Trace Authorization Calls in ACF2 DB2 : userids and resources

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC

Issue/Introduction

Is there some way to determine userids and resources being used in  ACF2/DB2 validations?

 

Environment

Release:
Component: ACF2DB

Resolution

The ACF2 DB2 utility CADB2TRC can be used to trace the processing. Sample JCL for a trace job is as follows:

//jobname  JOB  acct.info,'DIAG TRACE',CLASS=A,MSGCLASS=1
//CADB2TRC EXEC PGM=CADB2TRC,  
//          PARM='TRACE=ON,TYPE=JOB,NAME=jobname,SUBSYS=subsysname'

A similar job with PARM='TYPE=ALL,TRACE=OFF' can be used to turn the trace off when done. 

After the trace is set, have the user retry the function that failed.

The trace output should show if there is any activity for the protected resource. It will also show which userid (logonid) is being validated. The output is written to the 'jobname' JOBLOG. If there are difficulties interpreting the output, contact ACF2 Technical Support for assistance.

You can also turn on the TRACE attribute on the user logonid(s) you think should be validated. The ACFRPTRV report shows the TRC records for the validations. This displays the information in a more familiar format.

Additional Information

Documentation for CADB2TRC is available at the CA ACF2 DB2 Troubleshooting page.