IFA707I REASON=SAF RESOURCE WAS NOT DEFINED
Article ID: 379469
Updated On:
Products
Issue/Introduction
The SYS1.PARMLIB(IFASMFAA) is defined with an INMEM parameter to define an in-memory resource
INMEM(IFASMF.&SYSNAME..INMEM.XYZ,TYPE(number),RESSIZMAX(size))
The following command is issued to activate the updated SMFPRMAA member:
/ro sysname,set smf=aa
After issuing the command the following error messages are received:
SET SMF=AA
IEE252I MEMBER SMFPRMAA FOUND IN SYS1.PARMLIB
IEE974I hh.mm.ss SMF DATA SETS
NAME VOLSER SIZE(BLKS) %FULL STATUS
…
…
IFA707I SMF CANNOT CONNECT TO LOGSTREAM IFASMF.sysname.INMEM.XYZ
REASON=SAF RESOURCE WAS NOT DEFINED
After adding TRACE to the SMF acid the following trace is generated:
X TSS-X-0800*SMF SMF S IBMFAC 2000 G/0400000000,0000000000 L/208000 F/00000B20,040100,0001,000000
X TSS-1 000000000000 00000000 T/A800000025
X TSS-2 000000 R/129800 S/000100,020800000000 A/010080 P/IFASMF ,3122, ,IEESB605 F/80800020
X TSS-4 00000000 005FA9B8 7F254AD0 REQ/ SUB/
X TSS-F-0400*SMF SMF S PROGRAM 2000 G/0000000000,0000000000 L/200002 F/04000720,000900,8001,000000
X TSS-1 400000000000 00000000 T/0000000000 IFALSTCB
X TSS-2 2A0000 R/129800 S/000100,020800000000 A/010080 P/IFASMF ,3122, ,IEESB605 F/80800020
X TSS-4 00000000 005FA9B8 7F254AD0
According to the instructions to define in-memory resources the SAF resource profile name must start with the IFA. high-level qualifier, followed by the in-memory resource name.
a SAFTRACE shows that the resource passed to Top Secret is:
IFA.IFASMF.sysname.INMEM.XYZ
The user SMF has the following permit:
XA IBMFAC = IFA.IFASMF.*.INMEM. OWNER(owner )
ACCESS = UPDATE
The '08' in the TSS-X-0800* of the sectrace means that the access to the resource is denied however according to the permit the access should be allowed.
Environment
Z/OS 2.5
Top Secret 16.0
Cause
A list of the IBMFAC resource (TSS LIST(RDT) RESCLASS(IBMFAC)) sows the following:
ACCESSORID = *RDT* NAME = RESOURCE DEFINITIONS
RESOURCE CLASS = IBMFAC
RESOURCE CODE = X'086' POSIT = 8
ATTRIBUTE = NOMASK,MAXOWN(08),MAXPERMIT(039),ACCESS,PRIVPGM
ACCESS = NONE(0000),CONTROL(6400),UPDATE(6000),READ(4000)
ACCESS = WRITE(2000),ALL(FFFF)
DEFACC = READ
TSS0300I LIST FUNCTION SUCCESSFUL
The resource is defined as NOMASK so any masking characters will be viewed literally. In other words, any asterisk would not be viewed as a masking character but as an actual asterisk and therefore will not match the resources that are checked.
The permit was using an asterisk so this is the reason the access to the resource failed
Resolution
Define IBMFAC resource in RDT as MASK
Note: Altering a resource class to MASK from NOMASK makes existing resources un-administrable. Before making
such a change, it is recommended that all existing permissions and ownerships be revoked and removed, then readministered
after the attribute change.
or
Permit access to the resource without asterisk:
IFA.IFASMF.sysname.INMEM.
instead of
IFA.IFASMF.*.INMEM.
Feedback
