ACF0B901 and ACF0B900 messages in the JESLOG
Article ID: 136961
Updated On:
Products
Issue/Introduction
The below alerts appear continuously in an application region:
*ACF0B901 ACF2, SMF UNAVAILABLE, RETURN CODE = 40
*ACF0B900 ACF2, SMF JOURNALING HAS BEEN RE-ESTABLISHED
Environment
Component : CA ACF2 for z/OS Release : 16.0
ZOS 2.1 - 3.1
Cause
ACF2 stores data on records written to SMF. Messages in the ACF0Bxxx series indicate various possible SMF failures.
ACF0B901 is issued by ACF2 module ACF0BSMF when it gets a non-zero return code from the SMFWTM macro service, which is called to write SMF records.
ACF0B900 indicates an SMF record was successfully written after previous attempts to write SMF records failed.
Resolution
Information and RC values for the SMFWTM macro are documented at IBM.COM by z/OS release from z/OS 2.1 to z/OS 3.1.
An ACF0B901 RC=40 message means the record was not written because a buffer shortage problem caused the data to be lost.
A flood of SMF records are being written - possibly a result of ACF2 processing but maybe not.
To assess whether ACF2 activity is the cause, run reports such as ACFRPTRV, ACFRPTDS and ACFRPTPW for the region to expose what SMF records were being written by ACF2 in the seconds before and during the alerts. A flood of ACF2 SMF records might be caused by newly added/changed ACF2 security rules etc. that could affect processing.
Without evidence of ACF2 involvement, the cause likely lies outside of ACF2, e.g. z/OS buffer specifications, other applications, etc. It would be best to set a SLIP trap to issue an SVC dump when the message appears in the region.
Feedback
