ACF2: CKTI not triggering with MQ Monitor in CICS TS 5.5

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• LDAP SERVER FOR Z/OS
• PAM CLIENT FOR LINUX ON MAINFRAME
• WEB ADMINISTRATOR FOR TOP SECRET

Issue/Introduction

We Upgraded few of our Dev Region to CICS TS 5.5 from 5.3. Since then, we could see the below messages while starting up. CKTI doesn't get triggered upon startup.

+DFHMN0115I CICDXXXX CICS Server z/OS WLM Health percentage is now 25.
+DFHMQ0390 E CICDXXXX  472
 11/11/2020 03:16:03 CICDXXXX Unable to START transaction CKTI
 associated with MQMONITOR MQMXXXX. EIBFN=X'1008' EIBRESP=70
 EIBRESP2=9 EIBRCODE=X'D60000000000'.
+DFHMN0115I CICDXXXX CICS Server z/OS WLM Health percentage is now 50.
+DFHMQ0390 E CICDXXXX  177
 11/11/2020 03:16:23 CICDXXXX Unable to START transaction CKTI
 associated with MQMONITOR MQMXXXX. EIBFN=X'1008' EIBRESP=70
 EIBRESP2=9 EIBRCODE=X'D60000000000'.

EIBRESP 70 and EIBRESP 9 are auth id related messages. Don't see any messages related to Surrogate security.

See these messages:

**START COMMAND FAILED FOR TRANSACTION CKTI INVALID USERID PARAMETER OF PLTDIDB *

**START COMMAND FAILED FOR TRANSACTION ACFT INVALID USERID PARAMETER OF CICSDFLT*

 

 I don't see any ACF2 exit in place. 

Here are the resp codes

70 NOTAUTHRESP2 values:

7

A resource security check fails on TRANSID (name).

9

A surrogate user security check fails on USERID (name).

The security access capabilities of the transaction that issued the command do not allow the command to be performed with the value specified in the USERID option. The security access capabilities of the transaction have been established by the external security manager according to user security, and whether link security or the execution diagnostic facility (EDF) have been in use.

Default action: end the task abnormally.

Environment

Release : 16.0

Component : CA ACF2 for z/OS

Resolution

Ensure IBM PTF PH17093 applied? Please see https://www.ibm.com/support/pages/apar/PH17093

Ensure  PTFs SO04012, SO07136, SO08480, and RO96890 applied to system

If the problem persists, put TRACE on the CICS started task logonid, restart CICS to get validations. Then run the ACFRPTRV report for user CICDIDB and attach it to the case.
In the ACFRPTRV report look for  RSUR-*.DFHINSTL, and RSUR-*.DFHSTART violations.

If no violations check for a CICS exit Program that prevent CKTI from starting up. 
Disabling should allow CKTI to be started up as expected.