S000 U0010 Abends and "TSS9006E *** CA-SAF NOT UP. RE-IPL NECESSARY ***" During CA Top Secret Initialization

Products

• Cleanup
• Datacom
• DATACOM - AD
• CIS
• COMMON SERVICES FOR Z/OS
• 90S SERVICES
• DATABASE MANAGEMENT SOLUTIONS FOR DB2 FOR Z/OS
• COMMON PRODUCT SERVICES COMPONENT
• Common Services
• CA ECOMETER SERVER COMPONENT FOC
• Easytrieve Report Generator for Common Services
• INFOCAI MAINTENANCE
• IPC
• UNICENTER JCLCHECK COMMON COMPONENT
• Mainframe VM Product Manager
• CHORUS SOFTWARE MANAGER
• CA ON DEMAND PORTAL
• CA Service Desk Manager - Unified Self Service
• PAM CLIENT FOR LINUX ON MAINFRAME
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
• GRAPHICAL MANAGEMENT INTERFACE
• WEB ADMINISTRATOR FOR TOP SECRET
• Xpertware
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

 Receiving S000 U0010 Abends and "TSS9006E *** CA-SAF NOT UP. RE-IPL NECESSARY ***" during CA Top Secret initialization.

Example:

  $HASP373 TSS3     STARTED                                  
  IEF403I TSS3 - STARTED - TIME=15.08.28                     
 *TSS9006E *** CA-SAF NOT UP. RE-IPL NECESSARY ***           
  IEF450I TSS3 TSS3 - ABEND=S000 U0010 REASON=00000000 753   
          TIME=15.08.28                                      
  IEF404I TSS3 - ENDED - TIME=15.08.28                       
  $HASP395 TSS3     ENDED

 

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component:

Resolution

Common causes checklist:

1. The CA Top Secret CAILPA library definition is missing or incorrectly defined correctly to the LPA.
   
   
   • The CA Top Secret library must be defined to the LPA and must NOT be in linklist.
   
   
   
   • Remove any old CA Top Secret versions of ICHSEC00 and ICHSEC05 from LPA and linklist.
   
   
   
   • Make sure there is no missing comma or typo in your LPALSTxx members.
   • Make sure all members in the LPALST reside on the correct volumes and that any steplibs point to the correct LPALSTxx members.
   
   
   
2. An IBM version of ICHSCDMY must remain in linklist for proper functioning of the SAF interface. This is usually in SYS1.LINKLIB.
   
   
3. IBM versions of ICHSECnn are being loaded.
   
   
   • Check if any ICHSECnn members are present in SYS1.LPALIB.
   
   
   
   • Unless overridden by a SYSLIB statement in your PROGnn member of SYS1.PARMLIB, SYS1.LPALIB will be the first dataset in the LPA concatenation.
   
   
   
   • The ICH members should be renamed to something else.
   
   
   
   • IBM delivers skeleton versions of ICHSECnn modules. The CA Top Secret versions must be loaded.
   
   
   
4. CAILIB and/or CAILPA are not APF authorized or not cataloged. Or the wrong CAILIB or CAILPA dataset are being pointed to in the master catalog.
   
   
5. The CA Top Secret CAILIB is not in the linklist.
   
   
   • CAILIB should not be in LPA.
   
   
   
   • Make sure there is no missing comma or typo in the linklist members.