Alan Altmark <[EMAIL PROTECTED]> wrote:- > Where is the I/O going? SMF log? Database? In general, RACF does > nothing by himself. #CP TRACE EXT RUN on the suspect RACFVM server will
> tell you if its run amok or if something is driving the horses. > The external interrupts can come from CP on the *RPI interface on from > guests like LDAPSRV, FTPSERVE, and REXECD (issuing RACROUTEs). > QUERY IUCV RACFVM will give you the path ids. If you've got QIUCV, I > think it will tell you where the external interrupt buffer is in the > RACFVM server. My version does this: > QIUCV EXEC 1.2 (C) IBM Corporation, 1989, 2008 > User RACFVM has 4 out of a possible 300 connections. > - External interrupt buffer is located at 00E84D08 > - Control interrupt buffer not defined > - 1208 messages received, 1209 sent, 0 failed > But you can also go to each user listed in QUERY IUCV and do a TRACE IUCV > on those users. OK - that was a few good pointers to check. I did the EXT trace and could see the regular items occurring - all with the same address and with Code 4000 (not sure what this is but, I am guessing, IUCV). I dit the Query IUCV RACFVM and could see there was only the *RPI interface and RMSMASTR connected. I killed RMSMASTR and the IO continued unchanged so I have to assume this is the *RPI interface initiating the IO. I did a TRACE IUCV on RACFVM (only for a short time) and could see a stream of IUCVRECV & REPLY events. I tried displaying some of the storage referenced but I did not know quite what I was looking for and I could see no eyecatchers that meant anything to me. Next I tried turning on LOGOPTIONS ALWAYS for all the classes that were currently in DEFAULT (using an exec so I could quickly reverse). I left this on for about 2 minutes - during which time I took some IND USER displays about 4 seconds apart and noted the time. After turning everything back to default I took a copy of the SMF file and ran RACFADU against it. I could see a fair amount of activity from various servers (including incoming FTP on FTPSERVE) but nothing abnormal and the activity during the periods I had noted were completely unrelated (even allowing for the IO to the SMF file and the RACF database). To answer the question from Kris - no, don't have a RACF LIST running behind the scenes and we do have a user id checker but it only logs on missing servers and does not run that frequently. We don't have any second level system on this VM image. Not really sure where to go from here. Colin Allinson Amadeus Data Processing GmbH
