Why is an ACF2 logonid frequently experiencing ACF01011 LOGONID SUSPENDED errors?

Products

• ACF2 - z/OS
• ACF2
• ACF2 - MISC

Issue/Introduction

An ACF2 logonid has been suspended often on a sysplex without any visible errors or by failed password attempts. What can be used to identify why the user is being suspended?

Environment

Release : 16.0

Component : ACF2 for z/OS

Resolution

There are multiple ways that a user can be SUSPENDed in ACF2:

1. An administrator sets the SUSPEND bit on the logonid
2. The user reaches the maximum password violation counts specified in the GSO PSWD record
3. The user reaches the maximum number of allowed dataset and resource violations in a single session specified in the GSO OPTS record
4. The user reaches the maximum password violation counts and/or rule violations due to settings in the CICS or IMS interfaces

The CSWHO field from a LIST of the logonid will show the user that is setting the SUSPEND bit for the affected user. Also verify the PSWD-VIO count has not reached the limit specified in the GSO PSWD PASSLMT field.

Running a PW report against the SMF active at the time of the suspension will show whether or not the user was suspended due to password violations.

Running an RV report against the SMF active at the time of the suspension will show what/if resource violations were occurring during the time of suspension.

Running a DS report against the SMF active at the time of the suspension will show what/if dataset violations were occurring during the time of suspension.

 

Additional Information

Relevant documentation:
Logonid Record Fields
ACFRPTPW
ACFRPTRV
ACFRPTDS
GSO OPTS Record
GSO PSWD Record
CICS: SUSPEND-User Suspensions
IMS: Logonid Suspension (SUSPEND)