ACF2 messages ACF0B901 and ACF0B900 appearing in JESLOG
Article ID: 136961
Updated On:
Products
Issue/Introduction
The below alerts appear continuously in an application region:
*ACF0B901 ACF2, SMF UNAVAILABLE, RETURN CODE = 40
*ACF0B900 ACF2, SMF JOURNALING HAS BEEN RE-ESTABLISHED
Environment
Component : CA ACF2 for z/OS Release : 16.0
ZOS 2.1 - 2.4
Cause
ACF2 stores data on records written to SMF. Messages in the ACF0Bxxx series indicate various possible SMF failures.
The first message seen, ACF0B901, is issued by ACF2 module ACF0BSMF when it gets a non-zero return code from the SMFWTM service, which is called to write SMF records.
The second message seen, ACF0B900, indicates an SMF record was successfully written after previous attempts to write SMF records failed.
Resolution
Information and RC values for SMFWTM macro are documented at IBM.COM by z/OS release. For z/OS 2.2, see here. For z/OS 2.4, it is found here.
In this case, the RC=40 in message ACF0B901 means the record was not written because a buffer shortage problem caused the data to be lost. So it appears there is a flood of SMF records being written - possibly a result of ACF2 processing but maybe not.
To assess whether ACF2 activity is suspected, run reports such as ACFRPTRV, ACFRPTDS and ACFRPTPW for the region to expose what SMF records were being written by ACF2 in the seconds before and during the alerts. A flood of ACF2 SMF records might be caused by newly added/changed ACF2 security rules etc. that could affect processing.
Without evidence of ACF2 involvement, the cause likely lies outside of ACF2, e.g. z/OS buffer specifications, other applications, etc. It would be best to set a SLIP trap to issue an SVC dump when the message appears in the region.
Feedback
