OA41409: RACF MESSAGES DO NOT APPEAR ON THE MVS CONSOLE WHEN COMMAND AUTHORIZATION FAILS FOR AN OMEGAVIEW USER.

IBM Tivoli Monitoring 6.2.3 Fix Pack 5 (6.2.3-TIV-ITM-FP0005)
IBM Tivoli Monitoring 6.2.3 Fix Pack 4 (6.2.3-TIV-ITM-FP0004)
Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Users get messages such as these in the SLF during command
  processing:
       X8N0415  KMVSLFCM X8N0415  - /DIS A
       X8N0415  KMVSLFAU X8N0415  - Command Authorization Failed.
  but no related RACF failure messages appear in the SYSLOG.
  
  Detailed Recreation Procedure:
  Specify an SLFCMD in KMVSLFCL (e.g. SLFCMD EXTERNAL=$SLFCMD).
  Verify the OMEGAVIEW user is not authorized to execute this
  command.
  When the user issues this command, verify that no RACF messages
  appear on the MVS Console.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All ITMS/ENGINE users.                       *
  ****************************************************************
  * PROBLEM DESCRIPTION: THE IBM TIVOLI MONITORING ENGINE IS NOT *
  *                  SENDING RACF FAILURE MESSAGES TO THE        *
  *                  MVS CONSOLE.                                *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF.                               *
  ****************************************************************
  The IBM Tivoli Monitoring Engine is not sending RACF failure
  messages to the MVS Console.  According to the RACF manual,
  if a RACROUTE macro gets a non-zero return code and the RACF
  messages are desired on the MVS console, then the code must
  issue another RACROUTE macro with LOG=ASIS specified.
  

Problem conclusion

• The code has been changed to reissue the RACROUTE macro with
  the LOG=ASIS parameter to cause the RACF failure messages to
  be sent to the MVS console.  This is done if, and only if,
  the return code from the first RACROUTE macro was 4 and the
  reason code was 8.  A new Engine parameter, SAFMSGS(N | Y)
  has also been added to invoke this new Engine feature.  The
  default for the new parameter is "N".
  
    Install Actions
    This APAR introduces a new Engine Start parameter.  The
    following is the description of this new parameter.
  
    SAFMSGS - Allow SAF Authorization Failure Messages to be
    sent to the MVS Console
  
    =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  
    Purpose
  
    SAFMSGS specifies whether SAF/RACF Authorization failure
    messages should be displayed on the MVS System Console.
  
    Syntax
  
    SAFMSGS(N | Y)
  
    Parameters
  
  
    N         ITMS/ENGINE will not send Authorization failure
              messages to the MVS System Console.  This is the
              default value.
  
    Y         ITMS/ENGINE will send Authorization failure
              messages to the MVS System Console.
  
    Usage Note:
    - In order to use SAFMSGS(Y), SAF must be specified in the
    KppINNAM member of the RKANPARU dataset.
  
    Example
  
    |----------------------------------------------------------|
    |                                                          |
    |SAFMSGS(Y)                                                |
    |                                                          |
    |----------------------------------------------------------|
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  OA43252

Fix information

• Fixed component name

  CT/ENGINE

• Fixed component ID

  5608A41CE

Applicable component levels

• R623 PSY UA71032

     UP13/10/23 P F310

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.