IMS KEYWORDS ***
  
  The following algorithm was implemented to resolve the problem
  of issuing multiple ICH408I messages:
  
  In the case of transaction authorization, the RACROUTE macro
  will be issued with the MSGSUPP=YES parameter on the initial
  authorization call when the TIMS transaction is scheduled to
  run in the dependent region.  If the dependent region is not
  authorized to process this transaction, control is passed to
  SCHRSICH, the ICH408I message suppression management routine,
  a new subroutine in the DFSSCHR0 module.
  
  The SCHRSICH routine manages a message suppression algorithm
  which suppresses extra ICH408I messages while still allowing
  a user to receive warning messages about a RAS RACF security
  problem.  The message suppression algorithm works as follows:
  
  - If this is the first unauthorized transaction for the
    region, the following actions are performed:
  
    - allocate DFSRSSMP control block/tran table
    - initialize DFSRSSMP control block/tran table
    - store address of DFSRSSMP in PST PSTSSMPP field
    - save tran code in DFSRSSMP tran table
    - issue RACROUTE MSGSUPP=NO to show ICH408I
    - switch (ISWITCH) to dependent region
    - issue DFS2497W message in dependent region
    - switch (ISWITCH) back (TO=UNSTACK)
    - update STCK for last message suppressed
    - increment message suppression count
  
  - End
  - Else
  
    - Check the time difference between previous and
      current message suppression events and if it is
      more than 60 seconds, restart the suppression
      process by initializing the STCK value, message
      count and tran table.
  
    - If this is a new unauthorized transaction for the
      region, the following actions are performed:
  
      - If there is an available slot in the tran table:
  
        - save tran code in DFSRSSMP tran table (8 max)
        - issue RACROUTE MSGSUPP=NO to show ICH408I
        - switch (ISWITCH) to dependent region
        - issue DFS2497W message in dependent region
        - switch (ISWITCH) back (TO=UNSTACK)
        - update STCK for last message suppressed
        - increment message suppression count
  
      - End
      - Else
  
        - update STCK for last message suppressed
        - increment message suppression count
  
      - End
  
    - End
    - Else the unauthorized transaction has already
      been captured and the following actions are
      performed:
  
      - update STCK for last message suppressed
      - increment message suppression count
  
    - End
  - End
  
  - Each time a message suppression event is processed check the
    message count and if it is evenly divisible by 1000:
  
    - switch (ISWITCH) to dependent region
    - issue DFS3024W message in dependent region
    - switch (ISWITCH) back (TO=UNSTACK)
  
  Two warning messages are issued by the SCHRSICH subroutine:
  
  - DFS2497W lets a user know that ICH408I messages are
             suppressed for the specified region
  
  - DFS3024W lets a user know that ICH408I messages are
             still suppressed for the specified region and
             that the suppression process has suppressed
             the specified amount of messages for the region
  
  DFSSDA40 was changed to add code that releases the storage
  obtained for the DFSRSSMP block during dependent region
  SIGNOFF.
  
  A new macro DFSRSSMP was introduced to describe the DFSRSSMP
  control block which contains the following information:
  
  - macro eyecather
  - primary and current time stamps
  - 2 fields for work data convertion
  - message count
  - fields for 8 transaction names.
  
  IPST was updated to add the PSTSSMPP field.
  
  DFSAPST0 and DFSEF00F were added and recompiled to reflect
  the related IPST changes in Dump Formatter.
  
  ADDITIONAL KEYWORDS:
  ICH408I DFS2497W MSGDFS2497W DFS3024W
  MSGDFS3024W
  
  PUBLICATION CHANGE:
  Book IMS Version 10 Messages and Codes Reference,
  GC18-9712-00, will be changed to reflect the
  following.
  
  In Chapter 7. DFS messages, DFS2001I - DFS2500I
  the following description for message DFS2497W will be added:
  
  DFS2497W ICH408I MESSAGES ARE SUPPRESSED FOR REGION YYYYYYYY
           FOR TRAN ZZZZZZZZ BY RAS SECURITY
  
  Explanation:
  Additional ICH408I messages will be suppressed by IMS RAS
  security because there is a RACF definition error for the
  identified transaction for the identified dependent region.
  In the message text:
  
  YYYYYYYY identifies the dependent region name
  ZZZZZZZZ identifies the transaction name
  
  System action:
  IMS RAS security will suppress additional ICH408I messages
  for the transaction and dependent region.  The transaction
  is still in the message queue and could be processed by
  another eligible dependent region or another IMS system in
  an IMSPLEX.  Processing continues.
  
  System Programmer Response:
  Determine whether the region should be granted access to
  process the transaction.  If the region should be granted
  access to process the transaction, update the appropriate
  RACF definitions.  Otherwise, remove the transaction from
  the region.
  
  Problem determination:
  1, 5, 6, 27, 35, 36
  
  Module:
  DFSSCHR0
  
  in Chapter 9. DFS messages, DFS3001W - DFS3500W
  
  The following description for message DFS3024W will be added:
  
  DFS3024W RAS SECURITY HAS SUPPRESSED NNNNNNNN ICH408I MESSAGES
           FOR REGION YYYYYYYY
  
  Multiple ICH408I messages have been suppressed by RAS
  security because there is a RACF definition error for
  the identified dependent region.  DFS3024W is issued
  to let the user know that RAS security is still performing
  ICH408I message suppression for the dependent region and
  that message suppression has suppressed the specified
  amount of ICH408I messages for the dependent region.
  In the message text:
  
  NNNNNNNN   identifies how many ICH408I have been suppressed
  YYYYYYYY   identifies the dependent region name
  
  System action: The unauthorized transaction is in the message
  
  System action: The unauthorized transaction is in the message
  queue and could be processed by another eligible dependent
  region or another IMS system in an IMSPLEX.  Processing
  continues.
  
  System Programmer Response:
  Locate the DFS2497W message that specified the unauthorized
  transaction for the specified region.  See System Programmer
  Response for DFS2497W message to resolve the problem.
  
  Problem determination:
  1, 5, 6, 27, 35, 36
  
  Module:
  DFSSCHR0
  

Temporary fix

Comments

• ×**** PE09/08/27 FIX IN ERROR. SEE APAR PK94845  FOR DESCRIPTION
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PK66381

• APAR is sysrouted TO one or more of the following:

  UK48813

Modules/Macros

• DFSAPST0 DFSEF00F DFSRSSMP DFSSCHR0 DFSSDA40
  IPST
  

Fix information

• Fixed component name

  IMS V10

• Fixed component ID

  5635A0100

Applicable component levels

• R010 PSY UK48813

     UP09/08/06 P F908

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.