search cancel

TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

book

Article ID: 21589

calendar_today

Updated On:

Products

Cleanup Datacom DATACOM - AD CIS COMMON SERVICES FOR Z/OS 90S SERVICES DATABASE MANAGEMENT SOLUTIONS FOR DB2 FOR Z/OS COMMON PRODUCT SERVICES COMPONENT Common Services CA ECOMETER SERVER COMPONENT FOC Easytrieve Report Generator for Common Services INFOCAI MAINTENANCE IPC UNICENTER JCLCHECK COMMON COMPONENT Mainframe VM Product Manager CHORUS SOFTWARE MANAGER CA ON DEMAND PORTAL CA Service Desk Manager - Unified Self Service PAM CLIENT FOR LINUX ON MAINFRAME MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME GRAPHICAL MANAGEMENT INTERFACE WEB ADMINISTRATOR FOR TOP SECRET Xpertware Top Secret Top Secret - LDAP Top Secret - VSE

Issue/Introduction

Symptoms:

Excessive logging over an extended period of time can cause ECSA exhaustion.

If an ECSA Short-On-Storage condition is realized, we will issue the following message once every 30 seconds as long as the SOS condition exists.

TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

Resolution:

When the ECSA exhaustion has been alleviated, CA Top Secret will resume normal log processing.
The ESCA is filling up because records are not being written as fast as they are being audited.
Once the auditing slows down and the records that are being held in ESCA get written to the Audit file, then the ESCA should go back to normal.

Most likely the ESCA shortage is caused by the Audit attribute on active acids or ACTION(AUDIT) on facility permits.

To identify acids with the Audit attribute:

   TSS WHOHAS AUDIT  

To find all permits with ACTION(AUDIT) and ACTION(AUDIT) on any Facility permits (TSS ADD(acid) FAC(fac),

you will need to run TSSCFILE during off peak hours with the following input:

   TSS LIST(ACIDS) DATA(BASIC,XAUTH)  

Permits with ACTION(AUDIT) will have a record id of 2016 and in columns 49 through 56 it will say AUDIT.

If for some reason you do not find any auditing taking place, or if you reduce the amount of auditing and ECSA does not resume to normal, then an issue needs to be opened with Top Secret Support and an SVC dump will be needed, F TSS,SVCDUMP.

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component: