>On Thursday, Aug 08, 2013 at 5:51 AM, Robert S. Hansel wrote: >If the RACF database is shared across several LPARs, does the input to your >daily RACFRW report include SMF >data from all the LPARs?
No, we have only one LPAR. >1) Do you have SETROPTS INACTIVE set and to what number of days? 120 days. >3) Do you have a backup copy of the RACF database prior to July 8 from when >the ID was showing up as >REVOKED, and if you generate an IRRDBU00 database unload from this copy, does >it show the ID as REVOKED? >(An ID displayed as REVOKED by LU due to INACTIVE will not show up as REVOKED >in the unload.) I don't have regular backups, but I found output generated on 6/25/13 that indicates it was revoked: NO NO NO YES NO >4) What is the nature of this ID and how is it likely to be used? Is it >hardcoded in any >CICS CSD resource definitions such as those for SESSION, CONNECTION, TDQUEUE, >or TERMINAL? >Is it coded as the USERID in any EXEC CICS START commands within a program? >Might Digital >Certificates or PassTickets be involved in logging it on? It's a User ID with a CICS segment, no TSO segment and not associated with any resources. If it is logged on to CICS, it might be able to submit a batch job through a Menu selection. >6) What are the full details of its logon on the 9th. Does it show an >associated TERMINAL, >APPL, or JESINPUT node? (If it shows JESINPUT, then we might want to explore >your >RACFVARS &RACLNDE profile and NODES profiles.) Can't find any record that it logged on on the 9th. That part still bothers me. But knowing that it could have been resumed before then and the COBOL program not correctly reported it does give me some solace. Thanks, Greg Shirey Ben E. Keith Company ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
