A rule is missing in seosdb from policy that was previously deployed

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

When executing the sesu command with a user identified by PAMSC (who belongs to an authorized group), the request fails with the following error in  seaudit.

07 Aug 2026 03:34:05 D SURROGATE    MyUser      Read       63  3  USER.root          /opt/CA/PAMSC/bin/sesu  ServerName.Com 

Cause

The rule "authorize SURROGATE ('USER.root') access(READ) xgid('MyGroup') via(pgm('/opt/CA/PAMSC/bin/sesu'))" was part of a properly deployed policy but was missing in the active seosdb database.

 

 

Resolution

To restore functionality, follow these steps in order:

1. Verify and Add Missing Rules (Temporary Workaround) If immediate access is required, manually re-add the missing authorization rule to restore service. Example:  authorize SURROGATE ('USER.root') access(READ) xgid('MyGroup') via(pgm('/opt/CA/PAMSC/bin/sesu'))

2. Redeploy the Policy Redeploy the affected policy to refresh the rules and align the active database with the deployment configuration.

3. Perform a Clean Database Initialization (If Necessary) If rules continue to go missing, or if DEVCALC errors persist after redeployment, the database may require a clean initialization:

   • Initialize a new, clean seosdb.
   • Allow the endpoint to retrieve all active deployments from the PAMSC server.