I have implemented RULELONG feature and getting ACF04014 message. I have noticed that some rules are still at the 4096 byte length. Since I created a new CA-ACF2 Rules database that has record size of 16k, why would some rules still be using a 4k rule?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

This document describes the use of a larger access rule database.

Environment

Release:
Component: ACF2MS

Resolution

Solution

The implementation of RULELONG does not change the length of the rule record until the rule exceeds 4096 bytes. For example if you implement RULELONG with rule size of 16k, you will not notice any rule records at the 16k level until a rule record is changed such that the updated record exceeds the length of 4096 bytes.

The implementation of RULELONG should first include a review of existing rules to determine if any rules are close to exceeding the 4096 length. If there are a few rules that may require more space then you should first consider using the NEXTKEY feature of rules. If the NEXTKEY feature is not appropriate for your environment, then implement the RULELONG feature. The decision to use RULELONG should take into consideration current rule size and future requirements.

In addition it should also be noted that there is a Global System Option (GSO) control option which allows you to use the regular 4k rule compiler and then, if the rule is too large, it will automatically switch to using the compiler for the larger rules. The parameter is COMPDYN/NOCOMPDYN within the RULEOPTS GSO record. Its description is as follows.

COMPDYN|NOCOMPDYN

Specifies whether to compile a rule set with the 32K compiler. With this option, CA-ACF2 defaults to use the 4K rule format compiler and will dynamically switch to use the 32K compiler if the 4K compiler fails due to an out-of-buffer condition. For example, the rule set is too large to fit in a 4K buffer. The default is NOCOMPDYN.

Compdyn can be set using the following commands

    ACF 
    SET CONTROL(GSO) 
    CHANGE RULEOPTS COMPDYN 
    F ACF2,REFRESH(RULEOPTS) 

This parameter also works in conjunction with the RULELONG/NORULELONG parameter of the RULEOPTS record.

This parameter states whether the databases are 4k in length (NORULELONG) or are longer (RULELONG). If RULELONG is specified and NOCOMPDYN is set, the 32K rule compiler will be used unless you have the $NORULELONG control parameter specified in the resource rule.

If you have RULELONG and NOCOMPDYN you WILL notice that small rules will be much larger when they are recompiled - this is because the 32K compiler allows for more fields than the regular compiler and takes more room in the database when compiling the rules.

Important Note : If you make the ACCESS RULES DATABASE larger than 4K, you must also make the INFOSTORAGE DATABASE the same size.

Additional Information

ACF04014 message explanation.