z/vm v6.4 racf security server messages and codes · 2019-01-11 · this publication lists the...

z/VM

RACF Security ServerMessages and CodesVersion 6 Release 4

GC24-6217-04

IBM

Note:Before you use this information and the product it supports, read the information in “Notices” on page 271.

This edition applies to version 6, release 4, modification 0 of IBM z/VM (product number 5741-A07) and to allsubsequent releases of this product until otherwise indicated in new editions.

This edition replaces GC24-6217-03.

© Copyright IBM Corporation 1976, 2016.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiIntended Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiRecovery Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viiWhere to Find More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

Links to Other Documents and Websites . . . . . . . . . . . . . . . . . . . . . . . . viii

How to Send Your Comments to IBM . . . . . . . . . . . . . . . . . . . . . . . ix

Summary of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiGC24-6217-04, z/VM Version 6 Release 4 . . . . . . . . . . . . . . . . . . . . . . . . . xi

New Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiChanged Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

GC24-6217-03, z/VM Version 6 Release 3 (September 2015) . . . . . . . . . . . . . . . . . . . xiNew Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiChanged Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi

GC24-6217-02, z/VM Version 6 Release 3 . . . . . . . . . . . . . . . . . . . . . . . . . xiGC24-6217-01, z/VM Version 6 Release 2 . . . . . . . . . . . . . . . . . . . . . . . . . xi

New Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiiGC24-6217-00, z/VM Version 6 Release 1 . . . . . . . . . . . . . . . . . . . . . . . . . xii

Chapter 1. ICH Messages for the System Operator . . . . . . . . . . . . . . . . . 1Routing and Descriptor Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Descriptor Code Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Routing Code Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Reviewing and Replying to Operator Messages on z/VM . . . . . . . . . . . . . . . . . . . . 2SAF Initialization Operator Messages . . . . . . . . . . . . . . . . . . . . . . . . . . 3RACINIT Operator Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4RACF Processing Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5RACF Initialization Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18RACF Status Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29RACHECK Operator Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30RACDEF Operator Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Chapter 2. Other ICH Messages . . . . . . . . . . . . . . . . . . . . . . . . . 33RACF Database Initialization Messages . . . . . . . . . . . . . . . . . . . . . . . . . . 33RACF Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

ADDGROUP Command Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . 36ADDUSER Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 38CONNECT Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 40REMOVE Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42DELUSER Command Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . 43DELGROUP Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 43PERMIT, PERMDIR, and PERMFILE Command Messages . . . . . . . . . . . . . . . . . . . 44PASSWORD Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 47ADDSD and DELDSD Command Messages . . . . . . . . . . . . . . . . . . . . . . . 48RDEFINE, ADDDIR, and ADDFILE Command Messages . . . . . . . . . . . . . . . . . . . 55RALTER, ALTDIR, and ALTFILE Command Messages . . . . . . . . . . . . . . . . . . . . 58RDELETE, DELDIR, and DELFILE Command Messages . . . . . . . . . . . . . . . . . . . 61RLIST, LDIRECT, and LFILE Command Messages . . . . . . . . . . . . . . . . . . . . . 62SETROPTS Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 62RVARY Command Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70ALTGROUP Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 72ALTUSER Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74ALTDSD Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

© Copyright IBM Corp. 1976, 2016 iii

LISTUSER Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 83SEARCH, SRDIR, and SRFILE Command Messages . . . . . . . . . . . . . . . . . . . . . 84LISTGRP Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86LISTDSD Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86Common Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Other RACF Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87RACF Manager Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . 88RACF Cross-Reference Utility (ICHUT100) Messages . . . . . . . . . . . . . . . . . . . . 89RACF Database Verification Utility (ICHUT200) Messages . . . . . . . . . . . . . . . . . . . 90Block Update (BLKUPD) Command (ICHUT300) Messages . . . . . . . . . . . . . . . . . . 91RACF Report Writer (RACFRW) Messages . . . . . . . . . . . . . . . . . . . . . . . . 95RACF Database Split/Merge Utility (ICHUT400) Messages . . . . . . . . . . . . . . . . . . 97Data Security Monitor (DSMON) Messages . . . . . . . . . . . . . . . . . . . . . . . . 99RACF Miscellaneous Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Chapter 3. IRR Messages for the System Operator . . . . . . . . . . . . . . . . 105Routing and Descriptor Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Descriptor Code Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Routing Code Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Chapter 4. Other IRR Messages . . . . . . . . . . . . . . . . . . . . . . . . 115RACF Database Initialization Messages . . . . . . . . . . . . . . . . . . . . . . . . . . 115RACF Command Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Messages Common to Several Commands . . . . . . . . . . . . . . . . . . . . . . . . 118Dynamic Parse (IRRDPI00 Command) Messages. . . . . . . . . . . . . . . . . . . . . . 119RACF Database Verification (IRRUT200) Messages . . . . . . . . . . . . . . . . . . . . . 129RACF Block Update (BLKUPD) Command (IRRUT300) Messages . . . . . . . . . . . . . . . . 137RACF Database Split/Merge Utility (IRRUT400) Messages . . . . . . . . . . . . . . . . . . 142RACF Database Unload Utility (IRRDBU00) Messages and RACF SMF Data Unload Utility (IRRADU00)Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146Messages issued by the REXX RACVAR function . . . . . . . . . . . . . . . . . . . . . 157Messages issued by the RACF Subsystem . . . . . . . . . . . . . . . . . . . . . . . . 158These messages are also issued by the RACF Subsystem . . . . . . . . . . . . . . . . . . . 158More messages issued by the RACF Subsystem . . . . . . . . . . . . . . . . . . . . . . 162DISPLAY command messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165SIGNOFF command messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Chapter 5. Additional z/VM RACF Messages . . . . . . . . . . . . . . . . . . . 171Unnumbered RACF Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Unnumbered RACF Initialization Messages . . . . . . . . . . . . . . . . . . . . . . . 171Unnumbered RACF Execution Messages . . . . . . . . . . . . . . . . . . . . . . . . 171Unnumbered Operator Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . 171Unnumbered Report Writer Messages . . . . . . . . . . . . . . . . . . . . . . . . . 172Unnumbered Messages from CSTALLOC (Dataset Allocation Program) . . . . . . . . . . . . . . 172

Numbered Messages for RACF on z/VM . . . . . . . . . . . . . . . . . . . . . . . . . 173CST messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173DMS messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176HCP messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176ICH messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179IKJ Messages During A RACF Command Session . . . . . . . . . . . . . . . . . . . . . 186RAC messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188RPI messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Chapter 6. RACF Abend Codes . . . . . . . . . . . . . . . . . . . . . . . . . 251Abend Codes from RACF Modules in the z/VM Control Program . . . . . . . . . . . . . . . . 261

Appendix. Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . 263IUCV Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

CMSIUCV Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263VSIUCV Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

iv z/VM V6.4 RACF Security Server Messages and Codes

RAC Command Return Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264RACF Command Session Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . 264RACF-Manager Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265RACF-Utilities Return Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271IBM Online Privacy Statement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Programming Interface Information . . . . . . . . . . . . . . . . . . . . . . . . . . . 273Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Bibliography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277Where to Get z/VM Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277z/VM Base Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277z/VM Facilities and Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278Prerequisite Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Contents v

vi z/VM V6.4 RACF Security Server Messages and Codes

About This Document

This document describes the messages and codes generated by the IBM® RACF®

Security Server for z/VM®.

Though this document is specific to z/VM, there may be references to z/OS® orMVS™. These references are only applicable when sharing a RACF database with az/OS or MVS system.

This publication lists the messages, abend codes, RACF manager return codes, andRACF utility return codes.

Explanations of return codes from RACF macros are documented in z/VM: SecurityServer RACROUTE Macro Reference and z/VM: RACF Security Server Macros andInterfaces.

Intended AudienceThis document is intended for anyone who uses RACF and wants to know whatcaused a message to be displayed and what corrective action, if any, needs to betaken.

The messages and codes have been organized into chapters so that the publicationcan be separated for easy use (if desired) according to the needs of the installation.

Note that throughout this publication, messages are generally arranged inalphanumeric order by message identifier, except for messages that appear only onz/VM, which are in a separate chapter. Most of the messages are common with theversion of RACF that runs on z/OS.

If you have a message identifier, you might find the Index helpful in finding themessage itself. If you have a message with no identifier, look for an “unnumbered”message with the same text as the message you received.

Note: Most RACF messages have message identifiers. If you receive a messagewithout a message identifier, your system may be suppressing the display ofmessage numbers. Enter the following command and re-create the condition thatcaused the message to be displayed.v Check that error-message handling is ON. This can be done with the command

SET EMSG ON (not SET EMSG TEXT).

Recovery ProceduresSee RACF System Programmer's Guide for a description of the recovery proceduresto use when recovering from failures occurring during the processing of the RACFmanager, RACF data set, RACF commands, and other programs that use the RACFmanager.

See the RACF Diagnosis Guide for information on diagnosing suspected problems inRACF, searching for existing matching problems, and reporting RACF problems toIBM.

© Copyright IBM Corp. 1976, 2016 vii

Where to Find More InformationFor information about related publications, refer to the “Bibliography” on page277.

Links to Other Documents and WebsitesThe PDF version of this document contains links to other documents and websites.A link from this document to another document works only when both documentsare in the same directory or database, and a link to a website works only if youhave access to the Internet. A document link is to a specific edition. If a newedition of a linked document has been published since the publication of thisdocument, the linked document might not be the latest edition.

viii z/VM V6.4 RACF Security Server Messages and Codes

How to Send Your Comments to IBM

We appreciate your input on this publication. Feel free to comment on the clarity,accuracy, and completeness of the information or give us any other feedback thatyou might have.

Use one of the following methods to send us your comments:1. Send an email to [email protected]. Go to IBM z/VM Reader's Comments (www.ibm.com/systems/z/os/zvm/

zvmforms/webqs.html).

Include the following information:v Your namev Your email addressv The publication title and order number:

z/VM V6.4 RACF Security Server Messages and CodesGC24-6217-04

v The topic name or page number related to your commentv The text of your comment

When you send comments to IBM, you grant IBM a nonexclusive right to use ordistribute your comments in any way it believes appropriate without incurring anyobligation to you.

IBM or any other organizations will use the personal information that you supplyonly to contact you about the issues that you submit to IBM.

If You Have a Technical Problem

Do not use the feedback methods listed above. Instead, do one of the following:v Contact your IBM service representative.v Contact IBM technical support.v See IBM: z/VM Service Resources (www.ibm.com/vm/service/).v Go to IBM Support Portal (www.ibm.com/support/entry/portal/Overview/).

© Copyright IBM Corp. 1976, 2016 ix

http://www.ibm.com/systems/z/os/zvm/zvmforms/webqs.html

http://www.ibm.com/vm/service/

http://www.ibm.com/support/entry/portal/Overview/

x z/VM V6.4 RACF Security Server Messages and Codes

Summary of Changes

This document contains terminology, maintenance, and editorial changes. Technicalchanges are indicated by a vertical line to the left of the change. Some productupdates might be provided through service and might be available for some priorreleases.

GC24-6217-04, z/VM Version 6 Release 4This edition includes changes to support the general availability of z/VM V6.4.

New MessagesRPISMF073IRPISMF074E

Changed MessagesICH01011IRPIMGR041T

GC24-6217-03, z/VM Version 6 Release 3 (September 2015)This edition includes changes to support product changes provided or announcedafter the general availability of z/VM V6.3.

New MessagesICH563IICH08017IICH14057IICH14083IICH21036IICH21043IICH21044IIRR420IRPIMGR068E

Changed MessagesICH14010IICH21007IIRR015I

GC24-6217-02, z/VM Version 6 Release 3This edition supports the general availability of z/VM V6.3.


© Copyright IBM Corp. 1976, 2016 xi

New MessagesHCPRPD007IICH15043ARPICMS021ERPIRAC010WRPITMP021ERPIVPHSD001ERPIVPHSD002ERPIVPHSD003ERPIVPHSD004ERPIVPHSD006ERPIVPHSD007ERPIVPHSD008ERPIVPHSD009ERPIVPHSD010ERPIVPHSD011ERPIVPHSD012E


xii z/VM V6.4 RACF Security Server Messages and Codes

Chapter 1. ICH Messages for the System Operator

This chapter lists the system operator messages that the IBM licensed programResource Access Control Facility (RACF*), Program Number 5740-XXH, routes to asystem console or a security console.

The format of these messages is:ICHxnnt text

where:

ICH identifies the message as a RACF message.

x identifies the RACF function, where:

0 = SAF initialization

3 = RACROUTE REQUEST=VERIFY macro (RACINIT)

4 = RACF processing

5 = RACF initialization

7 = RACF status

8 = RACROUTE REQUEST=AUTH macro (RACHECK)

9 = RACROUTE REQUEST=DEFINE macro (RACDEF).

nn is the message serial number.

t is the type code, where:

A = Action; operator must perform a specific action.

D = Decision; operator must choose an alternative.

E = Eventual action required.

I = Information; no operator action is required.

W = Wait; processing stops until action is determined and performed.

text is the text of the message.

Routing and Descriptor CodesThe routing and descriptor codes for these messages are shown with the messageexplanations.

Descriptor Code DescriptionsDescriptor codes indicate the significance of a message. Specifically, descriptorcodes let the user know the status of the system itself or that of a specific task:

Has it stopped processing?Is it waiting for another action to be completed?Or, is it continuing to process?

In addition, this code determines how the system will display and delete themessage.

Code Description

© Copyright IBM Corp. 1976, 2016 1

1 System Failure

The message indicates a catastrophic error. To continue, the operator mustre-IPL the system or restart a major subsystem.

2 Immediate Action Required

The message indicates that the operator must perform an actionimmediately. The message issuer could be in a wait state until the action isperformed, or the system needs the action as soon as possible to improveperformance. The task waits for the operator to complete the action.

Note: When an authorized program issues a message with descriptor code2, a DOM macro instruction must be issued to delete the message after therequested action is performed.

4 System Status

The message indicates the status of a system task or of a hardware unit.

Routing Code DescriptionsRouting codes send system messages to the consoles where they are to bedisplayed. To send a message to more than one console, RACF assigns more thanone routing code to the message. For more information on message routing, see theCSTCONS table in z/VM: RACF Security Server System Programmer's Guide.

Code Description

1 Master Console Action

The message indicates a change in the status of the system. It demandsaction by the master console operator.

2 Master Console Information

The message indicates a change in the status of the system. It does notdemand action; rather, it alerts the master console operator to a conditionthat may require action.

This routing code is used for any message that indicates job status whenthe status is not requested specifically by an operator inquiry. It is alsoused for processor and problem program messages to the system operator.

9 System Security

The message gives information about security checking, for example, arequest for a password.

11 Programmer Information

The message is intended for the problem programmer. This routing code isused only when the program issuing the message cannot route themessage to the programmer by way of the user's printer on z/VM.

Note: Routing code 11 is ignored if specified for a multiple-line WTOmacro instruction.

Reviewing and Replying to Operator Messages on z/VMOn z/VM, the user defined in the CSTCONS routing table can review and answeroutstanding messages that are generated by the RACF service machine. To do this,enter the following command:CP SMSG nnnnnnn QMSG

2 z/VM V6.4 RACF Security Server Messages and Codes

where nnnnn is the user ID of the service machine (RACFVM).

The RACF service machine then transmits a list of outstanding messages to theuser. The message list contains the response number and the response text, viaMSG, MSGNOH, or WNG commands. In turn, the system operator responds asfollows:CP SMSG nnnnnnn n reply

where:

n is the number identifying the message for reply.

reply is the reply to be made to the message.

Also on z/VM, the user defined in the z/VM directory as a secondary user for theRACF service machine can respond to action or decision messages sent to theRACF service machine without logging on to the service machine. To do this, setup the system operator as a secondary user for the RACF service machine. Then,when an action or decision message arrives, the operator can issue the SENDcommand to reply, as follows:SEND RACFVM n reply

where:

n is the number identifying the message for reply.

reply is the reply to be made to the message.

SAF Initialization Operator Messages

ICH001E SAF IS NOT ACTIVE, DUMP TAKEN

Explanation: The system authorization facility (SAF) isnot active. The preceding message, which is ICH002I,ICH003I, or ICH004I, explains why.

System action: The SAF error exit requests a dumpand issues message ICH006D.

ICH002I UNABLE TO OBTAIN STORAGE FORSAF INITIALIZATION

Explanation: The system authorization facility (SAF)issued a GETMAIN macro for storage in the systemqueue area (SQA), which is subpool 265, to build theICHSAFV control block. The GETMAIN failed.

System action: The SAF error exit issues messageICH001E.

ICH003I UNABLE TO LOCATE SAF ROUTER(ICHSFR00) IN LPA

Explanation: The system cannot locate the systemauthorization facility (SAF) load module, ICHSFR00, inthe link pack area (LPA).


ICH004I SYSTEM ERROR DURING SAFINITIALIZATION

Explanation: During initialization of the systemauthorization facility (SAF), a program check occurred.The SAF error exit was invoked.


ICH005I ACTIVE SAF EXIT: ICHRTX00

Explanation: The system authorization facility (SAF)installation exit, module ICHRTX00, is in use.

System action: System initialization proceeds.

ICH006D RE-IPL OR REPLY U TO CONTINUEWITHOUT SAF

Explanation: The system authorization facility (SAF)error exit issues this message after ICH001E to let theoperator decide whether to continue without SAF or tore-IPL.

System action: System initialization stops until theoperator replies.

Operator response: Reply U to continue initializationwithout SAF. Otherwise, correct the problem and re-IPLthe system, so that SAF can be included.

ICH001E • ICH006D

Chapter 1. ICH Messages for the System Operator 3

|

|

ICH007E ICHSFI00 NOT FOUND. REPLY ‘U’ TOCONTINUE

Explanation: During RACF initialization, the systemcannot find the system authorization facility (SAF)initialization module, ICHSFI00, in SYS1.LINKLIB.

System action: System initialization stops until theoperator replies.

Operator response: Reply U to continue initializationwithout SAF. Otherwise, correct the problem and re-IPLthe system, so that SAF can be included.

RACINIT Operator Messages

ICH301I MAXIMUM PASSWORD OR PASSPHRASE ATTEMPTS BY SPECIALUSER userid [AT TERMINAL terminalid.]

Explanation: The user specified by userid has mademore than the permissible number of attempts to entera password or password phrase. If this was not a batchjob, the last attempt was from the terminal specified byterminalid. Because the specified user has the SPECIALattribute, the RACF security administrator has theoption of not revoking the user. This message isfollowed by message ICH302D.

The permissible number of password attempts is setusing the command

SETROPTS PASSWORD(REVOKE(number_invalid_passwords)

Destination: Descriptor code is 4. Routing code is 9.

ICH302D REPLY Y TO ALLOW ANOTHERATTEMPT OR N TO REVOKE USERIDuserid.

Explanation: This message, which is preceded by anumber, follows message ICH301I.

System action: If the response is Y, the specified useris allowed another attempt to log on. A failure duringthis attempt causes messages ICH301I and ICH302D tobe reissued. If the response is N, the specified user IDis revoked.

Note: If there is no response to this message withinabout 8 minutes, the LOGON request will time out andbe failed by VM. If a reply is now issued for thismessage, the reply will be accepted, but you willreceive the following message:

RPIMGR012E IUCV ERROR WITH CP:REPLY CC=1,RC=9

Operator response: Reply with either Y or N.

Note: VM users should refer to “Reviewing andReplying to Operator Messages on VM” on page 2.


Note: In multiple-user address spaces that have asingle signon task (such as CICS® or IMS™), when thesignon task issues the message, no other signons canoccur until the operator has replied to the message.

ICH303I INACTIVE INTERVAL EXCEEDED BY

USER userid (AT TERMINAL terminalid).

Explanation: The user specified by userid has notaccessed the system and had the last access intervalupdated within the limit specified by SETROPTSINACTIVE(unused-userid-interval). If this was not abatch job, the last attempt was from the terminalspecified by terminalid. Because the specified user hasthe SPECIAL attribute, the RACF security administratorhas the option of not revoking the user. This message isfollowed by ICH304D.


ICH304D REPLY Y TO ACTIVATE USER OR NTO REVOKE USERID userid.

Explanation: This message, which is preceded by anumber, follows message ICH303I.

System action: If the response is Y, the logon attemptby the specified user is allowed to continue. If theresponse is N, the specified user ID is revoked.

Note: If there is no response to this message withinabout 8 minutes, the LOGON request will time out andbe failed by VM. If a reply is now issued for thismessage, the reply will be accepted, but you willreceive the following message:

RPIMGR012E IUCV ERROR WITH CP:REPLY CC=1,RC=9

Operator response: Reply with either Y or N.

Note: VM users should refer to “Reviewing andReplying to Operator Messages on VM” on page 2.


Note: In multiple-user address spaces that have asingle signon task (such as CICS or IMS), when thesignon task issues the message, no other signons canoccur until the operator has replied to the message.

ICH007E • ICH304D


RACF Processing Messages

ICH401I abend-code ABEND DURING RACFPROCESSING OF request-nameREQUEST FOR ENTRY entry-name [INCLASS class-name] [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname] --or-- I/OERROR AT RBA relative-byte-addressDURING RACF PROCESSING OFrequest-name REQUEST FOR ENTRYentry-name [IN CLASS class-name][{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname] --or--RESTART KEY HIT DURING RACFPROCESSING OF request-nameREQUEST FOR ENTRY entry-name [INCLASS class-name] [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname]

Explanation: An abend or an I/O error occurredduring RACF processing, or the restart key waspressed.relative-byte-address

The RBA (relative byte address) where the I/Oerror occurred.

request-nameThe type of request the RACF manager wasprocessing when the error occurred.

class-nameFor resources other than DASD data sets, theclass name of the resource. The first 4characters of this class name and a hyphenprecede the entry name zzz in the RACFdatabase index. For example, the index nameof TAPE-T12345 is used to locate profileT12345 in class TAPEVOL.

dsname and nnnIf more than one RACF database exists, dsnameand nnn indicate the database and sequencenumber affected.

System action: The indicated request to the RACFmanager failed. Processing of the request is terminated.

Operator response: Save the exact text of this messageand of any following RACF messages (particularlyICH413I), and report them to the system programmeror the RACF security administrator, or both.

Programmer response: If message ICH402I, ICH403I,or ICH404I does not follow this message at the securityconsole, the error occurring in the RACF database maynot represent a permanent error. Attempt to reenter theRACF request (either the RACF command or the utilityprogram), or cause the RACF SVC to be invoked again(such as reentering the LOGON command, rerunningthe job, or retrying dynamic allocation).

If message ICH402I, ICH403I, or ICH404I does followthis message, then a permanent error may exist in theRACF database. Perform the action as specified by the

problem determination section for that message.

If an I/O error is occurring frequently on the RACFdatabase, an alternate device could be considered forthe next IPL.

If multiple extents were created for a new RACFdatabase, this message is issued when the newdatabase is used. Delete the database and rerun theICHMIN00 or IRRMIN00 utility to recreate it. SpecifyCONTIG and do not specify secondary space on theSPACE parameter in the JCL.

Problem determination: If an abend occurred, do thefollowing:

v Get the abend code from this message. If the abendis 000, see other messages issued for this problem(such as ICH409I) for the abend code.

v Look for a description of the abend code in thefollowing places:

– Chapter 6, “RACF Abend Codes,” on page 251 inthis book

– An MVS system codes manual. For the full titleand order number of your system codes manual,see the preface to this manual.

If you cannot find the abend code described in anyof the above, use the RACF Diagnosis Guide forinformation on diagnosing documentation errors andreporting documentation errors to IBM.

Diagnostic data is provided in the LOGREC data.

If an I/O error occurred, determine if the device orvolume is malfunctioning. For a permanent I/O error,also see the LOGREC data for diagnostic information.Also, see the section on failure during I/O operationson the RACF database in RACF System Programmer'sGuide.

If message ICH402I, ICH403I, or ICH404I follows thismessage, see “Problem Determination” for thatmessage.

Destination: Descriptor code is 1. Routing codes are 9and 11. The complete text of this message is sent onlyto the security console. Only ICH401I abend-code ABENDDURING RACF PROCESSING is sent to the programmer.

ICH402I BAM BLOCK AT RBArelative-byte-address MAY NOT REFLECTACTUAL SPACE USAGE

Explanation: An error has occurred during RACFprocessing when attempting to allocate or deallocatespace in the RACF database. The BAM block at theRBA (relative byte address) indicated in the messagemay not be accurate.

This message follows message ICH401I. If more than

ICH401I • ICH402I


one RACF database exists, the database referred to inthis message is the database named in the precedingICH401I message.

System action: RACF processing of the requestindicated in message ICH401I terminates.

Operator response: Report this message to the systemprogrammer or the RACF security administrator, orboth, and save the message output.

Programmer response: See “Problem Determination.”

Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program (ICHUT200or IRRUT200) to determine the inconsistency betweenthe BAM mappings and the actual space allocated.

If an inconsistency is found, use the BLKUPDcommand (ICHUT300 or IRRUT300 utility) to correctthe BAM blocks so they accurately reflect the spaceallocated. See RACF System Programmer's Guide foradditional information on how to diagnose and correctproblems with BAM blocks.


ICH403I INDEX MAY BE INVALID; LEVEL nnINDEX BEING PROCESSED FOR{ADDITION | DELETION} AT TIMEOF FAILURE

Explanation: An error occurred during RACFupdating of the index in the RACF database. The levelindex being processed is indicated by nn. This messagefollows message ICH401I. If more than one RACFdatabase exists, the database referred to in this messageis the database named in the preceding ICH401Imessage.

System action: RACF processing of the requestindicated in message ICH401I terminates.



Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program (ICHUT200or IRRUT200) to determine if there is an inconsistencyin the index structure.

If an inconsistency is found, use the BLKUPDcommand (ICHUT300 or IRRUT300 utility) to correctthe index structure so that it accurately reflects thecontents of the RACF database. See RACF SystemProgrammer's Guide for additional information on howto diagnose and correct problems with the data setindex.


ICH404I ICB RECORD HAS NOT BEENUPDATED - {TOPLEVEL INDEX |SEQUENCE SET } RBA IS INCORRECT

Explanation: An error occurred during RACFprocessing. The header record (ICB) in the RACFdatabase had not been updated before the failureoccurred in the RACF database. Updates to the indexstructure (that is the top level index block or thebeginning of the sequence set) are not reflected in theICB. The latest updates to the index will not bereflected in searches of the RACF database.

This message follows message ICH401I. If more thanone RACF database exists, the database referred to inthis message is the database indicated in the precedingICH401I message.

System action: RACF processing of the requestterminates.



Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program (ICHUT200or IRRUT200) to determine if there is an inconsistencyin the ICB and index structure. If an inconsistency isfound, use the BLKUPD command (ICHUT300 orIRRUT300 utility) to update the ICB so that itaccurately reflects the contents of the index structure.See RACF System Programmer's Guide for additionalinformation on how to diagnose and correct problemswith the data set index.


ICH405I INSUFFICIENT SPACE ON RACFDATA SET [{PRIMARY | BACKUP }RACF DATA SET SEQUENCE nnn,dsname]

Explanation: The RACF data set containing the RACFdatabase does not contain sufficient space to handle theRACF request. Either a request was made for a largeamount of space or there is very little space available inthe RACF database.

If more than one RACF database exists, this messageindicates which database the error occurred on.




Problem determination: Execute the RACF databaseverification utility program (ICHUT200 or IRRUT200)

ICH403I • ICH405I


to determine the amount of available space in theRACF database. If more space is needed, delete anyunused profiles from the RACF database.

Destination: Descriptor code is 4. Routing codes are 2,9, and 11.

ICH406I RACF DATA SET INDEX FULL[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname]

Explanation: During RACF processing, an attemptwas made to extend the index to another level, but themaximum number of index levels (10) had beenreached.





Problem determination: Execute the RACF databaseverification utility program (ICHUT200 or IRRUT200)to determine the index structure and index levels.Delete unused profiles to reduce the number of indexentries and make space available. If an error in theindex structure is suspected, execute the RACFdatabase verification utility program (ICHUT200 orIRRUT200) to determine if there is an inconsistency.

If an inconsistency is found, use the BLKUPDcommand (ICHUT300 or IRRUT300 utility) to correctany problems in the index of the RACF database.RACF allows a maximum of 10 index levels. See RACFSystem Programmer's Guide for additional informationon how to diagnose and correct problems with the dataset index.

Destination: Descriptor code is 4. Routing codes are 9and 11.

ICH407I RACF DATA SET INDEX ERROR.[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname] SEARCHON ENTRY entry-name

Explanation: An index error in the RACF databasewas detected while RACF was performing an indexsearch for the entry indicated in the message. Thismessage is issued if:

v During the index search, a block is found which isnot an index block.

v The data pointed to by a level one index block is notthe entry for the entry name indicated in themessage.



Operator response: Report the exact text of thismessage to your system programmer or the RACFsecurity administrator, or both.

System programmer response: See “ProblemDetermination.”

Problem determination: Execute the RACF databaseverification utility program (ICHUT200 or IRRUT todetermine the error in the index tree in the RACFdatabase.

If the ICHUT200 or IRRUT200 utility does not find theerror, list the profile indicated in the message byentry-name, using the appropriate RACF command. Forexample, if the search was for user profiles, use theLISTUSER command. If CLASS was not specified onthe SEARCH command, use the LISTDSD command.Look for error messages such as NO CONNECT ENTRYFOUND or invalid data in fields such as OWNER.

To correct any errors found, use the BLKUPDcommand (ICHUT300 or IRRUT300 utility). See RACFSystem Programmer's Guide for additional informationon how to diagnose and correct problems with the dataset index.


ICH408I USER (userid) GROUP (group-name)NAME (user-name) --or-- JOB (jobname)STEP (stepname) [SUBMITTER (userid)][resource-name] [CL(class-name)] [VOL][FROM generic-profile-name (G)] [ACCESSINTENT(intent) ACCESSALLOWED(allowed)]

Explanation: This message is issued when RACFdetects an unauthorized request (a violation) made by auser or job. The user and group indicated in the firstline of the ICH408I message are the execution user IDand group ID under which the job was to run.

The first line of message ICH408I identifies a user orjob that had an authorization problem. The other linesof the message (shown in this book following theexplanation of USER or JOB) describe the request theuser or job was issuing and the reason for the failure.

See the following example:ICH408I USER(SMITH ) GROUP(DEPT60 ) NAME(R.L.SMITH )ICH408I DEPT58.CLIST.CNTL CL(DATASET ) VOL(TSO035)ICH408I INSUFFICIENT ACCESS AUTHORITYICH408I FROM DEPT58.CLIST.* (G)ICH408I ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

This message can be interpreted as:

v User SMITH, a member of group DEPT60, whosename is R.L.SMITH, had INSUFFICIENT ACCESS

ICH406I • ICH408I


AUTHORITY to resource DEPT58.CLIST.CNTL,which is in class DATASET and resides on volumeTSO035.

v The RACF profile protecting the resource isDEPT58.CLIST.*, and it is a generic profile.

v The access attempted by SMITH was READ, and theaccess allowed by RACF was NONE.

If the message indicates a job and step instead of auser, group, and name, RACF could not find a validACEE containing user, group, and name information.This could occur for a started task that is not defined inthe RACF started-task table, if an entry in thestarted-task table has an invalid RACF group specified,or if the user's ACEE has been corrupted. If thesubmitting user ID is not the same as the executionuser ID, the message includes an additional linecontaining the submitting user ID, group, and node.

When the message is reporting an access failure for anOpenExtensions file, the resource name is the pathnamethat was specified to the kernel syscall.

The meaning of the volume serial number shown in theVOL field varies. For a non-VSAM data set, it meansthe volume on which the data set resides. For a VSAMdata set, it means the volume on which the catalogcontaining the data set entry resides.

The phrase FROM generic-profile-name (G), if includedin the message, identifies the generic profile that RACFused to check for access to the resource.

For further explanations of this message, check themessage line that indicates what request was made.This is usually line 2 or 3. For example, it could beINSUFFICIENT ACCESS AUTHORITY. Find this message lineamong the explanations that follow for messageICH408I (arranged alphabetically), and read theexplanation for that message line.

For attempts to use protected resources, the messageshows the access attempted (ACCESS INTENT phrase) andthe access permitted by RACF (ACCESS ALLOWED phrase).When the message is reporting an attempt to access anOpenExtensions file, the ACCESS INTENT (intent) isspecified as “RWX”, representing read, write orsearch/execute permission requested. More than onepermission can be requested at a time. If a permissionis not requested, the letter is replaced by a dash “-”.ACCESS ALLOWED (allowed) is specified as“{OWNER/GROUP/OTHER/NO} RWX”, whereOWNER indicates the owner permission bits wereused, GROUP indicates the group permission bits wereused, OTHER indicates the other permission bits wereused, NO indicates that another authority, such assuperuser, was used, and “RWX” represents thesettings of the permission bits that were checked.

System action: If the phrase RESOURCE NOT PROTECTED

appears in the message with a warning, RACF allowsthe request to continue. If the phrase RESOURCE NOTPROTECTED appears in the message without a warning,RACF fails the request. For attempts to use protectedresources, the message shows the access attempted(ACCESS INTENT phrase) and the access permitted byRACF (ACCESS ALLOWED phrase).

Note:

1. When a user is denied access to a RACF-protectedresource because of the return code from aRACHECK installation exit routine, the user'sallowed access may be inconsistent with therequested access. (For example, access allowed wasALTER, access requested was READ, but therequest for access was denied.)

2. On MVS, a user who has ALTER access authority toa DASD volume can scratch a data set on thatvolume even if the user does not have the requiredALTER access authority to that particular data set.In this case, on systems without always-call,message ICH408I is issued even though the data setis scratched; on systems with always-call, themessage is not issued.

3. On MVS, the phrase “LOGON/JOB INITIATION”may appear during logon processing; however, thelogon may be successful. When RACF is active,logon verification can produce an error duringRACF processing; however, the logon can proceedusing an alternate method (for example, UADS).This error occurs if the installation does not use theRACF database to store security-related informationfor a particular user, but it does use an alternatemethod (such as UADS) for the logon application(for example, TSO) to perform user verification.

Operator response: Follow the security proceduresestablished for your installation. If no such procedureshave been established, report the complete text of thismessage to the RACF security administrator.

User response: Follow the security proceduresestablished for your installation. If no such procedureshave been established, report the complete text of thismessage to the RACF security administrator.

Problem determination: Detailed information aboutthe violation is available in the SMF type 80 record thatRACF produces at the same time as this message. SeeRACF Auditor's Guide for information about reportingon the contents of the RACF SMF records.

Note:

1. When RACF verifies a password during logon orwhen a batch job begins, the message includes NAME(???).

2. On MVS, for users not defined to RACF, the job andstep are indicated by jobname and stepname. Forbatch users, stepname is blank.

Destination: Descriptor code is 4. Routing codes are 9

ICH408I


and 11. This message is routed to the security console.All violations (except LOGON/JOB INITIATION,COMMAND VIOLATIONS, and OPENEXTENSIONSVIOLATIONS) are issued as write-to-programmer(WTP) messages.

Note: A CMS user who is using OpenExtensions forVM will not see the ICH408I messages.

ICH408I DEFINE - GROUP NOT DEFINED

Explanation: This error occurs when RACF detects anunauthorized attempt to define a RACF-protectedresource; for example, by way of RDEFINE for ageneral resource or ADDSD for a data set.

System action: RACF prevents the request fromcompleting.

User response: Correct any spelling errors in thegroup ID and try again. If you cannot remember thecorrect group ID, ask your RACF security administratorto provide you with a valid group ID.

ICH408I DEFINE - INSUFFICIENT AUTHORITY

Explanation: This error occurs when RACF detects anunauthorized attempt to define a RACF-protectedresource; for example, by way of RDEFINE for ageneral resource or ADDSD for a data set. Thismessage can also be issued for certain types of createand rename requests.


ICH408I DEFINE - RESOURCE ALREADYDEFINED

Explanation: This error occurs when RACF detects anunauthorized attempt to define a RACF-protectedresource; for example, by way of RDEFINE for ageneral resource or ADDSD for a data set.


ICH408I DEFINE - RESOURCE NOTPROTECTED

Explanation: This error occurs when RACF detects anunauthorized attempt to define a resource that requiresRACF protection, such as an MVS data set when theSETROPTS PROTECTALL option is in effect.


ICH408I DEFINE - USER IN SECONDQUALIFIER IS NOT RACF-DEFINED

Explanation: This error occurs when RACF detects anunauthorized attempt to define a RACF-protectedresource. The user specified a profile name in whichthe second qualifier was not a RACF-defined user ID.


User response: Correct the second qualifier in theprofile name and try again.

ICH408I DEFINE - USER NOT MEMBER OFGROUP

Explanation: This error occurs when RACF detects anunauthorized attempt to define a RACF-protectedresource.



ICH408I DEFINE - USER NOT RACF-DEFINED



ICH408I DEFINE - WARNING: INSUFFICIENTSECURITY LABEL AUTHORITY

Explanation: This error occurs when RACF detects anunauthorized attempt to define a resource that has asecurity label associated with it.

System action: RACF allows the request to complete.

User response: If the security label is misspelled, tryagain. You might need to log off and log on again witha different security label. For a list of security labelsyou can specify, enter the following RACF command:

SEARCH CLASS(SECLABEL)

To find out which security label applies to the task youare currently doing, see your installation securityprocedures or ask your RACF security administrator.

ICH408I DEFINE - WARNING: RESOURCE NOTPROTECTED


ICH408I



ICH408I DEFINE - WARNING: SECURITYLABEL MISSING FROM USER, JOB,OR PROFILE

Explanation: RACF issues this message when asecurity label is missing from one of the following:

v The user profile

v A batch job

v A resource profile necessary for logon or jobinitiation.

and the SETROPTS MLACTIVE(WARNING) option isin effect.


User response: If a line of this message indicates aprofile in a RACF class, such as SMITH.CLISTCL(DATASET ) VOL(D58000), the indicated resourceprofile is missing a security label. If a security label isnot specified for the profile before the installation putsthe SETROPTS MLACTIVE(FAILURES) option intoeffect, you will not be able to log on or submit the job.

ICH408I DELETE - INVALID VOLUME

Explanation: This error occurs when RACF detects anunauthorized attempt to delete a RACF-protectedresource.


ICH408I DELETE - RESOURCE NOT FOUND

Explanation: This error occurs when RACF detects anunauthorized attempt to delete a RACF-protectedresource.


ICH408I FULL VIOLATION ON COMMANDcommand

Explanation: This error occurs when RACF detects anunauthorized attempt to use a RACF command thatwould modify profiles on the RACF database.

System action: RACF prevents the command fromcompleting.

ICH408I INSUFFICIENT ACCESS AUTHORITY

Explanation: This error occurs when RACF detects anunauthorized attempt to access a RACF-protectedresource.

System action: RACF denies the requested access.

ICH408I INSUFFICIENT AUTHORITY TOEXTEND TO A NEW VOLUME

Explanation: This error occurs when RACF detects anattempt to specify an unauthorized volume on theADDVOL or CHGVOL operand.

System action: RACF denies the request.

ICH408I INSUFFICIENT AUTHORITY TOsyscall-name

Explanation: This error occurs when RACF detects anattempt to specify an OpenExtensions function forwhich the user does not have authority. Syscall-nameidentifies the OpenExtensions callable service thatinvoked RACF.

System action: RACF returns an error return code tothe invoking system function, which will return anerror return code to the application caller. See z/VMOpenExtensions Callable Services Reference to determinethe action of the syscall functions.

Programmer response: Provide appropriateinformation about the failure to the user of yourprogram, based on the function invoked and the returncodes received.

ICH408I INSUFFICIENT SECURITY LABELAUTHORITY

Explanation: This error occurs when RACF detects

v An attempt to access a resource that has a securitylabel associated with it, and the access cannot beauthorized because the requester is running under aninappropriate security label. —or—

v An attempt to access a resource that has no securitylabel associated with it and the access cannot beauthorized because a security label is required.


User response: Log on (or submit the job again) underan appropriate security label and try the access again.For a list of security labels you can specify, enter thefollowing RACF command:



ICH408I INSUFFICIENT SECURITYLEVEL/CATEGORY AUTHORITY



User response: Enter the LISTUSER command to

ICH408I


determine the security level and category or see yourRACF security administrator.

ICH408I LOGON/JOB INITIATION -EXCESSIVE PASSWORD OR PASSPHRASE ATTEMPTS

Explanation: A user attempted to log on or access thesystem with passwords and/or password phrases thatwere not valid more times than allowed by the SETRPASSWORD(REVOKE) setting.

System action: RACF prevents the user from accessingthe system.

User response: Report the exact text of this messageto your RACF security administrator.

ICH408I LOGON/JOB INITIATION - INACTIVEUSER HAS BEEN REVOKED

Explanation: A user has not logged on, submitted ajob or accessed the system for so long that the user IDhas become inactive.



ICH408I LOGON/JOB INITIATION -INSUFFICIENT SECURITY LABELAUTHORITY

Explanation: This message is issued when RACFdetects an attempt to log on or submit a job with amissing or inappropriate security label. This could beissued on SETROPTS MLS when dominance check hasfailed or when the SETROPTS MLACTIVE option is ineffect requiring a SECLABEL to be specified.

System action: RACF prevents the user from loggingon or the job from executing.

User response: Log on (or submit the job again) underan appropriate security label. For a list of securitylabels you can specify, see your RACF securityadministrator.

Note: If you can log on (perhaps using a differentsecurity label), you can find out which security labelsyou can use by entering the following RACF command:


ICH408I LOGON/JOB INITIATION - INVALIDGROUP

Explanation: A user attempted to log on or submit ajob with an invalid group ID specified. The invalidgroup ID could be a translated group ID.



ICH408I LOGON/JOB INITIATION - INVALIDOIDCARD

Explanation: A user attempted to log on with aninvalid operator identification card.

System action: RACF prevents the user from loggingon.

User response: Attempt to log on again. If theproblem persists, report this message to your RACFsecurity administrator.

ICH408I LOGON/JOB INITIATION - INVALIDPASSWORD

Explanation: A user attempted to log on or submit ajob with an invalid password.


User response: Correct any spelling errors in thepassword and try again. If you cannot remember yourpassword, ask your RACF security administrator toprovide you with a new current password.

ICH408I LOGON/JOB INITIATION - INVALIDPASSWORD ENTERED AT TERMINALterminal-id

Explanation: A user attempted to log on with aninvalid password. The attempt was made from terminalterminal-id.


User response: Correct any spelling errors in thepassword and try again. If you cannot remember yourpassword, ask your RACF security administrator toprovide you with a new password.

ICH408I LOGON/JOB INITIATION - NOTAUTHORIZED TO APPLICATION



ICH408I LOGON/JOB INITIATION - NOTAUTHORIZED TO SECURITY LABEL

Explanation: You cannot use a particular security label(either for logging on or for initiating a job) unless youhave at least READ access authority to the SECLABELprofile of that name.

ICH408I



User response: Correct any spelling errors in thesecurity label and try again.



Security Administrator Response: If the user should beallowed to use the indicated security label, give theuser READ access authority to the SECLABEL profile.For example:

PERMIT security-label CLASS(SECLABEL)ID(userid) ACCESS(READ)

ICH408I LOGON/JOB INITIATION - NOTAUTHORIZED TO TERMINAL/CONSOLE

Explanation: A user has attempted to log on to aRACF-defined terminal or console, but is notauthorized to do so.


User response: Log on to a different terminal (orconsole), or ask your RACF security administrator toensure that you have access to this terminal (orconsole).

ICH408I LOGON/JOB INITIATION - PASSPHRASE IS NOT VALID

Explanation: A user attempted to access the systemspecifying a password phrase that is not valid.


User response: Correct any spelling errors in thepassword phrase and try again. If you cannotremember your password phrase, ask your RACFsecurity administrator to provide you with a newpassword phrase.

ICH408I LOGON/JOB INITIATION - REVOKEDUSER ACCESS ATTEMPT

Explanation: A user who has been revoked hasattempted to log on or submit a job.


User response: Report this message to your RACFsecurity administrator.

ICH408I LOGON/JOB INITIATION - SECURITYLABELS NOT COMPATIBLE.

Explanation: Different security labels are associatedwith the submitter and the job and neither onedominates the other.

System action: RACF prevents the job from executing.

User response: Ensure that you are using the correctsecurity labels for your logon session and jobsubmission.

ICH408I LOGON/JOB INITIATION -SUBMITTER IS NOT AUTHORIZEDBY USER

Explanation: You do not have the appropriate accessauthority to a profile in the SURROGAT class.


User response: One of the following:

v If you do not intend to submit a job for another user,ensure that the USER parameter on the JOBstatement specifies the user ID that you logged onwith.

v If you do intend to submit a job for another user, askthe user whose job you are submitting to ensure thatyou have the appropriate access authority to his orher profile in the SURROGAT class. The followingcommand can be used to do this:

RLIST SURROGAT userid.SUBMITAUTHUSER

where userid is the other user's (job owner's) user ID.

ICH408I LOGON/JOB INITIATION SUBMITTERIS NOT AUTHORIZED TO SECURITYLABEL

Explanation: Submitter does not have authorization tothe SECLABEL required to run the job. You cannot usea particular security label (either for logging on or forinitiating a job) unless you have at least READ accessauthority to the SECLABEL profile of that name.

Note: Both user (owner) and submitter of the job mustbe authorized to security label.


User response: Correct any spelling errors in thesecurity label and try again.



ICH408I


ICH408I LOGON/JOB INITIATION -SURROGAT CLASS IS INACTIVE

Explanation: You cannot submit jobs on behalf ofanother user, because the SURROGAT class is inactive.



v If you do not intend to submit a job for another user,ensure that the USER parameter on the JOBstatement specifies the user ID that you logged onwith.

v If you do intend to submit a job for another user, askyour RACF security administrator to activate theSURROGAT class.

ICH408I LOGON/JOB INITIATION - SYSTEMNOW REQUIRES MORE AUTHORITY

Explanation: The SETROPTS MLQUIET command hasbeen issued. Jobs cannot be initiated, and users cannotlogon, until the SETROPTS NOMLQUIET command isissued.

System action: Unless the user is trusted, has theSPECIAL attribute, or is the console operator, RACFprevents the user from logging on or the job fromexecuting.

User response: Submit your job or attempt to log onagain at a later time. If the problem persists, report thismessage to your RACF security administrator.

ICH408I LOGON/JOB INITIATION - USER ATTERMINAL(terminal-id) NOTRACF-DEFINED

Explanation: A user who does not have a RACF userprofile has attempted to log on to the system.


ICH408I LOGON/JOB INITIATION - NOTAUTHORIZED TO SUBMIT JOBjob-name.

Explanation: A job was submitted with the indicatedjob name, and a check of the submitter user ID doneagainst the JESJOBS profile SUBMIT.xnode.jobname.useridfailed, indicating that you are not authorized to submitjobs with the indicated job name, to run on theexecution node (xnode), for the specified user ID. Youdo not have the appropriate access authority to aprofile in the JESJOBS class.


User response: Correct any spelling errors in the jobname and try again.

ICH408I LOGON/JOB INITIATION -WARNING: INSUFFICIENT SECURITYLABEL AUTHORITY

Explanation: This error occurs when a user is loggingon or a batch job is being initiated, and RACF detectsan unauthorized attempt to access a resource that has asecurity label associated with it. It is issued when MLSWARN is specified, and means that you would havefailed a dominance check. For example, this messagecould be issued if a user attempts to log on at aRACF-protected terminal, and the profile protecting theterminal has a security label specified for it.


User response: If the security label is misspelled, tryagain. If you can log on (perhaps using a differentsecurity label), you can find out which security labelsyou can use by entering the following RACF command:



ICH408I LOGON/JOB INITIATION -WARNING: NOT AUTHORIZED TOSECURITY LABEL

Explanation: RACF issues this message when, forexample, a user with the SPECIAL attribute specifies asecurity label such as SYSHIGH to which he or shedoes not have at least READ access authority.

System action: RACF allows the user to log on or thejob to execute.

ICH408I LOGON/JOB INITIATION -WARNING: SECURITY LABELMISSING


v The user profile

v A batch job


and the SETROPTS MLACTIVE(WARNING) option isin effect.

System action: RACF allows the user to log on or thejob to execute.

User response: If a security label is not specified forthe profile before the installation puts the SETROPTSMLACTIVE(FAILURES) option into effect, you will notbe able to log on or submit the job.

ICH408I


ICH408I LOGON/JOB INITIATION - WARNINGSECURITY LABELS NOTCOMPATIBLE.

Explanation: Different security labels are associatedwith the submitter and the job and neither onedominates the other.

System action: RACF allows the job to execute.

User response: If you can specify security labels,ensure that you are using the correct security labels foryour logon session and job submission. If the system isnot in COMPATMODE, this job will fail.

ICH408I NETWORK JOB ENTRY - JOB FROMNODE node-name NOT AUTHORIZED

Explanation: The execution node is protected by theindicated profile in the NODES class (NJE processing).The submitting node or user ID is either not defined toor is not authorized to run on the execution node. TheUSER and GROUP indicated in the message are theuser ID and group ID under which the job was to run(as translated by a profile in the NODES class).

ICH408I PARTIAL VIOLATION ONCOMMAND command

Explanation: This error occurs when RACF detects anunauthorized attempt to use a RACF command thatwould modify profiles on the RACF database.

ICH408I PROFILE NOT FOUND. IT ISREQUIRED FOR AUTHORIZATIONCHECKING.

Explanation: This error occurs when RACF detects anattempt to access a data set that is not protected by aRACF profile, and RACROUTE REQUEST=AUTH (orRACHECK) is issued for the DATASET class when theSETROPTS PROTECTALL(FAILURES) option is ineffect.

User response: Ensure that a profile is created in theDATASET class for the data set indicated in themessage before requesting access.

ICH408I PROFILE NOT FOUND. RACFINDWAS SPECIFIED ON THE MACRO.

Explanation: This error occurs when RACF detects anattempt to access a resource that is not protected by aRACF profile, and RACFIND=YES was specified on theRACROUTE REQUEST=AUTH macro (or RACHECKmacro).

User response: Ensure that a profile is created in theDATASET class for the data set indicated in themessage before requesting access.

ICH408I REMOTE JOB ENTRY - JOB FROMNODE node-name NOT AUTHORIZED

Explanation: A job submitted from the indicated nodewas not authorized to run on this system. (A UACC ofNONE was specified on the NODES profile that appliesto this node.)

ICH408I RENAME - GROUP NOT DEFINED

Explanation: This error occurs when RACF detects aninvalid attempt to rename a resource.



ICH408I RENAME - INSUFFICIENTAUTHORITY

Explanation: This error occurs when RACF detects anunauthorized attempt to rename a resource.


ICH408I RENAME - NEW NAME ALREADYDEFINED

Explanation: This error occurs when RACF detects aninvalid attempt to rename a resource.


ICH408I RENAME - RESOURCE NOTPROTECTED


System action: RACF allows the request to continue.

ICH408I RENAME - USER NOT MEMBER OFGROUP




ICH408I


ICH408I RENAME - USER NOTRACF-DEFINED



ICH408I RENAME - WARNING: RESOURCENOT PROTECTED



ICH408I RESOURCE NOT PROTECTED

Explanation: This error occurs when RACF detects anunauthorized attempt to access a resource, but theresource is not protected.

System action: RACF allows the requested access.

ICH408I SECURITY LABEL MISSING FROMUSER, JOB, OR PROFILE


v The user profile

v A batch job



User response: If a line of this message indicates aprofile in a RACF class, such as SMITH.CLISTCL(DATASET ) VOL(D58000), the indicated resourceprofile is missing a security label.

ICH408I WARNING: DATA SET NOTCATALOGED

Explanation: This error occurs when the SETROPTSCATDSNS(WARNING) option is in effect, and RACFdetects an unauthorized attempt to access anuncataloged data set.


User response: Catalog the data set and attempt theaccess again.

Note: If the SETROPTS CATDSNS(FAILURES)command is issued before the data set is cataloged,RACF will fail any subsequent access attempts.

ICH408I WARNING: INSUFFICIENTAUTHORITY - TEMPORARY ACCESSALLOWED



ICH408I WARNING: INSUFFICIENT SECURITYLABEL AUTHORITY

Explanation: This error occurs when the SETROPTSMLS(WARNING) option is in effect and RACF detectsan attempt to access a resource that would fail becauseof the security label associated with the resource.


User response: Consider logging on again (orsubmitting the job again) with an appropriate securitylabel. To find out which security label applies to thetask you are currently doing, see your installationsecurity procedures or ask your RACF securityadministrator.

Note: If the SETROPTS MLS(FAILURES) command isissued, RACF will fail any subsequent access attempts.

ICH408I WARNING: RESOURCE NOTPROTECTED

Explanation: This error occurs when RACF detects anunauthorized attempt to access an unprotectedresource.


ICH408I WARNING: SECURITY LABELMISSING FROM USER, JOB, ORPROFILE

Explanation: RACF issues this message when asecurity label is missing from one of the following andthe SETROPTS MLACTIVE(WARNING) option is ineffect:

v The user profile

v A batch job



User response: If a line of this message indicates aprofile in a RACF class, such as SMITH.CLISTCL(DATASET ) VOL(D58000), the indicated resourceprofile is missing a security label.

ICH408I


ICH409I abend-code[-yy] ABEND DURING request{PROCESSING | PARAMETERVALIDATION}

Explanation: A failure occurred during the RACFprocessing of the indicated request. If the requestindicated in the message is RACINIT, RACHECK,RACDEF, or RACLIST, RACF was processing the SVCrelated to the request. If the request indicated in themessage is GENLIST, RACF was building in-storagegeneric profiles. If the request indicated in the messageis DIRAUTH, RACF was processing a directedauthorization check request.

System action: RACF processing is terminated.

Operator response: Report the exact text of thismessage to your system programmer or RACF securityadministrator, or both, and save the message output.


Problem determination: Try to determine where theabend occurred. RACF, a RACF caller, or other systemprocessing could have caused the abend. If the messagesays PARAMETER VALIDATION, the RACF caller probablycaused the abend.

If the last two digits of the abend are 82, 83, 84, or 85,locate the abend in Chapter 6, “RACF Abend Codes,”on page 251. The abend description will provideadditional assistance.

If the last two digits of the abend are not 82, 83, 84, or85, examine the abend code and analyze the error usinggeneral problem determination techniques. The valueyy is the contents of Register 15 (in hexadecimal). Forsystem abend and reason codes, see your system codesmanual.


ICH410I RACF UNABLE TO BACK UP UPDATEOF entry-name BACKUP RACF DATASET SEQUENCE nnn, dsname

Explanation: A failure occurred in attempting toduplicate on the backup RACF database an updateperformed in the corresponding primary database. Thedatabase is identified by:nnn Database sequence number (1 to 255 on MVS;

1 to 4 on VM)dsname Database name.

System action: RACF has not duplicated the updateoperation. Processing continues.

Operator response: Notify system programmer.


Problem determination: If this message is precededby message ICH401I, ICH405I, ICH406I, or ICH407I,the error was encountered on the backup database.Otherwise, the backup database was not in

synchronization with its primary database.


ICH411I MAXIMUM PROFILE SIZE EXCEEDED.profile-name NOT ALTERED.

Explanation: During RACF processing, an attemptwas made to expand the profile indicated in themessage. The profile has reached the maximum sizethat RACF can handle (65,535 bytes); the profile cannotbe made larger.


Operator response: Report this message to the systemprogrammer or the RACF security administrator, orboth, and save this output.

Programmer response: The profile has reached themaximum size allowed. If possible, decrease the size ofthe profile; if that is not possible, split the profile. Forexample, you could split a group with too many usersinto several smaller groups.


ICH412I RACF DATA AREAS FORCED BELOWTHE 16-MEGABYTE LINE.

Explanation: RACF was unable to allocate storageabove 16 megabytes because at least one of theinstallation exit routines does not support 31-bitaddressing mode.


Programmer response: If possible, change theinstallation exit routines to support 31-bit addressingmode.


ICH413I RACF MANAGER REQUEST ID WASxxxxxxxx

Explanation: This message contains additionalinformation to help determine the cause of an ICH401Ierror message. This message is issued only after anICH401I message. The xxxxxxxx field contains an IDthat can help the IBM support center determine thecause of the problem.

System action: See message ICH401I.

Operator response: See message ICH401I.

Programmer response: See message ICH401I.


ICH409I • ICH413I


ICH414I SMF IS RECORDING ON ITS LASTAVAILABLE DATA SET. WHEN DATASET FILLS UP, SMF EXIT IEFU29 WILLPLACE THE SYSTEM IN A WAITSTATE.

Explanation: SMF exit routine IEFU29, which stopssystem operations when all SMF data sets are full, hasbeen installed on your system. This exit routine helpsensure that no SMF data is lost in accordance withUnited States Department of Defense C2 criteria.

System action: Processing continues until the SMFdata set fills up. At that time, SMF exit IEFU29 willplace the system in a wait state.

Operator response: Using installation-definedprocedures, archive the SMF data sets that are full. Thismakes them available for re-use.


ICH415I session attempt rejected. reason code =code, entity netid.luid1.luid2, profileprofile-name, at hh:mm:ss on month, day,year

Explanation: The message alerts a RACF user that anattempt by logical unit netid.luid1 to establish a sessionwith the logical unit luid2 has been rejected for asecurity reason. The entity netid.luid1.luid2 was coveredby profile profile-name. The message is routed to theuser specified in the NOTIFY field of the profile.

This message is identical to ICH70005I except that it issent to the MVS security console.

System action: The session is terminated.

Operator response: Notify the RACF securityadministrator.

Problem determination: Check the reason code in themessage for one of the following values:

02 Local LU's session key will expire in five daysor less

03 Partner LU's access has been revoked

04 Session key does not match partner LU sessionkey

05 Partner LU has terminated the session due to asecurity reason

06 Partner LU verification required but no sessionkey is defined on this system

07 Possible security attack by partner LU

08 Verification was not indicated by partner LUbut a session key exists on this system

09 Verification was indicated by partner LU but asession key does not exist on this system

10 Failure due to SNA security related protocolerror

11 Failure due profile change during verification

12 A profile was found with an expired sessionkey


ICH416I RACF DETECTED AN INVALIDNON-EGN DATASET PROFILE NAME.PROFILE profile-name DOES NOTPROTECT THE INTENDEDRESOURCES.

Explanation: RACF detected a profile that was addedbefore the enablement of Enhanced Generic Names(EGN) and that cannot be interpreted as intendedunder EGN rules. This message identifies the non-EGNgeneric data set profile name. Under EGN rules, theprofile may not protect the resources that it wasdefined to protect. If this message is issued duringprocessing of a SEARCH or LISTDSD GENERICrequest, bad profile names (particularly names 43 and44 characters in length) may also have been displayedand the output should be considered unreliable.

For example, suppose the following six generic data setprofiles were defined before turning EGN on:1 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.D.*’2 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*’3 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*’4 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*’5 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.D.*’6 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.DD*’

Then EGN was enabled and three more generic data setprofiles were defined:

7 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.**’8 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.**’9 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.**’

A subsequent SEARCH request would display thefollowing:SEARCH CLASS(DATASET)ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.D.*DOES NOT PROTECT THE INTENDED RESOURCES.

ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*DOES NOT PROTECT THE INTENDED RESOURCES.

ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

A IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.D.*.* (G)ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.


B IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*.* (G)ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

C IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.** (G)D IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.* (G)ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*

ICH414I • ICH416I


DOES NOT PROTECT THE INTENDED RESOURCES.E IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD* (G)ICH416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

F IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.** (G)G IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.D.* (G)H IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.DD* (G)I IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.** (G)

Because of RACF command processing, the ICH416Imessage may be issued more than once. However, anytime it is issued during a command invocation, thecommand output must be considered unreliable. In theexample above, changes in EGN rules caused RACF toincorrectly interpret non-EGN profiles (1) and (2) asSEARCH profiles (A) and (B). These profiles no longercover the intended resources. Even though names (D)and (E) appear correct, with no additional characters atthe end, they also do not cover the intended resourcesand cause ICH416I messages to be issued. EGN profiles(7), (8), and (9) were correctly displayed by SEARCH as(C), (F), and (I). Profiles (G) and (H) follow the samerules under non-EGN and EGN, so they actuallyprotect what they were intended to protect.

System action: RACF processing of the requestcontinues.

Operator response: Report this message to the systemprogrammer or the RACF security administrator andsave the message output.

Programmer response: See problem determination.

Problem determination: This message identifies thebad profile.

An EGN profile, possibly less specific, can be definedto protect the desired resources; however the originalbad non-EGN profile must still be deleted to preventfurther ICH416I messages.

To delete bad profiles:

1. Use SETROPTS NOEGN to temporarily disableEGN. During this time, there should be no othersystem activity, in order to prevent the creation ofgeneric profiles that could result in additionalproblems. Under normal circumstances, it is notrecommended that EGN be turned off after it isturned on.

2. Use SEARCH GENERIC CLIST NOMASK NOLISTto create a CLIST containing generic data set profilenames.

3. Edit the CLIST to find 42- and 43-character namesending in ‘.*’.

4. Delete the profiles found.

5. Use SETROPTS EGN to re-enable EGN.

6. Define profiles according to EGN rules that protectthe resources intended to be protected by thenon-EGN profile names.

Destination: Descriptor code is 4. Routing codes are 9and 11. Routing code 11 is only used when a TSOenvironment is not in effect.

RACF Initialization Messages

ICH500I I/O ERROR DURING RACFINITIALIZATION [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname]

Explanation: During RACF initialization, an I/O erroroccurred on the RACF database.

System action: The system issues ICH502A followingthis message, then waits for the operator's reply.

Operator response: Notify your system programmer.

Programmer response: Determine if the device orvolume used for the RACF database is functioningproperly.


ICH501I --RACF IS NOT ACTIVE.--

Explanation: During RACF initialization, either aRACF or a system error occurred.

System action: IPL continues. RACF becomes inactiveand allows access to the following:

v On MVS: Resources accessed by started tasks that aremarked as privileged or trusted in the RACFstarted-tasks table (ICHRIN03)

v On MVS: A user's own data sets

v On both MVS and VM: Any other resources to whichthe operator allows access.


Programmer response: Correct the problem and IPLagain.

Problem determination: A message (either ICH511I,ICH512I, ICH517I, ICH518I, or ICH519I) precedes thismessage and indicates the cause of the error.


ICH502A SPECIFY NAME FOR {PRIMARY |BACKUP} RACF DATA SETSEQUENCE nnn OR ‘NONE’

Explanation: The data set name table indicates that aprimary (or backup) database is requested for thesequence number indicated by nnn. However, either nodatabase name was given in the table or an erroroccurred while the database was being processed. In

ICH500I • ICH502A


the latter case, a message (either ICH500I, ICH503I,ICH506I, ICH507I, ICH510I, or ICH515I) precedes thismessage.

System action: The system waits for the operator'sreply.

Operator response: Specify either the name of analternate RACF database or NONE if no primary (orbackup) RACF database is to be used for this sequencenumber.

Note:

1. On MVS, if an alternate database is specified, itmust be on-line and cataloged.

2. If there is a problem with the primary RACFdatabase, and RACF issues message ICH510I andICH502A, you might (appropriately) reply toICH502A with the name of the backup RACFdatabase. RACF will attempt to allocate the backupdatabase as the primary database. If, followingspecifications in the database name table, RACFthen attempts to allocate the backup RACF databaseas the backup database, RACF will issue messageICH515I, then ICH502A again. This is normal, andyou should consult with your system programmerabout whether to reply with NONE or the name ofyet another RACF database.

The following VM specific example shows how toreply to this message to continue processing withthe backup RACF database as the primary databaseand no backup database. It assumes that RACFVMis the RACF service machine and the operator isdefined as the secondary user ID for the RACFservice machine.

If RACFVM is disconnected, from the operatorcommand line,

v Enter the command CP SEND RACFVM1RACF.BACKUP in reply to message ICH502Afor the name of the primary RACF database.

v Enter the command CP SEND RACFVM 1NONEin reply to message ICH502A for the name of thebackup RACF database.

If RACFVM is not disconnected, from the RACFVMservice machine command line,

v Enter the command 1RACF.BACKUP in reply tomessage ICH502A for the name of the primaryRACF database.

v Enter the command 1NONE in reply to messageICH502A for the name of the backup RACFdatabase.

For additional information, see “Reviewing andReplying to Operator Messages on z/VM” on page2.


Problem determination: If the RACF database is on

VM, ensure that a FILEDEF exists for the RACFdatabase.

If the RACF database is on MVS, be sure it is catalogedand online, and that the device on which the RACFdatabase is mounted is functioning properly. If thedatabase was updated by the ICHMIN00 or IRRMIN00utility, ensure that templates of the correct level wereadded to the RACF database. (Down-level templatescan cause a RACF manager error.)


ICH503I RACF DATA SET NOT FOUND[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname]

Explanation: During initialization, the RACF databasecould not be found.

System action: The system issues ICH502A followingthis message, then waits for the operator reply.


Programmer response: Ensure that the correct RACFdatabase is specified in MSTRJCL on MVS or in theRACONFIG EXEC on VM or that it is included in theoperator's reply to message ICH502A. If the RACFdatabase is on MVS, ensure that it is cataloged andonline.


ICH504I USER ATTRIBUTE DATA SET NOTFOUND

Explanation: During RACF initialization on MVS, theTSO UADS data set could not be found. The UADSdata set had been defined in MSTRJCL.

System action: The system continues with the IPL, butTSO/E is not usable until the next IPL.

Operator response: Report this message to the systemprogrammer.

Programmer response: If TSO/E is to be used beforethe next IPL, a re-IPL is required to have TSO/E active.

Problem determination: Ensure the TSO UADS dataset is cataloged and online.


ICH505A RACF INITIALIZATION ABEND S‘xxx’

Explanation: A system abend occurred during RACFinitialization.


v On MVS: Resources accessed by started tasks that aremarked as privileged in the RACF started tasks table(ICHRIN03)

ICH503I • ICH505A






Problem determination: See Chapter 6, “RACF AbendCodes,” on page 251for system completion code xxx.The SDUMP data set and LOGREC data provide otherdiagnostic information. Correct the error and IPL again.

Destination: Descriptor codes are 1 and 2. Routingcode is 1.

ICH506I RACF DATA SET CANNOT BE USED[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname]

Explanation: The data set is not usable as a RACFdatabase because either: (1) the ICB indicates that thedata set has been extended, (2) the data set has beenextended by utility IRRDSC00 (DS convert), (3) the dataset was used as input in the ICHUT400 or IRRUT400utility with the LOCKINPUT parameter specified, or (4)the initialization of the RACF database failed.



Programmer response: Ensure that the correct RACFdatabase is specified in MSTRJCL on MVS or in theRACONFIG EXEC on VM or that it is included in theoperator's reply to message ICH502A.


ICH507I RACF DATA SET NOT AT CURRENTRELEASE LEVEL [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname]

Explanation: The primary or backup RACF databasebeing used is not at the appropriate release level.


Operator response: Check the response to messageICH502A. It should be the name of a RACF database atthe current release level. If this message recurs, reportthis message (and the response to message ICH502A) tothe system programmer.

Programmer response: See “Problem Determination”for message ICH502A.


ICH508I ACTIVE RACF EXITS: {NONE |name,...,name}

Explanation: During RACF initialization, one or moreof the following installation exit routines or tablesindicated by name were loaded from LPA and are ineffect for this IPL:

ICHCCX00Command preprocessing exit

ICHCNX00Command preprocessing exit

ICHDEX01Data encoding exit

ICHNCV00Naming conventions table

ICHPWX01New-password processing exit

ICHPWX11New-password-phrase processing exit

ICHRCX01RACHECK preprocessing exit

ICHRCX02RACHECK postprocessing exit

ICHRDX01RACDEF preprocessing exit

ICHRDX02RACDEF postprocessing exit

ICHRIX01RACINIT preprocessing exit

ICHRIX02RACINIT postprocessing exit

ICHRFX01FRACHECK preprocessing exit

ICHRFX02FRACHECK postprocessing exit

ICHRLX01RACLIST pre/postprocessing exit

ICHRLX02RACLIST selection exit

Note: This message only applies to exits common toMVS and VM during MVS or VM IPL; it does notinclude VM-specific exits.

System action: RACF initialization continues.

Operator response: Ensure that all of the expected exitroutines are listed in this message.

Programmer response: If any expected exit routinesare not listed, the exits to be loaded must be link-editedinto an LPA library on MVS or into a RACFLPALOADLIB on VM with the appropriate names.

ICH506I • ICH508I



ICH509I SYSRACF DD STATEMENT NOTSPECIFIED IN MSTRJCL ORALLOCATION FAILURE FOR RACFDATA SET.

Explanation: One of the following might generate thismessage:

v On MVS: RACF did not find SYSRACF (a DDstatement) in MSTRJCL.

v On MVS or VM: RACF did not find the RACFdatabase in the data set name table.

v Dynamic allocation could not allocate the RACFdatabase. SYSRACF might be in the MSTRJCL butthe RACF data set might not be cataloged in theproper volume.




Problem determination: If SYSRACF has beenremoved from the MSTRJCL, check to see if the RACFdatabase has been placed in the data set name table. Ifnot, correct the error and IPL again.

If the SYSRACF DD statement is present in MSTRJCL,the RACF database has been cataloged in the wrongvolume. Re-catalog SYSRACF and IPL again.


ICH510I ALLOCATION FAILED FOR RACFDATA SET [{PRIMARY | BACKUP }RACF DATA SET SEQUENCE nnn,dsname]

Explanation: The attempt to dynamically allocate thedatabase specified has failed.

System action: If this message is received duringRACF initialization, it is followed by message ICH502Ato prompt the operator for another data set name forthe data set sequence number nnn.

If this message is received during an RVARY request,message ICH502A is not issued and the RVARYcommand retries the activation of the data set.

Operator response: Notify the system programmer.

System programmer response: If this message isreceived during RACF initialization, verify that thename specified is a valid RACF data set name. If thespecified name is correct, make sure that the devicecontaining the data set is on line and available. Instructthe operator to reply to message ICH502A with thesame data set name. If the specified name is incorrect,provide the operator with the correct RACF data setname for the data set sequence number nnn. The

operator uses this name to reply to message ICH502A.Correct any errors in the data set name table.

If this message is received during an RVARY request,make sure that the specified RACF data set is catalogedand the device containing the data set is on line andavailable. Reissue the RVARY command.


ICH511I RACF DETECTED AN ERROR IN THE{IBM SUPPLIED | INSTALLATION}CLASS DESCRIPTOR TABLE, ENTRYentry-name, ERROR CODE yy

Explanation: After locating the class descriptor tables(installation-supplied ICHRRCDE and IBM-suppliedICHRRCDX), RACF ensures that each entry in the classdescriptor table satisfies certain conditions. The classdescriptor tables are located in one of the following:

v SYS1.LINKLIB on MVS or RACFLINK LOADLIB onVM

v A library concatenated to SYS1.LINKLIB on MVS

v LPA (for ICHRRCDE only) on MVS or RACFLPALOADLIB on VM.

If the table contains an error, RACF issues this messageto the operator. Message ICH501I follows this message.Error code yy identifies the problem, as follows:

Code Description of Error1 The class name is less than 4 characters or

contains embedded blanks ornon-alphanumeric characters.

2 The ID field has a value of zero.3 The POSIT mask has more than 1 bit turned

on or has no bits turned on.4 The MAXLNTH field has a value greater than

246.5 The class is designated as a resource group

class, but the MEMBER field does not containa member class name.

6 The table contains more than 1024 entries.7 Two entries have the same class names.8 One of the following:

v A grouped class specifies a member thatdoes not exist in the table or is incorrect, ora member class specifies a group that doesnot exist in the table or is incorrect.

v A pair of classes reference each other, butone or both is not a grouping class.

9 One of the reserved class names (USER,GROUP, or DATASET) appears in the classtable.

10 An entry in the installation table has a classname with the same name as an entry in theIBM-supplied table.

11 The area reserved for the pointer to theRACLISTed profiles is not zero.

12 The area reserved for the pointer to theGENLISTed profiles is not zero.

ICH509I • ICH511I


13 The length of the CDT entry (as indicated in afield in the entry itself) is not the same as theactual length of the CDT entry.





Operator response: On MVS, ensure that the systemparameters MLPA and LNK have been specifiedproperly. If they are not, correct any errors and IPLagain. Otherwise, notify your system programmer.

Programmer response: Ensure that no errors occurredduring the assembly of the table entries, that the tablewas properly link-edited, and that modificationssubsequent to link-edit did not cause an error. Correctthe error and IPL again.


ICH512I RACF UNABLE TO LOCATE modnameIN LPA

Explanation: RACF issues this message for twopossible reasons:

v First, on MVS, RACF searched the link-pack area andcould not locate one of the routines necessary forRACF processing. On VM, one of the routines wasnot in RACFLPA LOADLIB. Processing cannotcontinue. Message ICH501I follows this message.

v Second, on MVS, RACF could not locate ICHRFR00in the link-pack area. Processing continues, but theuser cannot invoke RACF with the RACROUTEmacro instruction.

System action: The system action depends on whichof the two reasons is responsible for the message:

If it is the first reason, IPL continues; RACF becomesinactive and allows access to the following:

v On MVS: Resources accessed by started tasks that aremarked as privileged in the RACF started-tasks table(ICHRIN03)



If it is the second reason, IPL continues.

Operator response: On MVS, ensure that the systemparameters MLPA and LNK have been specifiedproperly. If they are not, correct any errors and IPLagain. Otherwise, notify your system programmer.

Programmer response: On MVS, if the systemparameters MLPA and LNK have been properly

specified, one of the following has happened:

v RACF has not been installed properly.

v The MLPA and LNK lists do not contain all theentries necessary to load the RACF-required modulesinto the link-pack area.

v There is an error in the link-edit of a requiredroutine.

Correct the error and IPL again.


ICH513I DATA SET NOT REFERENCED INRANGE TABLE PRIMARY RACF DATASET SEQUENCE nnn, dsname

Explanation: There are no entries in the range tablethat would allow access to the database indicated bydsname with sequence number nnn.

System action: The database is not available to RACF.


System programmer response: Check for a mismatchbetween the data set name table (ICHRDSNT) and therange table (ICHRRNG).


ICH515I DATA SET ALREADY IN USE AS ARACF DATA SET [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname]

Explanation: The data set indicated by dsname withsequence number nnn has already been allocated foruse by RACF as a primary or backup database.




Problem determination: Ensure that the data set nametable (ICHRDSNT) does not contain two entries withthe same database name. Also, ensure that the operatordoes not respond to message ICH502A with the nameof a database that already exists in the data set nametable.


ICH516I UNABLE TO ESTABLISH RECOVERYENVIRONMENT RACFINITIALIZATION CONTINUING.

Explanation: RACF issued an ESTAE macroinstruction. A nonzero return code indicated that thesystem could not establish a recovery routine to getcontrol if a RACF failure occurred.

ICH512I • ICH516I


System action: RACF processing continues withoutactive error recovery.



Problem determination: Register 15 contains thenonzero return code passed back from the ESTAEmacro. For a description of the ESTAE return code, seeone of the following:

v On MVS/370, see OS/VS2 MVS System ProgrammingLibrary: Supervisor, GC28-1046, or OS/VS2 MVSSupervisor Services and Macro Instructions, GC28-1114.

v On MVS/XA, see MVS/XA SPL: System Macros andFacilities Volume 2, GC28-1151 or MVS/XA SupervisorServices and Macro Instructions, GC28-1154.

v On MVS/ESA, see MVS/ESA Application DevelopmentMacro Reference, GC28-1822.


ICH517I ERROR IN RANGE TABLE.

Explanation: On MVS, either the operator entered theincorrect MLPA or LNK value, or an entry in the rangetable is out of order. On VM, an entry in the rangetable is out of order. Message ICH501I follows thismessage.





Operator response: On MVS, if the MLPA or LNKvalue was incorrect, correct it and IPL again.Otherwise, notify your system programmer of the error.

Programmer response: Ensure that the range table(ICHRRNG) was assembled and link-edited correctly. Ifnecessary, correct the order of the entries in the rangetable. IPL again.

Problem determination: The range table must containat least one entry. The first entry must have a key of 44binary zeroes, and the entries must appear with theirkeys in ascending order.


ICH518I ERROR IN INITIALIZING RACF DATASET.

Explanation: RACF unsuccessfully defined the userprofile or groups to a new RACF database. MessageICH501I follows this message.

System action: IPL continues. RACF becomes inactive

and allows access to the following:





Programmer response:

v On MVS: Reinitialize the new RACF databases usingthe ICHMIN00 or IRRMIN00 utility withPARM=NEW and IPL again.

v On VM: Reinitialize the new RACF database byrunning the EXEC RACINITD, and IPL again.

Problem determination: The first time you IPL withRACF active, RACF generates a basic set of profiles.How these profiles are defined to each other isimportant. There should be one user profile(IBMUSER), and three group profiles (SYS1, SYSCATLGand VSAMDSET), the last two being subgroups ofSYS1. IBMUSER must be connected to each of the threegroups.


ICH519I ERROR DURING UNALLOCATION OFRACF DATA SET.

Explanation: There was an error during an attempt toallocate a RACF resource because RACF could notdynamically deallocate a database specified in the dataset name table or specified in a response to theoperator. Message ICH501A follows.






Programmer response: On both MVS and VM, ensurethat the databases actually exist. On MVS, ensure thatthey reside on the DASD volume that is specified in thecatalog entry of the data set. Correct the error and IPLagain.


ICH520I RACF xxxxx IS ACTIVE.

Explanation: RACF release xxxxx has beensuccessfully initialized.

System action: IPL continues with RACF active.

ICH517I • ICH520I



ICH521I GLOBAL ACCESS CHECKING BASETABLE NOT OBTAINED, NOSTORAGE AVAILABLE.

Explanation: The attempt to obtain storage fromsubpool 241 for the global-profile-base-name tablefailed.

System action: RACF initialization continues, butglobal access checking is disabled.

Operator response: Notify the RACF securityadministrator and the system programmer.

Programmer response: Check the amount of storageavailable for use with subpool 241 and, if necessary,increase the amount of CSA available.


ICH522I ERROR IN STARTED PROCEDURESTABLE

Explanation: In the started procedures table, RACFfound either a generic entry that was not the last entryor a generic entry that contains ‘=’ in both the user IDand group name fields.

System action: RACF initialization continues, but thegeneric entry is ignored.


Programmer response: Correct the started procedurestable, and if necessary, IPL again.


ICH523I ERROR DURING SVC TABLE UPDATE

Explanation: RACF encountered an error while tryingto update the SVC table with the RACF SVC entrypoints. Message ICH501I follows this message.

System action: A system dump is produced on MVS.IPL continues. RACF becomes inactive and allowsaccess to the following:





Programmer response: Determine the cause of theerror and correct it.


ICH524I INSTALLATION CLASS DESCRIPTORTABLE PROCESSED

Explanation: On MVS, during RACF initialization, theinstallation-supplied class descriptor table was locatedin SYS1.LINKLIB, a library concatenated toSYS1.LINKLIB, or LPA. On VM, theinstallation-supplied class descriptor table was locatedin RACFLINK LOADLIB. For both MVS and VM, thetable is in effect for this IPL.



ICH525I INSTALLATION ROUTER TABLEPROCESSED

Explanation: During RACF initialization, theinstallation-supplied router table was located inSYS1.LINKLIB, a library concatenated to theSYS1.LINKLIB, or LPA. The table is in effect for thisIPL.



ICH526I RACF UNABLE TO LOCATE modname

Explanation: There are two possible reasons for thismessage:

v First, RACF failed to locate the IBM-supplied classdescriptor table (ICHRRCDX) required for RACFprocessing. On MVS, this table is located inSYS1.LINKLIB or in a library concatenated toSYS1.LINKLIB. On VM, it is located in RACFLINKLOADLIB.

If this is the case, processing cannot continue.Message ICH501I will follow this message.

v Second, RACF could not locate the IBM-suppliedMVS router table (ICHRFR0X.) On MVS, the table islocated in in SYS1.LINKLIB or in a libraryconcatenated to SYS1.LINKLIB. On VM, it is locatedin RACFLINK LOADLIB.

If this is the case, processing continues, but the usercannot invoke RACF with the RACROUTE macroinstruction.

System action: The system action depends on whichof the two reasons is responsible for the message.

If the first reason is responsible, IPL continues. RACFbecomes inactive and allows access to the following:




If the second reason is responsible, IPL continues.

ICH521I • ICH526I



Programmer response: Correct the error and IPLagain.


ICH527I RACF DETECTED AN ERROR IN THEINSTALLATION ROUTER TABLE,ENTRY entry-name, ERROR CODE yy

Explanation: On MVS, RACF locates the RACF routertables (ICHRFR0X and ICHRFR01) in one of thefollowing:

v SYS1.LINKLIB on MVS

v A library concatenated to SYS1.LINKLIB

v LPA (for ICHRFR01 only).

RACF ensures that each class name satisfies certainconditions. RACF issues this message to the operatorwhen the table contains an error.

System action: RACF uses the first entry name andignores additional duplicate name(s).

Operator response: Check for errors in thespecification of the system parameters MLPA and LNK.If there are errors, correct them and IPL again. If thereare no errors, report the exact text of this message toyour system programmer.

System programmer response: Ensure that no errorsoccurred during the assembly of the table entries, thatthe table was properly link-edited, and thatmodification subsequent to link-edit did not cause theerror. Correct the error and IPL again.

Problem determination: The error code yy identifiesthe problem as follows:

Code Description of Error

1 An entry in the installation-supplied portion ofthe router table duplicates the class name,requestor, and subsystem ID of an entry in theIBM-supplied portion of the table.

2 An entry in the installation-supplied portion ofthe router table has the class name specified inanother installation-supplied entry.


ICH528I ERROR BUILDING PROGRAMCONTROL TABLES

Explanation: A processing error occurred as RACFattempted to build the program control tables.





Operator response: Notify the RACF securityadministrator and the system programmer.

Problem determination: The SDUMP data setprovides diagnostic information. Correct the error andIPL again.


ICH529I RVARY ALLOCATION/DEALLOCATION FAILED

Explanation: An RVARY command was issued, andthe allocation or deallocation of the RACF databasefailed.

System programmer response: Check that the data setspecified on the RVARY command actually exists. If thedata set specified on the RVARY command exists, checkthe DASD for problems.

User response: Check that the data set name specifiedon the RVARY command is correctly spelled. If the dataset name is spelled correctly, contact the systemprogrammer.

Destination: Descriptor code is 4. Routing code are 2and 11.

ICH530I I/O ERROR DURING DATASETALLOCATION/DEALLOCATION[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname]

Explanation: An I/O error occurred during theallocation or deallocation of the RACF database.

System action: The system issues message ICH502A toprompt for a new data set name.

System programmer response: To recover from theproblem, consider doing the following:

1. Reinitialize the RACF service machine. This mightcorrect errors related to FILEDEF statements (VMonly).

2. If necessary, switch to a backup RACF database(using the RVARY SWITCH command).

Note: For complete information on recovering fromthe problem, see the section on RACF databaserecovery in RACF System Programmer's Guide. Payparticular attention to the section on failures duringI/O operations on the RACF database in RACFSystem Programmer's Guide.

Problem determination: Other messages might havebeen issued for this problem. These messages mightappear on the system console or the security console, orend users might receive them. On VM, the messagesmight appear on the console log of the RACF service

ICH527I • ICH530I


machine. An analysis of those messages might help youdetermine the cause of the problem. In particular, lookfor message ICH51011I, which reports a return codefrom the RACF manager.

Destination: Descriptor code is 4. Routing code are 2and 11.

ICH531I RACF DATASET ALLOCATION/DEALLOCATION INTERFACE ISACTIVE.

Explanation: The facility that permits the RACFdatabase to be allocated or deallocated automaticallywhen the RVARY command is issued is active.


ICH532I RVARY REQUEST TERMINATED DUETO ERROR.

Explanation: An error occurred during RVARYprocessing.

System action: RACF terminates the RVARYcommand and issues message ICH15009I to the issuerof the RVARY command.

Operator response: Report this message to the systemprogrammer.

Programmer response: IPL again and reissue theRVARY command.

Problem determination: If this message recurs, callyour IBM support center.


ICH533I CLASS class-name IS ACTIVE, BUTRACLIST FOR THE CLASS FAILED.RACLIST MACRO RETURN CODE ISreturn-code.

Explanation: At IPL, RACLIST processing could notbe performed for the indicated class.

System action: No in-storage profiles are created forthe indicated class. RACF still protects the sameresources, but system performance might be adverselyaffected.

Operator response: Report the exact text of thismessage to your system programmer.

System programmer response: Check with the RACFsecurity administrator to see if this condition will causea performance problem on the system. If so, re-IPL thesystem.

Problem determination: See RACF SystemProgrammer's Guide for the indicated return code fromthe RACLIST macro.


ICH534I CLASS class-name IS ACTIVE, BUTRACLIST FOR THE CLASS FAILED.RACLIST MACRO RETURN CODE ISreturn-code. REASON CODE ISreason-code.

Explanation: At IPL, RACLIST processing could notbe performed for the indicated class.



System programmer response: Check with the RACFsecurity administrator to see if this condition will causea performance problem on the system. If so, re-IPL thesystem.

Problem determination: See RACF SystemProgrammer's Guide for the indicated return and reasoncodes from the RACLIST macro.


ICH535I RACF DATA SET IS NOT CORRECTBLOCKSIZE. xxxxxxxx DATA SETSEQUENCE xxx, xxxxxxxx.

Explanation: The RACF data set that is identified inthe message has an incorrect block size. Use block size1024 for nonrestructured data sets, and block size 4096for restructured data sets.

Note: RACF 1.9.2 supports only restructured data sets.See Program Directory for information about this change.

System action: Prompts the operator to enter a newdata set name.

Operator response: Contact the system programmer.

System programmer response: Correct the block sizeof the problem data set, and notify the operator toenter the appropriate data set name.

ICH536I RACF IS NOT ACTIVE. RACF DATASET IS NOT CORRECT BLOCKSIZE.IT DOES NOT MATCH THESEQUENCE 01 DATA SET. xxxxxxxxDATA SET SEQUENCE xxx, xxxxxxx.

Explanation: The RACF data set that is identified inthe message has an incorrect block size. It is not thesame as the first data set.

System action: RACF is not activated.

ICH531I • ICH536I



System programmer response: Replace the data setwith a data set of the correct format and block size. Useblock size 1024 for the nonrestructured data set formatand block size 4096 for the restructured data set format.

Note: RACF 1.9.2 supports only restructured data sets.See Program Directory for information about this change.

ICH537I RACF IS NOT ACTIVE. RACF ISUNABLE TO LOAD MANAGERxxxxxxxx.

Explanation: The RACF manager that is identified inthe message could not be loaded from SYS1.LINKLIB.

System action: RACF is not activated.

Operator response: Contact the system programmer.

System programmer response: Check the RACFinstallation procedure to determine the reason theRACF manager's load module is missing from the loadlibrary. Ensure that the manager's load module ispresent on the load library before attempting to activateRACF.

ICH538I RACF MESSAGE TASK ABEND Sxxx.

Explanation: An ABEND occurred during RACFmessage subtask processing.

System action: RACF remains active and the messagesubtask will attempt to restart.



Problem determination: See your MVS system codesmanual for completion code Sxxx. The SDUMP data setand LOGREC data provide other diagnosticinformation.

ICH539I UNABLE TO ESTABLISH RECOVERYENVIRONMENT, RACF MESSAGETASK TERMINATED.

Explanation: The RACF message subtask got anonzero return code from an ESTAE macro instruction.

System action: The message subtask terminates. RACFremains active but RACF SRB mode services are unableto issue messages.



Problem determination: For a description of theESTAE return code, see one of the following:


v On MVS/XA, see MVS/XA SPL: System Macros andFacilities Volume 2, GC28-1151, or MVS/XA SupervisorServices and Macro Instructions, GC28-1154.


ICH540I RACF MESSAGE TASK TERMINATED.

Explanation: Either four recursive abends (no requestssuccessfully processed between abends) or a total ofeleven abends have occurred during RACF messagesubtask processing.

System action: The message subtask terminates. RACFremains active but RACF SRB mode services are unableto issue messages.



Problem determination: See your MVS system codesmanual for for completion code Sxxx. The SDUMP dataset and LOGREC data provide other diagnosticinformation.

ICH541I RACINIT create|delete FAILED.RETURN CODE IS return-code.

Explanation: At IPL, during RACLIST processing, thecreation or deletion of an ACEE by way of RACINITfailed. The message is issued to both the operator andthe security console.

System action: If this occurred during creation theACEE, then no in-storage profiles are created for anyclass. RACF still protects the same resources, butsystem performance might be adversely affected. If thisoccurred during deletion of the ACEE, then, in-storageprofiles were created, system performance is noteffected, but storage is being wasted by the ACEEwhich should be deleted.


System programmer response: This condition couldcause a performance problem on the system. Forexample, on CREATE, no RACLIST processing takesplace. This could cause performance degradation. If so,re-IPL the system. On DELETE, performance is notadversely effected; however, storage is being wasted bythe ACEE (or ACEEs) that have not been deleted. If theproblem persists, contact IBM.

Problem determination: See RACF Macros andInterfaces for the indicated return and reason codesfrom the RACINIT macro.


ICH537I • ICH541I


ICH542I RETURN CODE FROM RACROUTEMACRO IS return-code.

Explanation: At IPL, during RACLIST processing, theRACLIST and RACINIT macros are invoked byRACROUTE. If one fails, RACROUTE returns its ownreturn code as well as the return and reason codes ofthe called macros. For example, if the RACROUTEreturn code is 4, and a called RACLIST return andreason codes are 0, this means that the class is not inthe router table and the RACLIST processing was notdone. The message is issued to both the operator andthe security console when, for example, there is anerror creating an ACEE during RACLIST processing.



System programmer response: This condition couldcause a performance problem on the system. Forexample, on CREATE, no RACLIST processing takesplace. This could cause performance degradation. If so,re-IPL the system.

Problem determination: See RACF Macros andInterfaces for the indicated return and reason codesfrom the RACROUTE macro.


ICH543I RACF DATA SET NOT ACTIVATED.ACTIVATION WOULD CAUSE MIXEDFORMAT.

Explanation: The RVARY command was issued whenboth RDS and non-RDS data set types existed. RDS andnon-RDS data set types cannot be active together asprimary or backup data sets because activation wouldresult in a mixed format condition. Therefore, the dataset was not activated.

System action: The command is not processed.


System programmer response: Review the RACF dataset configurations.

ICH544I RACLIST DID NOT OCCUR FOR ANYOF THE RACF CLASSES CONTACTYOUR SYSTEM ADMINISTRATOR.

Explanation: During IPL, RACF initialization was notable to create an ACEE needed for RACLISTing. As aresult none of the RACF classes could be raclisted. Thismessage is issued to both the operator and the securityconsole.

System action: For classes defined with

RACLREQ=NO (RACLIST not required), normalauthorization checking will occur, although systemperformance may be adversely affected. For classesdefined with RACLREQ=YES (RACLIST is required),ALL authorization requests for the class will result inreturn code 4.


System programmer response: This condition couldcause other components and applications to fail due toRACROUTE REQUEST=AUTH return code 4 forRACLREQ=YES classes. In addition, this conditioncould cause performance degradation. If either of theseproblems occur, re-IPL. Message ICH541I follows thismessage and indicates the cause of the error.


ICH546I Class classname is active, but RACLISTfor the class failed. Data space failurereturn code is return-code, reason code isreason-code.

Explanation: At IPL, RACLIST processing could notbe performed for the indicated class due to a problemin processing data spaces. The return and reason codescan help the IBM support center determine the cause ofthe problem.

System action: No in-storage profiles are created forthe indicated class. In addition to issuing this message,the system may have taken an SVC dump. RACF stillprotects the same resources, but system performancemay be adversely affected.


System programmer response: Have the RACFsecurity administrator issue SETROPTSRACLIST(classname). If this command fails withmessages ICH14301I and ICH14058I, proceed toproblem determination.

Problem determination: Call your IBM support center.Have the message text available as well as the SVCdump if one was taken. The return code and reasoncode values in the message are:

Return Code Reason Code

04 04 ALESERV ADDfunction failed

08 Data space too small

08 04 TCBTOKEN functionfailed

08 DSPSERV CREATEfunction failed

12 ALESERV ADDfunction failed

ICH542I • ICH546I



ICH547I CLASS DESCRIPTOR TABLECONTAINS DUPLICATE CLASSNAMES:

Explanation: The installation-defined class descriptortable contains class names in which the first fourcharacters are the same as the first four characters ofprevious class names in the table, and anon-restructured data base has been specified as aRACF data base.

System action: Message ICH548I follows this messageand provides a list of class names in which the firstfour characters are the same as the first four charactersof a previous class. RACF remains active.

ICH548I class-name1, class-name2 ...class-namen

Explanation: This message contains a list of classnames in which the first four characters are the same asthe first four characters of previous class names in theclass descriptor table. This message is issued as manytimes as necessary to display the complete list of suchclass names.

System action: RACF remains active. However, these

class names will not be accepted if specified in RACFcommands or RACF system macros.

Operator response: Provide this list of class names toyour system programmer.

System programmer response: Keep this list as areference. No action is necessary to start using theclasses once the primary and backup data bases havebeen converted to the restructured format.

ICH563I MSA HARDWARE FEATUREREQUIRED FOR PASSWORDENCRYPTION AND VERIFICATION ISNOT ENABLED.

Explanation: KDFAES password/passphraseencryption is configured in the RACF database but itcannot be activated because the hardware MSA(message-security assist) feature is not enabled.


Operator response: Report this message to yoursystem programmer.

System programmer response: The MSA featureshould be enabled on all IBM processors capable ofrunning this version of RACF/VM. Contact IBMhardware support for assistance in determining whythis feature is disabled.

RACF Status Messages

ICH600A RACF TEMPLATES ON DATABASEARE DOWNLEVEL : dbfmidrrrrrrrr.aaaaaaaa MINIMUM LEVELREQUIRED IS nffmid xxxxxxxx.yyyyyyyy.RUN RACFCONV.

Explanation: During IPL RACF found that thedatabase templates on the master primary database arenot at the proper level. dbfmid rrrrrrrr.aaaaaaaa are theRACF database FMID, Release and APAR level. nffmidxxxxxxxx.yyyyyyyy are the minimum FMID, Release andAPAR required by the level of RACF being initialized.


Operator response: Run RACFCONV to apply thelatest level of the templates to the database. Until youdo this new function provided by nffmid will not beavailable and may cause unpredictable results and/orabends if used. In addition, you may see errors if youuse IRRUT200 or BLKUPD to process the database, andthe RACF Database unload utility may not unload allfields and segments.

ICH701A CONFIRM CHANGE OF RACFSTATUS JOB = jobname, USER = userid,REPLY YES OR NO

Explanation: The RVARY command has been entered.

The indicated job name and user ID are those of theissuer of the RVARY command. This message is routedto the security console and the master console.

System action: RACF waits for a reply from theoperator at the master console or the operator at thesecurity console.

Operator response: Ensure that the request is made byan authorized person within your installation. If so,reply “yes”; otherwise, reply “no.”


ICH702A ENTER PASSWORD TO {ACTIVATE |DEACTIVATE} RACF JOB=jobname,USER=userid,

Explanation: The user has issued the RVARYcommand in order to switch RACF status. Theindicated job name and user ID are those of the issuerof the RVARY command.

System action: RACF waits for the operator to enterthe password to allow the RVARY command tocomplete, or to enter another response (including ablank line) to cancel the command.

Operator response: Ensure that the request has beenmade by an authorized person within your installation.

ICH547I • ICH702A


If it has, reply with the correct password; otherwise,enter a null response to cancel the RVARY command.See “RVARY Password Considerations ” in z/VM: RACFSecurity Server System Programmer's Guide.


ICH703A ENTER PASSWORD TO SWITCHRACF DATA SETS JOB=jobname,USER=userid

Explanation: The RVARY command has been enteredto switch RACF databases. The indicated job name anduser ID are those of the issuer of the RVARY command.RACF routes this message to the security console andthe master console.

System action: RACF waits for the operator to enterthe password to allow the RVARY command tocomplete, or to enter another response (including ablank line) to cancel the command.

Operator response: Ensure that the request has beenmade by an authorized person within your installation.If it has, reply with the correct password; otherwise,enter a null response to cancel the command. See“RVARY Password Considerations ” in z/VM: RACFSecurity Server System Programmer's Guide.


RACHECK Operator Messages

ICH801I ‘accessor’ ATTEMPTING ‘access-type’ACCESS OF ENTITY ‘name’

Explanation: A RACHECK has been issued during atime when RACF processing is inactive. Because RACFis inactive, it allows access to the following:




This message provides a record of the accesses toRACF-protected resources during the period whenRACF is inactive.

The accessor represents a user ID, job name, orstarted-task name. The access-type represents theintended mode of system access (such as ALTER,CONTROL, UPDATE, or READ). The name is the nameof the resource to which access was attempted, such asa data set name or a volume serial number. The name isone of the following:

v The name as specified on the RACROUTE macro (ifSETROPTS REALDSN is in effect)

v The name as modified according to RACF namingconventions (if SETROPTS NOREALDSN is in effect).

System action: If the accessor is a started task or auser accessing his own resource, RACF allows the

access without operator intervention. If not, RACFissues message ICH802D requesting that the operatorallow or deny the access.

Operator response: If RACF does not automaticallyallow the access, the following message ICH802D willask the operator to allow or deny access.

Destination: Descriptor code is 4. Routing codes are 1,2, 9, and 11.

ICH802D REPLY Y OR N TO THE REQUEST.

Explanation: This message appears when RACF isinactive and a RACHECK is issued on a protectedresource. It follows message ICH801I which asks theoperator to decide if the requestor should be allowedaccess to the resource.

System action: The requesting task waits for theoperator's reply. If the operator responds with N, therequest is denied with, in some cases, an abend code. Ifthe response is Y, the request is allowed, andprocessing continues.

Operator response: The preceding message ICH801Iinforms the operator about the resource beingrequested and the user ID, job name, or started-taskname of the requestor. The operator uses theinstallation regulations to decide whether or not toallow the access.


RACDEF Operator Messages

ICH901I ‘accessor’ ATTEMPTING ‘access-type’ACCESS OF ENTITY ‘name’ IN CLASS‘class-name’ [NEW NAME ‘new-name’]

Explanation: RACF issued a RACDEF during a timewhen RACF processing was inactive. Because RACF isinactive, it allows access to the following:




ICH703A • ICH901I


This message informs the operator about a resourcewhich RACF, in its inactive state, could not update inthe RACF database.

The variable accessor represents a user ID, job name orstarted-task name. The variable access-type representsthe intended mode of resource definition or update,such as DEFINE, ADDVOL, DELETE, or CHGVOL. Thevariable name is a RACF profile name, such as a dataset name or a volume serial number. The variableclass-name is one of the valid RACF class names. Thevariable new-name represents the new name of a dataset being renamed.

System action: Processing continues with RACFinactive.

Operator response: Report this message to the systemprogrammer and the RACF security administrator.

Programmer response: After RACF is reactivated,determine the status of the specified resource in theRACF database. If invalid, use the RACF commands toupdate the RACF database.



Chapter 2. Other ICH Messages

RACF Database Initialization MessagesThis section lists the RACF messages issued by the ICHMIN00 utility during theinitialization of the RACF database. The messages are routed to the RACF servicemachine's printer on z/VM.

The format of the messages is:ICH8nnn text

where:ICH identifies the message as a RACF message.8 identifies the RACF database-initialization utility program (ICHMIN00).nnn is the message serial number.text is the text of the message.

ICH8000 MAXIMUM NUMBER OF TEMPLATEDEFINITIONS EXCEEDED.

Explanation: During initialization of the RACFdatabase, more than 10 template definitions were foundon the control card input from the data set defined bythe SYSTEMP DD statement on MVS, or in theICHTEMP0 member of RACF MACLIB on VM.

System action: Initialization of the RACF data setterminates.


Programmer response: Ensure that no more than 10template definitions exist in the data set defined by theSYSTEMP DD statement on MVS or in the ICHTEMP0member of RACF MACLIB on VM. Rerun the program.

Problem determination: On MVS, list the contents ofthe data set defined by the SYSTEMP DD statement todetermine the problem; on VM, list the contents of theICHTEMP0 member in RACF MACLIB.

ICH8001 TEMPLATE IS A DUPLICATE; IT ISIGNORED.

Explanation: During initialization of the RACFdatabase, two template definitions were found in thedata set defined by the SYSTEMP DD statement withthe same template number on MVS or in theICHTEMP0 member of RACF MACLIB on VM.

System action: Initialization of the RACF databasecontinues using the first definition of the duplicate pair.


Programmer response: If the second definition of theduplicate pair is the correct definition, delete the firstdefinition and rerun the program.

Problem determination: On MVS, list the contents of

the data set defined by the SYSTEMP DD statement todetermine the problem; on VM, list the contents of theICHTEMP0 member in RACF MACLIB. The templatenumber of the duplicate template is contained in thedata statement listed before this message.

ICH8002 RACF DATA SET INITIALIZATIONCOMPLETE.

Explanation: The RACF database has beensuccessfully initialized.

System action: Processing continues.

ICH8003 NON NUMERIC CHARACTER INNUMERIC FIELD OF LASTSTATEMENT.

Explanation: During the initialization of the RACFdatabase, an invalid character was found in a numericfield of the previous input statement.

System action: Initialization of the RACF databaseterminates.


Programmer response: Ensure there are validcharacters in the numeric fields and rerun the program.

Problem determination: On MVS, list the contents ofthe data set defined by the SYSTEMP DD statement todetermine the problem; on VM, list the contents of theICHTEMP0 member in RACF MACLIB.

ICH8004 RACF DATA SET INITIALIZATIONTERMINATED.

Explanation: Initialization of the RACF database hasfailed (as noted by a previous message).


System action: Initialization of the RACF database isterminated.

ICH8005 RACF DATA SET INITIALIZATIONPROCESSING.

Explanation: Initialization of the RACF database hasbegun and template definitions will follow.


ICH8006 UNABLE TO OPEN {SYSRACF |SYSTEMP}

Explanation: The data set associated with theindicated ddname could not be opened.



Programmer response: On MVS, ensure that the DDstatement for the indicated data set is correct. On VM,ensure that ICHTEMP0 is in RACF MACLIB and thatSYSRACF identifies a minidisk that is properlyformatted for an OS data set.

ICH8007 END OF FILE OCCURRED BEFORE$/END STATEMENT ENCOUNTERED.

Explanation: During the initialization of the RACFdatabase, an end-of-file condition was detected on thedata set defined by the SYSTEMP DD statement beforea $/END statement. On VM, it was detected in theICHTEMP0 member of RACF MACLIB.

System action: Initialization of the RACF databasecontinues.


Programmer response: Verify the contents ofICHTEMP0. If more template definitions wereexpected, the program must be rerun with the completeset of template definitions as input. If all templatedefinitions are present and only the $/END statementis missing, the program need not be rerun.

Problem determination: On MVS, list the contents ofthe data set defined by the SYSTEMP DD statement todetermine the required templates; on VM, list thecontents of the ICHTEMP0 member of RACF MACLIB.

ICH8008 END OF FILE REACHED BEFORE ENDOF TEMPLATE DEFINITION.

Explanation: In attempting to initialize the RACFdatabase, one of the following conditions wasencountered:

v An end-of-file was reached before a $/TEMPLATEstatement was found.

v An end-of-file was reached immediately after a$/TEMPLATE statement but with no interveningfield definitions.

System action: The RACF database is not initialized.


Programmer response: Correct ICHTEMP0 and rerunthe program.

Problem determination: On MVS, list the contents ofthe data set defined by the SYSTEMP DD statement todetermine the required templates; on VM, list thecontents of the ICHTEMP0 member of RACF MACLIB.

ICH8009 TEMPLATE DEFINITION MISSING.

Explanation: In attempting to initialize the RACFdatabase, a $/END or $/TEMPLATE statement wasfound immediately following a $/TEMPLATEstatement in ICHTEMP0. The expected field definitionswere not found.



Programmer response: Correct ICHTEMP0 and rerunthe program.

Problem determination: On MVS, list the contents ofthe data set defined by the SYSTEMP DD statement toverify the definitions; on VM, list the contents of theICHTEMP0 member in RACF MACLIB.

Problem determination: List the contents of the dataset defined by the SYSTEMP DD statement to verify thedefinitions.

ICH8010 INVALID PARM parameter-value

Explanation: The indicated parameter value is not avalid value for the NEW or UPDATE parameter. Onlythe first nine characters of the parameter value arelisted.

System action: Updating of the RACF database isterminated.


Programmer response: Correct the value specified onthe NEW or UPDATE parameter and rerun theprogram.

ICH8011 UNABLE TO RETRIEVE DATASETNAME.

Explanation: While attempting to retrieve the data setname allocated by way of the SYSRACF DD statement,an error was encountered from the SVC 99 informationretrieval function.


ICH8005 • ICH8011



Programmer response: Correct the SYSRACF DDstatement and rerun the program.

ICH8012 RACF DATA SET HEADER RECORDINVALID.

Explanation: The RACF database initializationprogram found an invalid ICB (header) record in theRACF database while preparing to update the RACFdatabase.



Programmer response: If the RACF database was notpreviously formatted by using this program with thePARM=‘NEW’ specification on MVS or with theRACINITD EXEC on VM, then rerun the program withPARM=‘NEW’. If the RACF database is a version 1,release 1 or 2 database that is being updated, then runthe RACF database verification utility program(ICHUT200) to determine which ICB field is in error.

Problem determination: The validity check whichcaused the failure can result from an invalid ICB valuefor the number of templates or BAMs, or an invalidRBA (relative byte address). List the contents of thedata set defined by the SYSRACF DD statement todetermine the problem.

ICH8013 RACF DATA SET UPDATESCOMPLETE

Explanation: The template update function of theRACF database initialization program has completedsuccessfully.


ICH8014 RACF DATASET UPDATESTERMINATED.

Explanation: The template update function of the

RACF database initialization program has terminatedunsuccessfully as noted in a previous message.



Programmer response: Respond to the previousmessage and rerun the program.

ICH8015 UNABLE TO OBTAIN SPACE TOLOAD TEMPLATES IN SYSRACF

Explanation: The template update function of theRACF database initialization program was unable tolocate sufficient space in the RACF database to installthe RACF templates.



Programmer response: Using the ICHUT400 utility,consolidate any free space by copying the RACFdatabase. Retry updating the RACF database. If thesame error occurs, you will have to extend the RACFdatabase using the ICHUT400 utility.

ICH8016 BLKSIZE NOT EQUAL TO 1024 INSYSRACF. DATABASE MUST BENON-RESTRUCTURED.

Explanation: The dataset defined by the SYSRACF DDstatement does not have a blocksize of 1024.

System action: Updating of the RACF database isended.


System programmer response: Make sure that thedataset specified by the SYSRACF DD statement is avalid RACF nonrestructured database. Rerun theICHMIN00 utility.

RACF Command MessagesThis section lists the command messages issued by RACF during the processing ofthe RACF commands. These messages are routed to the user who issued thecommand. See “Recovery Procedures” in RACF System Programmer's Guide forprocedures to recover from errors that occur during the processing of the RACFcommands.

The format of the command messages is:ICHxxnnnt text

where:ICH identifies the message as a RACF message.xx is the command processor issuing the message.

ICH8012 • ICH8016

Chapter 2. Other ICH Messages 35

nnn is the message serial number.t is the type code (I=information, A=action).text is the text of the message.

The values for the xx field, which identifies the command processor, are:

xx Command00 ADDGROUP01 ADDUSER02 CONNECT03 REMOVE04 DELUSER05 DELGROUP06 PERMIT, PERMDIR, and PERMFILE08 PASSWORD or PHRASE09 ADDSD and DELDSD10 RDEFINE, ADDDIR, and ADDFILE11 RALTER, ALTDIR, and ALTFILE12 RDELETE, DELDIR, and DELFILE13 RLIST, LDIRECT, and LFILE14 SETROPTS15 RVARY20 ALTGROUP21 ALTUSER22 ALTDSD30 LISTUSER31 SEARCH, SRDIR, and SRFILE32 LISTGRP35 LISTDSD36 Common command messages

ADDGROUP Command Messages

ICH00002I NOT AUTHORIZED TO ISSUEADDGROUP

Explanation: You are not defined to RACF withsufficient authority and cannot issue the ADDGROUPcommand, or RACF is not active.

System action: RACF terminates the command.

User response: See your RACF security administrator.

RACF Security Administrator Response: See RACFCommand Language Reference for the authority requiredto issue the indicated command.

ICH00003I UNABLE TO ACCESS group-name

Explanation: RACF could not find the description ofthe indicated superior group.


ICH00004I COMMAND ENDED DUE TO ERROR

Explanation: An ESTAE recovery environment couldnot be established.


System programmer response: Ensure that RACF andthe operating system are properly installed. If they are,report this message (including its message ID) to yourIBM support center.

User response: Report this message to your systemprogrammer. Please include the following:

v The message ID

v The exact wording of the command you entered

v The date and time you entered the command.

ICH00005I RECOVERY UNSUCCESSFUL

Explanation: As issued, the ADDGROUP commandbegan to update more than one profile in the RACFdatabase. However, a system or RACF failure occurredduring command processing.

System action: To prevent discrepancies amongprofiles, RACF attempted to back out any changesalready made to profiles. However, not all changescould be backed out. This message follows messageICH00006I.

User response: Report this message and the exact textof message ICH00006I to your system programmer.

ICH00002I • ICH00005I


Problem determination: The RACF utility programsmay be needed to correct the RACF database.

ICH00006I group-name NOT ADDED -or- group-nameAND REMAINING GROUPS NOTADDED -or- GROUP(S) NOT ADDED

Explanation: The group indicated in the message wasnot added; succeeding groups will be added.

ICH00007I INSUFFICIENT AUTHORITY TOSUPERIOR GROUP

Explanation: You do not have sufficient authority toissue the ADDGROUP command.



ICH00008I OWNER-GROUP AND SUPERIORGROUP MUST BE THE SAME

Explanation: When the owner of a group is anothergroup, the owning group and the superior group mustbe the same.


ICH00009I NOT AUTHORIZED TO INCLUDEDFP SEGMENT IN GROUP PROFILEgroup-name GROUP PROFILE WAS NOTDEFINED

Explanation: You are not authorized to add DFPsegment information to the specified group profile.

System action: Command processing terminates withno update to the specified group profile.

User response: See your RACF security administratorfor authority to the DFP segment of this group profile.

RACF Security Administrator Response: You can usefield-level access checking to allow this user to addDFP segment information. For a description offield-level access checking, see RACF SecurityAdministrator's Guide.

ICH00010I Group group-name is specified multipletimes on the command.

Explanation: You are not allowed to specify the samegroup more than once on the command.

System action: The duplicate group is identified. Nogroup is added.

User response: Reissue the command without theduplicate group name.

ICH00011I No group is added.

Explanation: See accompanying message ICH00010I.

System action: Command processing ends with nogroup added.

User response: Using the information in messageICH00010I, correct the syntax and reissue thecommand.

ICH00006I • ICH00011I


ADDUSER Command Messages

ICH01001I

Explanation: You do not have sufficient authority tospecify the keywords shown.

System action: The command continues with theattributes NOOPERATIONS, NOSPECIAL, orNOAUDITOR.


ICH01002I NOPASSWORD OPERAND IGNORED

Explanation: You specified the NOPASSWORDoperand but did not specify the OIDCARD operand. Auser must have either a password or operatoridentification card specified.

System action: RACF ignores the NOPASSWORDoperand and assigns the user the default password.

ICH01003I NOT AUTHORIZED TO SPECIFYCLAUTH FOR (TAPEVOL, USER,DASDVOL, TERMINAL), CLASSIGNORED

Explanation: You do not have sufficient authority tospecify CLAUTH for the indicated class.

System action: RACF ignores this class and continueswith the next class or operand.


ICH01004A ENTER OPERATOR IDENTIFICATIONCARD

Explanation: You have specified the OIDCARDoperand. This message is requesting that you enter theoperator identification card for the user being definedso that the information on it can be put into the userprofile.

System action: Command processing waits for you toenter the operator identification card.

ICH01005I NOT AUTHORIZED TO ISSUEADDUSER

Explanation: You are not defined to RACF withsufficient authority and cannot issue the ADDUSERcommand, or RACF is not active.




ICH01006I COMMAND ENDED DUE TO ERRORTERMINAL TYPE NOT SUPPORTED

Explanation: You specified the OIDCARD operand,but when the operator identification card was entered,it could not be verified because it was entered on aterminal that is not supported.


ICH01007I COMMAND ENDED DUE TO ERRORUNABLE TO PROMPT FOR OIDCARD

Explanation: You specified the OIDCARD operand,but TSO/E was unable to prompt you to enter theoperator identification card.

User response: Be sure you are executing thecommand in the foreground and in prompt mode.

ICH01008I COMMAND ENDED DUE TO ERRORUNABLE TO ESTABLISH ESTAE





v The message ID




Explanation: As issued, the ADDUSER commandbegan to update more than one profile in the RACFdatabase. However, a system or RACF failure occurredduring command processing.




ICH01010I userid NOT ADDED -or- userid ANDREMAINING USERS NOT ADDED -or-USER(S) NOT ADDED

ICH01001I • ICH01010I


Explanation: The indicated user ID was not added;succeeding user IDs will be added. This message is alsoissued if the SETROPTS NJEUSERID or SETROPTSUNDEFINEDUSER is used on an ADDUSER.

ICH01011I INSUFFICIENT AUTHORITY TOGROUP group-name

Explanation: You do not have sufficient authority tothe default group for the user.



ICH01012I COMMAND ENDED DUE TO ERRORPUTGET ERROR RETURN CODE ISreturn-code

Explanation: You specified the OIDCARD operand,but the TSO/E PUTGET service routine failed with theindicated return code while trying to read the operatoridentification card. For an explanation of the returncode, (which is described in the PUTGETspecifications), see one of the following:

v For MVS/370, OS/VS2 TSO Guide to Writing aTerminal Monitor Program or a Command Processor,GC28-0648

v If TSO/E is installed, see one of the following: TSOExtensions Guide to Writing a Terminal Monitor Programor a Command Processor or TSO ExtensionsProgramming Services. For the order number of thebook you need, see the TSO Extensions GeneralInformation.

ICH01013I COMMAND PROCESSINGTERMINATED. NO {SECLEVELS |CATEGORIES} FOUND

Explanation: RACF could not validate the name youspecified on the SECLEVEL or ADDCATEGORYparameter. This happened for one of two reasons:

v There is no SECLEVEL or CATEGORY profile.

v A profile is defined, but it does not contain anymembers.


ICH01015I COMMAND PROCESSINGCOMPLETED BUT UNABLE TOUPDATE ‘SYS1.BRODCAST’.

Explanation: RACF could not update the TSO/E dataset SYS1.BRODCAST.

System action: The ALTUSER command completedsuccessfully and the user profile in the RACF databasehas been updated.

System programmer response: Check to ensure thatdata set SYS1.BRODCAST exists on the system and isavailable to RACF.

User response: Report this message to your systemprogrammer.

ICH01016I SIZE SPECIFIED GREATER THANMAXSIZE, SIZE ADJUSTED TOEQUAL TO MAXSIZE

Explanation: The specified SIZE is greater than themaximum allowable size, as specified on the MAXSIZEoperand.

System action: RACF adds a user profile, but adjustsSIZE to equal the MAXSIZE operand.

User response: To change the SIZE or MAXSIZEoperands for this user profile, use the ALTUSERcommand.

ICH01017I ADDUSER failed. SECLABELseclabel-name is not currently defined toRACF.

Explanation: There is no profile in class SECLABELwhose name matches the security label indicated in themessage.


User response: Check the spelling of the valuespecified on the SECLABEL operand. If it is correct,define a profile of that name in the SECLABEL class. Ifyou cannot define such a profile, report the exact textof this message to your RACF security administrator.

ICH01020I PASS PHRASE CHANGE REJECTEDBY INSTALLATION PASS PHRASEEXIT

Explanation: The proposed password phrase, asspecified in the PHRASE operand on the ADDUSERcommand has been rejected byt the installationpassword phrase exit, ICHPWX11.

System action: RACF ignores the operand andcontinues command processing with the next operand.

User response: See your RACF security administratorfor the rules regarding new password phrases.

ICH01021I NEW PASS PHRASE REJECTED BYRACF RULES

Explanation: You specified a potential passwordphrase that does not adhere to the following syntaxrules:

v Must not contain the user ID (as sequentialuppercase or sequential lowercase characters)

v Must contain at least 2 alphabetic characters (A-Z,a-z)

v Must contain at least 2 non-alphabetic characters(numerics, punctuation, or special characters)

ICH01011I • ICH01021I


||

||

v Must not contain more than 2 consecutive charactersthat are identical

v Must be enclosed in single quotation marks, withsingle quotation marks within the password phrasedoubled

v Must not contain forward slashes, nulls (X'00'), orleading or trailing blanks


User response: Try again with a different passwordphrase.

ICH01022I NO PASSWORD SPECIFIED, THEDEFAULT PASSWORD IS NOTUSABLE AS AN AUTHENTICATOR

Explanation: You did not specify a PASSWORDoperand.

System action: RACF creates a user but it is definedwith an unusable password.

User response: This may be intentional if the user willuse a password phrase to authenticate to RACF, or ifthis is a service machine which should have neither apassword nor a password phrase. If not, then eitherdelete the user and reissue the ADDUSER commandwith a password or use the ALTUSER command todefine a usable password. Note that if you explicitlyspecify NOPASSWORD on the ADDUSER command,this message will not be displayed.

ICH01023I operand OPERAND IGNORED

Explanation: You specified an operand which is nolonger supported by the ADDUSER command.

System action: RACF ignores the operand. Commandprocessing continues with the next operand.

CONNECT Command Messages






v The message ID




Explanation: As issued, the CONNECT commandbegan to update more than one profile in the RACFdatabase. However, a system or RACF failure occurredduring command processing.




ICH02003I userid NOT CONNECTED -or- useridAND REMAINING USERS NOTCONNECTED -or- USER(S) NOTCONNECTED

Explanation: The indicated user ID and all succeedinguser IDs were not connected because of an error inRACF processing.

ICH02004I INSUFFICIENT AUTHORITY TOGROUP

Explanation: You do not have sufficient authority toissue the CONNECT command.



ICH02005I userid CONNECTION NOT MODIFIED

Explanation: The indicated user ID was found in thegroup's access list, but either no connect profile wasfound or an error occurred while attempting to modifythe connect profile.

System action: Command processing continues withthe next user ID in the list.

ICH02006I NOT AUTHORIZED TO ISSUECONNECT

Explanation: You are not defined to RACF withsufficient authority and cannot issue the CONNECTcommand, or RACF is not active.



RACF Security Administrator Response: See RACF

ICH01022I • ICH02006I


Command Language Reference for the authority requiredto issue the indicated command.

ICH02007I NOT AUTHORIZED TO SPECIFY(SPECIAL, OPERATIONS, AUDITOR),OPERAND IGNORED

Explanation: You do not have sufficient authority tospecify the operand indicated.



ICH02008I AUTHORITY SPECIFIED GREATERTHAN THE COMMAND USER

Explanation: You have specified a group authority onthe AUTHORITY operand of the CONNECT commandthat is greater than your own.


User response: Check the spelling of the groupauthority you specified.

ICH02009I NOT AUTHORIZED TO ALTER useridTO (NOSPECIAL | NOOPERATIONS |NOAUDITOR)

Explanation: You do not have sufficient authority tospecify the indicated operand for the indicated user ID.




ICH02010I AUTHORITY NOT ALTERED FORuserid

Explanation: You specified the AUTHORITY operandbut an error occurred while attempting to modify thegroup authority field in the group profile for theindicated user ID.

System action: Command processing continues withthe next operand.

ICH02011I OWNER SPECIFIED IS NOT A RACFDEFINED USER OR GROUP

Explanation: The user ID or group name specified onthe OWNER operand is not defined to RACF.


ICH02012I ‘RESUME’ IGNORED. userid NOTCURRENTLY REVOKED

Explanation: The indicated user ID is not currentlyrevoked.

System action: RACF ignores the specification of afuture date with the RESUME operand. Commandprocessing continues with the next operand.

ICH02013I ‘REVOKE’ IGNORED. userid ISCURRENTLY REVOKED

Explanation: REVOKE was specified with a date, butthe user is already revoked.


ICH02007I • ICH02013I


REMOVE Command Messages

ICH03002I userid WAS NOT CONNECTED TOGROUP

Explanation: The indicated user ID was not connectedto the group so no processing could be done for theuser.

System action: Command processing continues withthe next user ID in the list.

ICH03003I INSUFFICIENT AUTHORITY TOGROUP, NO USERS REMOVED

Explanation: You do not have sufficient authority toissue the REMOVE command.








v The message ID



ICH03005I userid CANNOT BE NEW OWNER ASUSER WAS SPECIFIED TO BEREMOVED

Explanation: The indicated user ID was specified inthe OWNER operand but is the same user ID that wasspecified to be removed.

System action: Of the user IDs specified only thosethat do not own group data sets are removed.

ICH03006I userid NOT REMOVED -or- userid ANDREMAINING USERS NOT REMOVED-or- USER(S) NOT REMOVED

Explanation: The indicated user ID was not removed.

System action: If this message follows ICH03004I,then no further users are removed.

ICH03007I SOME GROUP DATA SET OWNERSWERE CHANGED

Explanation: The command was not completedsuccessfully. An error was detected while removing theuser indicated in message ICH03006I.

System action: Some of the group data sets owned bythe user were modified to reflect the new owner. Thiswas not completed.

User response: Use the LISTDSD command todetermine the status of the group data sets.

ICH03008I NOT AUTHORIZED TO ISSUEREMOVE

Explanation: You are not defined to RACF withsufficient authority and cannot issue the REMOVEcommand, or RACF is not active.




ICH03014I group-name IS DEFAULT GROUP, useridNOT REMOVED

Explanation: A user cannot be removed from thedefault group. Specify the group name again or use theDELUSER command to remove the user from thedefault group.

ICH03021I OWNER REQUIRED FOR GROUPDATASETS, userid NOT REMOVED

Explanation: The indicated user ID is the owner ofgroup data sets and cannot be removed becauseanother owner was not specified or was invalid.

System action: The command continues with the nextuser ID.

ICH03025I OWNER SPECIFIED NOTCONNECTED TO GROUP

Explanation: The owner specified on the command isnot connected to the group.

System action: If any user ID specified to be removedowns group data sets, message ICH03021I will beissued. The command continues with the next user ID.

ICH03026I INSTALLATION EXIT FAILEDREMOVE REQUEST FOR userid

Explanation: The command preprocessing exit routineICHCCX00 issued a return code of 8, indicating thatRACF should fail the REMOVE request for theindicated user ID.

ICH03002I • ICH03026I


System action: Processing of the REMOVE commandcontinues with the next user ID specified.


DELUSER Command Messages

ICH04001I ERROR LOCATING userid

Explanation: The indicated user ID is not defined inthe RACF database.

System action: Command processing continues withthe next user specified.

ICH04002I ERROR DELETING userid

Explanation: An error occurred while deleting theindicated user ID. The user profile may be in aninconsistent state.

System action: Command processing continues withthe next user specified.






v The message ID



ICH04006I userid NOT DELETED -or- userid ANDREMAINING USERS NOT DELETED-or- USER(S) NOT DELETED

Explanation: The indicated user ID was not removeddue to an error in command processing. Succeedingusers may not have been removed, depending on thetype of error.

ICH04007I INSTALLATION EXIT FAILED DELETE

REQUEST FOR userid

Explanation: The command preprocessing exit routineICHCCX00 issued a return code of 8, indicating thatRACF should fail the DELUSER request for theindicated user ID.

System action: Processing of the DELUSER commandcontinues with the next user ID specified.


ICH04009I userid CANNOT BE DELETED. DATASET PROFILES STILL EXIST.

Explanation: The indicated user ID was not deletedfrom the RACF database because the data set profilesstill exist for the user. All data set profiles for this usermust be deleted before the user ID can be deleted.

System action: Command processing continues withthe next user.

ICH04010I NOT AUTHORIZED TO ISSUEDELUSER

Explanation: You are not defined to RACF withsufficient authority and cannot issue the DELUSERcommand, or RACF is not active.




ICH04011I Deletion of IBMUSER not allowed.

Explanation: User IBMUSER may not be deleted fromthe RACF database.

System action: RACF attempts to delete the rest of theusers (if any) specified on the command line.

DELGROUP Command Messages

ICH05001I ERROR LOCATING group-name

Explanation: The specified group name is not definedin the RACF database.

System action: Command processing continues withthe next group.





User response: Report this message to your system

ICH04001I • ICH05002I


programmer. Please include the following:

v The message ID



ICH05004I group-name NOT DELETED -or-group-name AND REMAININGGROUPS NOT DELETED -or-GROUP(S) NOT DELETED

Explanation: The group indicated in the message andall succeeding groups were not deleted.

ICH05005I NOT AUTHORIZED TO ISSUEDELGROUP

Explanation: You are not defined to RACF withsufficient authority and cannot issue the DELGROUPcommand, or RACF is not active.




ICH05006I group-name CANNOT BE DELETED,GROUP DATA SETS STILL DEFINEDTO RACF

Explanation: The group indicated in the message wasnot deleted from the RACF database because there arestill group data sets associated with the group. A groupcannot be deleted until RACF-protection is removedfrom the group data sets with the DELDSD command.

System action: Command processing continues withthe next group.

ICH05007I INSTALLATION EXIT FAILED DELETEREQUEST FOR group-name

Explanation: The command preprocessing exit routineICHCNX00 issued a return code of 8, indicating thatRACF should fail the DELUSER request for theindicated group name.

System action: Processing of the DELUSER commandcontinues with the next group name specified.


PERMIT, PERMDIR, and PERMFILE Command Messages

ICH06001I name ALREADY AUTHORIZED TORESOURCE - ACCESS UNCHANGED

Explanation: The indicated name (user ID or groupname) in the FROM resource's access list is already onthe access list of the TO resource.

System action: Command processing continues withthe next name in the FROM resource's access list.

ICH06002I name NOT AUTHORIZED, DELETEIGNORED

Explanation: The indicated name (user ID or groupname) is not on the access list of the specified resource,and the request to delete the name from the access listis ignored.


User response: Check the spelling of the nameindicated in the message. If the name is spelledcorrectly, check the spelling of the profile whose accesslist you want to change. For general resource profiles,check the class name as well as the profile name.

ICH06003I NOT AUTHORIZED TO ISSUEcommand-name

Explanation: You are not defined to RACF and cannotissue the command indicated in the message, or RACFis not active.




ICH06004I profile-name NOT DEFINED TO RACF

Explanation: The specified profile name is not definedto RACF.

Note: If you enter the PERMIT command for a fullyqualified generic profile (one whose name has nogeneric characters), but you do not specify theGENERIC operand, RACF issues this message. Thisoccurs because, without the GENERIC operand, RACFlooks for a discrete profile of that name. For example, ifthere is a fully qualified generic profile namedABC.DATA, and you enter the following command:

PERMIT ’ABC.DATA’ ACCESS(READ) ID(JOE)

RACF looks for a discrete profile named ABC.DATAand, if there is none, issues this message (ICH06004IABC.DATA NOT DEFINED TO RACF). To identify for RACFthe generic profile, specify the GENERIC operand asfollows:

PERMIT ’ABC.DATA’ ACCESS(LEE) GENERIC

ICH05004I • ICH06004I


Likewise, when using the FROM operand to copy anaccess list from a fully qualified generic profile, specifythe FGENERIC operand to identify the fully qualifiedgeneric profile to RACF.



Explanation: A RACF manager error occurred. Thismessage is accompanied by a message explaining theerror.


ICH06006I NOT AUTHORIZED TO profile-name

Explanation: You are not authorized to alter or copythe access list of the resource indicated by profile-name.


ICH06007I name NOT DEFINED TO RACF

Explanation: The indicated name (user ID or groupname) is not defined to RACF and cannot beauthorized access to the resource.

System action: Command processing continues withthe next name specified on the command.

ICH06008I INSTALLATION EXIT FAILED PERMITREQUEST FOR profile-name

Explanation: The command preprocessing exit routineICHCNX00 issued a return code of 4, indicating thatRACF should fail the permit request for the profileindicated in the message.

System action: If the command attempted to modifythe access list of the profile, the command terminates.

If the command attempted to copy the access list of theprofile specified on the FROM operand, only theprocessing associated with the ID operand isperformed.


ICH06009I RESET OPTION IGNORED,CONFLICTS WITH DELETE REQUEST

Explanation: Both the DELETE and the RESET optionswere specified.

System action: RACF accepts the DELETE option andignores the RESET option.

ICH06010I (GENERIC | FGENERIC) INVALID,GENERIC COMMAND PROCESSINGIS INACTIVE.

Explanation: Because the generic command processingfacility is inactive, the GENERIC and FGENERICoperands are invalid.

System action: RACF terminates commandprocessing.

ICH06011I RACLISTED PROFILES FOR class-nameWILL NOT REFLECT THE UPDATE(S)UNTIL A SETROPTS REFRESH ISISSUED

Explanation: The changes to the profiles will notbecome effective until the SETROPTS command isissued with the REFRESH and RACLIST operands.

System action: RACF updates the profile(s) in theRACF database, but does not update the in-storagecopies of the profiles.

ICH06013I WHEN(PROGRAM(*)) OPERANDIGNORED. INVALID WITH ACCESSOPERAND.

Explanation: If the WHEN(PROGRAM(*)) andACCESS operands are both specified on the PERMITcommand, the WHEN(PROGRAM(*)) operand isignored. WHEN(PROGRAM(*)) can only be specifiedwith the DELETE operand.

System action: RACF ignores theWHEN(PROGRAM(*)) operand. Command processingcontinues with the other operands.

ICH06014I userid not authorized, DELETE ignoredfor WHEN(class-name(resource-name))

Explanation: The user issued the PERMIT commandwith the DELETE keyword and WHEN keywordsspecified. The class name and resource name specifiedon the WHEN keyword are indicated in the message.This attempts to delete an entry from the conditionalaccess list. However, the entry was not found.

System action: Command processing continues withthe next DELETE request.

User response: Check the spelling of the valuesspecified for the ID, ACCESS, and WHEN operands,and reissue the command. To check the profile itself,enter the RLIST command with AUTHUSER specified.

ICH06015I WARNING - In class class-name resourceresource-name not currently protected byRACF.

Explanation: The PERMIT command was issued withthe WHEN operand specified for the indicated class.

ICH06005I • ICH06015I


However, the indicated resource is not protected by aprofile in the class.

System action: The entry is added to the conditionalaccess list, but the entry has no effect on RACFprocessing.

ICH06016I Access unchanged. userid already hasaccess defined by WHEN(class-name(resource-name)).

Explanation: The user indicated in the message isalready on the conditional access list with the accessspecified.

System action: The conditional access list is notchanged.

ICH06017I WARNING for command-name.Extraneous information in the FROMkeyword has been ignored.

Explanation:

v For the PERMIT command, only one profile name(no blanks) is allowed in the FROM operand.

v For the PERMFILE and PERMDIR commands,

– If the FCLASS operand is DIRECTRY or defaultsto DIRECTRY, only one DIRECTRY name (noblanks) is allowed.

– If the FCLASS operand is FILE or defaults toFILE, only three names separated by spaces(file-name file-type directory-id) are allowed.

– If the FCLASS operand is a class other than FILEor DIRECTRY, only one profile name (no blanks)is allowed in the FROM operand.

System action:

v For the PERMIT command, the first profile name (noblanks) in the FROM operand is used, and the othernames are ignored.

v For the PERMFILE and PERMDIR commands,

– If the FCLASS operand is DIRECTRY or defaultsto DIRECTRY, the first DIRECTRY name (noblanks) in the FROM operand is used, and theother names are ignored.

– If the FCLASS operand is FILE or defaults toFILE, the first three names separated by spaces inthe FROM operand are used, and the other namesare ignored.

– If the FCLASS operand is a class other than FILEor DIRECTRY, the first profile name (no blanks) inthe FROM operand is used, and the other namesare ignored.

User response: If the access list was modified usingthe wrong FROM profile, delete the incorrect access listentries that were created and issue the command again.

ICH06018I command-name failed. WHEN operand isincorrect without a value.

Explanation: The user did not specify a class for theWHEN operand. Valid class names are PROGRAM,JESINPUT, or CONSOLE.


ICH06019I WARNING: Class class-name is notcurrently active.

Explanation: The PERMIT command was issued withthe WHEN operand specified for the indicated class.However, the indicated class is not active.

System action: The entry is added to the conditionalaccess list, but the entry has no effect on RACFprocessing.

ICH06020I command-name FAILED.WHEN(PROGRAM) IS INVALID FORTHIS CLASS.

Explanation: The WHEN(PROGRAM) operand is onlyvalid for the DATASET class.


ICH06016I • ICH06020I


PASSWORD Command Messages

ICH08001I userid NOT DEFINED TO RACF

Explanation: The indicated user ID was not found inthe RACF database.

System action: No processing is done.

ICH08002I NEW PASSWORD CANNOT EQUALCURRENT PASSWORD

Explanation: The new password specified must bedifferent from the current password.

System action: The password is not changed.

ICH08003I INTERVAL NOT IN RANGE 1-nnn

Explanation: The password change-interval must begreater than 0 and less than nnn, which is theinstallation-specified maximum.

System action: The interval is not changed.



ICH08005I VALUE SPECIFIED IS NOT CURRENTPASSWORD

Explanation: The value specified for the currentpassword is not your current password.


ICH08006I NOT AUTHORIZED TO ISSUEPASSWORD

Explanation: You are not defined to RACF and cannotissue the PASSWORD command, or RACF is not active.



RACF Security Administrator Response: See z/VM:RACF Security Server Command Language Reference forthe authority required to issue the indicated command.

ICH08007I NOT AUTHORIZED TO CHANGEPASSWORD/INTERVAL FOR userid

Explanation: You are not allowed to change thepassword or password interval for the user indicated inthe message.



ICH08010I INTERVAL CHANGE FOR ‘id’REJECTED BY

Explanation: This is the first part of a two-partmessage that indicates that the installation passwordexit (ICHPWX01) has rejected the value you specifiedin the INTERVAL keyword (in the PASSWORDcommand).

Message ICH08012I completes this message.

System action: The command is terminated.

User response: See your RACF security administratorfor the rules for interval values.

ICH08011I PASSWORD CHANGE FOR ‘id’REJECTED BY

Explanation: This is the first part of a two-partmessage that indicates that the installation passwordexit (ICHPWX01) has rejected the character string youspecified in the PASSWORD operand (on thePASSWORD command). See your RACF securityadministrator for the rules regarding new passwords.

Message ICH08012I follows this message.


User response: See your RACF security administratorfor the rules regarding new passwords.

ICH08012I INSTALLATION PASSWORD EXIT

Explanation: This message completes messagesICH08010I, ICH08111I and ICH08013I. Each of thesemessages is split because some console screens cannotaccommodate the complete message.

ICH08013I PASSWORD AND INTERVALCHANGES FOR id REJECTED BY

Explanation: This is the first of a two-part messagethat indicates that the installation password exit(ICHPWX01) has rejected the values you specified inboth the INTERVAL and PASSWORD operands (on thePASSWORD command).

Message ICH08012I follows this message.


User response: See your RACF security administratorfor the rules for interval values and new passwords.

ICH08014I PASSWORD CHANGE REJECTED BYINSTALLATION SYNTAX RULES

Explanation: You specified a potential password thatdoes not obey the syntax rules (specified by thePASSWORD operand on the SETROPTS command) ineffect for your installation.

ICH08001I • ICH08014I



User response: See your RACF security administratorfor the syntax rules for new passwords.

ICH08017I PASSWORD CHANGE REJECTED DUETO INSTALLATION MINIMUMCHANGE INTERVAL

Explanation: The PASSWORD command has detectedthat an insufficient number of days has passed sinceyour last password change.


User response: Contact your security administrator todetermine your installation's minimum passwordchange interval, and to reset your password if it hasbeen compromised.

ICH08019I PASS PHRASE CHANGE REJECTEDDUE TO INSTALLATION PASSPHRASE EXIT

Explanation: The proposed password phrase, asspecified in the PHRASE operand on the PASSWORDcommand, has been rejected by the installationpassword phrase exit, ICHPWX11.









v Must be enclosed in single quotation marks, withsingle quotation marks within the password phrasedoubled


System action: RACF ignores the operand and

continues command processing with the next operand.


ICH08021I NEW PASS PHRASE CANNOT EQUALCURRENT PASS PHRASE

Explanation: The new password phrase specified mustbe different from the current password phrase.

System action: The password phrase is not changed.

ICH08022I VALUE SPECIFIED IS NOT CURRENTPASS PHRASE

Explanation: The value specified for the currentpassword phrase is not correct or there is no currentpassword phrase assigned.


ICH08024I NEW PASS PHRASE CANNOTMATCH A PREVIOUSLY USED PASSPHRASE

Explanation: You specified a password phrase thatmatches a previous password phrase. Your systemrestricts the reuse of password phrases.


User response: See your RACF security administratorfor password HISTORY options set by the SETROPTScommand because this also applies to passwordphrases.

ICH08025I USER SPECIFIED WITHOUTINTERVAL/NOINTERVAL, THEPASSWORD IS DELETED

Explanation: Neither INTERVAL nor NOINTERVALwere specified on the PASSWORD command. Thepassword is removed and may not be used as anauthenticator.

System action: The password is removed and is notusable as an authenticator.

ICH08026I CONFLICTING PARMS:PASSWORD/PHRASE SPECIFIEDWITH USER

Explanation: You specified a combination of operandswhich is not allowed.


ADDSD and DELDSD Command Messages


Explanation: You are not defined to RACF and cannot

ICH08017I • ICH09000I


||||

||||

||

issue the ADDSD or DELDSD command, or RACF isnot active.




ICH09001I UNABLE TO ESTABLISH ESTAE

Explanation: The command processor was unable toestablish an ESTAE recovery environment.




v The message ID



ICH09002I NOT AUTHORIZED TO CREATEGROUP DATASETS FOR GROUPgroup-name

Explanation: You do not have sufficient authority tocreate group data sets. Processing continues with thenext data set.

User response: See your RACF security administratoror the group administrator for the group indicated inthe message.

ICH09004I profile-name ALREADY DEFINED TORACF

Explanation: The data set name indicated in themessage was found in the RACF database.

System action: RACF does not change the definition.Processing continues with the next data set.

ICH09005I dsname NOT FOUND (ON volume | INCATALOG)

Explanation: If “ON volume” appears in the message,the specified non-VSAM data set name was not foundon the indicated volume.

If “IN CATALOG” appears in the message, thespecified VSAM or non-VSAM data set name was notfound by a catalog search.

System action: If the data set was not found on aparticular volume, the command processor attempts toprocess the data set on any remaining volumes.

If the data set cannot be found in the catalog,processing continues with the next data set.

ICH09006I USER OR GROUP name NOT DEFINEDTO RACF

Explanation: The indicated name (user ID or groupname) was specified as the first-level qualifier of thedata set name but could not be found on the RACFdatabase. To protect a data set with RACF, thefirst-level qualifier of the data set name must be aRACF-defined user ID or group name.

System action: Processing continues with the nextdata set.

ICH09007I OWNER SPECIFIED IS NOT A RACFDEFINED USER OR GROUP

Explanation: The user ID or group name specified onthe OWNER operand is not defined to RACF.


ICH09008I VOLUME INFORMATION IN RACFPROFILE INCONSISTENT WITHCATALOG VOLUME INFORMATION

Explanation: In processing a request to delete RACFprotection for a VSAM data set, RACF found that thevolume serial number in the data set profile does notmatch the volume serial number in the containingcatalog.


Problem determination: Use the Access MethodServices LISTCAT command and the RACF LISTDSDcommand to locate the inconsistency. Processingcontinues with the next data set.

ICH09009I OWNER SPECIFIED HASINSUFFICIENT AUTHORITY TOGROUP

Explanation: For a group data set, the user IDspecified on the OWNER operand does not have groupauthority to the group and cannot be named the ownerof the group data set.



ICH09010I NOT AUTHORIZED TO SPECIFYNOSET

Explanation: To specify NOSET, your user ID mustmatch the first-level qualifier of the data set name, youmust have the SPECIAL attribute, or the data setprofile is in a group in which you have thegroup-SPECIAL attribute.

ICH09001I • ICH09010I



ICH09011I NOT AUTHORIZED TO DELETE RACFPROTECTION FOR dsname

Explanation: You do not have sufficient accessauthority to delete RACF protection for the data setspecified.



ICH09012I dsname (ON volume) ALREADY RACFINDICATED

Explanation: While attempting to RACF-indicate thedata set named in the message, the command processorfound that the data set was already RACF-indicated.For a VSAM data set, the RACF indicator is in theVSAM catalog. For a non-VSAM DASD data set, theRACF indicator is in the DSCB on the volume indicatedin the message. For a tape data set, the RACF indicatoris in the TVTOC for the tape volume indicated in themessage.


ICH09013I

Explanation: While attempting to remove RACFindication for the data set indicated in the message, thecommand processor found that the data set was notRACF-indicated. The RACF indicator is in the VSAMcatalog for a VSAM DASD data set, in the DSCB on theindicated volume for a non-VSAM DASD data set, orin the TVTOC for tape volume volume.


ICH09014I INCOMPLETE UNIT/VOLUMEINFORMATION SPECIFIED

Explanation: Either unit or volume information wasspecified, but not both. If the data set is cataloged, donot specify unit or volume. If the data set is notcataloged, specify both unit and volume.


ICH09015I I/O ERROR ON OBTAIN ON VOLUMEvolume

Explanation: An OBTAIN issued for the data set onthe volume indicated resulted in an error return code.


ICH09016I VSAM CATALOG RETURN CODE IS rc- REASON CODE IS IGGOCLaa - crs

Explanation: The return code rc and reason code crswere returned by the catalog management moduleIGGOCLaa as a result of a catalog error or exceptionalcondition. For an explanation of the return and reasoncodes, see the description of message IDC3009I in thesystem messages book for your system.


ICH09017I I/O ERROR PROCESSING VTOC ONVOLUME volume

Explanation: An I/O error occurred while reading orwriting a DSCB to the volume indicated.


ICH09018I OPEN FAILED ON VOLUME volume

Explanation: An OPEN failed for the data set to beprotected or for the VTOC data set on the volumeindicated.


ICH09019I RACF INDICATOR INCONSISTENTWITH DATA SET PROFILE

Explanation: RACF protection was partially added ordeleted for the data set indicated in the message.

System action: The RACF indicator for the data setwas processed successfully in the VSAM catalog entry,in the DSCB on DASD volume volume, or in theTVTOC for tape volume volume, but the associated dataset profile on the RACF database was not successfullyprocessed. Processing continues with the next data set.


Explanation: The profile in the message was notfound on the RACF database.

Note: If you enter the DELDSD command for a fullyqualified generic profile (one whose name has nogeneric characters), but you do not specify theGENERIC operand, RACF issues this message. Thisoccurs because, without the GENERIC operand, RACFlooks for a discrete profile of that name. For example, ifthere is a fully qualified generic profile namedABC.DATA, and you enter the following command:

DELDSD ’ABC.DATA’


ICH09011I • ICH09020I


DELDSD ’ABC.DATA’ GENERIC

System action: Processing continues with the nextprofile name.

ICH09021I

Explanation: RACF processing was not successful forthe indicated data set. For non-VSAM data sets, RACFprocessing was not successful on the volume volume.The phrase “AND REMAINING VOLUMES” meansthat all volumes sequentially after the indicated volumein the catalog entry for the data set or in the VOL listspecified on the command were not processed.

ICH09022I COMMAND PROCESSORENCOUNTERED SYSTEM ERROR

Explanation: The RDJFCB function failed during theprocessing of the RACF indicator for a volume of anon-VSAM data set.


ICH09023I profile-name - LAST VOLUME ADDEDTO DATA SET PROFILE WAS volume

Explanation: During processing of the ADDSDcommand with the NOSET operand specified, an erroroccurred while adding volume serials to the newlycreated data set profile on the RACF database.

System action: The volume indicated in the messagewas the last volume added before the terminating error.

User response: Use the ADDVOL operand of theALTDSD command to add the remaining volumes.

ICH09024I dsname INVALID DATA SET NAME

Explanation: The data set indicated in the message isnot a valid qualified name or the first qualifierexceeded the maximum allowed length of 8 characters.


ICH09025I NOT AUTHORIZED TO RACFPROTECT dsname

Explanation: You are not authorized to RACF-protectthe data set indicated in the message.



ICH09026I dsname HAS DUPLICATE VOLUMESERIALS

Explanation: The same volume serial was found twicein the list of volume serials for the data set indicated inthe message.

System action: RACF does not process any volumesand terminates the command.

ICH09027I dsname IN USE - TRY AGAIN LATER

Explanation: For the VSAM data set indicated in themessage, the catalog entry containing the RACFindicator cannot be modified because the data setspecified is in use.


ICH09028I

Explanation: The command preprocessing exit routineICHCNX00 issued a return code of 4, indicating thatRACF should fail the ADDSD or DELDSD request forthe profile indicated in the message.



ICH09029I ERROR ENCOUNTERED DURINGVTOC PROCESSING, RETURN CODEIS xx, CVSTAT IS yyy.

Explanation: The Common VTOC Access Facility(CVAF) issued a return code other than zero, indicatingthat a VTOC update operation was not completedsuccessfully.


User response: Report the exact text of this messageto your system programmer.

Problem determination: Return code xx (the contentsof register 15 from a CVAF invocation) and CVSTATvalue yyy are documented in the following:

v On MVS/370, Data Facility Device Support User’sGuide and Reference, GC26-3952.

v On MVS/XA, MVS/XA System Programming Library:Data Management, GC26-4014.

v On MVS/ESA, MVS/ESA Common VTOC AccessFacility Diagnosis Reference, LY27-9547 and MVS/ESAData Facility Product Version 3: Diagnosis Reference,LY27-9551.

ICH09030I FILESEQ(nnnn) ALREADY DEFINED INTVTOC FOR SPECIFIED VOLUME(S)

Explanation: For a tape data set, file sequence numbernnnn is already defined in the TVTOC for thevolume(s) specified. Message ICH09021I will followthis message.

System action: Command processing continues withthe next data set.

ICH09021I • ICH09030I


ICH09031I COMMAND PROCESSINGTERMINATED. FILESEQ(nnnn) ISINCONSISTENT WITH CURRENTVOLUME CONTENTS

Explanation: The specified tape volumes already havedata sets defined, and the file sequence number nnnnwould fall after a multivolume data set on the firstvolume specified, or the second or succeedingvolume(s) are not currently empty, or the specified tapevolume has been marked as a single data set volumeand the file sequence number specified is greater thanone.


ICH09032I UNABLE TO LOCATE TAPE VOLUMEFOR DATA SET

Explanation: A specific volume for the data set wasnot specified. RACF attempted to locate a catalog entryfor the tape date set and an entry could not be found.

System action: Command processing is terminated.

User response: Specify the correct volume for the dataset.

ICH09033I TAPE DATA SET PROTECTION ISINACTIVE. TAPE IS NOT VALID

Explanation: The TAPE operand may not be specifiedbecause tape data set protection is inactive.


User response: See your RACF security administratorfor information on protecting tape data sets.

ICH09034I GENERIC INVALID, GENERICCOMMAND PROCESSING ISINACTIVE

Explanation: The GENERIC operand is invalidbecause the generic command processing facility isinactive.


ICH09035I COMMAND PROCESSINGTERMINATED. USER NOTAUTHORIZED TO ‘FROM’ PROFILEprofile-name

Explanation: The user does not have sufficientauthority to the profile specified in the FROM operand.



ICH09036I COMMAND PROCESSINGTERMINATED. ‘FROM’ PROFILEprofile-name DOES NOT EXIST

Explanation: The profile name specified in the FROMoperand is not an existing profile.

If the FVOLUME operand was specified, RACF couldnot locate a profile with the specified name andvolume.

If the FVOLUME operand was not specified, one of thefollowing is true:

v There is no profile with the specified name.

v There is more than one discrete profile with the samename protecting data sets on different volumes.

Note: For fully qualified generic names, the FGENERICoperand must be specified in order to find a matchinggeneric profile.


ICH09037I NOT AUTHORIZED TO USE VOLUMEnnnn

Explanation: The tape volume is alreadyRACF-protected and the current user has an insufficientauthority to it.


User response: Check the spelling of the volume onthe command issued. If it is correct, see your RACFsecurity administrator to obtain the appropriateauthority.

ICH09038I COMMAND PROCESSINGTERMINATED. USER SPECIFIED FORNOTIFY NOT RACF DEFINED

Explanation: The user ID specified on the NOTIFYoperand is not a RACF-defined user.


ICH09039I COMMAND PROCESSINGTERMINATED. MULTIPLE TAPE DATASETS AND MULTIPLE VOLUMESWERE SPECIFIED

Explanation: The user has specified multiple tape datasets and multiple volumes. Either multiple tape datasets or multiple volumes may be specified, but notboth.


ICH09031I • ICH09039I


ICH09041I COMMAND PROCESSINGTERMINATED. FGENERIC NOTAUTHORIZED FOR FCLASSSPECIFIED

Explanation: The FCLASS operand was specified witha class name other than DATASET or one of thoseclasses defined in the class descriptor table.



Explanation: RACF could not validate the name youspecified on the SECLEVEL or ADDCATEGORYoperand. This happened for one of two reasons:




ICH09043I COMMAND PROCESSINGTERMINATED. TAPEVOL PROFILEprofile-name CANNOT CONTAIN ATVTOC.

Explanation: Profile profile-name was defined withouta TVTOC. ADDSD command cannot be used.


User response: Contact your RACF SecurityAdministrator.

ICH09044I NOT AUTHORIZED TO INCLUDEDFP SEGMENT IN DATASET PROFILEdsname DATASET PROFILE WAS NOTDEFINED

Explanation: The ADDSD command withRESOWNER operand specified was issued by a userwithout sufficient authority.

System action: Command processing is terminatedwithout adding a data set profile to the RACFdatabase.

User response: See your RACF security administratorfor authority to the DFP segment.


ICH09045I ADDSD failed. You are not authorizedto specify SECLABEL.

Explanation: The SECLABEL operand was specifiedon the ADDSD command and one of the followingconditions is true:

v The user did not have the SPECIAL attribute, andSETROPTS SECLABELCONTROL was in effect.

v SETROPTS MLSTABLE was in effect, but SETROPTSMLQUIET was not in effect.



ICH09046I DELDSD failed. There is a less specificprofile profile-name with a differentSECLABEL.

Explanation: The SETROPTS MLSTABLE option is ineffect. Therefore, the execution of the particularDELDSD command could potentially change theSECLABEL of the data set, because of the existence of aless specific profile with a different SECLABEL.



ICH09047I ADDSD failed. There is a less specificprofile profile-name with a differentSECLABEL.

Explanation: The SETROPTS GENERICOWNERoption is in effect. Therefore, the execution of theparticular ADDSD command could potentially changethe SECLABEL of the data set, because of the existenceof a less specific profile with a different SECLABEL.



ICH09048I Your current SECLABEL seclabel-namehas been used. FROM profile has adifferent SECLABEL.

Explanation: The ADDSD command was issued withFROM specified, but the FROM profile has a differentSECLABEL than the profile being defined, and theSETROPTS options prevent SECLABEL changes by auser without the appropriate authority. One of thefollowing conditions is true:

v The user did not have the SPECIAL attribute, andSETROPTS SECLABELCONTROL was in effect.


System action: The command will execute, but theSECLABEL will not be copied from the model profile.The current SECLABEL of the issuer will be used.

ICH09041I • ICH09048I


ICH09049I ADDSD failed. SECLABEL seclabel-nameis not currently defined to RACF.

Explanation: There is no profile in class SECLABELwhose name is the security label indicated in themessage.


User response: Check the spelling of the valuespecified on the SECLABEL operand. If it is correct,report the exact text of this message to your RACFsecurity administrator.

ICH09050I RACDEF FAILED. RETURN CODE ISreturn-code, REASON CODE ISreason-code

Explanation: RACROUTE REQUEST=DEFINE failedbecause:

v there is an error in an installation exit,

v the installation exit (such as ICHRDX01) returned anreturn code of 4, or

v there is an internal error.


User response: See your RACF administrator.

Problem determination: See the description of returnand reason codes for the REQUEST=DEFINE macro inExternal Security Interface (RACROUTE) Macro Referencefor MVS and VM. Check any related installation exit fora possible error.

ICH09051I ADDSD failed. You are not authorizedto specify SECLABEL seclabel-name.

Explanation: To specify the security label indicated inthe message, you must have at least READ accessauthority to the SECLABEL profile.



ICH09052I ADDSD failed. SECLABEL is requiredunder the current RACF options.

Explanation: The SETROPTS MLACTIVE option is ineffect on your system, which requires that all newprofiles have a security label specified. However, theSECLABEL operand was not specified on the ADDSDcommand, and you have no current security label.


User response: Specify a security label appropriate forthe profile. For a description of appropriate securitylabels, see your installation security procedures or yourRACF security administrator.

ICH09053I Profile not deleted. This profile is theonly profile providing SECLABELprotection for one or more datasets.

Explanation: You cannot delete the profile specified onthe DELDSD command because it is the only remainingprofile that protects one or more data sets with asecurity label, and the SETROPTS MLACTIVE optionprevents changes to SECLABEL protection.

System action: Command processing is terminatedwith no effect on profiles.

User response: Check the spelling of the commandyou entered. If it is correct and you intend to deletethis profile, rename or delete all data sets protected bythe profile, then reissue the DELDSD command.

ICH09054I CATALOG NOT available. Data set,dsname, was not processed.

Explanation: The device containing the catalog hasbeen dynamically reconfigured from the system.


System programmer response: Before this data set canbe processed the device containing the catalog must bedynamically re-configured back into the system.


ICH09049I • ICH09054I


RDEFINE, ADDDIR, and ADDFILE Command Messages

ICH10004I operand DOES NOT APPLY TOclass-name CLASS ENTITIES; OPERANDIGNORED

Explanation: The operand indicated in the messagedoes not apply to the class indicated in the message.

System action: RACF ignores the operand andcontinues processing with the next operand.

ICH10005I LIST OF ENTITY NAMES SPECIFIED;ADDMEM OPERAND IGNORED

Explanation: The RDEFINE command was issuedwith a list of entity names (profile names), a class nameof GLOBAL or SECDATA, and the ADDMEM operand.Only a single entity name (profile name) is allowed.

System action: RACF ignores the ADDMEM operand.Command processing continues with the next operand.

ICH10006I THE NEW PROFILE WILL NOT BE INEFFECT UNTIL A SETROPTSREFRESH HAS BEEN ISSUED.

Explanation: The profile class exists in commonstorage, but the new profile will not become effectiveuntil the SETROPTS command is issued with theREFRESH operand.

ICH10102I profile-name ALREADY DEFINED TOCLASS class-name

Explanation: The indicated profile has been previouslydefined to RACF in the indicated class.

System action: Command processing continues withthe next profile name.

ICH10103I NOT AUTHORIZED TO DEFINEprofile-name

Explanation: You do not have sufficient authority todefine the indicated profile to RACF.

System action: Command processing continues withthe next profile name in the list.


ICH10104I NOT AUTHORIZED TO ADDmember-name

Explanation: You do not have sufficient authority tospecify the indicated resource name on the ADDMEMoperand.

System action: Command processing continues withthe next member name.


ICH10105I LEADING ZEROES ARE NOTALLOWED WHEN DEFINING FOURCHARACTER MINIDISK. profile-nameIS NOT DEFINED.

Explanation: When specifying the profile names forminidisks that have 4-character virtual addresses, youcannot specify a zero as the first character in the virtualaddress. You must omit the leading zero. For example,for SMITH's 0191 minidisk, specify the followingprofile name:

SMITH.191


User response: Change the spelling of the profilename and issue the command again.






ICH10202I NOT AUTHORIZED TO DEFINEclass-name CLASS ENTITIES

Explanation: You do not have sufficient authority todefine entities (profiles) to RACF in the indicated class.



ICH10203I COMMAND PROCESSINGTERMINATED. NOT AUTHORIZEDTO ‘FROM’ PROFILE profile-name.

Explanation: The user does not have sufficientauthority to the profile specified in the FROM operand.



ICH10204I COMMAND PROCESSINGTERMINATED. ‘FROM’ PROFILEprofile-name NOT FOUND

Explanation: The profile name specified in the FROM

ICH10004I • ICH10204I


operand is not an existing profile.

If the FVOLUME operand was specified, RACF couldnot locate a profile with the specified name andvolume.

If the FVOLUME operand was not specified, one of thefollowing is true:

v There is no profile with the specified name.

v If FCLASS is DATASET, there is more than onediscrete profile with the same name protecting datasets on different volumes.

Note: For fully qualified generic names withFCLASS(DATASET), the FGENERIC operand must bespecified in order to find a matching generic profile.


ICH10207I COMMAND PROCESSINGTERMINATED. NO {SECLEVEL |CATEGORIES} FOUND

Explanation: RACF could not validate the name youspecified on the SECLEVEL or ADDCATEGORYkeyword. This happened for one of two reasons:


v A profile is defined, but it contains no members.


ICH10301I entity-name AND REMAININGENTITIES NOT DEFINED TO RACF

Explanation: The indicated entity name (profile name)and remaining entity names in the list were not definedto RACF because of one of the following:

v A RACF manager error occurred. In this case, aRACF manager error message explaining the errorprecedes this message.

v A system error occurred while building in-storageprofiles (using RACLIST) for the indicated entityname.

v A system error occurred while checking (withFRACHECK) the user's authority to the entities to bedefined.

v A system error occurred while building in-storageprofiles (using RACLIST) for the entity namesspecified by the ADDMEM operand, or the memberclass associated with the specified class is currentlyinactive.

v A system error occurred while checking (withFRACHECK) the user's authority to the entitiesspecified by the ADDMEM operand.

v A user with class authority (CLAUTH) but withoutthe SPECIAL attribute attempted to define an entityin a general resource class (for example, TIMS) whilethe class was not active.

ICH10302I NOT AUTHORIZED TO ADDmember-name WITH THE OPTIONSPECIFIED.

Explanation: The user has attempted to add a memberto a VMEVENT or VMXEVENT class profile and hasspecified an auditing or control option without theproper authority.



ICH10303I command-name failed. You are notauthorized to specify SECLABEL.

Explanation: The command indicated in the messagewas issued with the SECLABEL operand. However, oneof the following conditions caused the command to fail:

v The user issuing the command did not have theSPECIAL attribute, and SETROPTSSECLABELCONTROL is on.

v The SECLABEL operand was specified on theRDEFINE command, and SETROPTS MLSTABLE ison, but SETROPTS MLQUIET is not.



ICH10304I command-name failed. There is a lessspecific profile profile-name with adifferent SECLABEL.

Explanation: The execution of the command indicatedin the message could potentially change the SECLABELof the resource because of the existence of a lessspecific profile with a different SECLABEL.



ICH10305I Your current SECLABEL seclabel-namewas used. FROM profile has a differentSECLABEL.

Explanation: RDEFINE FROM was issued, but theFROM profile has a different SECLABEL, and theSETROPTS options preventing the SECLABEL changeby a user without the appropriate authority have beenturned on.

System action: Command will execute, but theSECLABEL will not be copied from the model profile.The LOGON SECLABEL of the issuer will be used.

ICH10306I command-name failed. SECLABELseclabel-name is not currently defined toRACF.

Explanation: There is no profile in class SECLABEL

ICH10207I • ICH10306I


whose name is the security label indicated in themessage.


User response: Correct the command or define theSECLABEL.

ICH10307I SECLABEL operand ignored. It does notapply to class class-name.

Explanation: The SECLABEL operand was specifiedon the command, but SECLABEL has no meaning forthe class. The operand has been ignored by thecommand processor.

System action: The profile is defined, but theSECLABEL operand is ignored.

ICH10308I command-name failed. You are notauthorized to specify SECLABELseclabel-name.

Explanation: SECLABEL seclabel-name was specified onthe command indicated in the message by a userwithout at least a READ authority to it.



ICH10309I WARNING for command-name.Extraneous information in the FROMkeyword has been ignored.

Explanation:

v For the RDEFINE command, only one profile name(no blanks) is allowed in the FROM operand.

v For the ADDFILE and ADDDIR commands,

– If the FCLASS operand is DIRECTRY or defaultsto DIRECTRY, only one DIRECTRY name (noblanks) is allowed.

– If the FCLASS operand is FILE or defaults toFILE, only three names separated by spaces(file-name file-type directory-id) are allowed.

– If the FCLASS operand is a class other than FILEor DIRECTRY, only one profile name (no blanks)is allowed in the FROM operand.

System action:

v For the RDEFINE command, the first profile name(no blanks) in the FROM operand is used, and theother names are ignored.

v For the ADDFILE and ADDDIR commands,

– If the FCLASS operand is DIRECTRY or defaultsto DIRECTRY, the first DIRECTRY name (noblanks) in the FROM operand is used, and theother names are ignored.

– If the FCLASS operand is FILE or defaults toFILE, the first three names separated by spaces inthe FROM operand are used, and the other namesare ignored.

– If the FCLASS operand is a class other than FILEor DIRECTRY, the first profile name (no blanks) inthe FROM operand is used, and the other namesare ignored.

User response: If the profile was created using thewrong FROM profile, delete the profile that wascreated and create it again.

ICH10310I command-name failed. User userid is notdefined to RACF.

Explanation: The user ID indicated in the messagewas specified as the second qualifier in a file ordirectory profile name but could not be found in theRACF database. The second qualifier in the profilename for a file or directory must be a RACF-defineduser ID.

System action: Command processing ends.

User response: Correct the second qualifier in theprofile name and issue the command again.

ICH10311I command-name failed. SECLABEL isrequired under the current RACFoptions.

Explanation: The SETROPTS MLACTIVE option is ineffect on your system, which requires that all newprofiles have a security label specified. However, theSECLABEL operand was not specified on the indicatedcommand, and you have no current security label.


User response: Specify a security label appropriate forthe profile. For a description of appropriate securitylabels, see your installation security procedures or youRACF security administrator.

ICH10312I Profile not created. You must specify theSECLEVEL keyword when creating aSECLABEL profile.

Explanation: The user attempted to create aSECLABEL profile without specifying a security level.Each SECLABEL profile must have a security level.

System action: The SECLABEL profile is not created.

User response: After choosing an appropriate securitylevel for this security label, specify it on the SECLEVELkeyword.

ICH10307I • ICH10312I


ICH10313I Profile cannot be defined. Profile namescannot end with ‘%*’.

Explanation: The user of the RDEFINE commandattempted to define a profile ending with %*.


ICH10315I PROFILES ARE NOT ALLOWED TOBE ADDED TO CLASS class-name.

Explanation: The user of the RDEFINE commandattempted to define a profile to a class that has beendefined in the class descriptor table withPROFDEF=NO specified.

System action: RACF command processing ends.

ICH10316I PROFILES CANNOT BE ADDED TOAN ORIGINAL FORMAT DATABASE

FOR CLASS class-name.

Explanation: The user of the RDEFINE commandattempted to define a profile to the APPCPORT,APPCTP, or APPCSI classes in a nonrestructured RACFdatabase (non-RDS) or mixed-mode environment.

System action: RACF command processing ends.

ICH10317I ‘FROM’ profile profile-name is defined indatabase, but is not active. SETROPTSREFRESH may be required.

Explanation: The profile name specified in the FROMoperand is not active.


User response: Issue the SETROPTS REFRESHcommand to activate the profile.

RALTER, ALTDIR, and ALTFILE Command Messages

ICH11001I NOT AUTHORIZED TO SPECIFYGLOBALAUDIT FOR profile-name;OPERAND IGNORED

Explanation: You do not have sufficient authority tospecify the GLOBALAUDIT operand for the profileindicated in the message.



ICH11002I AUTHORIZED TO ISSUE ONLYGLOBALAUDIT FOR profile-name;REMAINING OPERANDS IGNORED

Explanation: You have specified operands in additionto GLOBALAUDIT, but you are only authorized tospecify the GLOBALAUDIT operand for the indicatedprofile name.

System action: RACF ignores all operands other thanGLOBALAUDIT.


ICH11003I NOT AUTHORIZED TO SPECIFYOWNER FOR profile-name; OPERANDIGNORED

Explanation: You do not have sufficient authority tospecify the OWNER operand for the indicated profilename.

System action: RACF ignores the OWNER operand.Command processing continues with the next operand.


ICH11004I operand DOES NOT APPLY TOclass-name CLASS ENTITIES; OPERANDIGNORED

Explanation: The indicated operand does not apply tothe indicated class.


ICH11005I LIST OF ENTITY NAMES SPECIFIED;operand OPERAND IGNORED

Explanation: You have specified a list of entity names(profile names). Only a single entity name is allowedwhen either of the following is true:

v The ADDVOL or DELVOL operand is specified.

v The class name is specified as GLOBAL orSECDATA, and the ADDMEM or DELMEMoperands are specified.


ICH11006I NOT AUTHORIZED TO SPECIFYADDVOL; OPERAND IGNORED

Explanation: You do not have sufficient authority tospecify the ADDVOL operand.



ICH11007I entity NAME CANNOT BE SPECIFIEDIN DELVOL LIST; profile-name NOTDELETED

Explanation: The volume serial number indicated by

ICH10313I • ICH11007I


profile-name was specified on the profile-name operandand the DELVOL operand.

System action: RACF ignores the request to delete theprofile name. Command processing continues with thenext volume serial number specified on the DELVOLoperand.

ICH11008I SHOULD BE REMOVED FROM ALLUSER AND RESOURCE PROFILES

Explanation: A category or security level has beendeleted from a profile in the SECDATA class. Thesecurity categories or security levels that correspond tothe name(s) deleted should be deleted from all userand resource profiles or unexpected errors in RACFprocessing may occur.

ICH11009I RACLISTED PROFILES FOR class-nameWILL NOT REFLECT THE UPDATE(S)UNTIL A SETROPTS REFRESH ISISSUED

Explanation: The profile class exists in commonstorage, but the profile updates will not becomeeffective until the SETROPTS command is issued withthe REFRESH operand. If a RALTER command wasissued that didn't change anything, updating theRACLISTED profiles via the SETROPTS REFRESH isnot necessary.

ICH11102I profile-name NOT DEFINED TO CLASSclass-name

Explanation: The indicated profile name has not beenpreviously defined to RACF in the indicated class.


ICH11103I NOT AUTHORIZED TO ALTERprofile-name

Explanation: You do not have sufficient authority toalter the indicated profile.


User response: See the owner of the profile or yourRACF security administrator. To display the owner ofthe profile, use the RLIST command.

ICH11104I volser NOT IN VOLUME SET OFprofile-name; VOLUME NOT DELETED

Explanation: The indicated volume serial number(volser) specified on the DELVOL operand does notbelong to the volume set of the indicated profile.

System action: The volume serial number is notdeleted. Command processing continues with the nextoperand.

ICH11105I member-name ALREADY DEFINED TOGROUP profile-name

Explanation: The resource name specified on theADDMEM operand is already a member of theresource group being altered.


ICH11106I volser ALREADY DEFINED TO CLASSTAPEVOL

Explanation: The volume serial number (volser)specified on the ADDVOL operand is already definedto RACF in the TAPEVOL class.


ICH11107I member-name NOT DEFINED TOGROUP profile-name

Explanation: The resource name specified on theDELMEM operand is not a member of the resourcegroup being altered.


ICH11108I NOT AUTHORIZED TO ADDmember-name

Explanation: The user of the RALTER command doesnot have sufficient authority to specify the indicatedresource name on the ADDMEM operand.



ICH11111I SINGLEDS IGNORED. VOLUME volserCONTAINS MORE THAN ONE DATASET

Explanation: The indicated volume already containsmore than one entry in the TVTOC.

System action: RACF ignores the SINGLEDS operand.Command processing continues with the next operand.

ICH11112I TVTOC IN USE. NOTVTOC IGNORED

Explanation: A TVTOC that protects a tape data setalready exists.

System action: RACF ignores the NOTVTOC operand.Command processing continues with the next operand.

ICH11008I • ICH11112I


ICH11113I DELVOL volume PROCESSINGIGNORED. A TVTOC ENTRY EXISTSFOR A DATA SET ON THE VOLUME.

Explanation: The DELVOL operand was specified fora volume that has TVTOC entries for a tape data set(s)on the volume. The data set(s) must be deleted beforethe volume can be deleted.


ICH11114I category ALREADY DEFINED TOprofile-name

Explanation: The security category indicated in themessage has already been defined in this profile.


ICH11115I category NOT DEFINED TO profile-name

Explanation: The security category indicated in thismessage has not been defined to this profile.












ICH11301I entity-name AND REMAININGENTITIES NOT ALTERED

Explanation: The indicated entity name (profile name)and remaining entity names in the list were not alteredbecause of one of the following:

v A RACF-manager error occurred. In this case, themessage is preceded by a RACF-manager errormessage explaining the error.

v A system error occurred while building in-storageprofiles (using RACLIST) for the entity namesspecified by the ADDMEM operand or the memberclass associated with the specified class is currentlyinactive.

v A system error occurred while checking (withFRACHECK) the user's authority to the entitiesspecified by the ADDMEM operand.

ICH11302I

Explanation: The indicated volume serial number andall remaining volumes specified on the ADDVOL orDELVOL operand were not added to or deleted from avolume set because an error occurred in the RACFmanager. A RACF-manager error message precedes thismessage and explains the error.

System action: Other operands on the command havebeen processed. RACF terminates the command.

ICH11303I MEMBER member-name ANDREMAINING MEMBERS NOTPROCESSED FOR ENTITY entity-name

Explanation: An error occurred in the RACF-managerthat prevented the indicated entity name (resourceprofile) from being added to or deleted from theindicated resource group. A RACF-manager errormessage precedes this message.

System action: Other operands on the command havebeen processed.

ICH11304I NOT AUTHORIZED TO ADD/DELETEmember-name WITH THE OPTIONSPECIFIED.

Explanation: You have attempted to add a member to,or delete a member from, a profile in class VMEVENTor VMXEVENT. However, you specified an option(auditing or control) that you do not have the authorityto specify. The auditing or control option to which youare not authorized is part of the member nameindicated in the message.



ICH11306I command-name failed. You are notauthorized to alter a SECLABEL profile.

Explanation: The command indicated in the messagewas issued for a SECLABEL profile. However, one ofthe following conditions caused the command to fail:

ICH11113I • ICH11306I


v The user issuing the command did not have theSPECIAL attribute, and SETROPTSSECLABELCONTROL is on.

v The command indicated in the message was issuedby any user while SETROPTS MLSTABLE was on,but SETROPTS MLQUIET was not.



ICH11307I command-name failed. NOSECLABEL isnot allowed under the current RACFoptions.

Explanation: NOSECLABEL operand was specified onthe command indicated in the message, and SETROPTSMLACTIVE is on.


User response: Correct the command.




User response: Correct the command or define theSECLABEL.

ICH11309I SECLABEL operand ignored. It does notapply to class class-name.

Explanation: The SECLABEL operand was specifiedon a RACF command, but SECLABEL has no meaningfor the class.

System action: The profile is defined, but theSECLABEL operand is ignored.

ICH11311I NOSECLEVEL operation ignored. Youcannot specify the NOSECLEVELkeyword for SECLABEL profiles.

Explanation: The user attempted to delete the securitylevel from a SECLABEL profile. Each SECLABELprofile must have a security level.

System action: The command processor ignores theNOSECLEVEL operand. All other operands areprocessed.

User response: Reconsider why you issued thiscommand. If you wish to change the security levelassociated with a security label, issue the RALTERcommand with the new security level specified on theSECLEVEL keyword.

RDELETE, DELDIR, and DELFILE Command Messages

ICH12001I

Explanation: A CATEGORY or SECLEVEL profile inthe SECDATA class was deleted from the RACF dataset. The profile contained a member list. All securitycategories or security levels should be deleted fromuser and resource profiles, or unexpected errors inRACF processing may occur.

ICH12002I RACLISTED PROFILES FOR class-nameWILL NOT REFLECT THEDELETION(S) UNTIL A SETROPTSREFRESH IS ISSUED.

Explanation: The profile class exists in commonstorage; the profile cannot be deleted until theSETROPTS command is issued with the REFRESHoperand.

ICH12102I profile-name NOT DEFINED TO CLASSclass-name

Explanation: The indicated profile name has not beenpreviously defined to RACF in the indicated class.


ICH12103I NOT AUTHORIZED TO DELETEprofile-name

Explanation: You do not have sufficient authority todelete the indicated profile name.




Explanation: You are not defined to RACF and cannotissue the specified command, or RACF is not active.




ICH12202I COMMAND PROCESSINGTERMINATED. USER DOES NOTHAVE SUFFICIENT AUTHORITY TOALL DATA SETS IN THE TVTOC.

ICH11307I • ICH12202I


Explanation: The TAPEVOL profile cannot be deletedbecause the TVTOC in the profile contains data set(s)that have not yet passed their security retention periodand the user does not have sufficient authority todelete them.


ICH12301I entity-name AND REMAININGENTITIES NOT DELETED

Explanation: The indicated entity name (profile name)and all remaining entity names in the list were notdeleted from RACF because a RACF-manager erroroccurred. This message is preceded by aRACF-manager error message, which explains the error.


ICH12302I command-name failed. There is a lessspecific profile profile-name with adifferent SECLABEL.

Explanation: The execution of the command indicatedin the message could potentially change the security

label of the data set because of the existence of another,less specific profile with a different security label.



ICH12303I Profile not deleted. Deleting this profilewould remove the only profile thatprovides SECLABEL protection for oneor more resources.

Explanation: You cannot delete the profile specified onthe command because it is the only remaining profilethat protects one or more resources with a securitylabel, and the SETROPTS MLACTIVE option preventschanges to SECLABEL protection.

System action: Command processing is terminatedwith no effect on profiles.

User response: Check the spelling of the commandyou entered. If it is correct and you intend to deletethis profile, rename or delete all resources protected bythe profile, then reissue the command.

RLIST, LDIRECT, and LFILE Command Messages


Explanation: You are not defined to RACF and cannotissue the specified command, or RACF is not active.




ICH13002I NOT AUTHORIZED TO LISTprofile-name

Explanation: You do not have sufficient authority tolist the indicated profile name.



ICH13003I profile-name NOT FOUND

Explanation: The indicated profile name was not

found in the RACF database.

ICH13004I NOTHING TO LIST

Explanation: You specified * for profile name. Eitherthere are no profiles in that class or you do not havesufficient authority to list any of them.

ICH13005I RESGROUP DOES NOT APPLY TOclass-name CLASS ENTITIES; OPERANDIGNORED

Explanation: The RESGROUP operand was specifiedon the RLIST command and the specified class is not a“member class” (such as TERMINAL or DASDVOL) forwhich a resource grouping class exists.


ICH13006I No profile(s) listed. NORACF specifiedand no other information requested.

Explanation: NORACF was specified on the RLISTcommand, but no segments were requested.

SETROPTS Command Messages

ICH14001I NOT AUTHORIZED TO ISSUESETROPTS

Explanation: You are not defined to RACF withsufficient authority and, therefore, cannot issue theSETROPTS command; or RACF is not active.




ICH12301I • ICH14001I


ICH14002I KEYWORD IGNORED.

Explanation: You do not have sufficient authority tospecify the keywords indicated.

System action: RACF ignores these keywords andcontinues command processing with the remainingkeywords.


ICH14003I I/O ERROR - jjj, sss, ddd, devtyp, ddn,oper, xxxx, acc

Explanation: A permanent I/O error occurred whileprocessing on device ddd. In the message text, the erroranalysis information provided by the SYNADAF datamanagement macro instruction issued by the SYNADroutine was:jjj Job namesss Step nameddd Unit address of the devicedevtyp Device typeddn Data definition nameoper Operation attemptedxxxx Last seek address or block countacc Access method


System programmer response: To recover from theproblem, consider switching to a backup RACFdatabase (using the RVARY SWITCH command).

Note: For complete information on recovering from theproblem, see the section on RACF database recovery inRACF System Programmer's Guide. Pay particularattention to the section on failures during I/Ooperations on the RACF database in SPL: RACF.

User response: Notify your system programmer.

Problem determination: Other messages might havebeen issued for this problem. These messages mightappear on the system console or the security console, orend users might receive them. On VM, the messagesmight appear on the console log of the RACF servicemachine. An analysis of those messages might help youdetermine the cause of the problem. In particular, lookfor message ICH51011I, which reports a return codefrom the RACF manager.

ICH14004I UNABLE TO OPEN RACF DATA SETdsname

Explanation: The OPEN for the indicated data setfailed.



Note: For complete information on recovering from theproblem, see the section on RACF database recovery inRACF System Programmer's Guide. Pay particularattention to the section on failures during I/Ooperations on the RACF database in RACF SystemProgrammer's Guide.



ICH14006I NOT AUTHORIZED TO CHANGERACF OPTIONS; RACF CURRENTLYINACTIVE.

Explanation: RACF has previously been set not activeby the RVARY command. RACF options cannot bechanged by the SETROPTS command until the RVARYcommand is issued and RACF is set active again.


ICH14009I RULEn HAS AN OVERLAPPINGSPECIFICATION IN THE CONTENTRULES.

Explanation: You have tried to use the SETROPTScommand to define a syntax rule for use in yourinstallation. The position values for the contentkeywords overlap. The following example illustratesoverlapping position values:

SETROPTS PASSWORD (RULE1(LENGTH(8) -ALPHA(1:5) NUMERIC(4:8)))

The overlap occurs for positions 4 and 5 in the contentkeywords ALPHA and NUMERIC. There are severalways to correct the error, depending on your intentionfor the rule. For example, ...ALPHA(1:3)NUMERIC(4:8)... is correct.

System action: RACF ignores this rule (and otherrules specified by RULEn) but will process otherPASSWORD options and other keywords specified onthe SETROPTS command.

ICH14010I * WARNING, THIS OPTION ISINACTIVE, IT REQUIRES THE‘INITSTATS’ OPTION.

Explanation: RACF requires that the INITSTATSoption be in effect when you specify the LIST operandon the SETROPTS command with any of the followingoptions: INACTIVE, REVOKE, or WARNING.


ICH14002I • ICH14010I


ICH14011I GLOBAL ACCESS CHECKING BASETABLE IS ABSENT, NO GLOBALACCESS CHECKING CAN BE DONE.

Explanation: During RACF Master SchedulerInitialization processing, an error preventedconstruction of the global-access-checking base table.

System action: Global access checking is disabled, butthe GLOBAL options are set in the RACF CVT and inthe RACF database ICB.

ICH14013I REFRESH IGNORED. NO RELATEDKEYWORDS SPECIFIED.

Explanation: When the REFRESH operand isspecified, the GLOBAL, GENERIC, GENLIST, orWHEN operand must also be specified to indicate whatis to be refreshed.

System action: RACF continues command processingwith the other operands specified.

ICH14014I GLOBAL ACCESS CHECKING BASETABLE IS ABSENT, REFRESHCANNOT BE DONE.

Explanation: During RACF initialization processing,an error prevented construction of the global-access-checking base table.

System action: No global-accesschecking refresh orgeneric-profile- checking refresh can be done.Command processing continues with the otheroperands.

ICH14015I

Explanation: You do not have sufficient authority torefresh the given class.

System action: RACF ignores this class. Commandprocessing continues with the next operand.


ICH14016I

Explanation: Because global access checking or genericaccess checking is inactive for the given class, norefresh can be done.

System action: RACF ignores this class. Commandprocessing continues with the next operand.

ICH14017I ERROR ENCOUNTERED DURINGGROUP AUTHORITY PROCESSING;COMMAND PROCESSINGTERMINATED

Explanation: A RACF manager error occurred duringthe processing required to determine whether thecommand issuer has group authority.



ICH14018I WARNING: TAPEDSN OPTIONACTIVE, TAPEVOL CLASS IS NOTACTIVE

Explanation: To protect tape data sets, if yourinstallation does not have a tape management system,RACF requires the TAPEVOL class to be active.

User response: Use the SETROPTS command withCLASSACT(TAPEVOL) specified to activate theTAPEVOL class.

ICH14019I ‘RVARYPW’ IGNORED. ERRORENCOUNTERED DURINGPASSWORD ENCODING.

Explanation: RACF uses an installation-definedpassword to approve a user's issuance of the RVARYcommand. The password is specified in the RVARYPWoperand of the SETROPTS command. If RACF isunable to encode the password at the time theSETROPTS command is issued, you receive thismessage.

System action: RACF ignores the operand andprocessing continues with the next operand.


ICH14020I ‘WHEN/NOWHEN’ OPTIONIGNORED. ENVIRONMENT DOESNOT SUPPORT class-name CLASS

Explanation: Because it does not support the indicatedclass, RACF cannot implement the indicated operand(WHEN or NOWHEN) in this system environment.

System action: RACF ignores the option.

ICH14021I ERROR REFRESHING program ACCESSTABLE. COMMAND PROCESSINGTERMINATED

Explanation: An error occurred when RACFattempted to refresh the PROGRAM access table.


ICH14022I CAN'T REFRESH class-name, CLASS ISNOT RACLISTED.

Explanation: You must issue the SETROPTS RACLISTcommand before refreshing this class.

ICH14011I • ICH14022I


ICH14023I ERROR ENCOUNTERED DURINGRACLIST, NORACLIST, OR RACLISTREFRESH PROCESSING. SYSTEMSTORAGE MAY NOT HAVE BEENRECOVERED.

Explanation: An error occurred during RACLIST,NORACLIST, or RACLIST REFRESH processing, whichmay have caused storage loss.

ICH14024I SECDATA SECLEVEL PROFILE NOTFOUND ON RACF DATASET.COMMAND PROCESSINGTERMINATED.

Explanation: No profile named SECLEVEL is definedin class SECDATA.

ICH14025I ERROR ENCOUNTERED DURINGSECLEVEL PROCESSING. COMMANDPROCESSING TERMINATED.

Explanation: An error occurred when RACFattempted to process the SECLEVEL operand.


ICH14026I NOT PROCESSED FOR class-name,RACLIST AND GENLIST CANNOTBOTH BE ACTIVE.

Explanation: You cannot specify both RACLIST andGENLIST for the same general resource class.

User response: Reissue the command, specifyingeither RACLIST or GENLIST.

ICH14027I NOT ALLOWED BY THE CLASSDESCRIPTOR TABLE. OPERANDIGNORED.

Explanation: The definition in the class descriptortable does not allow this class to be RACLISTed orGENLISTed.


ICH14028I OPERAND IGNORED.

Explanation: A class can be RACLISTed orGENLISTed only once. The class specified has alreadybeen RACLISTed or GENLISTed using the SETROPTScommand and cannot be RACLISTed or GENLISTedagain.


ICH14029I NORACLIST of class class-name ignored.RACLIST has not been done yet.

Explanation: SETROPTS NORACLIST is valid only forclasses for which SETROPTS RACLIST has beensuccessful.

System action: None of the classes specified on theNORACLIST operand is affected.

User response: If you do not want profiles kept instorage for this class, do nothing. If you have specifiedmore than one class on the NORACLIST operand, noneof the classes is affected by the command. Issue theSETROPTS command again, omitting the classindicated in the message from the NORACLISToperand.

ICH14030I NOGENLIST of class class-name ignored.GENLIST has not been done yet.

Explanation: SETROPTS NOGENLIST is valid only forclasses for which SETROPTS GENLIST has beensuccessful.

System action: None of the classes specified on theNOGENLIST operand was affected.

User response: If you do not want profiles kept instorage for this class, do nothing. If you have specifiedmore than one class on the NOGENLIST operand, noneof the classes is affected by the command. Issue theSETROPTS command again, omitting the classindicated in the message from the NOGENLISToperand.

ICH14031I request of class class-name failed.

Explanation: The SETROPTS command was issuedwith one of the following specified:

v RACLIST

v RACLIST REFRESH

v NORACLIST

v NOGENLIST

v NOGENERIC.

System action: The class indicated in the message wasnot affected by the SETROPTS command.

Problem determination: The message following thismessage describes why the SETROPTS commandfailed.

ICH14032I No in-storage profiles were found forclass class-name.

Explanation: The SETROPTS command was issuedwith one of the following specified:

v RACLIST REFRESH

v NORACLIST

v NOGENLIST

ICH14023I • ICH14032I


v NOGENERIC.

The request was not completed successfully.


User response: Check that the class name specified inthe SETROPTS command is spelled correctly. If it is,then the class does not have appropriate profiles:

v For RACLIST REFRESH or NORACLIST, the classmust have either discrete or generic profiles.

v For NOGENLIST or NOGENERIC, the class musthave generic profiles.

Add appropriate profiles to the class, then issue theSETROPTS command again.

ICH14033I Return code from RACLIST macro isreturn-code.

Explanation: The SETROPTS command processorencountered an error related to the RACLIST macro.



User response: If the message indicates a return codeother than zero, issue the SETROPTS command again.If the problem persists, see your system programmer.

If the message indicates a return code of zero, andmessage ICH14031I (which can appear with thismessage) indicates a RACLIST failure for aninstallation-defined class, ensure that theinstallation-defined class is defined in both the classdescriptor table (CDT) and the RACF router table.

Problem determination: If the return code reported inthis message is not zero, see the description of returncodes for the RACLIST macro in RACROUTE.

ICH14034I Reason code from RACLIST macro isreason-code.

Explanation: The SETROPTS command processorissued the RACLIST macro, but received the returncode reported in message ICH14033I. This messagereports a related reason code.



User response: Issue the SETROPTS command again.If the problem persists, see your system programmer.

Problem determination: The reason code indicated inthis message is related to the return code indicated inmessage ICH14033I. For a description of return andreason codes for the RACLIST macro, see RACROUTE.

ICH14035I return code return-code.

Explanation: If the message indicates CREATE, thenSETROPTS RACLIST processing could not create anACEE. If the message indicates DELETE, thenSETROPTS RACLIST processing could not delete anACEE.

System action: RACF terminates the command, andno classes are affected.

System programmer response: To correct the problem,re-IPL the system. If the problem persists, see “ProblemDetermination”.

User response: Issue the SETROPTS command again.If the problem persists, report the exact text of thismessage to your system programmer.

Problem determination: For a description of theRACLIST return codes, see RACROUTE. Report theexact text of this message, with the exact wording ofthe SETROPTS command you entered, to your IBMsupport center.

ICH14036I

Explanation: If ENQ is specified in the message,SETROPTS RACLIST (or GENLIST) processing couldnot obtain an exclusive lock on the class descriptortable. If DEQ is specified in the message, SETROPTSRACLIST (or GENLIST) processing could not release itslock on the class descriptor table.

System action: RACF terminates the command, andno classes are affected.

System programmer response: To correct the problem,re-IPL the system. If the problem persists, see “ProblemDetermination.”

User response: Issue the SETROPTS command again.If the problem persists, see your system programmer.

Problem determination: Report the exact text of thismessage, with the exact wording of the SETROPTScommand you entered, to your IBM support center.

ICH14037I WARNING! The MLS option is active,but the SECLABEL class is inactive.

Explanation: The SETROPTS MLS command wasissued, but the SECLABEL class is not active.

System action: There is no effect on system operation.

User response: To put the MLS option into effect, youmust activate the SECLABEL class.

ICH14038I WARNING! The MLACTIVE option isactive, but the SECLABEL class isinactive.

Explanation: The SETROPTS MLACTIVE commandwas issued, but the SECLABEL class is not active.

ICH14033I • ICH14038I


System action: There is no effect on system operation.

User response: To put the MLACTIVE option intoeffect, you must activate the SECLABEL class.

ICH14040I WARNING! You must RACLIST classclass-name before authorization checkingcan occur.

Explanation: This message is issued when a class isactivated by way of the SETROPTS CLASSACT(class)command, and the RACF class descriptor tableindicates that this class must be RACLISTed beforechecking can occur.

System action: RACF will perform no authorizationchecking (or auditing based on profiles) for the classuntil the indicated class has been RACLISTed.

User response: Issue the SETROPTS RACLISTcommand for the class.

ICH14041I action of class class-name ignored. Theclass is not active yet.

Explanation: The SETROPTS command was issuedwith the RACLIST or RACLIST REFRESH operandsspecified. However, the class indicated in the messageis not active.

System action: SETROPTS RACLIST processing is notdone for the class.

User response: Activate the class, then issue theSETROPTS RACLIST command.

ICH14042I action of class class-name ignored. Theclass has been marked for de-activation.

Explanation: The SETROPTS command was issuedwith the NOCLASSACT and RACLIST operandsspecified.


User response: You cannot specify both theNOCLASSACT operand and the RACLIST operand forthe same class. Correct the command, then try again.

ICH14043I Invalid character character specified inthe userid for operand. Operand ignored.

Explanation: The user ID specified on theJES(NJEUSERID) or JES(UNDEFINEDUSER) operandcontained an invalid character.

System action: RACF ignores the JES sub-operandindicated in the message.

User response: Change the user ID specified in thecommand and try again.

ICH14044I Userid userid specified for operandalready exists. Please try another userid.

Explanation: The user ID specified on theJES(NJEUSERID) or JES(UNDEFINEDUSER) operand isalready a RACF-defined user.

System action: RACF ignores the JES sub-operandindicated in the message.

User response: Change the user ID specified in thecommand and try again.

ICH14045I RACXTRT macro for operand failed.

Explanation: While processing the SETROPTScommand, RACF issued the RACXTRT macro, and anerror occurred.

System action: Command processing terminates.

System programmer response: See “ProblemDetermination”.

User response: Report the exact text of this message,and of message ICH14046I, to your systemprogrammer.

Problem determination: See message ICH14046I,which is issued with this message, for the return andreason codes for the RACXTRT macro. For adescription of these return and reason codes, seeRACROUTE. You should also consider checking anyrelated installation exit for a possible error.

ICH14046I Return code is return-code, reason code isreason-code.

Explanation: This message follows messageICH14045I, and includes additional problemdetermination information for the error that causedmessage ICH14045I.


User response: See message ICH14045I.

ICH14047I Return code from RACROUTE macro isreturn-code.

Explanation: This message follows message ICH14045Iand includes additional problem determinationinformation for the error that caused messageICH14045I. Various RACF macros are invoked byRACROUTE. If either the RACROUTE interface or thecalled macro fails, the RACROUTE macro returns itsown return code as well as the return and reason codesof the called macro. For example, if the RACROUTEreturn code is 4, and the called-RACLIST return andreason codes are 0, this means that the class is not inthe router table and the RACLIST processing was notdone.


ICH14040I • ICH14047I


User response: See message ICH14045I.

ICH14048I Security level name security-level-name isnot defined to RACF.

Explanation: An incorrect security level name wasentered on a SETROPTS ERASE-ON-SCRATCH BYSECLEVEL or SETROPTS SECLEVELAUDIT option.

System action: The system prompts the user to reenterthe command.

User response: Check the spelling of the valuespecified for the security-level name and reenter thecommand.

ICH14049I The PRIMARY sub-operand wasignored. value is not a valid languagecode.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.

Note that the SETROPTS command was issued withthe PRIMARY sub-operand of the LANGUAGEoperand specified and RACF is not running underMVS/ESA SP 4.1 or later.

System action: The installation default for thePRIMARY language is not changed. Processingcontinues with the next operand or sub-operand.

User response: Issue the SETROPTS command againwith a valid language code specified.

ICH14050I The PRIMARY sub-operand wasignored. The MVS message service isnot active.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because the MVSmessage service is not active.

Note that the SETROPTS command was issued withthe PRIMARY sub-operand of the LANGUAGEoperand specified and RACF is running underMVS/ESA SP 4.1 or later.



ICH14051I The PRIMARY sub-operand wasignored. The specified language is notactive.


The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because none ofthe languages active under the MVS message serviceare known, to the MVS message service, by thespecified name.



User response: Issue the SETROPTS command againwith a valid language code or language name specified.

ICH14052I The SECONDARY sub-operand wasignored. value is not a valid languagecode.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.

Note that the SETROPTS command was issued withthe SECONDARY sub-operand of the LANGUAGEoperand specified and RACF is not running underMVS/ESA SP 4.1 or later.

System action: The installation default for theSECONDARY language is not changed. Processingcontinues with the next operand or sub-operand.


ICH14053I The SECONDARY sub-operand wasignored. The MVS message service isnot active.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because the MVSmessage service is not active.

Note that the SETROPTS command was issued withthe SECONDARY sub-operand of the LANGUAGEoperand specified and RACF is running underMVS/ESA SP 4.1 or later.



ICH14048I • ICH14053I


ICH14054I The SECONDARY sub-operand wasignored. The specified language is notactive.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because none ofthe languages active under the MVS message serviceare known, to the MVS message service, by thespecified name.



User response: Issue the SETROPTS command againwith a valid language code or language name specified.

ICH14055I The PRIMARY sub-operand wasignored. QRYLANG failed with returncode xxxx and reason code yyyy.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because an errorcondition occurred when the QRYLANG macro of theMVS message service was executing. The return code isindicated by xxxx. The reason code is indicated byyyyy.


System action: The system-wide default for thePRIMARY language is not changed. Processingcontinues with the next operand or sub-operand.

System programmer response: See MVS/ESAApplication Development Reference for a description ofreturn codes and reason codes for the QRYLANGmacro.

User response: Report the complete text of thismessage to your system programmer.

ICH14056I The SECONDARY sub-operand wasignored. QRYLANG failed with returncode xxxx and reason code yyyy.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the required

language code could not be obtained because an errorcondition occurred when the QRYLANG macro of theMVS message service was executing. The return code isindicated by xxxx. The reason code is indicated byyyyy.


System action: The system-wide default for theSECONDARY language is not changed. Processingcontinues with the next operand or sub-operand.



ICH14057I ALGORITHM(KDFAES) cannot beactivated.

Explanation: Password/passphrase algorithmKDFAES has been requested but it cannot be activatedbecause the hardware MSA (message-security assist)feature is not enabled.


System programmer response: The MSA featureshould be enabled on all IBM processors capable ofrunning this version of RACF/VM. Contact IBMhardware support for assistance in determining whythis feature is disabled.


ICH14058I request of class classname encountered adata space problem. Return code isreturn-code, reason code is reason-code.

Explanation: The SETROPTS command processorencountered a problem creating a data space, deleting adata space, or moving data into a data space. Therequest can be one of the following:

RACLIST

RACLIST REFRESH

NORACLIST.

System action: If this message is preceded byICH14031I, data-space processing is the reason thecommand failed. If not, the command completed inspite of the data-space problems. The return and reasoncodes can help the IBM support center determine thecause of the problem. In addition to issuing thismessage, the system may also have taken an SVCdump.

ICH14054I • ICH14058I


System programmer response: Perform problemdetermination.

User response: If the SETROPTS command failed,reissue it. If the problem recurs, report the exact text ofthis message to your system programmer.

Problem determination: Report the issuance of thismessage plus the exact wording of the SETROPTScommand you entered to your IBM support center.Have the return and reason codes, as well as the SVCdump if one was taken, available.

ReturnCode

ReasonCode

04 04 ALESERV ADD functionfailed

08 Data space too small

08 04 TCBTOKEN function failed

08 DSPSERV CREATE functionfailed

12 ALESERV ADD functionfailed

16 DSPSERV Delete failed

Note: These return codes and reason codes aredescribed in MVS/ESA Authorized AssemblerProgramming Reference, GC28-1857.

ICH14059I Class class-name was not activated by theSETROPTS CLASSACT(*) command.

Explanation: The SETROPTS CLASSACT(*) commandwas issued and the class indicated in the message has adefault return code of 8 in the class descriptor table.This class should be activated explicitly.

System action: The class indicated in the message was

not affected by the SETROPTS command.

System programmer response: See RACF Macros andInterfaces for an explanation of defining a class withshared POSIT values.

User response: If you want this class to be activated,ensure that profiles have been defined for this class,then use SETROPTS class-name to activate it.

If you do not want this class to be activated, issue aSETROPTS LIST command to ensure that the class wasnot activated by means of a shared POSIT value. If theclass has been activated, contact your systemprogrammer.

ICH14060I Incomplete specification of keywordkeyword. Keyword ignored.

Explanation: The syntax of the keyword keyword wasnot completely specified.

System action: The keyword is ignored by theSETROPTS command.

User response: Respecify the keyword with the correctsyntax.

ICH14083I Minimum change interval exceeds thepassword interval

Explanation: The value specified for MINCHANGEexceeds the installation-specified maximum set bySETROPTS PASSWORD(INTERVAL).



RACF Security Administrator Response: IssueSETROPTS LIST to check the current minimum andmaximum values and specify correct values.

RVARY Command Messages

ICH15001I REQUEST DENIED - RACFPERMANENTLY INACTIVE

Explanation: The RACF CVT (RCVT) indicates thatRACF is not active.


User response: Issue this command after RACFbecomes active (is initialized).

ICH15002I DATASET dsname ALREADY INREQUESTED STATE

Explanation: The user requested that the indicateddata set be made active and the data set is currentlyactive, or the user requested that the indicated data setbe made inactive and the data set is currently inactive.

System action: Command processing continues withthe next data set name in the list.

ICH15003I CHANGE TO RACF STATUS DENIEDBY OPERATOR

Explanation: The system operator's reply to messageICH701A was NO.

System action: A log record is written to SMF, andRACF terminates the command.

ICH15004I BACKUP DATASET CAN NOT BESWITCHED; dsname IGNORED

Explanation: The user requested that the indicateddata set be switched with its backup and the indicateddata set is currently a backup data set.

ICH14059I • ICH15004I



ICH15005I PRIMARY MASTER DATASETACTIVE; NOCLASSACT/NOTAPEOPERAND IGNORED

Explanation: The user specified either theNOCLASSACT operand or the NOTAPE operand andthe primary master data set is currently active.


ICH15006I DATASET dsname HAS NO BACKUP;DATASET NOT SWITCHED

Explanation: The user requested that the indicateddata set be switched with its backup and the indicateddata set currently has no backup.


ICH15007I CHANGES TO RACF STATUSDENIED. OPERATOR ENTEREDINCORRECT PASSWORD

Explanation: The operator entered an incorrectpassword in response to message ICH702A.

System action: The status of RACF remainsunchanged.

ICH15008I COMMAND PROCESSINGTERMINATED. ERRORENCOUNTERED DURINGPASSWORD ENCODING.

Explanation: To approve the user's issuance of theRVARY command, the operator must enter aninstallation- defined password. If RACF fails to encodethis password at the time the operator issues it, youreceive this message.



Programmer response: IPL again and try thecommand again.


ICH15009I ERROR ENCOUNTERED WHENATTEMPTING REQUESTEDOPERATION, OPERATION NOTPERFORMED.

Explanation: An error occurred during RVARYprocessing.





ICH15010I ERROR WHEN INVOKING RACFDATASET ALLOCATION/DEALLOCATION OPERATION, TRYAGAIN. IF THIS PROBLEM PERSISTS,CALL OPERATOR.

Explanation: An error occurred while attempting theallocation or deallocation of the RACF data set.





ICH15011I RVARY SWITCH DENIED. ALLREQUIRED BACKUP DATA SETSMUST BE ACTIVE BEFORE ISSUINGTHE SWITCH COMMAND.

Explanation: The RVARY SWITCH command wasissued when one or more of the data sets to beswitched was not active.



Programmer response: All backup data sets must beactive when attempting an RVARY SWITCH command.Activate the backup data sets (using the RVARYACTIVE command) and then switch.

ICH15012I RVARY SWITCH DENIED. YOU MUSTSPECIFY ALL PRIMARY DATA SETSWHEN THE PRIMARY DATA SETFORMAT DIFFERS FROM THEBACKUP DATA SET FORMAT.

Explanation: The RVARY SWITCH command wasissued when the primary data set format was differentfrom the backup data set format. When data setformats differ for primary and backup data sets, thecomplete set of data sets must be switched; otherwise amixed-format condition occurs.



Programmer response: When the formats differ, all

ICH15005I • ICH15012I


data sets must be specified when attempting an RVARYSWITCH. Specify all data sets and then switch.

ICH15013I RACF DATABASE STATUS:

Explanation: This message begins a display of RACFdatabase status information in response to issuing theRVARY LIST command, or any RVARY command inwhich the NOLIST operand is not in effect.

System action: None

Operator response: None.

System programmer response: None.

Destination: Descriptor code 6. Routing code 2.

ICH15014I INVALID KEYWORD ENCOUNTEREDFOR RVARY

Explanation: This message is displayed when aninvalid keyword was encountered during processing ofthe RVARY command from an MVS operator's console.

System action: none

Operator response: none.

System programmer response: none.

Destination: Descriptor code 6. Routing code 2.

ICH15015I SETROPTS RACLIST (class-name)REFRESH MUST BE ISSUED BEFOREATTEMPTING TO USE THERACLISTED PROFILES IN THISCLASS.

Explanation: The RVARY command changed theallowable maximum length for profile names in thisclass. As a result, the RACLISTed profiles in this classare no longer valid.

System action: Command processing continues.

User response: Issue the SETROPTSRACLIST(class-name) REFRESH command for thespecified class.

ICH15016I ANY LOCALLY RACLISTED CLASSESWHOSE PROFILE NAMES CAN BEGREATER THAN 39 CHARACTERSMUST BE REFRESHED BEFORE THERACLISTED PROFILES IN THEM CANBE USED AGAIN.

Explanation: The RVARY command changed theallowable maximum length for profile names. As aresult, profiles in any locally RACLISTed classes mayno longer be valid.

System action: Command processing continues.

User response: Classes locally RACLISTed (usingRACROUTE REQUEST=LIST) whose profile names canbe greater than 39 characters must be refreshed.

ICH15043A THE RVARY COMMAND WILL NOTBE PROPAGATED TO THE OTHERRUNNING SERVER(S), TYPE Y TOCONTINUE OR ANY OTHERRESPONSE TO CANCEL.

Explanation: Using a RACF command session to issuean RVARY will not propagate the command to anyother connected RACF servers.

User response: If you respond with Y then thecommand is executed and RVARY commandpropagation is disabled on this system. If you cancelthe command you may issue the RVARY using theRAC command to have it propagated to all connectedservers.

ALTGROUP Command Messages

ICH20002I NOT AUTHORIZED TO ALTERgroup-name

Explanation: You do not have sufficient authority toalter the group indicated in the message.



ICH20003I NOT AUTHORIZED TO SPECIFYOWNER

Explanation: You do not have sufficient authority tospecify the OWNER operand.

System action: Processing continues with the ownerfield unchanged.


ICH20004I ERROR FOUND IN GROUP TREESTRUCTURE

Explanation: An inconsistency or error was found inthe group tree structure while processing theALTGROUP command.


User response: Use the LISTGRP command to listgroups in the superior group tree structure, looking inparticular for disagreements between superior groupsand subgroups.

ICH20005I

Explanation: You do not have sufficient authority tochange the superior group indicated in the message.


ICH15013I • ICH20005I



ICH20006I xxxxxxxx CANNOT BE A SUPERIORGROUP OF yyyyyyyy

Explanation: The command requested that groupxxxxxxxx be made the superior group of yyyyyyyy.However, group yyyyyyyy is already above groupxxxxxxxx in the group hierarchy and the result wouldbe a circular definition that is invalid.

System action: The subgroup list for group xxxxxxxxis not changed. RACF terminates the command.

ICH20007I

Explanation: An error occurred while altering theTERMUACC or NOTERMUACC operand for the groupindicated in the message. The TERMUACC andNOTERMUACC indicators in the group profile andconnect entries are not updated.


ICH20008I FOR [USER userid | ANY USERS]

Explanation: An error occurred while either retrievingthe access list of all users connected to the group(indicated by ANY USERS), or altering theTERMUACC or NOTERMUACC indicator in theconnect profile for a user (indicated by USER userid).

System action: In either case, the TERMUACC orNOTERMUACC indicator in the group profile wasaltered to the value specified on the command. If theerror occurred while retrieving the access list, thecommand is terminated. If the error occurred whilealtering a particular user's connect profile, commandprocessing continues with the next user ID in the accesslist.

ICH20009I group-name NOT ALTERED,PROGRAMMING LIMIT EXCEEDED

Explanation: While searching the index structure forthe superior group of the group specified, more than398 superior groups were found. This exceeds theRACF command limit.

System action: RACF ignores the SUBGROUPoperand. Command processing continues with the nextoperand.

ICH20010I NOT AUTHORIZED TO ISSUEALTGROUP

Explanation: You are not defined to RACF withsufficient authority and cannot issue the ALTGROUPcommand, or RACF is not active.









v The message ID




Explanation: As issued, the ALTGROUP commandbegan to update more than one profile in the RACFdatabase. However, a system or RACF failure occurredduring command processing.




ICH20013I group-name NOT ALTERED -or-GROUP(S) NOT ALTERED

Explanation: An error occurred during ALTGROUPcommand processing.

System action: The group indicated in the messagewas not altered.

ICH20014I OWNER NOT ALTERED FORgroup-name

Explanation: An error occurred while processing theowner field specified in the OWNER operand.

System action: RACF does not alter the owner field.Command continues processing with the next operand.

ICH20006I • ICH20014I


ICH20015I SUPGROUP NOT ALTERED FORgroup-name

Explanation: An error occurred while processing thesuperior group field specified in the SUPGROUPoperand.

System action: The superior group field is not alteredand the command continues processing with the nextoperand.

ICH20016I NOT AUTHORIZED TO SPECIFY THEDATA OR NODATA KEYWORDS

Explanation: You do not have sufficient authority toalter the installation- defined data in the group profile.



ICH20017I NOT AUTHORIZED TO SPECIFY THEMODEL OR NOMODEL KEYWORDS

Explanation: You do not have sufficient authority tospecify the MODEL or NOMODEL operand on theALTGROUP command.



ICH20018I WARNING, UNABLE TO LOCATE THEMODEL PROFILE FOR dsname

Explanation: You have specified a model profile dataset name that cannot be found on the RACF database.For modeling to be effective for this data set name, adata set profile must first be created.

System action: RACF adds the data set name youspecified to the group profile in anticipation that profileinformation for this name will be completed (using theADDSD command) at a later time.

RACF continues to process the ALTGROUP command.

ICH20019I UNABLE TO LOCATE group-name

Explanation: The group indicated in the message

could not be found in the RACF database.

System action: Command processing continues withthe next group name in the list.

ICH20020I OWNER-GROUP AND SUPERIORGROUP MUST BE THE SAME FORGROUP group-name

Explanation: When the owner of a group is anothergroup, the owning group and the superior group mustbe the same. This message is followed by messageICH20014I or message ICH20015I, or both.

ICH20021I NOT AUTHORIZED TO ALTERSEGMENT FOR GROUP group-name

Explanation: You are not authorized to change thesegment for the specified group.

System action: Command processing ends with noupdate to the group profile.

User response: See your RACF security administratorfor authority to the segment of this group profile.

RACF Security Administrator Response: You can usefield-level access checking to allow this user to addsegment information. For a description of field-levelaccess checking, see RACF Security Administrator'sGuide.

ICH20022I DFP SEGMENT NOT ALTERED FORGROUP group-name

Explanation: You are not authorized to change theDFP segment for the specified group.

System action: Command processing terminates withno update to the group profile.


RACF Security Administrator Response: You can usefield-level access checking to allow this user to addDFP segment information. For a description offield-level access checking, see RACF CommandLanguage Reference.

ALTUSER Command Messages

ICH21001I COMMAND ENDED DUE TO ERRORUNABLE TO PROMPT FOR OIDCARD

Explanation: You specified the OIDCARD operand,but TSO/E was unable to prompt you to enter theoperator identification card.


User response: Be sure you are executing thecommand in the foreground and in prompt mode.

ICH21002I COMMAND ENDED DUE TO ERRORUNABLE TO ESTABLISH ESTAE




ICH20015I • ICH21002I



v The message ID



ICH21003I COMMAND ENDED DUE TO ERRORPUTGET ERROR RETURN CODE IS xx

Explanation: You specified the OIDCARD operand,but the TSO/E PUTGET service routine failed with areturn code indicated by xx while trying to read theoperator identification card. For an explanation of thereturn code, (which is described in the PUTGETspecifications), see one of the following:


v If TSO/E is installed, see one of the following: TSOExtensions Guide to Writing a Terminal Monitor Programor a Command Processor or TSO ExtensionsProgramming Services For the order number of thebook you need, see the TSO Extensions GeneralInformation

ICH21004I

Explanation: An error occurred during RACFprocessing.

System action: If a user ID appears in the message,the user profile was not changed. If USER appears, theerror occurred before a particular user ID could bedetermined. Otherwise, the DFLTGRP or OWNERfields were not altered.


v If DFLTGRP appears in the message, the userspecified on the ALTUSER command was not alreadyconnected to the group specified on the DFLTGRPoperand. Use the CONNECT command to connectthe user to the group (with the desired groupauthority), then issue the ALTUSER command withDFLTGRP specified again.

v If OWNER appears in the message, there is noprofile (user or group, as appropriate) for the ownerspecified on the ALTUSER command.

ICH21005I NOT AUTHORIZED TO SPECIFYoperand, OPERAND IGNORED

Explanation: You do not have sufficient authority tospecify the indicated operand.



ICH21006I AUTHORITY SPECIFIED GREATERTHAN THE COMMAND USER

Explanation: You have CONNECT authority andcannot specify JOIN authority. The other operands weremodified.


ICH21007I (EXPIRED, NOEXPIRED) OPERANDIGNORED

Explanation: On of the following situations occurred:

v You specified the NOEXPIRED operand but neitherthe PASSWORD or PHRASE operand is specified onthe command. NOEXPIRED is valid only if specifiedwith the PASSWORD or PHRASE operand.

v You specified the EXPIRED operand with both theNOPASSWORD and NOPHRASE operands.


ICH21008I

Explanation: You do not have sufficient authority tospecify the CLAUTH or NOCLAUTH operands for theindicated class.

System action: RACF ignores the class and continuescommand processing with the next class specified.


ICH21009I UNABLE TO LOCATE userid

Explanation: The indicated user ID could not befound in the RACF database.


ICH21010I NOT AUTHORIZED TO ISSUEALTUSER

Explanation: You are not defined to RACF withsufficient authority and, therefore, cannot issue theALTUSER command; or RACF is not active.




ICH21011I

Explanation: An error occurred during ALTUSERcommand processing.

System action: The AUTHORITY or UACC fields arenot altered.

ICH21003I • ICH21011I


ICH21012I AUTHORIZED TO ISSUE ONLYUAUDIT/NOUAUDIT FOR userid;REMAINING OPERANDS IGNORED

Explanation: You specified operands in addition toUAUDIT or NOUAUDIT, but for the indicated user ID,you are only authorized to specify the UAUDIT orNOUAUDIT operands.

System action: All operands other than UAUDIT orNOUAUDIT are ignored.


ICH21013A ENTER OPERATOR IDENTIFICATIONCARD

Explanation: You have specified the OIDCARDoperand. This message is requesting that you enter theoperator identification card for the user being altered sothat the information on it can be put into the user'sprofile.

System action: Command processing waits for you toenter the operator identification card.

ICH21014I COMMAND ENDED DUE TO ERRORTERMINAL TYPE NOT SUPPORTED

Explanation: You specified the OIDCARD operand,but when the operator identification card was entered,it could not be verified because it was entered on aterminal that is not supported.

System action: The ALTUSER command is terminated.

ICH21015I CLASS class-name AND REMAININGCLASSES NOT ALTERED FORCLAUTH/NOCLAUTH

Explanation: The indicated class and all remainingclass names in the CLAUTH/NOCLAUTH list werenot added to or deleted from the list of authorizedclasses in the user profile because an error occurred inthe RACF manager.

System action: A RACF-manager error messageprecedes this message and explains the error. Otheroperands on the command have been processed.

ICH21016I PASSWORD CHANGE FOR ‘id’SUPPRESSED BY INSTALLATIONPASSWORD EXIT

Explanation: The proposed password, as specified inthe PASSWORD operand on the ALTUSER command,does not obey the syntax rules of the installation.(These rules were specified by the PASSWORDkeyword, RULEn option, on the SETROPTS command.)


User response: See your RACF security administratorfor the rules regarding new passwords.

ICH21017I NOT AUTHORIZED TO SPECIFYMODEL/NOMODEL, OPERANDIGNORED

Explanation: You do not have sufficient authority tospecify MODEL or NOMODEL on the ALTUSERcommand.



ICH21018I WARNING, UNABLE TO LOCATE THEMODEL PROFILE FOR dsname

Explanation: You have specified a model profile dataset name that cannot be found on the RACF database.For modeling to be effective for this data set name, adata set profile must first be created.

System action: RACF adds the data set name youspecified to the user profile in anticipation that profileinformation for this name will be completed (using theADDSD command) at a later time. RACF continues toprocess the ALTUSER command.

ICH21019I ‘RESUME’ IGNORED. userid NOTCURRENTLY REVOKED

Explanation: The indicated user ID is not currentlyrevoked.

System action: RACF ignores the specification of afuture date with the RESUME operand.

ICH21020I category ALREADY DEFINED TOprofile-name

Explanation: The specified category has already beendefined in this profile.

System action: RACF ignores the category andcontinues command processing with the next operand.

ICH21021I category NOT DEFINED TO profile-name

Explanation: Because the specified category has notbeen defined in this profile, RACF cannot delete it.

System action: RACF ignores the category andcontinues command processing with the next operand.

ICH21022I ‘REVOKE’ IGNORED. userid ISCURRENTLY REVOKED

Explanation: REVOKE was specified with a date, butthe user is already revoked.

System action: RACF ignores REVOKE processingand continues command processing with the nextoperand.

ICH21012I • ICH21022I







ICH21026I NOT AUTHORIZED TO SPECIFIEDFIELD(S) IN segment-name SEGMENT

Explanation: You are not authorized to update thefields specified on the ALTUSER command in segmentsegment-name.

System action: Command processing terminates withno update to the RACF database.



ICH21027I COMMAND PROCESSINGCOMPLETED BUT UNABLE TOUPDATE ‘SYS1.BRODCAST’.

Explanation: The command you issued has beencompleted; however, your attempt to change theTSO/E data set SYS1.BRODCAST has failed.

ICH21028I segment-name OPERAND NOTPROCESSED

Explanation: You are not authorized to change thespecified segment.

System action: None of the operands for this segmentare processed.

User response: See your RACF security administratorfor authority to this segment.

ICH21029I CONFLICT BETWEEN SIZE ANDMAXSIZE. OPERAND IS IGNORED.

Explanation: The SIZE and MAXSIZE operands differ.

System action: Both operands are ignored.

ICH21030I SIZE SPECIFIED GREATER THANMAXSIZE. SIZE ADJUSTED EQUALTO MAXSIZE.

Explanation: The specified size is greater than themaximum allowable size, as specified on the MAXSIZEoperand.

System action: RACF adjusts the size to equal theMAXSIZE operand.

User response: You can adjust the SIZE and MAXSIZEoperands using the ALTUSER command.

ICH21031I ALTUSER failed. NOSECLABEL is notallowed under the current RACFoptions.

Explanation: NOSECLABEL operand was specified onthe ALTUSER command, and SETROPTS MLACTIVE ison.



ICH21032I ALTUSER failed. SECLABELseclabel-name is not currently defined toRACF.



User response: Check the spelling of the valuespecified on the SECLABEL operand. If it is correct,define a profile of that name in the SECLABEL class. Ifyou cannot define such a profile, report the exact textof this message to your RACF security administrator.

ICH21033I ALTUSER failed. User is not connectedto group group-name

Explanation: The indicated group name was specifiedin the DFLTGRP operand, but the user is not yetconnected to the group.

System action: The command continues, but theDFLTGRP is not updated in the user profile.

User response: Correct the DFLTGRP operand, or usethe CONNECT operand to connect the user to thespecified group name and issue the command again.

ICH21034I PASSWORD CHANGE REJECTED BYINSTALLATION SYNTAX RULES

Explanation: You specified a potential password thatdoes not adhere to the syntax rules that are in effect foryour installation.


ICH21023I • ICH21034I


User response: See your RACF security administratorfor the syntax rules for passwords.

ICH21036I PASSWORD CHANGE REJECTED DUETO INSTALLATION MINIMUMCHANGE INTERVAL

Explanation: The ALTUSER command has detectedthat an insufficient number of days has passed sinceyour last password change.


User response: Contact your security administrator todetermine your installation's minimum passwordchange interval, and to reset your password if it hasbeen compromised.

ICH21038I PASS PHRASE CHANGE REJECTEDBY INSTALLATION PASS PHRASEEXIT

Explanation: The proposed password phrase, asspecified in the PHRASE operand on the ALTUSERcommand has been rejected by the installationpassword phrase exit, ICHPWX11.









v Must be enclosed in single quotes, with single quoteswithin the password phrase doubled




ICH21042I operand OPERAND IGNORED

Explanation: You specified an operand which is nolonger supported by the ALTUSER command.


ICH21043I {PWCLEAN|PWCONVERT} REJECTEDFOR USER userID DUE TO ACONCURRENT PASSWORD CHANGEBY ANOTHER TASK.

Explanation: The ALTUSER command attempted toclean or convert the password or password phrasehistory for the specified user. Between the time thehistory was read from the user's profile and the timethe modified history was being written back to theprofile, the user's password or password phrase waschanged by another user. Storing the cleaned orconverted history array would result in the loss of thenew history entry that the other change created.

System action: The history is not updated in theuser's profile.

User response: Reissue the ALTUSER command.

ICH21044I PWCONVERT encountered internalerror error-code and diagnostic code1=diag-code1 and code 2=diag-code2 whileprocessing user userID.

Explanation: An internal error occurred during anattempt to process the PWCONVERT keyword.


System programmer response: Report this message tothe IBM support center.


ICH21036I • ICH21044I


ALTDSD Command Messages


Explanation: The profile indicated in the message isnot defined to RACF and cannot be altered.

System action: Processing continues with the nextprofile name.

Note: If you enter the ALTDSD command for a fullyqualified generic profile (one whose name has nogeneric characters), but you do not specify theGENERIC operand, RACF issues this message. Thisoccurs because, without the GENERIC operand, RACFlooks for a discrete profile of that name. For example, ifthere is a fully qualified generic profile namedABC.DATA, and you enter the following command:

ALTDSD ’ABC.DATA’


ALTDSD ’ABC.DATA’ GENERIC

ICH22002I NOT AUTHORIZED TO SPECIFYOWNER

Explanation: You do not have sufficient authority tospecify the OWNER operand.

System action: The owner field is not changed.Processing continues with the next operand of theALTDSD command.


ICH22003I NOT AUTHORIZED TO ISSUEALTDSD

Explanation: You are not defined to RACF and cannotissue the ALTDSD command, or RACF is not active.





Explanation: A RACF-manager error occurred. Thismessage is accompanied by a message explaining theerror.

ICH22005I NOT AUTHORIZED TO ALTERprofile-name

Explanation: You are not authorized to change theindicated profile.

System action: The profile is not altered. Processingcontinues with the next profile.

User response: See the owner of the profile or yourRACF security administrator. To display the owner ofthe profile, use the LISTDSD command.

ICH22006I OWNER SPECIFIED NOT DEFINEDTO RACF

Explanation: The user ID or group name specified onthe OWNER operand is not a RACF-defined user.


ICH22007I OWNER SPECIFIED NOTAUTHORIZED TO GROUP

Explanation: The user ID specified on the OWNERoperand does not have sufficient authority to the groupwhose name is the first level qualifier of the data setbeing altered.



ICH22008I ADDVOL/DELVOL NOT ALLOWEDFOR VSAM/MODEL DATASET

Explanation: The ADDVOL and DELVOL operandsapply only to non-VSAM data sets.

System action: The ADDVOL or DELVOL operand isignored. Command processing continues with the nextoperand.

ICH22009I VOLUME SPECIFIED ALREADYEXISTS IN DATASET PROFILE

Explanation: The ADDVOL or ALTVOL operand wasspecified which requests a volume to be added to thedata set profile but the volume already exists in theprofile.

System action: RACF terminates processing for theADDVOL or ALTVOL operand.

ICH22010I VOLUME SPECIFIED DOES NOTEXIST IN DATASET PROFILE

Explanation: The DELVOL or ALTVOL operand wasspecified which requests a volume to be deleted fromthe data set profile but the volume does not exist in theprofile.

System action: RACF terminates processing for the

ICH22001I • ICH22010I


DELVOL or ALTVOL operand.

ICH22011I VOLUME SPECIFIED IS LASTVOLUME IN DATASET PROFILE. NOCHANGE MADE

Explanation: The DELVOL operand was specifiedwhich requested that the last volume be deleted fromthe data set profile. This is not a valid request for theALTDSD command.

System action: Processing for the DELVOL operand isterminated.

ICH22012I NOT AUTHORIZED TO SPECIFYNOSET/ALTVOL

Explanation: You do not have sufficient authority tospecify the NOSET or ALTVOL operand.

System action: The NOSET, ADDVOL, ALTVOL, andDELVOL operands are ignored.


ICH22013I ADDVOL/DELVOL NOT PROCESSED

Explanation: While adding or deleting a volume, thecommand processor could not establish the requiredESTAE recovery environment. Other operands havealready been processed.



v The message ID



ICH22014I NOT AUTHORIZED TO SPECIFYGLOBALAUDIT FOR profile-name;OPERAND IGNORED

Explanation: You do not have sufficient authority tospecify the GLOBALAUDIT operand for the indicatedprofile name.

System action: RACF ignores the operand for theindicated profile name.


ICH22015I AUTHORIZED TO ISSUE ONLYGLOBALAUDIT FOR profile-name;REMAINING OPERANDS IGNORED

Explanation: You do not have sufficient authority tospecify any operand except GLOBALAUDIT for theindicated profile name.

System action: RACF ignores all other operands forthe indicated profile name.


ICH22016I VOLUME SPECIFIED ALREADYEXISTS IN ANOTHER PROFILE FORSAME DATASET NAME

Explanation: An ADDVOL or ALTVOL request wasspecified, but the volume serial number to be added tothe data set profile specified is already defined inanother data set profile of the same name.

System action: The volume serial number is notadded.

ICH22017I ALTVOL PROCESSING ENDED DUETO ERROR

Explanation: While processing the ALTVOL operand,the command processor encountered an error whichcaused processing to be terminated. Other operandshave already been processed.

ICH22018I INSTALLATION EXIT FAILED ALTERREQUEST FOR profile-name

Explanation: The command preprocessing exit routineICHCNX00 issued a return code of 4, indicating thatRACF should fail the ALTDSD request for the profilename indicated in the message.

System action: The command terminates.


ICH22020I GENERIC INVALID, GENERICCOMMAND PROCESSING NOTACTIVE

Explanation: Because the generic command processingfacility is inactive, the GENERIC operand is invalid.


ICH22021I category ALREADY DEFINED TOprofile-name.

Explanation: The specified category has already beendefined in this profile.

System action: RACF ignores the category. Commandprocessing continues with the next operand.

ICH22022I category NOT DEFINED TO profile-name.

Explanation: The specified category has not beendefined in this profile; therefore, deletion is impossible.

System action: RACF ignores the category. Commandprocessing continues with the next operand.

ICH22011I • ICH22022I


ICH22023I ‘NOTIFY IGNORED’ SPECIFIED USERIS NOT DEFINED TO RACF

Explanation: The user ID specified for the NOTIFYoperand is not a RACF-defined user ID.


ICH22024I NOT AUTHORIZED TO USE VOLUMEvolume

Explanation: You do not have allocation authority tothe volume specified.



ICH22025I UNABLE TO LOCATE TAPE VOLUMEFOR TAPE DATA SET dsname

Explanation: The tape volume profile named in theindicated tape data set profile could not be located.This error indicates a problem with the RACF database.



Problem determination: Do the following:

1. Use the LISTDSD command to display profiledsname. In the LISTDSD output, check the VOLUMEON WHICH DATASET RESIDES and UNIT fieldsfor a possible error.

2. If no error is apparent in the LISTDSD output, usethe RLIST command to display the profile named inthe VOLUME ON WHICH DATASET RESIDESfield. Check the output of the RLIST command for apossible error.

ICH22026I UNABLE TO LOCATE TAPE VOLUMEENTRY FOR TAPE DATA SET dsname

Explanation: A TVTOC entry could not be locatedafter a discrete profile for the tape data set indicated bydsname was found. RACF searched for a TVTOC entryin one of the following places:

v The TVTOC of the volume specified in the ADDVOLor DELVOL operand of the ALTDSD command

v The TVTOC of the volume specified in the data setprofile, if ADDVOL and DELVOL were not specifiedon the ALTDSD command and this is a tape data set.


User response: Do one of the following:

v If ADDVOL or DELVOL was specified on theALTDSD command, check the spelling of the volumespecified on the ADDVOL or DELVOL operands. If

the spelling is correct, check that the volumespecified actually contains part of the data setspecified.

v If ADDVOL and DELVOL were not specified on theALTDSD command, do the following:

1. Use the LISTDSD command to display profiledsname. In the LISTDSD output, check theVOLUME ON WHICH DATASET RESIDES andUNIT fields for a possible error.

2. If no error is apparent in the LISTDSD output,use the RLIST command to display the profilenamed in the VOLUME ON WHICH DATASETRESIDES field. Check the output of the RLISTcommand for a possible error.

ICH22027I ALTVOL OPERAND INCONSISTENTWITH TAPE DS PROFILE FOR DATASET profile-name.

Explanation: A tape data set profile was found whenan ALTVOL request was entered. RACF does notsupport ALTVOL processing for tape data sets.

System action: ALTVOL processing continues with thenext profile specified on the ALTDSD command.

ICH22028I TAPE DATA SET SPECIFIED NOTLAST ON VOLUME -ADDVOL/DELVOL IGNORED

Explanation: The ADDVOL or DELVOL operand wasentered for a tape data set that is not the last one onthe tape volume set.

System action: RACF ignores the operand. Commandprocessing continues with the next data set name.

ICH22029I TVTOC UPDATE FAILED.ADDVOL/DELVOL BYPASSED FORDATA SET PROFILE dsname

Explanation: When ADDVOL or DELVOL operandprocessing attempted to update the tape data set entryin the TVTOC of the TAPEVOL profile, aRACF-manager error occurred.

System action: RACF does not update the TVTOC.Command processing continues with the next data setname.

ICH22030I VOLSER LIST INCONSISTENT WITHADDVOL/DELVOL OPERAND FORTAPE DS dsname

Explanation: For ADDVOL, the VOLSER specified inthe command was found in the tape volume list. ForDELVOL, the VOLSER specified in the command wasnot found in the list.

System action: The ADDVOL/DELVOL operand forthis data set will be bypassed. Command processingcontinues with the next data set name.

ICH22023I • ICH22030I







ICH22032I NOT AUTHORIZED TO DFPSEGMENT FOR DATASET PROFILEprofile-name DATASET PROFILE NOTPROCESSED

Explanation: You specified the RESOWNER operandon the ALTDSD command, but you are not authorizedto the DFP segment for the specified data set profile.

System action: Command processing terminates withno update to the data set profile.

User response: See your RACF security administratorfor authority to the DFP segment of this profile.


ICH22033I DFP OPERAND NOT PROCESSED

Explanation: You are not authorized to alter theRESOWNER field of the specified data set profile.



ICH22034I ALTDSD failed. You are not authorizedto specify SECLABEL or NOSECLABEL.

Explanation: The SECLABEL operand was specifiedon the ALTDSD command and one of the followingconditions is true:

v The user did not have the SPECIAL attribute andSETROPTS SECLABELCONTROL was in effect.




ICH22035I ALTDSD failed. SECLABEL seclabel-nameis not currently defined to RACF.



User response: Check the spelling of the valuespecified on the SECLABEL operand. If it is correct,report the exact text of this message to your RACFsecurity administrator.

ICH22036I ALTDSD failed. NOSECLABEL is notallowed under the current RACFoptions.

Explanation: The NOSECLABEL operand wasspecified on the ALTDSD command and SETROPTSMLACTIVE is on.



ICH22037I ALTDSD failed. You are not authorizedto specify SECLABEL seclabel-name.

Explanation: To specify the security label indicated inthe message, you must have at least READ accessauthority to the SECLABEL profile indicated in themessage.



ICH22031I • ICH22037I


LISTUSER Command Messages

ICH30001I

Explanation: The indicated profile name could not befound on the RACF database.

System action: If a user profile cannot be located,processing continues with the next profile. If a group orconnect profile cannot be located, then an inconsistencyexists on the RACF database.

Problem determination: The RACF utility programsmay be needed to determine the inconsistency. Allinformation that is available is listed.

ICH30002I

Explanation: You do not have sufficient authority tolist the indicated user ID or to specify *.


User response: If you are attempting to list your ownuser ID, enter the LISTUSER command withoutoperands. Otherwise, see your RACF securityadministrator.

ICH30003I GROUP group-name USERCONNECTION NOT INDICATED

Explanation: The user profile being listed identifiesthe indicated group as a connected group, but thegroup profile does not reference the user. Aninconsistency exists on the RACF database.

Problem determination: The RACF utility programsmay be needed to determine the inconsistency. Allinformation that is available is listed.

ICH30010I NOT AUTHORIZED TO ISSUELISTUSER

Explanation: You are not defined to RACF and cannotissue the LISTUSER command, or RACF is not active.




ICH30011I NO USERS LISTED.

Explanation:

v You issued LISTUSER *, but you are not authorized tolist any users,

or

v You issued LISTUSER * segment-name NORACF, and nousers with the specified segment were found.

ICH30012I NO USER(S) LISTED. NORACFSPECIFIED AND NO OTHERSEGMENTS REQUESTED.

Explanation: RACF cannot list users when NORACFis specified. Listing users for other segments has notbeen requested.

System action: Command processing terminates withno output produced.

User response: If you specify NORACF, you mustspecify an operand that requests output, such as DFP,TSO/E, or DSNS.

ICH30013I NOT AUTHORIZED TO LISTsegment-name SEGMENTINFORMATION

Explanation: You are not authorized to list thespecified segment for the specified user.


User response: See your RACF security administratorfor authority to the specified segment of this userprofile.

RACF Security Administrator Response: See thecommand description in RACF Command LanguageReference for the authority required to list the indicatedsegment.

ICH30014I LISTUSER failed. Parameter list errordetected while translating a SECLABEL.

Explanation: An internal RACF error has beendetected.


System programmer response: Report this message toyour IBM support center.


ICH30015I This SECLABEL is not currently definedto RACF.

Explanation: The security label specified in the userprofile does not exist as a profile in the SECLABELclass.

System action: Command processing continueswithout listing the description of the security label.


ICH30001I • ICH30015I


SEARCH, SRDIR, and SRFILE Command Messages


Explanation: You are not defined to RACF and cannotissue the SEARCH command, or RACF is not active.




ICH31002I UNABLE TO OPEN CLIST DATASET,COMMAND TERMINATED

Explanation: SEARCH command processing SEARCHcould not open the specified CLIST data set.


ICH31003I MASK TOO LONG, COMMANDTERMINATED

Explanation: The character string specified on theMASK operand is longer than the maximum allowablelength for the profile name in the specified class. Forthe DATASET class, the maximum length is 44characters; for the DASDVOL and TAPEVOL classes,the maximum length is 6 characters; and for theTERMINAL class, the maximum length is 8 characters.


ICH31004I LIST AND CLIST OMITTED,COMMAND TERMINATED

Explanation: CLIST must be specified on the SEARCHcommand when NOLIST is specified.


ICH31005I NO ENTRIES MEET SEARCHCRITERIA

Explanation: One or more of the following occurred:

v There are no RACF profiles that meet the searchcriteria.

v You do not have sufficient authority to list theprofiles that match the search criteria.

ICH31006I CLIST DATA SET ORGANIZATION ISNOT SEQUENTIAL ORPARTITIONED. COMMANDTERMINATED.

Explanation: The CLIST data set for the SEARCHcommand must have either the physical sequential (PS)organization or the partitioned organization (PO). The

CLIST data set found does not have one of theseorganizations.


System programmer response: Make sure the CLISTdata set, userid.EXEC.RACF.CLIST, is either apartitioned data set or a sequential data set.

User response: See your system programmer.



ICH31008I CATEGORY category-name IGNORED

Explanation: The user does not have sufficientauthority to list the entries in the RACF data set for thesecurity category name specified on the command, orthe security category name does not exist.


ICH31009I FILTER STRING LONGER THANPROFILE NAMES

Explanation: A filter string was specified longer thanthe maximum allowable for a profile name in that class.


ICH31010I FILTER AND MASK BOTH SPECIFIED

Explanation: The FILTER operand is an alternative tothe MASK operand; they are mutually exclusive.


ICH31011I BLANK FOUND IN FILTER STRING

Explanation: The filter string cannot contain blanks.


ICH31012I CHARACTER FOUND AFTER ** INFILTER STRING

Explanation: Double asterisks must be the last(rightmost) characters in the filter string.


ICH31001I • ICH31012I


ICH31013I INVALID LEADING CHARACTER INFILTER STRING

Explanation: A character that is not allowed was usedto start a filter string.


ICH31014I INVALID USE OF ** IN FILTERSTRING

Explanation: Double asterisks can not be mixed withother characters within a qualifier.


ICH31015I INVALID USE OF * IN FILTERSTRING

Explanation: The asterisk is used incorrectly.


ICH31016I INVALID CHARACTER IN FILTERSTRING

Explanation: A character(s) that is not consideredvalid was specified in a filter string. Only alphanumericcharacters, a single asterisk (*), a double asterisk (**), orthe percent sign (%) are allowed.


ICH31017I FILTER QUALIFIER LENGTHINVALID FOR CLASS

Explanation: The specified filter string is too long. Thefilter string length must not exceed 44 characters for atape or DASD data set name. For general resourceclasses, the filter string must not exceed the lengthspecified in the class descriptor table.


ICH31018I INVALID FILTER STRING

Explanation: An error was detected in the specifiedfilter string.


ICH31021I NOT AUTHORIZED TO SPECIFYUSER userid

Explanation: You are not authorized to listinformation about the user specified by the USERoperand.


ICH31022I USER userid IS NOT DEFINED TORACF

Explanation: The user specified by the USER operandis not defined to RACF.


ICH31023I RACINIT WAS FAILED BY THEINSTALLATION EXIT ROUTINE

Explanation: RACINIT processing for the userspecified by the USER operand was failed by theinstallation exit routine.


ICH31024I THE ACCESS OF THE SPECIFIEDUSER HAS BEEN REVOKED

Explanation: RACINIT processing for the userspecified by the USER operand failed because theaccess of the user has been revoked.


ICH31025I USER ACCESS TO THE DEFAULTGROUP HAS BEEN REVOKED

Explanation: RACINIT processing for the USERspecified by the USER operand failed because thisuser's access to the default group has been revoked.


ICH31026I UNEXPECTED RETURN CODEreturn-code FROM RACINIT

Explanation: RACINIT processing for the userspecified by the USER operand failed with anunexpected return code.





User response: Check the spelling of the valuespecified on the SECLABEL operand. If it is correct,

ICH31013I • ICH31027I


report the exact text of this message to your RACFsecurity administrator.

LISTGRP Command Messages

ICH32002I NOT AUTHORIZED TO LIST BASEINFORMATION FOR GROUPgroup-name

Explanation: You do not have sufficient authority tolist the group profile indicated in the message.

System action: Command processing continues withthe next group specified.


ICH32004I NOT AUTHORIZED TO ISSUELISTGRP

Explanation: You are not defined to RACF withsufficient authority and cannot issue the LISTGRPcommand, or RACF is not active.




ICH32005I NO GROUPS LISTED

Explanation:

v You issued LISTGRP *, but are not authorized to listany groups,

or

v You issued LISTGRP * segment-name NORACF, and nogroups with the specified segment were found.


ICH32006I NOT AUTHORIZED TO DISPLAY DFPSEGMENT IN GROUP PROFILEgroup-name

Explanation: You are not authorized to display a DFPsegment.




ICH32007I NO SEGMENT REQUESTED

Explanation: You specified NORACF (which requestsno display for the RACF segment of a group profile),but did not specify any other segment (such as DFP).

System action: Command processing continues withno segment displayed.

User response: Either specify another segment to bedisplayed or omit the NORACF operand. Enter thecommand again.

LISTDSD Command Messages


Explanation: A RACF-manager error occurred. Thismessage is accompanied by a message explaining theerror.

ICH35002I NOT AUTHORIZED TO LISTprofile-name

Explanation: You do not have sufficient authority tothe profile indicated in the message and cannot list theprofile.

System action: Command processing continues withthe next profile.


ICH35003I NO RACF DESCRIPTION FOUND FORdsname

Explanation: No profile could be found in the RACFdatabase for the data set indicated in the message.

User response: If the LISTDSD command was issuedwithout the GENERIC operand, this message could beissued for a data set that is protected by a genericprofile. Issue the command again with the GENERICoperand.

ICH35004I NOT AUTHORIZED TO ISSUELISTDSD

Explanation: You are not defined to RACF and cannotissue the LISTDSD command, or RACF is not active.




ICH35005I NO DATASETS LISTED

Explanation: No data sets were found that you areauthorized to list.

ICH32002I • ICH35005I


ICH35006I INSTALLATION EXIT FAILED LISTREQUEST FOR profile-name

Explanation: The command preprocessing exit routineICHCNX00 issued a return code of 4, indicating thatRACF should fail the LISTDSD request for theindicated profile.

System action: Processing of the LISTDSD commandcontinues with the next profile specified.


ICH35007I NO RACF DESCRIPTION FOUND ONTHE SPECIFIED VOLUME(S) FORdsname

Explanation: The RACF database does not contain adiscrete profile for the indicated data set for any of thevolume serials given in the LISTDSD command.

ICH35008I NO DFP SEGMENT FOR DATASETPROFILE profile-name

Explanation: The RESOWNER operand was specifiedfor the LISTDSD command, but there is no DFPsegment information in the profile specified.


ICH35009I NOT AUTHORIZED TO LIST DFPSEGMENT FOR DATASET PROFILEdsname

Explanation: The RESOWNER operand was specified

for the LISTDSD command, but you are not authorizedto display the DFP segment for a data set profile.




ICH35010I No profile(s) listed. NORACF specifiedand no other information requested.

Explanation: You specified NORACF (which requestsno display for the RACF segment of a data set profile),but did not request any other output (such as anothersegment like the DFP segment or the DSNS operand).

System action: Command processing continues withno segment displayed.

User response: Either specify other output to be listed(such as the DFP or DSNS operand) or omit theNORACF operand. Enter the command again.

ICH35011I LISTDSD failed. Error encounteredduring catalog processing.

Explanation: LISTDSD DSNS was issued, but there areno cataloged data sets that are protected by thespecified profile.

System action: Command will execute, but no data setnames will be displayed.

Common Command Messages

ICH36001I CLASS class-name CANNOT BE USEDWITH A NON-RESTRUCTURED DATABASE.

Explanation: The specified class name class-namecannot be used as input to a RACF command.

System action: You will be prompted for a class nameuntil a valid class name is entered.

User response: Reply with a valid class name orcancel the command.

Other RACF MessagesThis section lists the messages issued by:v RACF command processors, when the messages reflect errors in the RACF

managerv Utility programsv BLKUPD utility commandv RACF report writerv Data security monitor.

RACF routes these messages to the user.

The format of these messages is:

ICH35006I • ICH36001I


ICHxxnnnt text

where:ICH identifies the message as a RACF message.xx identifies the function issuing the message.nnn is the message serial number.t is the type code (I = information, or A = action).text is the text of the message.

The values for the xx field that identifies the function issuing the message are:

xx Function/Program51 RACF manager (see “Note”)61 Cross-reference utility program (ICHUT100)

xx Function/Program62 RACF database verification utility program (ICHUT200)63 Block update (BLKUPD) utility command (ICHUT300)64 RACF report writer (RACFRW)65 RACF database split/merge utility program (ICHUT400)66 Data security monitor (DSMON)70 Miscellaneous.

Note: These common error messages are issued by the various RACF commandprocessors based on return codes from the RACF manager.

RACF Manager Error Messages

ICH51001I SVC 132 UNABLE TO INVOKEPROCESSING ROUTINE

Explanation: RACF was unable to invoke theappropriate processing routine (RACF manager,RACLIST) because of one of the following errors,whose code is returned in register 0:

Code Description0 Unable to establish ESTAE environment.1 The function code (third byte of parameter list)

does not represent a valid function.

ICH51002I NAME TO BE ADDED TO RACFDATA SET ALREADY EXISTS

Explanation: The user or group name that wasrequested to be added to the RACF database alreadyexists on the RACF database; for example, if youattempted to add user X, and group X already exists.

ICH51003I NAME NOT FOUND IN RACF DATASET

Explanation: A profile requested by the commanddoes not exist on the RACF database. If the commanddoes not issue a message giving the profile name, theRACF list commands (LISTDSD, LISTGRP, andLISTUSER) can be used to determine inconsistencies inprofiles associated with the command.

ICH51004I PARAMETER LIST ERROR DETECTED

BY RACF MANAGER

Explanation: The RACF manager has detected one ofthe following errors:

v Input parameter list error. The following codes arereturned in register 0:

Code Description1 Entry name (profile name) invalid2 Action specified for delete3 Invalid field name4 Test specified for rename request7 Entry type (profile type) incorrect.

v User work area not large enough to hold all the data.

v User work area smaller than minimum allowablesize.

ICH51005I ATTEMPT TO DELETE RESTRICTEDNAME DENIED BY RACF MANAGER

Explanation: An attempt was made to delete arestricted name.

ICH51006I ALTER IN PLACE REQUESTREJECTED BY RACF MANAGER

Explanation: The requested ALTERI operation isinvalid.

ICH51001I • ICH51006I


ICH51007I RACF DATA SET CANNOT BEALTERED. IT HAS BEEN EXTENDEDBY RACF UTILITY

Explanation: The RACF database is marked extendedand cannot be altered.

ICH51008I DUPLICATE DATASET NAME FOUNDBUT VOLUME NOT SPECIFIED

Explanation: In processing a data set request, theRACF manager found duplicate data set profiles in theRACF database and did not process the request becausethe VOLUME operand was not specified on therequest.

ICH51009I VOLUME NOT FOUND

Explanation: In processing a data set request, theRACF manager searched all the data set profiles thathave the name specified in the command. However, theRACF manager could not find the volume serialnumber that you specified in any of those profiles.

ICH51010I RACF DATASET ACCESS DENIED–RACF IS NOT ACTIVE OR THE RACFDATASET CONTAINING THEREQUESTED PROFILE NOT ACTIVE

Explanation: The RACF manager could not completethe requested operation because RACF is currently notactive.

ICH51011I RACF MANAGER PROCESSINGENDED DUE TO ERROR. RETURNCODE = return-code

Explanation: The RACF manager could not completethe requested operation because of a system error or aproblem with the RACF database. The return code is aRACF manager return code that is not recognized bythe command processor that invoked the RACFmanager.

Problem determination: If there is an error in theRACF database, the RACF manager issues messageICH401I, ICH405I, ICH406I, ICH407I or ICH411Ipreceding this message. See these messages forinformation on how to resolve the problem.

Note: On MVS, if the user is not receivingwrite-to-programmer messages, then message ICH401I,ICH405I, ICH406I, ICH407I or ICH411I will not bereceived. To receive these messages, issue the TSO/Ecommand PROFILE WTPMSG MSGID and rerun theRACF command or utility. (Messages ICH401I,ICH405I, ICH406I, ICH407I and ICH411I are alwayssent to the security console for use by the RACFadministrator.)Check the list of RACF-manager return codes in“RACF-Manager Return Codes” on page 265. If thereturn code is listed, the explanation should help youinvestigate the problem. If the return code is not listedor relates to a problem with RACF (as opposed to aproblem you can fix in the RACF database), report thecomplete text of this message to your IBM supportcenter.

For certain return codes, this message might be issuedbecause there is a bad profile in the RACF database. Tofind the bad profile, enter the SEARCH command. Witha bad profile in the database, this command is likely tofail also. The profile after the last one listed is probablythe bad profile. Because this command might take along time to run and might produce a many lines ofoutput, you might wish to execute the command inbatch.

ICH51012I RACF AUTHORITY DENIED BY FIELDLEVEL ACCESS CHECKING

Explanation: You do not have sufficient authority foraccess at the field level. The RACF database is notupdated.


RACF Cross-Reference Utility (ICHUT100) Messages

ICH61000I OPEN FAILED FOR DD ddn

Explanation: The RACF cross-reference utilityprogram was unable to open the data set specified bythe specified ddname.

System programmer response: To recover from theproblem, consider doing the following actions:

v On MVS, ensure that the DD statement is correct.

v On VM, ensure that the data set specified by theFILEDEF statement is on a minidisk that has beenformatted for an OS data set.

Problem determination: Check for other errors relatedto the disk pack on which the data set resides.

ICH61001I INVALID INPUT (80 character inputrecord)

Explanation: A name supplied as input to thecross-reference utility program has more than 8characters. The remaining records are scanned forerrors.

System action: The utility program terminates.

ICH61002I UNAUTHORIZED USER

Explanation: You are not defined to RACF or do nothave sufficient authority to run the cross-referenceutility program.

ICH51007I • ICH61002I



ICH61003I FOLLOWING NAMES NOTPROCESSED

Explanation: More than 1000 names were specified tothe cross-reference utility program.

System action: Those names over 1000 are listed andare not processed.

ICH61004I NO OCCURRENCES OF name

Explanation: The cross-reference utility program couldnot find the indicated name in the RACF database.

ICH61006I SYSIN CONTAINS NO VALID INPUT.

UTILITY TERMINATED

Explanation: The cross-reference utility program couldnot find valid input in SYSIN on MVS or in theRACUT100 SYSIN file on VM.

System action: The utility program terminates.

ICH61007I INSUFFICIENT AUTHORITY TO‘name’; NAME IGNORED

Explanation: You are not authorized to list anythingfor the user ID or group name specified.

System action: The name is ignored.


RACF Database Verification Utility (ICHUT200) Messages

ICH62001I UNABLE TO OPEN DD ddn -PROCESSING TERMINATED

Explanation: The verification utility program was notable to open the data set with the specified ddname.





This message is a WTO message with routing code 11and descriptor code 6.

ICH62002I UNABLE TO OPEN DD SYSUT1 -COPY FUNCTION BYPASSED

Explanation: The verification utility program was notable to open the SYSUT1 data set.

System action: The data set associated with DDSYSRACF has opened successfully and is used by theutility program.

ICH62003I UNABLE TO OPEN DD SYSRACF -SYSUT1 MUST CONTAIN RACF DATASET

Explanation: The verification utility program couldnot open the SYSRACF data set. The data set associatedwith DD SYSUT1 is assumed to contain a copy of theRACF database.

ICH62004I INSUFFICIENT STORAGE -PROCESSING TERMINATED

Explanation: A GETMAIN failed for the buffers and

work areas necessary for the verification utilityprogram to function. The request was for storage fromsubpool 0.

ICH62007I INVALID CONTROL STATEMENT

Explanation: The verification utility program foundthat the control statement contains a delimiter orcontents errors.

ICH62008I I/O ERROR - jjj, sss, ddd, devtyp, ddn,oper, err, xxxx, acc

Explanation: The verification utility programencountered a permanent I/O error while processingon device ddd. In the message text, the error analysisinformation provided by the SYNADAF datamanagement macro instruction issued by the SYNADroutine was:jjj Job namesss Step nameddd Unit address of the devicedevtyp Device typeddn Data definition nameoper Operation attemptederr Error descriptionxxxx Last seek address or block countacc Access method.

This message can be caused by unformatted space atthe end of the RACF database. Copying the RACFdatabase with utilities other than ICHUT400 can causeunformatted space.

System action: Utility processing terminates.

User response: Copy the database with ICHUT400 toformat the space.

ICH62009I EOF ON SYSIN - PROCESSINGTERMINATED

ICH61003I • ICH62009I


Explanation: On MVS, the verification utility programfound an end-of-file condition on the SYSIN data set.On VM, the utility found it in the RACVERFY FILE.

ICH62010I RACF DATA SET NOT FOUND -PROCESSING TERMINATED

Explanation: A failure occurred when the verificationutility program made a request to dynamic allocationfor information retrieval.

ICH62012I INSUFFICIENT STORAGE FOR MAPFUNCTION - REQUEST TERMINATED

Explanation: A GETMAIN failed for the storagerequired by the verification utility program to performthe map function. The request was for storage fromsubpool 0.

ICH62014I RBA OF TOP LEVEL INDEX BLOCK ISINVALID - PROCESSINGTERMINATED

Explanation: The verification utility program found anerror in the RBA (relative byte address) of the top levelindex block (in the ICB); either, (1) the last 4 bytes arezero, or (2) the first 2 bytes are not zero, or (3) the last10 bits are not zero (denoting an address not on a 1Kboundary).

ICH62015I RBA OF FIRST BAM BLOCK ISINVALID - MAP FUNCTIONTERMINATED

Explanation: The verification utility program found anerror in the RBA (relative byte address) of the firstBAM block (in the ICB); either, (1) the last 4 bytes arezero, or (2) the first 2 bytes are not zero, or (3) the last10 bits are not zero (denoting an address not on a 1Kboundary).

ICH62017I SEQUENCE SET CHAIN FIELD ISBROKEN

Explanation: In processing all the index blocks, theverification utility program keeps a count of level 01blocks. This count is used while processing thesequence set. While following the chain of level 01

blocks (sequence set), the utility program found a zerosequence set RBA (relative byte address) before thecount of level 01 blocks was reached.

ICH62018I PROGRAM LIMIT EXCEEDED -PROCESSING OF INDEX BLOCKSTERMINATED

Explanation: More than six levels of index blockswere found by the verification utility program.

System action: Index block processing is terminatedafter six levels have been processed. Level 01 blocks arenot processed.

ICH62019I UNABLE TO OPEN DD SYSUT1 FORREAD AFTER COPY FUNCTIONCOMPLETED - PROCESSINGTERMINATED

Explanation: The RACF database verification utilityprogram was not able to open the SYSUT1 data set forread after successfully copying the RACF database. TheRACF database is defined by the SYSRACF DDstatement on MVS and by the SYSRACF FILEDEF onVM.

ICH62021I UNABLE TO LOAD SYSUT1 -UNRECOVERABLE I/O ERROR ONDD SYSRACF - PROCESSINGTERMINATED

Explanation: While reading the blocks from the RACFdatabase defined by the SYSRACF DD statement onMVS or the FILEDEF statement in RACUT200 on VM,RACF encountered an unrecoverable error. MessageICH62008I precedes this message and describes the I/Oerror.

ICH62022I UNABLE TO LOAD CLASSDESCRIPTOR TABLE

Explanation: The verification utility program was notable to load the class descriptor table.

System action: The verification utility programcontinues processing general classes using their class IDnumbers instead of their class names.

Block Update (BLKUPD) Command (ICHUT300) Messages

ICH63001I INVALID COMMAND

Explanation: One of the following situations occurred:

v The command is unknown.

v The command is a subcommand of READ and wasentered without first entering the READ command.

v The command is a subcommand of READ orDISPLAY that attempts to update the RACFdatabase, but UPDATE was not specified on theREAD command.

v A READ (or DISPLAY) is in progress but thecommand entered is not a subcommand of READ (orDISPLAY).

System action: The command is ignored.

Programmer response: Enter the next command.

ICH62010I • ICH63001I


ICH63002I OFFSET IS xxx

Explanation: The search argument specified on theFIND command was located at the hexadecimal valuexxx into the specified NEW or OLD block.


ICH63003I CONFIGURATION NOT FOUND

Explanation: The search argument in the FINDcommand was not located in the specified NEW orOLD block.

Programmer response: Enter the next command. Youcan use the LIST command to view the contents of theNEW or OLD block.

ICH63004I REPLACE COMPLETE

Explanation: The operation requested by theREPLACE command is completed.


ICH63005I VERIFY FAILED, REPLACE NOTDONE

Explanation: The string specified in the VERIFYkeyword of the REPLACE subcommand was not foundat the given offset, or the string extended beyond theend of the block.

System action: The string was not replaced. Thecommand is ignored.

Programmer response: Enter the next command. Youcan use the LIST command to view the contents of theNEW block.

ICH63006I READ FUNCTION ENDED. BLOCKNOT SAVED

Explanation: The function initiated by the READcommand is ended and nothing is saved in response tothe END command.

System action: The block was not written back to theRACF database because either NOSAVE was specified,or no changes were made to the block, or UPDATE wasnot specified on the READ command.

Programmer response: Enter a READ, LOCATE, orEND command.

ICH63007I UPDATE CAUSES BLOCKOVERFLOW, NO CHANGES MADE

Explanation: The REPLACE, or CHANGE andINSERT (under DISPLAY) operation is ignored becausethe modified block would be greater than 1024 bytes.


Programmer response: If a REPLACE command was

entered, correct the offset or string length specified. Itmust not exceed 1024 bytes.

ICH63008I BLOCK RESTORED

Explanation: The REREAD subcommand of READ iscomplete. The NEW block is again the same as theOLD block.


ICH63009I DISPLAY ENDED. CHANGES SAVED

Explanation: The DISPLAY function is ended and theupdates saved. The block may be changed further bysubcommands of READ. The END SAVE subcommandof READ will update the RACF database with thisblock.

Programmer response: Enter a subcommand ofREAD.

ICH63010I DISPLAY ENDED. CHANGES NOTSAVED

Explanation: The DISPLAY function has endedwithout saving the changes made in response to theEND (with NOSAVE) command, or because UPDATEwas not specified on the READ command.


ICH63011I INVALID DATA IN INDEX BLOCK.DISPLAY ENDED

Explanation: The entry identifier or the length in theindex is not correct.

System action: The DISPLAY function is ended andany changes made are not saved.

Programmer response: Use the LIST and REPLACEsubcommands of READ to correct the entry. Executethe DISPLAY subcommand again.

ICH63012I BLOCK IS NOT A VALID INDEXBLOCK

Explanation: The block that is the object of aFORMAT or DISPLAY command is not a valid indexblock. The following tests are made for a valid indexblock:

v The first index block identifier (offset 00) must beX'8A'.

v The second index block identifier (offset 03) must beX'4E'.

v The displacement to free space must be greater thanthe displacement to the last entry.

v The displacement to free space must be less than1024.

ICH63002I • ICH63012I


v The last byte before free space (the end of blockdelimiter) must be X'0C'.

v The entry identifier for all entries must be X'21' orX'22', except for the identifier of the last entry in alevel 01 block which must be X'20'.

v The lengths of all entries must be correct.

v The entry pointer identifier—also called the E(P)byte—of each entry must be X'62' or X'66'.


Programmer response: Use LIST and REPLACEsubcommands of READ to fix the block.

ICH63013I READ FUNCTION ENDED. BLOCKSAVED

Explanation: The function initiated by the READcommand is ended.

System action: The modified block is saved in theRACF database.


ICH63014I RECORD NOT FOUND

Explanation: The RBA (relative byte address) specifiedon a READ command is not within the extents of theRACF database.


Programmer response: Enter another READ commandfor a block within the RACF database.

ICH63015I OPEN FAILED FOR DD SYSRACF

Explanation: The BLKUPD utility command could notopen the RACF database defined by the SYSRACF DDstatement.

System action: The BLKUPD command utility isended.

Programmer response: Allocate the RACF database toDD SYSRACF and retry.

ICH63016I I/O ERROR jjj, sss, ddd, devtyp, ddn, oper,err, xxxx, acc

Explanation: The BLKUPD utility encountered apermanent I/O error while processing on device ddd.

System action: The command is terminated with areturn code 12.

Problem determination: In the message text, the erroranalysis information provided by the SYNADAF datamanagement macro instruction issued by the SYNADroutine was:jjj Job namesss Step name

ddd Unit address of the devicedevtyp Device typeddn Data definition nameoper Operation attemptederr Error descriptionxxxx Last seek address or block countacc Access method.

ICH63017I ENTRY NOT FOUND. LOGICALLEVEL 1 FOLLOWS

Explanation: The entry specified in a LOCATEcommand cannot be found. The level 1 block thatought to contain the specified entry is displayed.

Programmer response: Enter a READ, LOCATE orEND command. The DISPLAY subcommand of READmay be used to add the entry to the block.

ICH63018I INDEX BLOCK CHAIN FOR ENTRY ISBROKEN

Explanation: A block in the chain for a LOCATEcommand search is not a valid index block. Thefollowing tests are made for a valid index block:

v The same tests are made as shown for messageICH63012I page “ICH63012I” on page 92.

v The RBA (relative byte address) for the next block onthe chain must be nonzero, with the two high-orderbytes zero, and represent an address on a 1Kboundary within the extent of the RACF database.

v The level of the block must be below the level of theprevious block on the chain.

System action: The block is dumped in hexadecimal.

Programmer response: Correct the block in error byusing the READ command and its subcommands.

ICH63019I ERROR IN SEQUENCE SET BLOCK ATRBA rba

Explanation: The sequence set block at the specifiedRBA (relative byte address) contains an error. Thefollowing tests are made for a valid block:

v The block must be in collating sequence with theprevious block on the sequence set.






v The entry identifier of the last entry in the blockmust be X'20'.

ICH63013I • ICH63019I


v The entry identifier for all other entries must be X'21'or X'22'.

v All entries must have correct lengths andpointer-section identifiers of X'62' or X'66'.

v The block must be a level 01 block.

v The RBA (relative byte address) for the next block inthe sequence set must be nonzero, with the twohigh-order bytes zero, represent an address on a 1Kboundary within the extent of the RACF database,and be not more than 4 bytes long.



ICH63020I ENTRY NOT FOUND. DISPLAYENDED

Explanation: The DISPLAY command specified anentry that could not be found in the index block.


Programmer response: Reenter the DISPLAYcommand with an existing entry.

ICH63021I BLKUPD ENDED DUE TO ERROR +UNABLE TO ESTABLISH ESTAE

Explanation: The BLKUPD utility ended due to asystem error. An ESTAE recovery environment couldnot be established.

System action: BLKUPD command processing isterminated with a return code of 12.

Programmer response: Enter the BLKUPD commandagain. If the problem persists, ensure that RACF andthe operating system are properly installed. If they are,report this message (including its message ID) to yourIBM support center.

ICH63022I COMMAND SYSTEM ERROR +routine-name ERROR RETURN CODE ISreturn-code

Explanation: The TSO/E service routine indicated inthe message failed with the return code indicated in themessage.

System action: BLKUPD command processing isterminated with a return code of 12.

Problem determination: For an explanation of theTSO/E service routines return codes, see one of thefollowing:

v For MVS/370, see OS/VS2 TSO Guide to Writing aTerminal Monitor Program or a Command Processor,GC28-0648.

v If TSO/E is installed, see one of the following: TSOExtensions Guide to Writing a Terminal Monitor Programor a Command Processor or TSO Extensions

Programming Services For the order number of thebook you need, see TSO Extensions GeneralInformation

ICH63023I KEY LENGTH ERROR +COMPRESSION COUNT PLUS KEYLENGTH MUST BE FROM 1 to 44CHARACTERS

Explanation: After processing a CHANGE or INSERTcommand, the compression count plus the key lengthof the new entry is less than 1 or greater than 44.


Programmer response: Adjust the length orcompression count so that the sum is 44 or less. Enterthe command again.

ICH63024I INVALID ICB. LOCATE ENDED

Explanation: The LOCATE command found the ICB inthe RACF database contains incorrect data. Thesequence set RBA or the RBA of the first index block inthe ICB is zero or not on a 1K boundary.

System action: The LOCATE command is ignored.

Programmer response: Correct the ICB using theREAD command and its subcommands. Check that thedatabase used is the correct RACF database.

ICH63025I ENTRY FOUND

Explanation: The entry requested by the LOCATEcommand was found via a sequence set search.

System action: The index block containing the entry isdisplayed.


ICH63026I WARNING - FIRST INDEX ENTRYCHANGED

Explanation: A CHANGE, DELETE, or INSERTcommand has changed the first entry in an index block.The index compression count in the remaining entriesmay be incorrect now.

System action: The entry is modified as requested.

Programmer response: If necessary, fix the indexcompression count in the remaining entries in theblock. See the descriptions of index compression in thesection on index block format in the RACF DiagnosisGuide.

ICH63027A ENTER SAVE OR NOSAVE

Explanation: SAVE or NOSAVE was not specified onthe END command and must be entered to continuecommand processing.

System action: The system prompts for the operand.

ICH63020I • ICH63027A


Programmer response: Enter SAVE if the changes areto be saved. Enter NOSAVE if the changes are not to besaved.

RACF Report Writer (RACFRW) Messages

ICH64001I SUBCOMMAND subcommand-name NOTFOUND+ ANY SUBCOMMANDENTERED AFTER subcommand-nameMUST BE REENTERED

Explanation: The RACF report writer does notsupport the subcommand name entered.

System action: The RACF report writer ignores thissubcommand and all subsequent RACF-report-writersubcommands. On MVS, the RACF report writerprompts the user to enter another subcommand.

User response: On MVS, the user must enter anothersubcommand. On VM, the user must correct the errorin the RACFRW CONTROL file and reexecute theRACRPORT EXEC. For more information, see the RACFAuditor'S Guide.

ICH64002I TOO MANY SUBCOMMANDS;IMAGES LOST ON OUTPUT LISTING

Explanation: The user has entered more than themaximum number (100) of subcommands that theRACF report writer can reproduce on the outputlisting.

System action: Although all the subcommands areprocessed, the list of subcommands appearing on theoutput listing is incomplete. On MVS, the RACF reportwriter prompts the user to enter another subcommand.

User response: On MVS, the user must enter anothersubcommand. On VM, the user must correct the errorin the RACFRW CONTROL file and reexecute theRACRPORT EXEC. For more information, see the RACFAuditor's Guide.

ICH64003I report-name REPORT COMPLETE

Explanation: The named report has been completedsuccessfully.

System action: The RACF report writer continues withthe next report or, if all reports have been processed,terminates normally.

ICH64004I operand DOES NOT APPLY TO STATUSRECORDS; OPERAND IGNORED

Explanation: On the SELECT subcommand, the userhas specified the named operand along with theSTATUS operand.

System action: Because the named operand has nomeaning for status records, the RACF report writerignores it. On MVS, the RACF report writer promptsthe user to enter another subcommand.


ICH64005I LIMIT OF 50 SELECT AND EVENTSUBCOMMANDS HAS BEENEXCEEDED; subcommand-nameIGNORED

Explanation: The user has entered more than themaximum number (50) of SELECT and EVENTsubcommands.

System action: The RACF report writer ignores thesubcommand. On MVS, the RACF report writerprompts the user to enter a subcommand other thanSELECT or EVENT.


ICH64006I OPERAND DOES NOT APPLY TOevent-name EVENT; OPERANDIGNORED

Explanation: On the EVENT subcommand, the userspecified an operand that is invalid for the namedevent.

System action: The RACF report writer ignores theinvalid operand. On MVS, the RACF report writerprompts the user to enter another subcommand.


ICH64007I THERE IS NO PRECEDING SELECTSUBCOMMAND FOR THIS EVENTSUBCOMMAND; EVENT IGNORED

Explanation: The user has entered an EVENTsubcommand without first having entered any SELECTsubcommands.

System action: The RACF report writer ignores theEVENT subcommand. On MVS, the RACF reportwriter prompts the user to enter another subcommand.

User response: On MVS, the user must enter anothersubcommand. On VM, the user must correct the error

ICH64001I • ICH64007I


in the RACFRW CONTROL file and reexecute theRACRPORT EXEC. For more information, see the RACFAuditor's Guide.

ICH64008I INVALID SUBCOMMAND

Explanation: The user has entered a subcommand thatviolates the syntax rules for subcommand names.

System action: The IKJSCAN TSO/E service routinedetects the invalid subcommand. The RACF reportwriter ignores the invalid subcommand. On MVS, theRACF report writer prompts the user to enter anothersubcommand.


ICH64009I NOUSER/NOJOB COMBINATIONINVALID; BOTH OPERANDSIGNORED

Explanation: On the SELECT subcommand, the userhas specified both the NOUSER and the NOJOBoperands.

System action: The RACF report writer ignores bothoperands and uses the defaults (USER and JOB) toselect all user IDs and job names.

User response: Enter next subcommand.

ICH64301I RACFRW ENDED DUE TO PUTGETERROR + PUTGET RETURN CODEreturn-code

Explanation: While the RACF report writer wasprompting the user to enter a subcommand, an erroroccurred in the PUTGET TSO/E service routine.

System action: The RACF report writer terminatesimmediately.

This message does not occur on VM.

System programmer response: For an explanation ofthe TSO/E service routines return codes, see one of thefollowing:

v For MVS/370, see OS/VS2 TSO Guide to Writing aTerminal Monitor Program or a Command Processor,GC28-0648.



ICH64302I RACFRW ENDED DUE TO IKJSCANERROR + IKJSCAN RETURN CODEreturn-code

Explanation: An error occurred in the IKJSCANTSO/E service routine while it was checking the syntaxof a RACFRW subcommand.


System programmer response: For an explanation ofthe TSO/E service routines return codes, see one of thefollowing:




ICH64303I FILE ddname COULD NOT BE OPENED

Explanation: The RACF report writer could not openthe file identified by ddname.


User response: On MVS, ensure that the DD statementexists or that the data set has been preallocated. OnVM, ensure that the data set specified by the DDstatement is on a minidisk that has been formatted foran OS data set.

ICH64304I SORT ERROR RETURN CODE‘return-code’ OCCURRED WHILEPRODUCING ‘report-name’ REPORT;COMMAND TERMINATED

Explanation: The sort function invoked by RACF(DFSORT or SORT/MERGE) encountered an errorwhile sorting the records for the named report.


System programmer response: Check for an error inmodule ICHRSMFI, which is an installation-replaceablemodule used by the RACF report writer. For anexplanation of the sort and sort/merge return codes,see the DFSORT Application Programming Guide, or theOS/VS Sort/Merge Programmer's Guide, which have thesame order number, SC33-4035.

This message does not occur on VM.


ICH64008I • ICH64304I


ICH64305I NO INPUT DATASET ALLOCATED;COMMAND TERMINATED

Explanation: The user did not preallocate the RSMFINfile or did not specify the DATASET operand on theRACFRW command.

System action: The RACF report writer terminatesimmediately. This message does not occur on VM.

User response: Preallocate the file RSMFIN or specifythe DATASET operand on the RACFRW command. Formore information, see the RACF Auditor's Guide.

RACF Database Split/Merge Utility (ICHUT400) Messages

ICH65001I ELEMENT NUMBER n OF RANGETABLE IS OUT OF SEQUENCE

Explanation: The designated range table entry is outof collating sequence.

ICH65002I UNABLE TO LOAD MODULEmodule-name TO BE USED AS RANGETABLE

Explanation: The load module named in the TABLEkeyword could not be loaded into storage. On MVS, aSTEPLIB DD statement might be missing; on VM,perhaps the member could not be loaded from theuser-supplied library.

ICH65003I error-description ON ddnameATTEMPTING A request OF BLOCK ATrba

Explanation: The indicated error occurred whileattempting a BDAM read (READ), BDAM write(WRITE), or BSAM write (LOAD).

System action: The ddname of the file on which theerror occurred is listed, along with the RBA (relativebyte address) of the block being accessed.





ICH65004I RANGE TABLE CONTAINS NOELEMENTS OR FIRST ELEMENTSTRING IS NOT BINARY ZEROS

Explanation: The first fullword of the range table isbinary zeros, indicating no elements in the table, or thestring portion of the first element is not binary zeros, asis required.

ICH65005I RACF DATA SET FULL ON ddname

Explanation: Space has been exhausted on thespecified output RACF database.

ICH65006I UNABLE TO OPEN dsname, ddname

Explanation: If the data set is for input, the utilityterminates. If the data set is for output, only processingto that data set is terminated.





ICH65007I INFORMATION RETRIEVAL FORddname FAILED WITH ERROR CODEcode

Explanation: RACF issued a dynamic allocationrequest (SVC 99) for information about the ddnameindicated in the message. However, the return codefrom dynamic allocation was unexpected.


Problem determination: Check the return code fromthe SVC 99 in one of the following:

v On MVS/XA, see MVS/XA SPL: System Macros andFacilities Volume 1, GC28-1150.

v On MVS/ESA, see MVS/Enterprise SystemsArchitecture SPL: Application Development Guide,GC28-1852.

ICH65008I dsname SUCCESSFULLY OPENED FOR{INITIALIZATION | PROCESSING}

Explanation: The named data set has beensuccessfully opened (BSAM open for INITIALIZATIONor BDAM open for PROCESSING) with the givenddname.

ICH65009I NO INPUT DD STATEMENTS FOUND- PROCESSING TERMINATED

Explanation: The utility cannot perform without atleast one input RACF database.

ICH65010I LOCK FUNCTION REQUESTED,ddname {ALREADY | NOW} LOCKED

ICH64305I • ICH65010I


Explanation: To prevent updates to the databaseindicated by ddname, the LOCK function is requested. Ifthe data set was not located previously, it is locked atthis time.

ICH65011I LOCK RECOVERY {SUCCESSFUL |UNSUCCESSFUL} FOR ddname

Explanation: This message reports the results of theattempt to turn the extend bit OFF in the ICB for thelisted ddname. If lock recovery is not successful, the bitwill still be ON in that ICB. If lock recovery issuccessful, the bit has been turned OFF.

ICH65012I profile-name IN CLASS class FROMddname1 IS DUPLICATE OF SAMENAME FROM ddname2

Explanation: The named profile could not be copiedto an output database because it has the same name asa profile already copied from another input database.Either the profile is in a class other than DATASET orthe NODUPDATASETS option is in effect.

ICH65013I INDEX ENTRY entry-name ON ddnamePOINTS TO A TAPE VOLUME SET OFWHICH IT IS NOT A MEMBER

Explanation: The index entry indicated by entry-namedoes not appear in the volume list of the profile for thetape volume set to which it points.

System action: The index entry is not copied to anoutput data set. The tape volume set is copied if noother errors exist.

ICH65014I A TAPE VOLUME SET FROM ddnameIS INCONSISTENT WITH THERANGE TABLE, MEMBER NAMESFOLLOW: member-name member-name ...

Explanation: The range table specified by the TABLEkeyword does not designate all of the members of theset to be copied to the same output data set. Themember names listed are not prefixed by the charactersTAPE-, but the prefix was used when interrogating therange table. The tape volume set is not copied tooutput.

ICH65015I A TAPE VOLUME SET FROM ddname1CONTAINS A DUPLICATE OFentry-name FROM ddname2, MEMBERNAMES FOLLOW: member-namemember-name ...

Explanation: Two tape volume sets contain the samename in their volume lists. Therefore, only one of thesets can be copied to the output data set. The entiretape volume set whose members are listed is notcopied to output.

ICH65016I abend-code ABEND DURINGSPLIT/MERGE PROCESSING

Explanation: The specified abnormal terminationoccurred during the execution of the utility.

ICH65017I UNABLE TO ESTABLISH RECOVERYENVIRONMENT. PROCESSINGTERMINATED

Explanation: Processing is terminated becauseadequate recovery cannot be provided.

ICH65018I OUTPUT PROCESSING TO ddnameTERMINATED WHILE PROCESSINGENTRY entry-name

Explanation: Because of an error identified by themessage immediately preceding this message on theoutput, no further processing of the data set indicatedby ddname is attempted. The data set should not beused as a RACF database.

ICH65019I OUTPUT PROCESSING TO ddnameTERMINATED DUE TO FAILUREDURING DATA SET INITIALIZATION

Explanation: This message will follow messagesICH65003, ICH65006, and ICH65007. See the previousmessage description for more information.

System action: Processing to the data set isterminated.




ICH65020I SPECIFIED OPTIONS: parm

Explanation: The parameters specified by the user onthe EXEC statement are listed.

ICH65021I PARAMETER ERROR. TEXTBEGINNING WITH ‘text’ CONTAINSAN UNDEFINED KEYWORD

Explanation: The listed text does not start with akeyword defined to the utility.

ICH65022I PARAMETER ERROR. KEYWORD‘keyword-abbreviation’ IS AMBIGUOUS

Explanation: The utility has more than one keywordwith the character string indicated bykeyword-abbreviation. Ensure that abbreviations forkeywords contain enough significant characters to

ICH65011I • ICH65022I


make the abbreviation uniquely identifiable to theutility.

ICH65023I PARAMETER ERROR. TEXTBEGINNING WITH ‘text’ ISREDUNDANT OR CONTRADICTORYTO A PREVIOUS SPECIFICATION

Explanation: Either the keyword contained in the textor its opposite form was specified previously. Theutility uses the first specification of the keyword.

ICH65024I PARAMETER ERROR. KEYWORD‘keyword(value)’ CONTAINS ANUNACCEPTABLE VALUE

Explanation: The value specified is not acceptablewhen associated with the keyword listed.

ICH65025I OPTIONS IN EFFECT: options

Explanation: All options, including default options, ineffect for the execution of this utility are listed.

ICH65026I INCORRECT BLOCKSIZE FOUND ONddname, ICHUT400 EXPECTS ABLOCKSIZE OF 1024. PROCESSINGWILL TERMINATE.

Explanation: The DCB for the input ddname data setindicates a block size other than 1024. ICHUT400 willonly process a data set with LRECL and BLOCKSIZEequal to 1024.


System programmer response: Ensure that the dataset name specified on the ddname DD statement is anonrestructured RACF database. ICHUTxxx utilitiesshould only be run against nonrestructured RACFdatabases. IRRUTxxx utilities should only be runagainst restructured RACF databases.

Data Security Monitor (DSMON) Messages

ICH66001I ICHDSM00 STARTED ON mm/dd/yy AThh:mm:ss

Explanation: Data security monitor execution began atthis date and time.

ICH66002I FUNCTION name ENDEDSUCCESSFULLY

Explanation: The data security monitor performed thespecified test function.

System action: Processing continues with the nextfunction.

Note: For an explanation of the test functions that thedata security monitor performs, see the RACF Auditor'sGuide.

ICH66003I ICHDSM00 ENDED ON mm/dd/yy AThh:mm:ss - RETURN CODE = nn

Explanation: Data security monitor executionterminated at this date and time with the specifiedreturn code. The return codes that can appear in thismessage are:

Code Description0 The data security monitor completed execution

successfully.16 The execution of one or more test functions

was unsuccessful.20 An attempt to open the data set specified in

message ICH66101I failed.

ICH66004I USER NOT AUTHORIZED TOEXECUTE THE DATA SECURITYMONITOR

Explanation: DSMON is not a controlled program, butyou cannot execute the DSMON program because youdo not have the system AUDITOR attribute.

System action: The program terminates with returncode 16 and produces no reports.


ICH66005I USER userid NOT AUTHORIZED TOEXECUTE THE DATA SECURITYMONITOR

Explanation: DSMON is not a controlled program, butuserid cannot execute the DSMON program because itdoes not have the system AUDITOR attribute.

System action: The program terminates with returncode 16 and produces no reports.

Operator response: Report this message to the RACFsecurity administrator.

ICH66006I DSMON ENDED WITH RC= nn

Explanation: DSMON ended with a return code ofuserid.

ICH66009I ---START OF INPUT LISTING---

Explanation: The data security monitor has started toread the input control statements from the SYSIN dataset. A listing of each control statement follows thismessage.

ICH66010I ---END OF INPUT LISTING---

Explanation: The data security monitor has finished

ICH65023I • ICH66010I


reading the input control statements from the SYSINdata set.

ICH66011I ABOVE CONTROL CARD IGNORED.UNKNOWN TYPE

Explanation: The control statement that precedes themessage did not have a valid control statementidentifier (FUNCTION, USEROPT, or LINECOUNT)and was not a continuation of the prior statement.

System action: Processing continues with the nextcontrol statement.

ICH66012I ERROR IN ABOVE CONTROL CARD.xxxxxxx IS AN UNKNOWN FUNCTIONTYPE AND IS IGNORED

Explanation: The FUNCTION statement that precedesthe message includes an invalid function name.


ICH66013I ABOVE CONTROL CARD IGNORED.xxxxxxx IS AN UNKNOWN USEROPTTYPE

Explanation: The USEROPT statement that precedesthe message includes an invalid function name.


ICH66014I ABOVE CONTROL CARD IGNORED.INCORRECT LINECOUNT VALUE

Explanation: The lines per page indicated by theLINECOUNT statement was too great, too small, ornon-numeric.


ICH66015I EXTRANEOUS INFORMATIONIGNORED IN ABOVE CONTROLCARD

Explanation: The LINECOUNT statement containedextra information after the lines per page information.


ICH66016I NO xxxxxx FUNCTION CARD FOUND.ANY RELATED USEROPTSTATEMENTS WILL BE IGNORED

Explanation: DSMON found a USEROPT statementfor function xxxxxx, but there is no matchingFUNCTION statement.


ICH66017I ABOVE CONTROL CARD IGNORED.NO FUNCTION SPECIFIED

Explanation: DSMON found a function card with nofunctions specified.


ICH66018I ABOVE CONTROL CARD IGNORED.INCOMPLETE SPECIFICATION

Explanation: DSMON found a USEROPT statementwith no user value specified. Processing continues withthe next control statement.

ICH66019I ERROR IN ABOVE CONTROL CARD

Explanation: DSMON found incorrect data on acontrol statement. Message ICH66020I follows thismessage.

ICH66020I FOLLOWING INPUT DATAIGNORED:...

Explanation: The indicated input data is incorrect.DSMON ignores it.


ICH66021I EXPECTED CONTROL CARDCONTINUATION NOT FOUND

Explanation: The previous input control statementcontained a continuation character, indicating thatanother control statement involving the same statementwould follow. DSMON did not find that controlstatement.


ICH66101I OPEN FAILED FOR DDNAME name

Explanation: An error occurred during the OPENissued for the named data set. If the data set thatcannot be opened is SYSPRINT, RACF issues thismessage to the programmer's console with awrite-to-operator message (routing code 11).


ICH66102I FUNCTION name ENDEDUNSUCCESSFULLY - ERROR CODE =nnn

Explanation: The specified test function endedabnormally with the specified error code. This is a

ICH66011I • ICH66102I


right-justified integer code which can range from 1 to999.



Problem determination: The following table containsa list of the test functions and their associated errorcodes:

Function Code DescriptionSYSAPF 1 There were no entries in

the list of APF libraries.SYSLNK 1 An error occurred while

attempting to open theSYS1.PARMLIB data set.

SYSLNK 2 An error occurred whileattempting to openSYSUT1.

SYSPPT 1 RACF could not locate theprogram properties table(PPT).

SYSPPT 2 An error occurred whileattempting to load moduleIEFSD060, which containsthe program propertiestable (PPT).

RACUSR 1 An error occurred whileattempting to access a userprofile in the RACFdatabase.

RACUSR 2 An error occurred whileattempting to access agroup profile in the RACFdatabase.

RACEXT 1 Either the entry pointaddress of the specifiedRACF exit did notcorrespond with theaddress contained in theRACF communicationsvector table (RCVT), or anerror occurred whileattempting to load a RACFexit routine module definedby the installation.

RACGRP 1 An error occurred whileattempting to access agroup profile in the RACFdatabase.

RACGAC 1 There are no classes eligiblefor global access checking.

Note: Functions not named in the preceding list haveno associated error codes.

ICH66103I RACF IS INACTIVE OR VERSION ISINVALID - ONLY SYSTEM REPORTPRODUCED

Explanation: One of the following conditionsoccurred: (1) RACF is not installed; (2) RACF isinactive; or (3) the RACF version that is active is priorto RACF Version 1 Release 6.

System action: The data security monitor producesthe system report and terminates.


ICH66104I PROGRAM PROPERTIES TABLE NOTFOUND

Explanation: The data security monitor could notlocate the program properties table; therefore, the datasecurity monitor does not produce the programproperties table report.



ICH66105I RACF MANAGER ERROR - RETURNCODE = return-code

Explanation: The RACF manager encountered an errorwhile attempting to retrieve RACF user attributes, asindicated by the return code in the message.



Problem determination: For a description of thereturn codes see “RACF-Manager Return Codes” onpage 265.

ICH66106I ERROR OCCURRED DURINGMEMBERLIST RETRIEVAL

Explanation: The data security monitor encounteredan error while attempting to retrieve a list ofpartitioned data set (PDS) members.



ICH66107I EXIT name HAS INVALID RCVTADDRESS

Explanation: The entry point address of the namedRACF exit routine does not correspond with theaddress contained in the RACF communications vectortable (RCVT). This difference might indicate a systemintegrity exposure.

User response: Report the exact text of this message

ICH66103I • ICH66107I


to your system programmer.

ICH66108I ERROR OCCURRED WHILELOADING EXIT name

Explanation: RACF attempted to load the RACF exitroutine, but could not find this installation-definedmodule. This error message might indicate a systemintegrity exposure.


ICH66109I NO PROFILE EXISTS FOR DATA SETname

Explanation: Although the RACF indicator for thespecified data set is on, no resource profile or UACChas been defined.


ICH66110I NO ENTRIES IN THE RACF CLASSDESCRIPTOR TABLE

Explanation: No entries were found in theIBM-supplied class descriptor table or the installationclass descriptor table.

System action: RACF processing does not occur.Processing continues with the next function.


ICH66111I RACF GLOBAL ACCESS TABLE NOTFOUND

Explanation: DSMON could not locate the globalaccess table.

System action: It does not execute function RACGAC,which obtains the entry name and global-accessauthority level for all classes eligible for global accesschecking. DSMON continues processing with the nextfunction.


ICH66134I USER NOT AUTHORIZED TORECEIVE USERCAT LISTING

Explanation: You do not have the required authorityto profile ICHDSM00.SYSCAT in class FACILITY.

System action: DSMON only reports on the mastercatalog. No report is made on the user catalogs.


ICH66135I FUNCTION function-name IS INVALIDIN VM ENVIRONMENT

Explanation: Certain DSMON functions are not validin the VM environment. These include RACAUT,RACSPT, SYSAPF, SYSCAT, SYSLNK, SYSPPT, andSYSSDS.

System action: Processing continues. The requestedinvalid option is ignored.

ICH66136I MAXIMUM NUMBER OFPROCESSABLE USRDSNS FORCURRENT REGION SIZE EXCEEDED

Explanation: DSMON did not execute successfully,because of storage constraints.

System action: The job is terminated with return code8.


Programmer response: See accompanying ICH66137Imessage.

ICH66137I EITHER INCREASE THE REGIONSIZE AND RERUN THE JOB OR RUNA MULTI-STEP JOB

Explanation: Not enough storage was available, giventhe current JCL REGION parameter, for DSMON toprocess all user datasets as specified.



Programmer response: The job may run successfully ifa larger REGION can be specified. If this is impossible,or if the job fails with larger REGIONs, submit amultistep job, breaking up the user data sets intoportions as indicated by the messages that follow thisone. If possible, isolate the USRDSN USEROPTS intotheir own steps. If a substantial number of RACGRPUSEROPTS are specified in the JCL, isolate these intotheir own jobsteps as well. Steps in which onlyUSRDSNs or RACGRPS are specified should specifyFUNCTION USRDSN or FUNCTION RACGRP toavoid the default (FUNCTION ALL) processing.

ICH66138I DUE TO STORAGE CONSTRAINTS,NO USRDSNS MAY BE SPECIFIED

Explanation: DSMON did not run successfully,because of storage constraints.



Programmer response: See accompanying ICH66139Imessage.

ICH66108I • ICH66138I


ICH66139I INCREASE THE JOBS REGION SIZEAS MUCH AS POSSIBLE AND RERUNTHE JOB

Explanation: So many user options were specified, forthe current REGION size, that DSMON cannot processANY of the given datasets or groups.



Programmer response: Increase the REGION JCLparameter as much as possible and rerun the job. If thisfails, try submitting a multistep job with the useroptions (datasets/groups) distributed among two ormore job steps. Watch for ICH66138I or ICH66137I

messages and instructions that might accompany theinitial multistep jobs submitted.

ICH66140I PROGRAM PROPERTIES TABLESCAN (IEFPPSCN) ERROR

Explanation: An error was returned to the DataSecurity Monitor (DSMON) from the ProgramProperties Table scan service (the IEFPPSCN macro).

System action: The job ends with return code 16.

System programmer response: This failure may bedue to a dynamic Program Properties Table update.Rerun DSMON to see if the problem persists.


RACF Miscellaneous Messages

ICH70001I userid LAST ACCESS AT hh:mm:ss ONwww, month, day, year

Explanation: This message explains the last date andtime that a RACINIT macro was issued for the user.This could be:

v The last time the user successfully logged on

v The last time a batch job submitted by the userbegan execution

v For MVS, if JES(EARLYVERIFY) was specified withthe SETROPTS command, the last time the usersubmitted a batch job

v The last time the user was resumed (either manuallyor automatically).

Note:

1. This message does not reflect all accesses donethrough APPC.

2. With MVS 3.1.3 and later, this message issuppressed for started procedures because of a timelapse between when the procedure is started andwhen its JOBLOG is activated. It is replaced byMVS message IEF657I identifying the startedprocedure and its associated user and group ID.

Information in the message includes hour, minute,second, day of week, month, day, and year.

The first time this message is issued for a user, themessage will read **:**:** ON ***,*** **,****.

This message is routed to the RACF-defined userindicated by userid and is issued only when theINITSTATS option (specified on the SETROPTScommand) is active.

ICH70002I YOUR PASSWORD WILL EXPIRE INxxx DAYS

Explanation: Your password or password phrase

(whichever one you used to log on) will expire withinthe specified number of days. RACF issues thismessage when the WARNING option on thePASSWORD keyword (specified on the SETROPTScommand) is active.

ICH70003I YOU HAVE EXCEEDED THEMAXIMUM NUMBER OF RACFPASSWORD OR PASS PHRASEATTEMPTS

Explanation: You have exceeded the number ofconsecutive unsuccessful password or password phraseattempts your installation allows.

System action: RACF revokes the user ID.

User response: To reactivate the user ID, see yourRACF security administrator.

ICH70004I USER(accessor) GROUP(group-name)NAME(user-name) ATTEMPTED‘access-type’ ACCESS OF ENTITY‘resource-name’ IN CLASS ‘class-name’ AThh:mm:ss ON month day, year

Explanation:

Note: The lines of message text can appear in anyorder.This message alerts a RACF user that an accessviolation has occurred against the indicated resource.This message is routed to the user specified in theNOTIFY field of the resource profile that denied theaccess.

The message itself supplies the following information:accessor

A user ID, job name, or started task namegroup-name

A group of which the user is a member

ICH66139I • ICH70004I


access-typeThe intended type of access, such as ALTER,CONTROL, UPDATE, EXECUTE, or READ

resource-nameA resource name, such as a data set name or avolume serial number

Note: The entity name is blank if theauthorization check is done for a class inwhich there are no profiles, such asDIRAUTH.

class-nameOne of the valid RACF class names.

The message also indicates the time and date of theviolation.

ICH70005I Session attempt rejected. Reason code =xx, entity netid.luid1.luid2, profileprofile-name, at hh:mm:ss on month, day,year

Explanation: The message alerts a RACF user that anattempt by logical unit (LU) netid.luid1 to establish asession with the logical unit luid2 has been rejected fora security reason. The entity netid.luid1.luid2 wascovered by profile profile-name. The message is routedto the user specified in the NOTIFY field of the profile.

System action: The session is terminated.

Operator response: Notify the RACF securityadministrator of the exact text of the message.

Problem determination: Check the reason code in themessage for one of the following values:

02 Local LU (luid1) session key will expire in 5days or less.

08 Verification was not indicated by partner LU(luid2), but a session key exists on this system.

09 Verification was indicated by partner LU(luid2), but a session key does not exist on thissystem.

10 Failure due to SNA-security-related protocolerror.

11 Failure due to profile change duringverification.

12 The profile has an expired session key.

ICH70006I Userid userid associated with procedure[procname|*UNKNOWN] has beenrevoked from [the system|groupgroupname]; verification for theprocedure continues.

Explanation: During verification of a startedprocedure, userid userid associated with procedureprocname was determined to be revoked from either thesystem or group groupname

A value of *UNKNOWN for procname indicates that theprocedure name could not be determined.

If procname is blank, the procedure name is made up ofat least one non-printable character, which couldindicate an error in the procedure name specification.

System action: The revoked status of the userid isignored, and verification processing for the procedurecontinues.

System programmer response:

v If the userid is not intended to be revoked, use theRESUME operand of the ALTUSER command toreinstate the userid. Once the userid is reinstated,this message will no longer appear.

v If the userid is intended to be revoked, update thestarted procedures table (ICHRIN03) to associateanother userid with the procedure. The update willnot take place until the next IPL, so this messagemay appear if the procedure is started again beforethe next IPL.


ICH70007I USER AUTHORITY CANNOT BEUSED FOR THIRD-PARTYAUTHORIZATION CHECK FOR USER(userid) GROUP (groupid) BECAUSE THEEXECUTION NODE (nodeid) IS NOTLOCAL. UACC WILL BE USED.

Explanation: A third-party RACROUTEREQUEST=AUTH call was made specifying anexecution node (nodeid). However, this execution nodewas not identified as a local node in the &RACLNDEprofile in the RACFVARS class. The user's identity(userid) cannot be assumed to be valid at the currentnode, so the UACC authority for the protected resourcewill be used. If that authority is not sufficient to allowaccess to the resource, message ICH408I is issued alongwith this message.

System action: RACF uses the UACC authority for theprotected resource.

System Administrator Response: Check to see if theexecution node is supposed to be local. If it is, makesure the node is defined to the &RACLNDE profile inthe RACFVARS class. Otherwise only the UACCauthority for the protected resource can be obtained.

ICH70005I • ICH70007I


Chapter 3. IRR Messages for the System Operator

This chapter lists IRR messages that are issued to the operator. The format of themessages is:IRRxnnt text

where:IRR identifies the message as a RACF message.x identifies the function issuing the message.nn is the message serial number.t is the type code (I = information, or A = action).text is the text of the message.

Routing and Descriptor CodesThe routing and descriptor codes for these messages are shown with the messageexplanations.

Descriptor Code Descriptions

Descriptor Code DescriptionsDescriptor codes indicate the significance of a message. Specifically, descriptorcodes let the user know the status of the system itself or that of a specific task:

Has it stopped processing?Is it waiting for another action to be completed?Or, is it continuing to process?

In addition, this code determines how the system will display and delete themessage.

Code Description

1 System Failure

The message indicates a catastrophic error. To continue, the operator mustre-IPL the system or restart a major subsystem.

2 Immediate Action Required

The message indicates that the operator must perform an actionimmediately. The message issuer could be in a wait state until the action isperformed, or the system needs the action as soon as possible to improveperformance. The task waits for the operator to complete the action.

Note: When an authorized program issues a message with descriptor code2, a DOM macro instruction must be issued to delete the message after therequested action is performed.

4 System Status

The message indicates the status of a system task or of a hardware unit.


Routing Code Descriptions

Routing Code DescriptionsRouting codes send system messages to the consoles where they are to bedisplayed. To send a message to more than one console, RACF assigns more thanone routing code to the message. For more information on message routing, see thefollowing:v On z/VM, see the CSTCONS table in RACF System Programmer's Guide.

Code Description

1 Master Console Action

The message indicates a change in the status of the system. It demandsaction by the master console operator.

2 Master Console Information

The message indicates a change in the status of the system. It does notdemand action; rather, it alerts the master console operator to a conditionthat may require action.

This routing code is used for any message that indicates job status whenthe status is not requested specifically by an operator inquiry. It is alsoused for processor and problem program messages to the system operator.

9 System Security

The message gives information about security checking, for example, arequest for a password.

11 Programmer Information

The message is intended for the problem programmer. This routing code isused only when the program issuing the message cannot route themessage to the programmer by way of the user's printer on z/VM.

Note: Routing code 11 is ignored if specified for a multiple-line WTOmacro instruction.

VERIFY and VERIFYX Messages

IRR008I JOB FAILED. USER PARAMETERREQUIRED ON JOB STATEMENT.

Explanation: A job was submitted with no user IDinformation specified or propagated from the submitterand the system requires jobs to run with RACF userIDs by way of the SETROPTS JES(BATCHALLRACF) orJES(XBMALLRACF) options.

System action: The job is terminated, and no steps areexecuted.

User response: Specify USER parameter on the JOBcard and resubmit the job.

IRR009I JOB FAILED. OLD PASSWORDREQUIRED WITH NEW PASSWORDON PASSWORD PARAMETER.

Explanation: The old password is missing on thePASSWORD parameter on the JOB statement.


User response: Specify both the old password and thenew password on the JOB card, PASSWORD=(old,new);and resubmit the job.

IRR010I USERID userid IS ASSIGNED TO THISJOB.

Explanation: The user did not specify the USERparameter on the job card.

System action: The submitting user's user ID isassigned to this job. (This is normal for user IDpropagation.) Processing continues. This message goesonly to the job log.

User response: None.

IRR008I • IRR010I


IRR011I SECLABEL seclabel IS ASSIGNED TOTHIS JOB.

Explanation: The user did not specify the SECLABELparameter on the JOB card.

System action: The security label assigned to the job isthe one the submitter is currently using. Processingcontinues.


IRR012I VERIFICATION FAILED. USERPROFILE NOT FOUND.

Explanation: There is no user profile in the RACFdatabase for the user associated with this job.

System action: The external security manager hasfailed the request. The application decides whether toend the job or continue with an alternative method.

User response: If the application allows the job tocontinue, no action is required. Otherwise, specify aRACF-defined user on the USER parameter, or submitfrom a RACF-defined session.

IRR013I VERIFICATION FAILED. INVALIDPASSWORD GIVEN.

Explanation: The password supplied was notcontained in the user's profile.


User response: Specify the correct password in thePASSWORD parameter on the JOB card.

IRR014I VERIFICATION FAILED. EXPIREDPASSWORD GIVEN.

Explanation: The user's password has expired. A newpassword must be provided.


User response: Specify a new password with the oldexpired one on the JOB card: PASSWORD=(old,new).

IRR015I VERIFICATION FAILED. NEWPASSWORD IS NOT VALID.

Explanation: The new password is not valid or is thesame as the old password.


User response: Specify a valid new password. Forassistance with your installation's password rules andminimum password change interval, see your RACFsecurity administrator.

IRR016I VERIFICATION FAILED BY RACFINSTALLATION EXIT.

Explanation: The job was failed by the RACINITinstallation exit routine taken when the job wasinitiated.


User response: Report this message to your RACFsystem programmer

IRR017I VERIFICATION FAILED. USER ISREVOKED AT THE GROUP LEVEL.

Explanation: The group specified (which is either thedefault group or is specified on the job card) is a validgroup for this user. However, the user's access to thegroup has been revoked.



IRR018I VERIFICATION FAILED. OIDCARD ISREQUIRED.

Explanation: The user is required to supply anoperator ID card when entering the system. It is notpossible to supply an OIDCARD with this batch job.


User response: Specify a different user on the JOBcard.

IRR011I • IRR018I

Chapter 3. IRR Messages for the System Operator 107

RACF Processing Messages

IRR401I abend-code ABEND DURING RACFPROCESSING OF request-nameREQUEST FOR ENTRY entry-name [INCLASS class-name] [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname] --or-- I/OERROR AT RBA relative-byte-addressDURING RACF PROCESSING OFrequest-name REQUEST FOR ENTRYentry-name [IN CLASS class-name][{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname] --or--RESTART KEY HIT DURING RACFPROCESSING OF request-nameREQUEST FOR ENTRY entry-name [INCLASS class-name] [{PRIMARY |BACKUP } RACF DATA SETSEQUENCE nnn, dsname]

Explanation: An abend or an I/O error occurredduring RACF processing, or the restart key waspressed.relative-byte-address

The RBA (relative byte address) where the I/Oerror occurred.

request-nameThe type of request the RACF manager wasprocessing when the error occurred.

class-nameFor resources other than DASD data sets, theclass name of the resource. The 8-characterclass name and a hyphen precede the entryname zzz in the RACF database index. Forexample, the index name ofTAPEVOL -T12345 is used to locate profileT12345 in class TAPEVOL.

dsname and nnnIf more than one RACF database exists, dsnameand nnn indicate the database and sequencenumber affected.

System action: The indicated request to the RACFmanager failed. Processing of the request is terminated.

Operator response: Save the exact text of this messageand of any following RACF messages (particularlyIRR413I), and report them to the system programmeror the RACF security administrator, or both.

Programmer response: If message IRR402I, IRR403I,or IRR404I does not follow this message at the securityconsole, the error occurring in the RACF database maynot represent a permanent error. Attempt to reenter theRACF request (either the RACF command or the utilityprogram), or cause the RACF SVC to be invoked again(such as reentering the LOGON command, rerunningthe job, or retrying dynamic allocation).

If message IRR402I, IRR403I, or IRR404I does followthis message, then a permanent error may exist in theRACF database. Perform the action as specified by the

problem determination section for that message.

If an I/O error is occurring frequently on the RACFdatabase, an alternate device could be considered forthe next IPL.

If multiple extents were created for a new RACFdatabase, this message is issued when the newdatabase is used. Delete the database and rerun theIRRMIN00 utility to recreate it. Specify CONTIG anddo not specify secondary space on the SPACEparameter in the JCL.

Problem determination: If an abend occurred, do thefollowing:

v Get the abend code from this message. If the abendis 000, see other messages issued for this problem(such as ICH4409I) for the abend code.

v Look for a description of the abend code in thefollowing places:

– Chapter 6, “RACF Abend Codes,” on page 251 inthis book.

– An MVS system codes manual.

If you cannot find the abend code described in anyof the above, use the RACF Diagnosis Guide forinformation on diagnosing documentation errors andreporting documentation errors to IBM.

Diagnostic data is provided in the LOGREC data.

If an I/O error occurred, determine if the device orvolume is malfunctioning. For a permanent I/O error,also see the LOGREC data for diagnostic information.Also, see the section on failure during I/O operationson the RACF database in RACF System Programmer'sGuide.

If message IRR402I, IRR403I, or IRR404I follows thismessage, see “Problem Determination” for thatmessage.

Destination: Descriptor code is 1. Routing codes are 9and 11. The complete text of this message is sent onlyto the security console. Only IRR401I abend-code ABENDDURING RACF PROCESSING is sent to the programmer.

IRR402I BAM BLOCK AT RBArelative-byte-address MAY NOT REFLECTACTUAL SPACE USAGE

Explanation: An error has occurred during RACFprocessing when attempting to allocate or deallocatespace in the RACF database. The BAM block at theRBA (relative byte address) indicated in the messagemay not be accurate.

This message follows message IRR401I. If more thanone RACF database exists, the database referred to in

IRR401I • IRR402I


this message is the database named in the precedingIRR401I message.

System action: RACF processing of the requestindicated in message IRR401I terminates.



Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program IRRUT200to determine the inconsistency between the BAMmappings and the actual space allocated.

If an inconsistency is found, use the BLKUPDcommand IRRUT300 to correct the BAM blocks so theyaccurately reflect the space allocated. See the RACFDiagnosis Guide for additional information on how todiagnose and correct problems with BAM blocks.


IRR403I INDEX MAY BE INVALID; LEVEL nnINDEX BEING PROCESSED FOR{ADDITION | DELETION} AT TIMEOF FAILURE

Explanation: An error occurred during RACFupdating of the index in the RACF database. The levelindex being processed is indicated by nn. This messagefollows message IRR401I. If more than one RACFdatabase exists, the database referred to in this messageis the database named in the preceding IRR401Imessage.

System action: RACF processing of the requestindicated in message IRR401I terminates.



Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program IRRUT200.To determine if there is an inconsistency in the indexstructure.

If an inconsistency is found, use the BLKUPDcommand IRRUT300 to correct the index structure sothat it accurately reflects the contents of the RACFdatabase. See RACF System Programmer's Guide foradditional information on how to diagnose and correctproblems with the data set index.


IRR404I ICB RECORD HAS NOT BEENUPDATED - {TOP LEVEL INDEX |SEQUENCE SET } RBA IS INCORRECT

Explanation: An error occurred during RACFprocessing. The header record (ICB) in the RACFdatabase had not been updated before the failureoccurred in the RACF database. Updates to the indexstructure (that is the top level index block or thebeginning of the sequence set) are not reflected in theICB. The latest updates to the index will not bereflected in searches of the RACF database.

This message follows message IRR401I. If more thanone RACF database exists, the database referred to inthis message is the database indicated in the precedingIRR401I message.




Problem determination: The control information inthe RACF database may not be accurate. Execute theRACF database verification utility program IRRUT200to determine if there is an inconsistency in the ICB andindex structure. If an inconsistency is found, use theBLKUPD command IRRUT300 to update the ICB sothat it accurately reflects the contents of the indexstructure. See the RACF Diagnosis Guide for additionalinformation on how to diagnose and correct problemswith the data set index.


IRR405I INSUFFICIENT SPACE ON RACFDATA SET [{PRIMARY | BACKUP }RACF DATA SET SEQUENCE nnn,dsname]

Explanation: The RACF data set containing the RACFdatabase does not contain sufficient space to handle theRACF request. Either a request was made for a largeamount of space or there is very little space available inthe RACF database.





Problem determination: Execute the RACF databaseverification utility program IRRUT200 to determine theamount of available space in the RACF database. If

IRR403I • IRR405I


more space is needed, delete any unused profiles fromthe RACF database.


IRR406I RACF DATA SET INDEX FULL[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname]

Explanation: During RACF processing, an attemptwas made to extend the index to another level, but themaximum number of index levels (10) had beenreached.





Problem determination: Execute the RACF databaseverification utility program IRRUT200 to determine theindex structure and index levels. Delete unused profilesto reduce the number of index entries and make spaceavailable. If an error in the index structure is suspected,execute the RACF database verification utility programIRRUT200 to determine if there is an inconsistency.

If an inconsistency is found, use the BLKUPDcommand IRRUT300 to correct any problems in theindex of the RACF database. RACF allows a maximumof 10 index levels. See the RACF Diagnosis Guide foradditional information on how to diagnose and correctproblems with the data set index.


IRR407I RACF DATA SET INDEX ERROR.[{PRIMARY | BACKUP } RACF DATASET SEQUENCE nnn, dsname] SEARCHON ENTRY entry-name

Explanation: An index error in the RACF databasewas detected while RACF was performing an indexsearch for the entry indicated in the message. Thismessage is issued if:

v During the index search, a block is found which isnot an index block.

v The data pointed to by a level one index block is notthe entry for the entry name indicated in themessage.



Operator response: Report the exact text of thismessage to your system programmer or the RACFsecurity administrator, or both.


Problem determination: Execute the RACF databaseverification utility program IRRUT200 to determine theerror in the index tree in the RACF database.

If the IRRUT200 utility does not find the error, list theprofile indicated in the message by entry-name, usingthe appropriate RACF command. For example, if thesearch was for user profiles, use the LISTUSERcommand. If CLASS was not specified on the SEARCHcommand, use the LISTDSD command. Look for errormessages such as NO CONNECT ENTRY FOUND or invaliddata in fields such as OWNER.

To correct any errors found, use the BLKUPDcommand IRRUT300. See the RACF Diagnosis Guide foradditional information on how to diagnose and correctproblems with the data set index.


IRR410I RACF UNABLE TO BACK UP UPDATEOF entry-name BACKUP RACF DATASET SEQUENCE nnn, dsname

Explanation: A failure occurred in attempting toduplicate on the backup RACF database an updateperformed in the corresponding primary database. Thedatabase is identified by:nnn Database sequence number (1 to 255 on MVS;

1 to 4 on VM)dsname Database name.

System action: RACF has not duplicated the updateoperation. Processing continues.



Problem determination: If this message is precededby message IRR401I, IRR405I, IRR406I, or IRR407I, theerror was encountered on the backup database.Otherwise, the backup database was not insynchronization with its primary database.


IRR411I MAXIMUM PROFILE SIZE EXCEEDED.profile-name NOT ALTERED.

Explanation: During RACF processing, an attemptwas made to expand the profile indicated in themessage. The profile has reached the maximum sizethat RACF can handle (65,535 bytes); the profile cannotbe made larger.

IRR406I • IRR411I



Operator response: Report this message to the systemprogrammer or the RACF security administrator, orboth, and save this output.

Programmer response: The profile has reached themaximum size allowed. If possible, decrease the size ofthe profile; if that is not possible, you must split theprofile. For example, you could split a group with toomany users into several smaller groups.


IRR413I RACF MANAGER REQUEST ID WASrequest-id

Explanation: This message contains additionalinformation to help determine the cause of an IRR401Ierror message. This message is issued only after anIRR401I message. The request-id field contains an IDthat can help the IBM support center determine thecause of the problem.

System action: See message IRR401I page “IRR401I”on page 108.

Operator response: See message IRR401I.

Programmer response: See message IRR401I.


IRR416I RACF DETECTED AN INVALIDNON-EGN DATASET PROFILE NAME.PROFILE profile-name DOES NOTPROTECT THE INTENDEDRESOURCES.

Explanation: RACF detected a profile that was addedbefore the enablement of Enhanced Generic Names(EGN) and that cannot be interpreted as intendedunder EGN rules. This message identifies the non-EGNgeneric data set profile name. Under EGN rules, theprofile may not protect the resources that it wasdefined to protect. If this message is issued duringprocessing of a SEARCH or LISTDSD GENERICrequest, bad profile names (particularly names 43 and44 characters in length) may also have been displayedand the output should be considered unreliable.

For example, suppose the following six generic data setprofiles were defined before turning EGN on:

Then EGN was enabled and three more generic data setprofiles were defined:

7 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.**’8 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.**’9 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.**’

A subsequent SEARCH request would display thefollowing:SEARCH CLASS(DATASET)IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.


IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*DOES NOT PROTECT THE INTENDED RESOURCES.

IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

A IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.D.*.* (G)IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.


B IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*.* (G)IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

C IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.** (G)D IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.* (G)IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*DOES NOT PROTECT THE INTENDED RESOURCES.

E IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD* (G)IRR416I RACF DETECTED AN INVALID NON-EGN DATASET PROFILE NAME.

PROFILE IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*DOES NOT PROTECT THE INTENDED RESOURCES.

F IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.** (G)G IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.D.* (G)H IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.DD* (G)I IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.** (G)

RACF command processing may have caused theIRR416I message to be issued more than once.However, any time it is issued during a commandinvocation, the command output must be consideredunreliable. In the example above, changes in EGN rulesmay have caused RACF to incorrectly interpretnon-EGN profiles (1) and (2) as SEARCH profiles (A)and (B). These profiles no longer cover the intendedresources. Even though names (D) and (E) appearcorrect, with no additional characters at the end, theyalso do not cover the intended resources and causeIRR416I messages to be issued. EGN profiles (7), (8),and (9) were correctly displayed by SEARCH as (C),(F), and (I). Profiles (G) and (H) follow the same rulesunder non-EGN and EGN, so they actually protectwhat they were intended to protect.

System action: RACF processing of the requestcontinues.

Operator response: Report this message to the systemprogrammer or the RACF security administrator andsave the message output.

Programmer response: See problem determination.

Problem determination: This message identifies thebad profile.

An EGN profile, possibly less specific, can be definedto protect the desired resources; however the originalbad non-EGN profile must still be deleted to preventfurther IRR416I messages.

1 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.D.*’2 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.U.XX.D.DD*’3 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.D.*’4 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.US.XX.D.DD*’5 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.D.*’6 ADDSD ’IBMUSER.IBMUSER.IBMUSER.IBMUSER.USE.XX.D.DD*’

IRR413I • IRR416I


To delete bad profiles:

1. Use SETROPTS NOEGN to temporarily disableEGN. During this time, there should be no othersystem activity, in order to prevent the creation ofgeneric profiles that could result in additionalproblems. Under normal circumstances, it is notrecommended that EGN be turned off after it isturned on.

2. Use SEARCH GENERIC CLIST NOMASK NOLISTto create a CLIST containing generic data set profilenames.

3. Edit the CLIST, to find 42– and 43–character namesending in '.*'.

4. Delete the profiles found.

5. Use SETROPTS EGN to re-enable EGN.

6. Define profiles according to EGN rules that protectthe resources intended to be protected by thenon-EGN profile names.

Destination: Descriptor code is 4. Routing codes are 9and 11. Routing code 11 is only used when a TSOenvironment is not in effect.

IRR420I ERROR error-code DURINGoperation-name OF field-name FOR userID.DIAG CODE 1=diag-code1, DIAG CODE2=diag-code2. OCCURRENCESerror-count.

Explanation: An internal error occurred during anattempt to encrypt a password or password phrase forthe specified user. operation-name is either VALIDATE orCREATE. field-name indicates the name of the RACFdatabase template field being referenced. RACF issuesIRR420I only once per minute. error-count indicates howmany times an encryption error occurred since IPL.This count is cumulative for all user IDs and alldiagnostic codes.

System action: RACF stops processing the request.

System programmer response: If SETROPTSPASSWORD(ALGORITHM(KDFAES)) is not active, anderror-code is 132, then you might be able to fix the errorby issuing the following commands:

SETROPTS PASSWORD(ALGORITHM(KDFAES))SETROPTS PASSWORD(NOALGORITHM)

Otherwise, report this message to the IBM supportcenter.

IRRDPI00 command messages

IRR545I IRRDPI00 FAILED BECAUSE IT ISNOT A TSO-AUTHORIZEDCOMMAND

Explanation: This message is issued when theIRRDPI00 UPDATE command is issued from a startedtask (for example, during IPL), but the IRRDPI00command is not defined as an authorized command inthe IJKTSOxx parameter library member.

System action: RACF processing continues normally,except that users cannot work with profile segments(such as TSO or DFP segments). This affects both RACFcommand users and RACF ISPF panel users.


System programmer response: Ensure that theIRRDPI00 command is defined as an authorizedcommand in the IKJTSOxx parameter library member.For more information, consult the RACF ProgramDirectory for MVS Installations.

If the problem persists, call your IBM support center.

IRR546I IRRDPI00 FAILED. SAVE JOB LOGAND CONTACT SYSTEM SUPPORT

Explanation: This message is issued when theIRRDPI00 UPDATE command is issued from a startedtask (for example, during IPL), and then a problemoccurs.

System action: RACF processing continues normally,except that users cannot work with profile segments(such as TSO or DFP segments). This affects both RACFcommand users and RACF ISPF panel users.


System programmer response: Check the job log ofthe started task for other messages that may be relatedto this problem. Find out what was wrong, correct theproblem, and re-IPL.

RACHECK VLF Messages

IRR803I VLF IS NOT ACTIVE. POSSIBLE RACFPERFORMANCE IMPACT

Explanation: This message appears when VLF isinactive and RACF is doing group authority checking.

RACF uses VLF to store group tree information forimproving performance.

System action: RACF will continue processingwithout using VLF. The result of group authority

IRR420I • IRR803I


checking should be the same whether VLF is active ornot.

Operator response: Use operation procedures for yourinstallation to decide whether or not to activate VLF.The command S VLF,SUB=MSTR will start the VLF,and VLF will use the COFVLF00 PARMLIB member asthe default. The command STOP VLF will deactivateVLF.


IRR804I RACF VLF CLASS IRRGTS NOTDEFINED IN COFVLFxx PARMLIB.

Explanation: This message appears when VLF isactive but the VLF class IRRGTS is not defined in theCOFVLFxx parameter library member. Therefore, GTS(group trees in VLF storage) cannot be activated inRACF. It will affect the RACF performance duringgroup authority checking.

System action: RACF will continue processingwithout GTS. The result of group authority checkingshould be the same no matter whether GTS is active ornot.

Operator response: Use the installation procedures todecide whether or not to activate GTS. If the decision isto have GTS active, update the COFVLFxx PARMLIBmember to specify that the VLF class name is IRRGTSand its major name is GTS. Add the following two linesto the COFVLFxx parameter library member.

CLASS NAME(IRRGTS) /* RACF GTS Feature */EMAJ(GTS) /* Major Name */

After updating the COFVLFxx PARMLIB, you mustactivate GTS. One way to make GTS active is to stopVLF, and start it again with the updated COFVLFxxparameter library member.


RACINIT NJE Messages

IRR805I IDENTITY IS PROPAGATED FOR THEUNKNOWN USER FROM TRUSTEDNODE node-name.

Explanation: This informational message is sent to thesecurity console when a job is received from anunknown user on a trusted node. The NODES profilelookup for this submitter resulted in a UACC thatallowed propagation of the NJE unknown user, set bySETROPTS JES(NJEUSERID(userid)). Propagation of thissubmitter is not possible. This situation can occur whena job is sent across nodes by an external physical readersuch as a card reader. Refer to RACF SecurityAdministrator's Guide for details on the NODES profilelookup. This message will occur only once per IPL;however, an SMF record will be cut for everyoccurrence.

System action: The job is allowed to run. If a user IDis specified, a password is required and no propagationtakes place. If a user ID is not specified, the job runsaccording to the setting on the SETROPTSJES(BATCHALLRACF) command. Refer to RACFSecurity Administrator's Guide for information on usingthe BATCHALLRACF operand.

IRR806I PROFILE profile-name IN THE NODESCLASS WAS USED TO TRANSLATEUSER userid-1 TO userid-2.

Explanation: This informational message is sent to thesecurity console when a user ID is translated for NJE(network job entry). The profile-name is the actualprofile used to do the translation. To determine whichENTITY was built, refer to RACF SecurityAdministrator's Guide for information about NODESprofiles.

Note: When userid-2 is “&SUSER”, it is possible for anadditional IRR806I message to be issued, because asecond NODES lookup is done. Refer to RACF SecurityAdministrator's Guide for information about &SUSER.

System action: Processing continues with theauthority of userid-2.

IRR807I PROFILE profile-name IN THE NODESCLASS WAS USED TO TRANSLATESECLABEL seclabel-1 TO seclabel-2.

Explanation: This informational message is sent to thesecurity console when a security label is translated forNJE (network job entry). The profile-name is the actualprofile used to do the translation. To determine whichENTITY was built, refer to RACF SecurityAdministrator's Guide for information about NODESprofiles.

System action: Processing continues with seclabel-2 asthe current security label.

IRR808I WARNING: NJE SYSOUT ERRORFROM NODE nodeid. USER (userid-1)GROUP (groupid) SECLABEL (seclabel)[poeclass(poeid)] RACF VERIFYXRETURN CODE CHANGED FROM nnto 0. UNDEFINED USER undef-userASSIGNED.

Explanation: Security information was incorrectduring NJE SYSOUT verification from the nodeidsubmit node for user userid-1 using group groupid,security label seclabel, and if specified, the poeid port ofentry in the specific poeclass port of entry class (such asthe JESINPUT class). Return code nn is the hexadecimalvalue of the return code that describes the error.

IRR804I • IRR808I


VERIFYX return codes for RACF are described inRACROUTE.

System action: SYSOUT verification continues withthe NJE unknown user as specified by SETROPTSJES(NJEUSERID(undef-user).

System action: Processing continues with seclabel-2 asthe current security label.


Chapter 4. Other IRR Messages

RACF Database Initialization MessagesThis section lists the RACF messages issued by the IRRMIN00 utility during theinitialization of the RACF database. The messages are routed to the RACF servicemachine's printer on z/VM.

The format of the messages is:IRR8nnn text

where:IRR identifies the message as a RACF message.8 identifies the RACF database initialization utility program (IRRMIN00).nnn is the message serial number.text is the text of the message.

IRR8000 Maximum number of templatedefinitions exceeded.

Explanation: During initialization of the RACFdatabase, more than 10 template definitions were foundin IRRTEMP2.



Programmer response: Report this message to yourIBM support center.

IRR8001 Template is a duplicate. It is ignored.

Explanation: During initialization of the RACFdatabase, two template definitions were found inIRRTEMP2

System action: Initialization of the RACF databasecontinues using the first definition of the duplicate pair.



IRR8002 RACF data base initialization complete.

Explanation: The RACF database has beensuccessfully initialized.


IRR8003 Non-numeric character in numeric fieldof last statement.

Explanation: During the initialization of the RACF

database, an invalid character was found in a numericfield of the previous input statement.




IRR8004 RACF data base initializationterminated in error.

Explanation: Initialization of the RACF database hasfailed (as noted by a previous message).

System action: Initialization of the RACF database isterminated.

IRR8005 Beginning RACF data baseinitialization.

Explanation: Initialization of the RACF database hasbegun and template definitions will follow.


IRR8006 Unable to open DD ddname

Explanation: The data set associated with theindicated ddname could not be opened.



Programmer response: On z/OS, ensure that the DDstatement for the indicated data set is correct. On


z/VM, ensure that SYSRACF identifies a minidisk thatis properly formatted for an OS data set.

IRR8007 End of file reached before $/ENDstatement.

Explanation: During the initialization of the RACFdatabase, an end-of-file condition was detected in theRACF templates before a $/END statement.

System action: Initialization of the RACF databasecontinues.


Programmer response: Verify the contents of thetemplates in the IRRMIN00 load module. If moretemplate definitions were expected, the program mustbe rerun with the complete set of template definitionsas input. If all template definitions are present and onlythe $/END statement is missing, the program need notbe rerun.

IRR8008 End of file reached before end oftemplate definition.

Explanation: In attempting to initialize the RACFdatabase, the end-of-file was encountered before a$/TEMPLATE statement was found.




IRR8009 Invalid JCL parameter: parameter

Explanation: The indicated parameter value is not avalid value for the NEW or UPDATE parameter. Onlythe first nine characters of the parameter value arelisted.



Programmer response: Correct the value specified onthe NEW or UPDATE parameter and rerun theprogram.

IRR8010 Unable to retrieve data base name.

Explanation: While attempting to retrieve the databasename allocated by way of the SYSRACF DD statement,an error was encountered from the SVC 99 informationretrieval function.



Programmer response: Correct the SYSRACF DDstatement and rerun the program.

IRR8011 RACF data base header record isinvalid.

Explanation: The RACF database initializationprogram found an invalid ICB (header) record in theRACF database while preparing to update the RACFdatabase.



Programmer response: If the RACF database was notpreviously formatted by way of this program with thePARM=‘NEW’ specification on MVS or with theRACINITD EXEC on VM, then rerun the program withPARM=‘NEW’. If the RACF database is a version 1,release 1 or 2 database that is being updated, then runthe RACF database verification utility program(IRRUT200) to determine which ICB field is in error.

Problem determination: The validity check whichcaused the failure can result from an invalid ICB valuefor the number of templates or BAMs, or an invalidRBA (relative byte address). List the contents of thedata set defined by the SYSRACF DD statement todetermine the cause of the problem.

IRR8012 RACF data base updates complete.

Explanation: The template update function of theRACF database initialization program has completedsuccessfully.


IRR8013 RACF data base updates terminated inerror.

Explanation: The template update function of theRACF database initialization program has terminatedunsuccessfully as noted in a previous message.



Programmer response: Respond to the previousmessage and rerun the program.

IRR8014 Segment definition missing frompreceding data.

Explanation: In attempting to initialize the RACFdatabase, a $/TEMPLATE statement was foundimmediately following a $/SEGMENT statement.

IRR8007 • IRR8014





IRR8015 Consecutive segment identifiers.

Explanation: In attempting to initialize the RACFdatabase, a $/SEGMENT statement was immediatelyfollowed by a $/SEGMENT statement.




IRR8016 Segment identifier missing frompreceding data.

Explanation: In attempting to initialize the RACFdatabase, a field definition statement was foundimmediately following a $/TEMPLATE statement.




IRR8017 Consecutive template identifiers.

Explanation: In attempting to initialize the RACFdatabase, a $/TEMPLATE statement was foundimmediately following a $/TEMPLATE statement.




IRR8018 $/END follows a segment identifier.

Explanation: In attempting to initialize the RACFdatabase, a $/END statement was found immediatelyfollowing a $/SEGMENT statement.




IRR8019 $/END follows a template identifier.

Explanation: In attempting to initialize the RACFdatabase, a $/END statement was found immediatelyfollowing a $/TEMPLATE statement.




IRR8020 Dataset specified for UPDATE functionis incorrect.

Explanation: The dataset defined by the SYSRACF DDstatement does not have a blocksize of 4096.

System action: Updating of the RACF database isended.


System programmer response: Make sure that thedataset specified by the SYSRACF DD statement is avalid RACF restructured database. Rerun theIRRMIN00 utility.

IRR8025I PARM=UPDATE specified, but templateupdate not required.

Explanation: You specified PARM=UPDATE whenrunning IRRMIN00 but provided a RACF database viathe SYSRACF DD statement that already has the latestlevel of the templates applied.

System action: IRRMIN00 ends with RC=4 withoutmaking any changes to the database.

User response: No response is required. The databasealready has the latest level of the templates applied.

IRR8015 • IRR8025I

Chapter 4. Other IRR Messages 117

RACF Command MessagesThis chapter describes the messages with a prefix of IRR that are not systemoperator messages.

RACF routes these messages to the user. The format of these messages is:IRRxxnnnt text

where:IRR identifies the message as a RACF message.xx identifies the function issuing the message.nnn is the message serial number.t is the type code (I = information, or A = action).text is the text of the message.

The values for the xx field that identifies the function issuing the message are:

xx Function/Program

16 Messages common to several commands

52 Dynamic parse (IRRDPI00 command) messages

62 RACF database verification utility program (IRRUT200)

63 Block update (BLKUPD) utility command (IRRUT300)

65 RACF database split/merge utility program (IRRUT400)

67 RACF database unload utility program (IRRDBU00)

and

RACF SMF data unload utility program (IRRADU00)

71 REXX RACVAR function

A0 RACF subsystem

B0 RACF subsystem

C0 RACF subsystem

D0 DISPLAY command messages

E0 SIGNOFF command messages

Messages Common to Several Commands

IRR16001I command-name failed. profile-name is not avalid profile name for class class-name.

Explanation: The profile name in the indicatedcommand did not follow the format required forprofiles in the indicated class.


User response: Check the spelling and form of theprofile name, and reissue the command.

IRR16002I command-name failed. The file pool id ismissing from profile name profile-name.

Explanation: The profile name in the indicated

command did not contain a file pool ID, which isrequired.


User response: Check the spelling and form of theprofile name, and reissue the command.

IRR16003I WARNING for command-name. Theexisting internal profile profile-name isnot valid and should be deleted.

Explanation: The indicated profile name was found inthe database, but it does not follow the format requiredfor profiles in the class related to the indicatedcommand.

IRR16001I • IRR16003I


System action: If the command was LFILE orLDIRECT, the invalid profile is listed normally. If thecommand was SRFILE or SRDIR, the invalid profile isnot added to the list of selected profile names. In allcases, command processing continues with the nextprofile name.

User response: Delete the invalid profile with theRDELETE command, or contact your systemadministrator to delete the profile.

Dynamic Parse (IRRDPI00 Command) Messages

Dynamic parse messages can be issued at the following times:v When dynamic parse is initializedv When IRRDPI00 is run (usually during system IPL)v When a user issues a RACF command that uses dynamic parse to check the

syntax of the operands specified on the RACF command.

IRR52001I Command IRRDPI00 is invalid whenRACF is not active.

Explanation: RACF is not active on the system. RACFmust be active to issue the command.

System action: IRRDPI00 command processing isterminated. No action taken.

Operator response: Ensure that RACF is available,and IPL the system again.


IRR52002I User userid not authorized to issuecommand IRRDPI00.

Explanation: The user indicated in the message is notauthorized to issue the IRRDPI00 command.



RACF Security Administrator Response: See RACFProgram Directory for MVS Installations or RACF ProgramDirectory for VM Installations for more information onusing IRRDPI00.

IRR52003I Command IRRDPI00 failed. Unable toestablish ESTAE environment. Returncode from ESTAE is return-code

Explanation: IRRDPI00 was unable to establish anerror recovery environment. Processing cannot continuewithout such an environment.




Problem determination: For a description of theESTAE return code, see one of the following:


v On MVS/XA, see MVS/XA SPL: System Macros andFacilities Volume 2, GC28-1151 or MVS/XA SupervisorServices and Macro Instructions, GC28-1154.


IRR52004I Command IRRDPI00 failed. Unable toprocess the parameters specified.

Explanation: IRRDPI00 was unable process theparameters specified.


User response: Reissue the IRRDPI00 command withcorrect parameters. For a description of IRRDPI00, seeRACF Program Directory for MVS Installations or RACFProgram Directory for VM Installations.

IRR52005I Dynamic parse initialization failed. Noaction was taken. Return code fromIKJPARS is return-code

Explanation: A call to the IKJPARS service routinefailed with the indicated return code.




Problem determination: See TSO/E ProgrammingServices for an explanation of the return code from theparse service routine.

IRR52001I • IRR52005I


IRR52006I Unable to completely parse commandcommand because the command line wasincomplete. Processing continues withthe next input line.

Explanation: The parse service routine did not receiveall the required operands, or an attention interruptoccurred before input was completed.

System action: Processing continues with the nextinput line in the dynamic parse specifications data set.



IRR52007I Command IRRDPI00 failed. No actionwas taken. Return code from STACK isreturn-code

Explanation: An error occurred when the STACKservice routine attempted to open the SYSUT1 data set.




Problem determination: See TSO ExtensionsProgramming Services for an explanation of the returncode from the STACK service routine.

IRR52008I Command IRRDPI00 failed. No actionwas taken. Return code from GETLINEis return-code

Explanation: An error occurred when the GETLINEservice routine attempted to read the SYSUT1 data set.




Problem determination: See TSO ExtensionsProgramming Services for an explanation of the returncode from the GETLINE service routine.

IRR52009I Error in PUTLINE service routine.Processing continues with next inputline. Return code is return-code

Explanation: An error occurred when the PUTLINEservice routine attempted to echo a line of input.

System action: IRRDPI00 command processing is

terminated. No action taken.



Problem determination: See TSO ExtensionsProgramming Services for an explanation of the returncode from the PUTLINE service routine.

IRR52010I Keyword keyword is specified out oforder. Processing continues with nextcommand.

Explanation: The dynamic parse specificationscommands were specified in the wrong order.

System action: Processing continues with the nextinput line.



IRR52011I Name name is invalid. Possible linecontinuation problem. Processingcontinues with the next input line.

Explanation: An invalid command was encountered inthe input, or, if this is a valid keyword, a continuationcharacter is missing on the previous input line.

System action: Processing continues with the nextinput line.



IRR52012I Segment name invalid for profile typespecified. Processing continues with thenext command.

Explanation: The segment name specified for aPROFILE command is not correct for that profile type.

System action: Processing continues with the nextDPSDS command set.

System programmer response: Make sure that thelevel of the RACF database templates is compatiblewith the IRRDPSDS data set. Also, make sure that anyupdates to the templates that affected the IRRDPSDSdata set were applied to the database via theIRRMIN00 PARM=UPDATE profile and that the systemwas IPLed to bring the correct templates into storage sothe fields and segment names can be verified againstthose in IRRDPSDS.

IRR52006I • IRR52012I



IRR52013I Field name invalid for profile typespecified.

Explanation: An invalid field name was specified onthe KEYWORD command, or a RACF Data BaseTemplate Field definition was not found for the fieldname specified.


System programmer response: Make sure that thelevel of the RACF database templates is compatiblewith the IRRDPSDS data set. Also, make sure that anyupdates to the templates that affected the IRRDPSDSdata set were applied to the database via theIRRMIN00 PARM=UPDATE profile and that the systemwas IPLed to bring the correct templates into storage sothe fields and segment names can be verified againstthose in IRRDPSDS.


IRR52014I SUBFIELD keyword is invalid for flagfield specifications. Processingcontinues with the next command.

Explanation: Flag field specifications require only themask keywords ORMASK and ANDMASK to bespecified. Information supplied by the SUBFIELDkeyword does not pertain to flag field specifications.




IRR52015I Mask values are required for flag fieldspecifications, but are not specified.Processing continues with the nextcommand.

Explanation: Flag field specifications require the maskkeywords ORMASK and ANDMASK to be specified.Information supplied by these commands is used toupdate the flag field in the RACF database.




IRR52016I SUBFIELD, TRANSLATE, andANDMASK/ORMASK are mutuallyexclusive, only one may be specified.Processing continues with the nextcommand.

Explanation: Explicit values are specified by theTRANSLATE keyword; therefore, novariable-value-subfield definition is required (in otherwords, the SUBFIELD keyword).




IRR52017I LIST keyword was not specified for arepeat group specification. Processingcontinues with the next command.

Explanation: The LIST keyword was specified and theRACF template definition showed the field named notto be a repeat group field.




IRR52018I Length of ORMASK is too long for fieldin RACF data base. Processing continueswith the next command.

Explanation: The value of the mask was too large tofit in the amount of storage available for the field.




IRR52019I Length of ANDMASK is too long forfield in RACF data base. Processingcontinues with the next command.

Explanation: The value of the mask was too large tofit in the amount of storage available for the field.



IRR52013I • IRR52019I



IRR52020I Dynamic Parse storage allocation failed.No action taken. Return code isreturn-code. Internal code is internal-code

Explanation: The dynamic parse table was notinstalled.

System action: Processing terminated.

System programmer response: Run IRRDPI00(dynamic parse initialization program). For adescription of IRRDPI00, see RACF Program Directoryfor MVS Installations or RACF Program Directory for VMInstallations.

User response: Contact system support.

IRR52021I You are not authorized to viewsegment-name segments.

Explanation: The user requested to display segmentinformation but did not have proper field-level accessauthority.

System action: The requested segment information isnot displayed for the requested profile(s). The basesegment information is listed if the user is authorizedand the NORACF keyword has not been specified.

RACF Security Administrator Response: For adescription of field-level access checking, see RACFSecurity Administrator's Guide.

IRR52022I Severe program error occurred. Consultyour System Programmer. Internal codeis code

Explanation: An error occurred in dynamic parseprocessing.

System action: The request is terminated.

System programmer response: Report the exact text ofthis message to your IBM support center.


IRR52023I Invalid input to dynamic parse tableupdate.

Explanation: There is an error in the dynamic parsespecifications data set.

System action: Command is terminated.

User response: Ensure that the correct dynamic parsespecifications data set is specified.

IRR52024I Unable to obtain space for DynamicParse Update work area. Return codefrom GETMAIN is return-code

Explanation: Dynamic parse issued the GETMAINmacro to obtain space, but the GETMAIN requestfailed.


System programmer response: For VM users, definemore storage for the RACF service machine. If theproblem cannot be corrected, report the exact text ofthis message to your IBM support center.

User response: For TSO users, log on with a largerregion size. For MVS batch users, specify a largerregion size for the job that failed.

IRR52025I Unable to obtain space for DynamicParse Table. Return code fromGETMAIN is return-code.





IRR52026I Unable to FREEMAIN space fordynamic parse table. Size of FREEMAINis size at location location. Return code isreturn-code.

Explanation: Dynamic parse issued the FREEMAINmacro to release space, but the FREEMAIN requestfailed.




IRR52027I Unable to perform a check for this fieldagainst the RACF template definitionbecause either PROFILE keywordinformation or SEGMENT keywordinformation was incomplete. Processingcontinues with the next command.

IRR52020I • IRR52027I


Explanation: An error was encountered in thedynamic parse specifications data set.

System action: Processing continues with the nextinput command.



IRR52028I Either PROMPT or DEFAULT must bespecified for the SUBFIELD keyword.Processing continues with the next inputcommand.





IRR52029I PROMPT and DEFAULT are mutuallyexclusive, only one may be specified.Processing continues with the next inputcommand.





IRR52030I PTYPE must be specified whenSUBFIELD is specified.





IRR52031I Command IRRDPI00 failed because thedynamic parse specifications data set isempty. No action was taken.

Explanation: There are no source statements in thedynamic parse specifications data set.

System action: No action was taken.

System programmer response: Ensure the correctdynamic parse specifications data set is specified. Seethe RACF Program Directory for more information.


IRR52100I Processing terminated. Dynamic parse isnot active. Contact your systemprogrammer.

Explanation: An operand specified on a RACFcommand was not recognizable without dynamic parse.


System programmer response: Ensure that IRRDPI00was run during IPL and that the correct dynamic parsespecifications data set was specified. See RACF SystemProgrammer's Guide for more information.


IRR52101I Processing terminated. Unable to obtainstorage for dynamic parse work area.





IRR52102I Insufficient storage for internal workarea. Processing terminated.



System programmer response: For VM users, definemore storage for the RACF service machine. If theproblem cannot be corrected, report the exact text of

IRR52028I • IRR52102I


this message to your IBM support center.


IRR52103I FREEMAIN failed for PCL work area.Contact your IBM support center.

Explanation: Dynamic parse issued the FREEMAINmacro to release space, but the FREEMAIN requestfailed.




IRR52104I Dynamic parse exit module-name notfound in load library. Commandprocessing continues.

Explanation: The installation exit indicated in themessage was not found in the load library.

System action: Command processing continueswithout the function provided by the installation exit.

System programmer response: Ensure that theindicated exit is in a LINKLIB or LPA library.


IRR52105I Field in dynamic parse table is notfound in template. Contact your systemprogrammer.

Explanation: A keyword specified in the command isfound in the dynamic parse table, but is not found inthe associated template.

System action: The RACF command is terminated.

System programmer response: Check that thetemplates used for the RACF database are correct. Ifnecessary, reinitialize RACF.


IRR52106I Segment not found in Template. Contactyour system programmer.

Explanation: A segment name specified on thecommand is found in the dynamic parse tables, but isnot found in the associated templates.


System programmer response: Check that the

templates used for the RACF database are correct. Ifnecessary, reinitialize RACF.


IRR52107I NOTIFY exit module-name not found.

Explanation: The installation exit indicated in themessage was not found.




IRR52108I Insufficient storage for internalworkarea. Processing terminated.GETMAIN return code is return-code.Internal code is code.





IRR52109I Dynamic parse storage allocation failed.No action taken. Return code isreturn-code.





IRR52103I • IRR52109I


IRR52110I Insufficient storage for command buffer.Processing terminated.

Explanation: There is not enough storage for thecommand as issued.

System action: RACF command is terminated.



IRR52112I Sub-operands are not allowed with‘NO-’ keyword. Processing terminated.

Explanation: A sub-operand that begins with NOcannot be specified.

System action: Processing is terminated.



IRR52113I Keyword keyword contains invalid ormissing subfield(s). Processingcontinues.

Explanation: One or more subfields specified for theindicated keyword are incorrect or are required.




IRR52114I Processing terminated. Unable to obtainstorage requested.





IRR52115I Error during RACF manager processing.Return code is return-code. Reason codeis reason-code.

Explanation: A RACF-manager error occurred duringrequest processing.

System action: RACF command is terminated.


Problem determination: Check the list ofRACF-manager return codes in “RACF-Manager ReturnCodes” on page 265. If the return code is listed, theexplanation should help you investigate the problem. Ifthe return code is not listed or relates to a problemwith RACF (as opposed to a problem you can fix in theRACF database), report the complete text of thismessage to your IBM support center.

IRR52116I RACF data base access denied — RACFis not currently active or the RACFdataset containing the requested profileis not active.

Explanation: RACF is not active at the time of thisrequest.

System action: No action is taken.

System programmer response: Check IPL processingto make sure that RACF is activated during system IPL.

User response: Issue your request again. If themessage persists, contact system support.

IRR52117I LISTING exit module-name not found.

Explanation: The installation exit indicated in themessage was not found.




IRR52118I Segment name abbreviation value isambiguous. Please enter again.

Explanation: The segment name specified is not longenough.

System action: If TSO prompting is on, the user isprompted for a valid segment name abbreviation. IfTSO prompting is off, RACF command processing isterminated.

User response: Specify a longer segment nameabbreviation.

IRR52110I • IRR52118I


IRR52119I Keyword name abbreviation value isambiguous. Please enter again.

Explanation: The keyword name specified is not longenough.

System action: If TSO prompting is on, the user isprompted for a valid keyword name abbreviation. IfTSO prompting is off, RACF command processing isterminated.

User response: Specify a longer keyword nameabbreviation.

IRR52120I SIZE size is out of range.

Explanation: The region size specified is incorrect foryour system.

System action: If TSO prompting is on, the user isprompted for a valid keyword name abbreviation. IfTSO prompting is off, RACF command processing isterminated.

User response: The region size specified is probablytoo large. If so, specify a smaller region size.

IRR52121I SIZE specified is greater thanMAXSIZE. SIZE is adjusted to be equalto MAXSIZE.

Explanation: The value specified for SIZE cannot begreater than the value specified for MAXSIZE.

System action: RACF adds a user profile, but adjustsSIZE to equal the MAXSIZE operand.


IRR52122I Conflict between SIZE and MAXSIZE.Operand ignored.

Explanation: The values specified on the SIZE andMAXSIZE operands are incompatible.

System action: RACF adds a user profile, but ignoresthe SIZE and MAXSIZE operands.


IRR52123I Data must be hexadecimal.

Explanation: The data specified can be A through Z or0 through 9.


User response: Correct the data and issue thecommand again.

IRR52124I Operand is not valid. Session keyinterval is not in range 1 - value.

Explanation: The session key change interval specifiedfor a session segment must be greater than or equal to1 and less than or equal to value, where value variesaccording to the setting of SETROPTSSESSIONINTERVAL. If SETROPTS SESSIONINTERVALis in effect, or defaulted, then value is theSESSIONINTERVAL value. If SETROPTSNOSESSIONINTERVAL is in effect, then the value is32767.

System action: If you are in prompt mode (on TSO,PROFILE PROMPT is in effect), you will receive aprompt to reenter the operand. If you are not inprompt mode, RACF terminates the command.

User response: Specify a valid value for theINTERVAL operand, by either responding to theprompt, or by reentering the command.

IRR52125I Operand is not valid. Session keyexceeds 8 characters.

Explanation: The user has entered more than eightcharacters of character data for a session key. Themaximum length is eight characters.

System action: If you are in prompt mode (on TSO,PROFILE PROMPT is in effect), you will receive aprompt to reenter the operand. If you are not inprompt mode, RACF terminates the command.

User response: Specify a valid value for the SESSKEYoperand, either by responding to the prompt, or byreentering the command.

IRR52126I RACXTRT failed. Return code isreturn-code. Reason code is reason-code.

Explanation: RACXTRT failed because of an error inan installation exit, or because of an internal error.



Problem determination: See the description of returnand reason codes for the RACXTRT macro inRACROUTE. Check any related installation exit for apossible error.

IRR52127I Field level access checking failed forsegment segment-name.

Explanation: You do not have authorization to theindicated segment.



RACF Security Administrator Response: For a

IRR52119I • IRR52127I


description of field-level access checking, see RACFSecurity Administrator's Guide.

IRR52128I Mutually exclusive operands arespecified for keyword keyword.Processing terminated.

Explanation: One or more pairs of operands cannot bespecified together on the indicated keyword in thedynamic parse specifications data set.




IRR52129I The PRIMARY sub-operand wasignored. value is not a valid languagecode.


Note that the ADDUSER or ALTUSER command wasissued with the PRIMARY sub-operand of theLANGUAGE operand specified and RACF is notrunning under MVS/ESA SP 4.1 or later.

System action: The user's default for the PRIMARYlanguage is not changed. Processing continues with thenext operand or sub-operand. If you issued theADDUSER command and no other messages wereissued by RACF, the user profile was created.

User response: Issue the ALTUSER command with avalid language code specified.

IRR52130I The PRIMARY sub-operand wasignored. The MVS message service isnot active.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because the MVSmessage service is not active.

Note that the ADDUSER or ALTUSER command wasissued with the PRIMARY sub-operand of theLANGUAGE operand specified and RACF is runningunder MVS/ESA SP 4.1 or later.



IRR52131I The PRIMARY sub-operand wasignored. The specified language is notactive.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because none ofthe languages active under the MVS message serviceare known, to the MVS Message Service, by thespecified name.



User response: Issue the ALTUSER command with avalid language code or language name specified.

IRR52132I The SECONDARY sub-operand wasignored. value is not a valid languagecode.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.

Note that the ADDUSER or ALTUSER command wasissued with the SECONDARY sub-operand of theLANGUAGE operand specified and RACF is notrunning under MVS/ESA SP 4.1 or later.

System action: The user's default for theSECONDARY language is not changed. Processingcontinues with the next operand or sub-operand. If youissued the ADDUSER command and no other messageswere issued by RACF, the user profile was created.


IRR52133I The SECONDARY sub-operand wasignored. The MVS message service isnot active.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because the MVSmessage service is not active.

Note that the ADDUSER or ALTUSER command wasissued with the SECONDARY sub-operand of theLANGUAGE operand specified and RACF is runningunder MVS/ESA SP 4.1 or later.

System action: The user's default for the

IRR52128I • IRR52133I


SECONDARY language is not changed. Processingcontinues with the next operand or sub-operand. If youissued the ADDUSER command and no other messageswere issued by RACF, the user profile was created.


IRR52134I The SECONDARY sub-operand wasignored. The specified language is notactive.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because none ofthe languages active under the MVS message serviceare known, to the MVS Message Service, by thespecified name.



User response: Issue the ALTUSER command with avalid language code or language name specified.

IRR52135I The PRIMARY sub-operand wasignored. QRYLANG macro failed withreturn code xxxx and reason code yyyy.

Explanation: The specified PRIMARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because an errorcondition occurred when the QRYLANG macro of theMVS message service was executing. The return code isindicated by xxxx. The reason code is indicated byyyyy.





IRR52136I The SECONDARY sub-operand wasignored. QRYLANG macro failed withreturn code xxxx and reason code yyyy.

Explanation: The specified SECONDARY sub-operandvalue is not one of the 3-letter codes defined by IBM.The specified value was therefore assumed to be aninstallation-defined language name, but the requiredlanguage code could not be obtained because an errorcondition occurred when the QRYLANG macro of theMVS message service was executing. The return code isindicated by xxxx. The reason code is indicated byyyyy.





IRR52139I KEYMASKED or KEYENCRYPTED datamust be 16 hexadecimal characters.

Explanation: You entered data in the KEYMASKED orKEYENCRYPTED suboperand that:

v Is not exactly 16 characters long.

v Contains characters other than the hexadecimalcharacters 0 through 9 and A through F.

System action: If TSO/E prompting is active for thesession, you are prompted to reenter the suboperand.Otherwise, command processing stops.

User response: Reenter the suboperand correctly. Besure it is 16 characters long and contains onlycharacters 0 through 9 and A through F.

IRR52140I Either the KEYMASKED or theKEYENCRYPTED sub-operand has beenspecified twice. Command processing isterminated.

Explanation: You entered the KEYMASKED orKEYENCRYPTED suboperand twice. The suboperandcan be specified only once.

System action: Command processing stops.

IRR52134I • IRR52140I


User response: Reenter the command and specify theKEYMASKED or KEYENCRYPTED suboperand onlyonce.

IRR52141I KEYMASKED and KEYENCRYPTEDare mutually exclusive sub-operands,and both have been specified.Command processing is terminated.

Explanation: You specified both the KEYMASKEDand the KEYENCRYPTED suboperands, which aremutually exclusive. You can specify only one operandat a time.


User response: Reenter the command with either theKEYMASKED or the KEYENCRYPTED suboperand.

IRR52142I The KEYENCRYPTED sub-operand wasspecified but a Cryptographic product isnot available on this system. Commandprocessing is terminated.

Explanation: The KEYENCRYPTED suboperand is notavailable. A cryptographic product is not available onthis system.


User response: Reenter the command with theKEYMASKED suboperand if you want to mask thesecured signon key when it is stored on the RACFdatabase. You can also reenter the command with theKEYENCRYPTED suboperand after you verify thatyour cryptographic product is installed and availableon your system.

IRR52153I Unexpected return code return-code andreason code reason-code encounteredwhile attempting an ICHEINTYoperation.

Explanation: Dynamic parse attempted to update aUID-to-user or GID-to-group mapping profile because achange was made to UID information by anADDUSER, ALTUSER, or DELUSER command, or toGID information by an ADDGROUP, ALTGROUP, orDELGROUP command. An ICHEINTY macro wasissued to update the RACF database; however, themacro failed with an unexpected return and reasoncode. Message IRR52154I will immediately follow thismessage and will identify the name of the mappingprofile for which the ICHEINTY failed, as well as the

name of the USER or GROUP profile for which thischange was being attempted. The return and reasoncodes are displayed in decimal.

System action: Command processing successfullyupdates the user or group profile, but the profile in theVMPOSIX class, which maps the user ID to a UID orthe group name to a GID, might not match theinformation in the user or group profile.

User response: See RACF Security Administrator'sGuide for details on the mapping profiles and how torecover from the failure reported by this message. If theinformation in the mapping profile for this UID/GID isnot kept up to date with respect to its correspondinguser/group profile, erroneous information will bereturned to OpenExtensions functions that requestinformation based on this UID or GID.

Report the exact text of this message to the IBMsupport center.

IRR52154I The information in the VMPOSIXmapping profile profile1 does not matchthe profile2 profile in the class class.

Explanation: Dynamic parse attempted to update aUID-to-user or GID-to-group mapping profile because achange was made to UID information by anADDUSER, ALTUSER, or DELUSER command, or toGID information by an ADDGROUP, ALTGROUP, orDELGROUP command. An ICHEINTY macro wasissued to update the RACF database; however, themacro failed with an unexpected return and reasoncode. The ICHEINTY operation, return code and reasoncode are identified in message IRR52153I, whichpreceded this message.

System action: Command processing successfullyupdates the user or group profile, but the profile in theVMPOSIX class, which maps the user ID to a UID orthe group name to a GID, does not match theinformation in the user or group profile.

User response: See RACF Security Administrator'sGuide for details on the mapping profiles and how torecover from the failure reported by this message. If theinformation in the mapping profile for this UID/GID isnot kept up to date with respect to its correspondinguser/group profile, erroneous information will bereturned to OpenExtensions functions that requestinformation based on this UID or GID.

Report the exact text of this message to the IBMsupport center.

RACF Database Verification (IRRUT200) Messages

IRR62001I Unable to open DD ddn - processingterminated

Explanation: The verification utility program was notable to open the database with the specified ddname.

System action: Processing terminates.



IRR52141I • IRR62001I


v On VM, ensure that the database specified by theFILEDEF statement is on a minidisk that has beenformatted for an OS data set.

Problem determination: Check for other errors relatedto the disk pack on which the database resides.

IRR62002I Unable to open DD SYSUT1 - copyfunction bypassed

Explanation: The verification utility program was notable to open the SYSUT1 data set.

System action: The data set associated with DDSYSRACF has opened successfully and is used by theutility program.

Programmer response: SYSUT1 DD statement is usedas the work data set in which IRRUT200 copies thedatabase specified by SYSRACF DD statement for thecopy function. If you want the RACF database to beused throughout processing, ignore this message.Otherwise, provide a usable work data set for SYSUT1DD statement and rerun the utility.

IRR62003I Unable to open dd SYSRACF - SYSUT1must contain RACF data set

Explanation: The verification utility program couldnot open the SYSRACF data set. The data set associatedwith DD SYSUT1 is assumed to contain a copy of theRACF database.


Programmer response: The database verificationutility will continue to process if it was unable to openthe data set pointed to by SYSRACF DD statement. Theutility assumes that the work data set (SYSUT1)contains a copy of the RACF database. Make sure thatSYSRACF DD statement points to a RACF data set.

IRR62004I Insufficient storage - processingterminated

Explanation: A GETMAIN failed for the buffers andwork areas necessary for the verification utilityprogram to function. The request was for storage fromsubpool 0.


Programmer response: Get the message ID, anydiagnostic information generated and contact your IBMsupport center.

Problem determination: A GETMAIN was issued forinternal work areas (buffers and work tables) in theIRRUT200 utility. The GETMAIN was unsuccessful.Probable cause: the storage was unavailable.

IRR62007I Invalid control statement

Explanation: The verification utility program foundthat the control statement contains a delimiter orcontents errors.


Programmer response: Verify that the SYSIN DDstatement contains valid IRRUT200 control statements.For valid control statements, see RACF SystemProgrammer's Guide.

IRR62008I I/O ERROR - jjj, sss, ddd, devtyp, ddn,oper, err, xxxx, acc

Explanation: The verification utility programencountered a permanent I/O error while processingon device ddd. In the message text, the error analysisinformation provided by the SYNADAF datamanagement macro instruction issued by the SYNADroutine was:jjj Job namesss Step nameddd Unit address of the devicedevtyp Device typeddn Data definition nameoper Operation attemptederr Error descriptionxxxx Last seek address or block countacc Access method.

This message can be caused by unformatted space atthe end of the RACF database. Copying the RACFdatabase with utilities other than IRRUT400 can causeunformatted space.


User response: Copy the database with IRRUT400 toformat the space.

IRR62009I EOF on SYSIN - processing terminated

Explanation: On MVS, the verification utility programfound an unexpected end-of-file condition on theSYSIN data set. On VM, the utility found it in theRACVERFY file.


Programmer response: Ensure that the END controlstatement is included in the SYSIN DD controlstatements to prevent an implied end of utilityprocessing from occurring.

IRR62010I RACF data set not found - processingterminated

Explanation: A failure occurred when the verificationutility program made a request to dynamic allocationfor information retrieval.


IRR62002I • IRR62010I


Programmer response: Make sure SYSRACF DDstatement specifies, as the data set name, the databaseyou want to use during processing.

IRR62012I Insufficient storage for map function -request terminated

Explanation: A GETMAIN failed for the storagerequired by the verification utility program to performthe map function. The request was for storage fromsubpool 0.


Programmer response: This is an internal error. Getthe message ID, any diagnostic information generatedand contact your IBM support center.

Problem determination: A GETMAIN request wasdone for storage to process the BAM/allocationverification for the MAP function of the IRRUT200utility. The GETMAIN failed. Probable cause is storageunavailable.

IRR62014I RBA of top level index block is invalid -may be an empty dataset - processingterminated

Explanation: The verification utility program found anerror in the RBA (relative byte address) of the top levelindex block (in the ICB).


Programmer response: See “Problem Determination”for more detail. Use the RACF Block Update Utility(IRRUT300) to correct the RBA of the top level indexblock. Also, make sure database is not empty.

Problem determination: When this error occurs, theutility dumps the ICB in hexadecimal. Any one of thefollowing conditions could cause this error in the ICB:

v The last 4 bytes are zero.

v The first 2 bytes are not zero.

v The last 12 bits are not zero (denoting an address noton a 4K boundary).

IRR62015I RBA of first BAM block is invalid -map function terminated

Explanation: The verification utility program found anerror in the RBA (relative byte address) of the firstBAM block (in the ICB).


Programmer response: See “Problem Determination”for more detail. Use the RACF Block Update Utility(IRRUT300) to correct the RBA of first BAM block.

Problem determination: When this error occurs, theutility dumps the ICB in hexadecimal. Any one of thefollowing conditions could cause this error in the BAM:



v The last 12 bits are not zero (denoting an address noton a 4K boundary).

IRR62017I Sequence set chain field is broken

Explanation: In processing all the index blocks, theverification utility program keeps a count of level 01blocks. This count is used while processing thesequence set. While following the chain of level 01blocks (sequence set), the utility program found a zerosequence set RBA (relative byte address) before thecount of level 01 blocks was reached.


Programmer response: The current index block isdumped in hexadecimal. Use the RACF Block UpdateUtility (IRRUT300) to correct the problem. Rerun theIRRUT200 utility.

IRR62018I Program limit exceeded - processing ofindex blocks terminated

Explanation: More than six levels of index blockswere found by the verification utility program.

System action: Index block processing is terminatedafter six levels have been processed. Level 01 blocks arenot processed.

Programmer response: Use the BLKUPD utility(ICHUT300 or IRRUT300) to confirm that you have asmany levels as reported by this message. If you doconfirm this error, split the RACF database (using therange table) to correct the problem. For moreinformation, see RACF Diagnosis Guide. If you cannotcorrect the problem, contact your IBM support center.

IRR62019I Unable to open DD SYSUT1 for READafter COPY function completed -processing terminated

Explanation: The RACF database verification utilityprogram was not able to open the SYSUT1 data set forread after successfully copying the RACF database. TheRACF database is defined by the SYSRACF DDstatement on MVS and by the SYSRACF FILEDEF onVM.


Programmer response: Check for disk pack errormessages related to SYSUT1 DD allocation; verify thecharacteristics of the data set for SYSUT1 and makesure they are correct. Rerun the IRRUT200 utility usingthe SYSUT1 data set for SYSRACF DD statement and awork data set for SYSUT1. If the problem still occurs,run the IRRUT200 utility with the original databaseused prior to the error and do not use the copyfunction.

IRR62012I • IRR62019I


IRR62021I Unable to load SYSUT1 - unrecoverableI/O error on DD SYSRACF - processingterminated

Explanation: While reading the blocks from the RACFdatabase defined by the SYSRACF DD statement onMVS or the filedef in RACUT200 on VM, RACFencountered an unrecoverable error.


Problem determination: Message IRR62008I precedesthis message and provides information about the I/Oerror.

IRR62022I Unable to load class descriptor table

Explanation: The verification utility program was notable to load the class descriptor table.

System action: The verification utility programcontinues processing general classes using their class IDnumbers instead of their class names.

IRR62023I Incorrect RACF dataset format

Explanation: One of the following problems occurred:

v The database name pointed to by the new formatRACF database field (ICBDSFMT) of the inventorycontrol block (ICB) for the the SYSRACF DDstatement is not a restructured database.

v The inventory control block (ICB) does not have thecorrect information in the ICBID field.


Programmer response: Verify that your SYSRACF DDstatement points to a restructured database which hasbeen pre-formatted by RACF Database InitializationUtility (IRRMIN00). Correct the problem and rerun theIRRUT200 utility.

Problem determination: Make sure the database wasinitialized by the IRRMIN00 utility.

IRR62024I Segment table cannot be read


Programmer response: Verify that your SYSRACF DDstatement points to a restructured database which hasbeen pre-formatted by RACF Database InitializationUtility (IRRMIN00). Correct the problem and rerun theIRRUT200 utility.

Problem determination: An attempt was made by theRACF Database Verification utility to read the segmenttable associated with the templates for the data setspecified by SYSRACF DD statement. The READ wasunsuccessful because of one of the following:

v The database was not properly initialized by RACFDatabase Initialization utility (IRRMIN00).

v Reading of the database resulted in an end-of-filecondition before the segment table was found.

v The segment table did not exist.

Ensure that the database is initialized and contains aset of templates and the associated segment table.

IRR62025I Name of segment or profile in indexdoes not match equivalent in profile.See the following.

Explanation: The name and/or type of the profile donot agree between the index entry and the contents ofthe profile read. This message includes the followinginformation about the error:

IRR62025I Prof Type: profile typeIRR62025I Seg Name in Prof: segment name in

the profileIRR62025I Seg Name in Index: segment name in

the indexIRR62025I Prof Name in Prof: profile name in

the profileIRR62025I Prof Name in Index: profile name in

the index

For example, in the following, the profile names do notmatch:

IRR62025I Prof Type: DATA SETIRR62025I Seg Name in Prof: BASEIRR62025I Seg Name in Index: BASEIRR62025I Prof Name in Prof: PAYROLL.JULY.1987IRR62025I Prof Name in Index: PAYROLL.JULY.1986


Programmer response: Use the RACF Block UpdateUtility (BLKUPD) to correct the inconsistency.

Problem determination: The error message indicatesthe index name and profile name in which themismatch was found. Use this information to correctthe inconsistency.

IRR62026I BAM block chain field is broken - mapfunction terminated

Explanation: While processing the chain of BAMblocks, IRRUT200 found a zero chain field in the BAMbefore all the blocks (the number contained in the ICB)were processed.

System action: Map function terminates.

Programmer response: The BAM is dumped inhexadecimal when this error occurs. Use the RACFBlock Update Utility (IRRUT300) to correct theproblem.

IRR62027I BAM block chain fields are in a loop -map function terminated

Explanation: IRRUT200 was processing the BAMwhen the count of the number of BAMs in the ICB wasexceeded. The fields might be in a loop.

IRR62021I • IRR62027I



Programmer response: Use the BLKUPD utility(ICHUT300 or IRRUT300) to confirm this error. If youdo confirm this error, correct the problem usingBLKUPD. For more information, see RACF DiagnosisGuide. If you cannot correct the problem, contact yourIBM support center.

IRR62028I Count of BAM blocks in ICB is zero -map function terminated

Explanation: The ICB contains a count of zero for thenumber of BAM blocks in the RACF database.


Programmer response: Make sure your database waspre-formatted by the RACF Database InitializationUtility (IRRMIN00). Also, ensure that SYSRACF DDstatement points to the correct database you want touse.

IRR62029I Count of number of blocks defined by aBAM is invalid - map functionterminated

Explanation: The count of the number of blocksdefined by the BAM contained in the header is eitherzero or greater than 2038.


Programmer response: Make sure your database waspre-formatted by the RACF Database InitializationUtility (IRRMIN00). Also, ensure that SYSRACF DDstatement points to the database you want to use.

IRR62030I Data block failed validity check

Explanation: The data block pointed to by a level oneindex block does not begin with the value X'83'.


Programmer response: This is an internal error. Theblock in error is dumped in hexadecimal. Collect themessage ID, dump, and any other diagnostic materialsand contact your IBM support center.

IRR62031I Data block key length invalid

Explanation: The record name in the profile is notfrom 1 to 255 bytes in length.


Programmer response: This is an internal error. Theblock in error is dumped in hexadecimal. Collect themessage ID, dump, and any other diagnostic materialand contact your IBM support center.

IRR62032I Displacement to free space is incorrect

Explanation: The offset (in the header of the indexblock) to the free space in the block is incorrect, or theend-of-block delimiter (X'0C') is not present.


Programmer response: This is an internal error. Theparticular index block is dumped in hexadecimal.Collect the message ID, dump, and any otherdiagnostic material and contact your IBM supportcenter.

IRR62033I Displacement to last key is incorrect

Explanation: The offset (in the header of the indexblock) to the last entry is incorrect, or the entryidentifier (X'21' or X'20') is not present.


Programmer response: This is an internal error. Theindex block is dumped in hexadecimal. Collect themessage ID, dump, and any other diagnostic materialand contact your IBM support center.

IRR62034I E(P) Byte/RBA of next block in sequenceset is invalid

Explanation: The sequence set pointer entry in thelevel one index block is not preceded by the valueX'6x', or the next level one block is invalid for one ofthe following reasons:


v The last 4 bytes are zero and this is not the last blockin the chain.

v The RBA is not a multiple of 4096.


Programmer response: The index block is dumped inhexadecimal. Use the RACF Block Update Utility(IRRUT300) to correct the problem in the index. Rerunthe IRRUT200 utility.

IRR62035I E(P) Byte/RBA xxxxxxxxxxxx Failedvalidity check

Explanation: The pointer entry of an index entry inthe block is not preceded by the value X'6x', or theRBA xxxxxxxxxxxx of the next level index block orprofile is invalid for one of the following reasons:




v For level one blocks, the RBA is not a multiple of256.

IRRUT200 does not dump the index block if only theRBA is invalid.


IRR62028I • IRR62035I


Programmer response: If the problem was invalidRBA, no dump is produced. Otherwise, a hexadecimaldump is produced. Use the RACF Block Update Utility(IRRUT300) to correct the problem.

IRR62036I End of data flag byte possibly missing

Explanation: The end-of-block delimiter at the end ofthe index block is not X'0C' or the displacement to thisbyte is incorrect. The displacement is calculated byadding the sum of the length of the last entry name inthe block and the length of the pointer entry to theoffset of the last entry name in the block. If the lengthof the entry name is incorrect, the displacement to thisbyte is incorrect.


Programmer response: The block in error is dumpedin hexadecimal. Use the RACF Block Update Utility(IRRUT300) to correct the problem. Rerun theIRRUT200 utility.

IRR62037I Following Level 01 block is not pointedto by a Level 02 block

Explanation: An index block with a level greater thenX'02' points to an index block with a level of X'01' inthe header. IRRUT200 processes the level one indexblock normally.


Programmer response: The level one index block wasprocessed. You may want to run the IRRUT200 utilityagainst your database again to check for any remainingerrors.

IRR62038I I/O error rereading BAM block - mapfunction terminated

Explanation: IRRUT200 encountered an unrecoverableI/O error while attempting to reread a BAM block. Theblock is not dumped.

System action: MAP function terminates.

Programmer response: An I/O error message wasgenerated prior to this message (IRR62008I). Use thismessage to determine the cause of the I/O error.

IRR62039I Index block failed validity check

Explanation: The block does not begin with the valueX'8A'.



IRR62040I Invalid E(K) byte in key entry at offset

Explanation: An index entry name might not bepreceded by a valid key byte. All entries in indexblocks that are not level one must begin with the valueX'21'. In level one index blocks, either X'22' or X'21'must precede each entry except for the last entry, whichmust be preceded by X'20'.


Programmer response: Use the RACF Block UpdateUtility (IRRUT300) to correct the problem.

IRR62041I Key entry length invalid at offset offset

Explanation: An index entry name does not have avalid length. An entry other than the first entry in ablock that is not level one, might have a zero length. Ifit does, it must also have a compression count otherthan zero. The compression count must not be greaterthan the length of the first entry in the block. The offsetindicated in the message is the offset of the beginningof the invalid entry in the index block.



IRR62042I Logical length of data block is invalid

Explanation: The logical length of the profile is not amultiple of 256 or is greater than the allocated lengthas defined in the header.



IRR62043I More than 200 BAM allocation errorsfound

Explanation: In verifying the BAM blocks with theactual allocation of segments in the RACF database,IRRUT200 found more then 200 locations with possibleconflicts.


Programmer response: Make sure you are processingwith the correct database. Also, ensure that you have adatabase at the right release level and properlyinitialized.

IRR62036I • IRR62043I


IRR62044I Non Level 01 index block is in sequenceset

Explanation: The index block is in the sequence set,but the level in the header is not one.


Programmer response: The block in error is dumpedin hexadecimal. Use the RACF Block Update Utility(IRRUT300) to correct the problem.

IRR62045I Possible compression count error in keyentry at offset offset

Explanation: An index entry name might not have avalid compression count. The first entry must have azero compression count. An entry, other then the firstentry, must have a compression count which is lessthan or equal to the length of the first entry name. Theoffset indicated in the message is the offset of thebeginning of the invalid entry in the index block.


Programmer response: At the completion of the utilityprocessing, you can use the offset from the messageand correct the problem by using RACF Block UpdateUtility (IRRUT300).

IRR62046I Possible loop in sequence set

Explanation: The first entry name of the level oneindex block is not alphabetically greater than the firstentry name of the previous level one index block.


Programmer response: Use the BLKUPD utility(ICHUT300 or IRRUT300) to confirm this error. If youdo confirm this error, correct the problem usingBLKUPD. Note that if both blocks contain X'22', theyare valid duplicates. For more information, see RACFDiagnosis Guide. If you cannot correct the problem,contact your IBM support center.

IRR62048I RBA invalid for template at offset offsetRBA rba

Explanation: In the ICB, the indicated RBA for thetemplate at the indicated offset is invalid. The RBA isinvalid for one of the following reasons:





Programmer response: A dump is provided inhexadecimal. Use RACF Block Update Utility(IRRUT300) to correct the problem.

IRR62050I RBA of first block of index sequence setis invalid

Explanation: The RBA of the first block of the indexsequence set (in the ICB) is invalid for one of thefollowing reasons:





Programmer response: A dump is provided for theblock in error. Use the RACF Block Update Utility(IRRUT300) to correct the problem.

IRR62051I RBA of next BAM block is invalid -map function terminated

Explanation: The RBA of the next BAM block isinvalid for one of the following reasons:



System action: Map function terminates. Ahexadecimal dump is provided.

Programmer response: Using the information from theexplanation and the dump, use the RACF Block UpdateUtility (IRRUT300) to correct the problem.

IRR62053I Read failed for top level index block -processing terminated

Explanation: A permanent I/O error occurred whileattempting to read the top-level index block. The blockis not dumped.


Programmer response: Message IRR62008I containsthe specifics regarding the I/O error. Use thisinformation to determine the cause of the problem.

IRR62055I Template count in ICB is invalid

Explanation: The ICB contains a count of the numberof templates that is either zero or greater than thenumber of spaces allocated for template definitions.


Programmer response: Make sure that your databasehas been properly initialized by RACF DatabaseInitialization Utility (IRRMIN00). Also, make sure theSYSRACF DD statement points to the correct database.

IRR62056I Top level index block failed validitycheck - processing terminated

Explanation: The top-level index block, pointed to bythe ICB, does not begin with the value X'8A'.

IRR62044I • IRR62056I



Programmer response: Make sure your data base hasbeen properly initialized by the RACF DatabaseInitialization Utility (IRRMIN00). Also, make sure thatSYSRACF DD statement points to the correct database.

IRR62057I Unrecoverable logic error detectedduring name verification

Explanation: An error occurred within the utility.


Programmer response: Report this problem to yourIBM support center.

IRR62058I The offset table pointer for the aboveindex block failed a validity check

Explanation: This message is issued as part of thevalidity checking done by this utility.

Programmer response: Use the BLKUPD utility toinvestigate and correct the error.

IRR62059I The offset table entry count for theabove index block failed a validitycheck



IRR62060I The count of names in the above indexblock statistics does not equal the offsettable count of count



IRR62061I The offset table pointer at indexposition position has failed a validitycheck for the above index block



IRR62062I The offset table pointer at indexposition position does not point to avalid entry in the above index block


IRR62063I Zero segment count found during[MAP|INDEX] processing for entry atoffset offset.

Explanation: A segment count of zero was detected inan index entry beginning at offset offset. This is anincorrect state in that all index entries should have oneor more segments.

System action: Utility processing continues. A returncode of 8 is issued. BAM allocation errors(BAM=ALLOC ACTUAL=UNALLOC) are flaggedduring MAP processing for valid entries in the blockcontaining the failing entry.

For index processing, statistics are not compiled for thefailing index block. Validation continues with the nextindex entry.

Map processing is terminated for the failing block. Itcontinues with the next block.

Programmer response: A dump is provided for theindex block in error if INDEX was requested. The offsetof the index entry containing the incorrect segmentcount is included in this message text. (If only MAPprocessing was requested, running IRRUT200 anothertime requesting INDEX FORMAT will help to identifythe block in which the error occurred.) Determinewhether it is easier to delete or correct this entry. Ineither case, refer to the RACF Diagnosis Guide for indexentry formats.

If it is decided that the entry should be deleted, do sousing the RACF Block Update Utility (BLKUPD). Afterdeletion, MAP processing shows BAM allocation errors(BAM=ALLOC ACTUAL=UNALLOC) for the BAMassociated with the deleted profile. These errors can beresolved using the RACF Data BaseSplit/Merge/Extend Utility (IRRUT400).

If it is decided that the entry should be corrected, do sousing BLKUPD.

Upon completion of index entry correction or deletion,IRRUT200 must be run against the updated database toensure complete validation. IRRUT200 bypassesvalidation for index entries containing a zero segmentcount. Data block verification is bypassed during mapprocessing for all entries in the data block following theentry in error.

IRR62064I A RESERVE is not held while verifyingthe data base associated with DDSYSUT1

Explanation: This is an informational message. Itappears at the end of the DD SYSUT2 data set onlywhen the SYSUT1 DD statement is specified and theSYSRACF DD statement is absent from your JCL.

Programmer response:

IRR62057I • IRR62064I


v If the IRRUT200 utility ran without errors, themessage is informational only; no response isneeded.

v If the DD SYSUT1 data set has specified the activedatabase, and database updates were performedwhile the IRRUT200 utility was running, database

errors may have been reported. Database errorsreported in this instance are not necessarily truedatabase errors. Either rerun the job without makingdatabase updates while the job is running, or specifya DD SYSRACF statement to take advantage of theRESERVE on the data set.

RACF Block Update (BLKUPD) Command (IRRUT300)Messages

IRR63001I Invalid command.

Explanation: One of the following situations occurred:

v The command is unknown.

v The command is a subcommand of READ and wasentered without first entering the READ command.

v The command is a subcommand of READ orDISPLAY that attempts to update the RACFdatabase, but UPDATE was not specified on theREAD command.

v A READ (or DISPLAY) is in progress but thecommand entered is not a subcommand of READ (orDISPLAY).


Programmer response: Enter another command.

IRR63002I Offset is offset

Explanation: The search argument specified on theFIND command was located at the hexadecimal valuexxx into the specified NEW or OLD block.

Programmer response: Enter another command ifdesired.

IRR63003I String not found.

Explanation: The search argument in the FINDcommand was not located in the specified NEW orOLD block.


Problem determination: To view the contents of theNEW or OLD block, use the LIST or FORMATcommand.

IRR63004I REPLACE complete.

Explanation: The operation requested by the REPcommand is completed.


IRR63005I VERIFY failed. REPLACE not done.

Explanation: The string specified in the VER keywordof the REP subcommand was not found at the givenoffset, or the string extended beyond the end of theblock.

System action: The string was not replaced. Thecommand is ignored.


Problem determination: To view the contents of theNEW block, use the LIST or FORMAT command.

IRR63006I READ ended. Block not saved.

Explanation: The function initiated by the READcommand is ended and nothing is saved in response tothe END command.

System action: The block was not written back to theRACF database because either NOSAVE was specified,or no changes were made to the block, or UPDATE wasnot specified on the READ command.


IRR63007I UPDATE causes block overflow. NOchanges made.

Explanation: The REP, or CHANGE and INSERT(under DISPLAY) operation is ignored because themodified block would be greater than 4096 bytes.



Problem determination: To view the contents of theNEW block, use the LIST or FORMAT command.

IRR63008I Old block recopied into new block.

Explanation: The REREAD subcommand of READ iscomplete. The NEW block is again the same as theOLD block.


IRR63009I DISPLAY ended. Changes saved.

Explanation: The DISPLAY function is ended and theupdates saved. The block may be changed further bysubcommands of READ. The END SAVE subcommandof READ will update the RACF database with thisblock.


IRR63001I • IRR63009I


IRR63010I DISPLAY ended. Changes not saved.

Explanation: The DISPLAY function has endedwithout saving the changes made in response to theEND (with NOSAVE) command, or because UPDATEwas not specified on the READ command.


IRR63011I Invalid data in index block. DISPLAYended.

Explanation: The entry identifier or the length in theindex is not correct.

System action: The DISPLAY function is ended andany changes made are not saved.

Programmer response: To correct the entry, use theLIST and REP subcommands of READ. Enter theDISPLAY subcommand again.

Problem determination: Record message number andRBA of READ command. Get a dump of the area youare trying to DISPLAY and check the data of the entrywhich had the error. Contact your IBM support center.

IRR63012I Block is not a valid index block.

Explanation: The block that is the object of aFORMAT or DISPLAY command is not a valid indexblock. The following tests are made for a valid indexblock:


v The second index block identifier (offset 03) must beX'4E'0.




v The entry identifier for all entries must be X'21' orX'22', except for the identifier of the last entry in alevel 01 block, which must be X'20'.

v The lengths of all entries must be correct.

v The pointer section identifier—also called the E(P)byte—of each entry must be X'62' or X'66'.


Programmer response: Make sure the RBA specifiedon the READ command is that of an index block. Usethe LIST and REP subcommands of READ to fix theindex block.

Problem determination: Record message number andRBA of READ command. Get a dump of the area youare trying to DISPLAY or FORMAT and check the data

of the index which had the error. Contact your IBMsupport center.

IRR63013I READ ended. Block saved.

Explanation: The function initiated by the READcommand is ended.

System action: The modified block is saved in theRACF database.

Programmer response: Enter a READ, LOCATE or,END command.

IRR63014I Record not found.

Explanation: The RBA (relative byte address) specifiedon a READ command is not within the extents of theRACF database.


Programmer response: Enter another READ commandfor a block within the RACF database.

IRR63015I Open failed for DD SYSRACF.

Explanation: The BLKUPD utility command could notopen the RACF database defined by the SYSRACF DDstatement.

System action: The BLKUPD command utility isended.

Programmer response: Allocate the RACF database toDD SYSRACF and retry.

Problem determination: Find out if the DD SYSRACFis already allocated to a data set.

IRR63016I I/O error - jjj, sss, ddd, devtyp, ddn, oper,err, xxxx, acc

Explanation: The BLKUPD utility encountered apermanent I/O error while processing on device ddd.

System action: The command is terminated with areturn code 12.

Programmer response: Examine the text of themessage displayed on terminal and match error withcodes in “Problem Determination.”

Problem determination: In the message text, the erroranalysis information provided by the SYNADAF datamanagement macro instruction issued by the SYNADroutine was:jjj Job namesss Step nameddd Unit address of the devicedevtyp Device typeddn Data definition nameoper Operation attemptederr Error descriptionxxxx Last seek address or block count

IRR63010I • IRR63016I


acc Access method.

IRR63017I Entry not found. Logical level 1 follows.

Explanation: The entry specified in a LOCATEcommand cannot be found. The level 1 block thatought to contain the specified entry is displayed.

Programmer response: Enter a READ, LOCATE orEND command. To add the entry to the block, use theDISPLAY subcommand of READ.

Problem determination: To view the contents of theindex block, use the LIST or FORMAT command.

IRR63018I Index block chain for entry is broken.

Explanation: A block in the chain for a LOCATEcommand search is not a valid index block. Thefollowing tests are made for a valid index block:

v The same tests are made as shown for messageIRR63012Ipage “IRR63012I” on page 138.

v The RBA (relative byte address) for the next byte onthe chain must be nonzero, with the two high orderbytes zero, and represent an address on a 4Kboundary within the extent of the RACF database.

v The level of the block must be below the level of theprevious block on the chain.



Problem determination: Run the IRRUT200 utilityagainst the RACF database to find the troubled area.

IRR63019I Error in sequence set. Index block atRBA rba.

Explanation: The sequence set block at the specifiedRBA (relative byte address) contains an error. Thefollowing tests are made for a valid block:

v The block must be in collating sequence with theprevious block on the sequence set.






v The entry identifier of the last entry in the blockmust be X'20'.

v The entry identifier for all other entries must be X'21'or X'22'.

v All entries must have correct lengths and pointersection identifiers of X'62' or X'66'.

v The block must be a level 01 block.

v The RBA (relative byte address) for the next byte inthe sequence set must be nonzero, with the twohigh-order bytes zero, represent an address on a 4Kboundary within the extent of the RACF database,and be not more than 4 bytes long.



Problem determination: Examine the hexadecimaldump of the index block. Run the IRRUT200 utilityagainst the RACF database to find the index problem.

IRR63020I Entry not found. DISPLAY ended.

Explanation: The DISPLAY command specified anentry that could not be found in the index block.


Programmer response: Reenter the DISPLAYcommand with an existing entry.

IRR63021I BLKUPD ended due to error+ Unable toestablish ESTAE.

Explanation: The BLKUPD utility ended due to asystem error. An ESTAE recovery environment couldnot be established.

System action: BLKUPD command processingterminates with a return code of 12.

Programmer response: Enter the BLKUPD commandagain. If the problem persists, ensure that RACF andthe operating system are properly installed. If they are,report this message (including its message ID) to yourIBM support center.

Problem determination: Examine system abend codeand return code to determine the cause of the ESTAEsetup failure.

IRR63022I Command not processed due to error+routine-name return code is return-code

Explanation: The TSO/E service routine indicated inthe message failed with a return code of xx.


Programmer response: Refer to manual containing theservice routine for an explanation.

Problem determination: For an explanation of theTSO/E service routines return codes, see one of thefollowing:

IRR63017I • IRR63022I




IRR63023I Key length error+ Compression countplus key length must be from 1 to 255characters.

Explanation: After processing a CHANGE or INSERTcommand, the compression count plus the key lengthof the new entry is less than 1 or greater than 255.


Programmer response: Adjust the length orcompression count so that the sum is 255 or less. Enterthe command again.

Problem determination: To view the contents of theindex block, use the LIST or FORMAT command.

IRR63024I Invalid ICB. LOCATE ended.

Explanation: The LOCATE command found the ICB inthe RACF database contains incorrect data. Thesequence set RBA or the RBA of the first index block inthe ICB is zero or not on a 4K boundary.

System action: The LOCATE command is ignored.

Programmer response: Correct the ICB using theREAD command and its subcommands. Check that thedatabase used is the correct RACF database.

Problem determination: Run the IRRUT200 utilityagainst the RACF database to find the error.

IRR63025I Entry found.

Explanation: The entry requested by the LOCATEcommand was found with a sequence set search.

System action: The index block containing the entry isdisplayed.


IRR63032I Segment not defined in templates.

Explanation: The segment name specified does notmatch any of the segments defined in the templates.

System action: Command fails.

Programmer response: Check the segment name thatwas specified as the SEGMENT parameter.

IRR63033I Base segment cannot be specified.

Explanation: The segment name specified of BASE onthe command is invalid. Only the RBA of the BASEsegment can be updated.



IRR63034I Segment already exists.

Explanation: The segment name specified on theINSERT command already is defined to the currententry.



IRR63035I Storage allocation failed.

Explanation: The GETMAIN of storage for thismodule failed.

System action: The BLKUPD utility terminates with areturn code of 12.

Programmer response: Try the command again. If thesame error occurs, check for a problem with storagemanagement. Should storage management be fine,record this error and call your IBM support center.

Problem determination: Examine abend and returncode from GETMAIN. Refer to proper manual fordetails about failure codes.

IRR63036I The first index entry has been deleted.The rest of the index block may need tobe updated.

Explanation: The programmer just deleted the firstindex entry of an index block.

Programmer response: Check the rest of the indexentries for front-end compression. If they werecompressed they may need to be decompressed sothere will be no errors in the index block.

Problem determination: Use the FORMAT commandto view the NEW block to analyze the index blockwhich has been updated.

IRR63037I The first index entry has been changed.The rest of the index block may need tobe updated.

Explanation: The programmer just changed the firstindex entry of an index block.

Programmer response: Check the rest of the indexentries for front-end compression. If they werecompressed they may need to be decompressed so

IRR63023I • IRR63037I


there will be no errors in the index block. Also checkthat the index entries are still in collating sequence.


IRR63038I The first index entry has been inserted.The rest of the index block may need tobe updated.

Explanation: The programmer just inserted a new firstindex entry into the current index block.

Programmer response: Check the rest of the indexentries for front-end compression. If they werecompressed they may need to be decompressed sothere will be no errors in the index block. Also checkthat the index entries are still in collating sequence.


IRR63039I Segment does not exist.

Explanation: The segment name specified on theSEGMENT keyword of the CHANGE or DELETEcommands is not defined to the current index entry.


Programmer response: DISPLAY the index entry againand examine it to be sure it is the correct entry. If thesegment you wish to update is not there, use theINSERT command to insert it.

Problem determination: Use the DISPLAY commandto view the index entry and its segments.

IRR63040I Input data set is invalid. Processingterminated.

Explanation: The database specified on the BLKUPDcommand is not a valid format RACF database.

System action: The BLKUPD utility terminates with areturn code of 12.

Programmer response: Check the database name.Check the database block size; it must be 1024 or 4096.

Note: RACF 1.9.2 supports only restructured databases,which have a block size of 4096. See Program Directoryfor information about this change.Call your IBM support center with this messagenumber and a listing of the database you are trying toBLKUPD.

IRR63041I Could not read the ICB.

Explanation: The RACF database specified on theBLKUPD command could not be validated for itsformat because the ICB could not be read.


Programmer response: Check the database name.Check the database block size; it must be 1024 or 4096.

Note: RACF 1.9.2 supports only restructured databases,which have a block size of 4096. See Program Directoryfor information about this change.

Problem determination: Run the IRRUT200 utility tovalidate the RACF database and to point out anydiscrepancies. Call your IBM support center with thismessage number and a listing of the database you aretrying to work with.

IRR63042I This is not a level 1 index block, nosegment information is available.

Explanation: The index block that was read in by theREAD command is not a level-1 index block. TheSEGMENT keyword of the DISPLAY command and itssubcommands is only valid for level-1 index blocks.

System action: The subcommand of DISPLAY(CHANGE, INSERT, or DELETE) fails, and utilityprocessing continues.

System programmer response: End processing of theDISPLAY command and perform a FORMATsubcommand under READ. Determine the level of theindex block being listed by the output of the FORMATsubcommand. Reassess which level-1 index block RBAyou intended to work with, END the READ command,and issue the READ command with the RBA of thelevel-1 index block.

IRR63043I The ICB indicates the input data set isnot a Restructured Data Base. The ICBmay be corrupt. Processing Continues.

Explanation: The ICBDSFMT field of the ICB, for theRACF data base specified on the BLKUPD command,indicates that data base supplied is not a RestructuredRACF Data Base.

System action: Utility processing continues.

System programmer response: Use theBLKUPD/READ/LIST ALL command to examine theICB and assess the extent of the damage to the ICB. Ifthe ICB is extensively damaged call your IBM supportcenter with this message number and a listing of thedata base you are trying to BLKUPD.

IRR63038I • IRR63043I


RACF Database Split/Merge Utility (IRRUT400) Messages

IRR65000I Invalid input to message writing routineattempting to write message numbermessage-number.

Explanation: This is an error internal to the utility.The specified message-number was not found.

System action: System processing continues.

Problem determination: Record the specified messagenumber and contact your IBM support center.

IRR65001I Element number number of range tableis out of sequence.

Explanation: The indicated range table entry is out ofcollating sequence.


System programmer response: Ensure that the rangetable was assembled and link-edited correctly. Correctthe order of the entries which are out of sequence. Forinformation on using a range table, see RACF SystemProgrammer's Guide.

Problem determination: Verify that each entry in therange table appears with its keys in ascending order.

IRR65002I Unable to load module table-name to beused as range table.

Explanation: The load module named in the TABLEkeyword could not be loaded into storage.


System programmer response: On MVS, a STEPLIBDD statement might be missing; on VM, perhaps themember could not be loaded from the user-suppliedlibrary.

IRR65003I error-type on ddname attempting a requestof block at RBA rba.

Explanation: The indicated error occurred whileattempting a BDAM read (READ), BDAM write(WRITE), or BSAM write (LOAD).

System action: The ddname of the file on which theerror occurred is listed, along with the RBA (relativebyte address) of the byte being accessed.





IRR65004I Range table contains no elements orfirst element string is not binary zeros.

Explanation: The first fullword of the range table isbinary zeros, indicating no elements in the table, or thestring portion of the first element is not binary zeros, asis required.


Programmer response: Ensure that the range tablewas assembled and link-edited correctly. Forinformation on using a range table, see RACF SystemProgrammer's Guide.

IRR65005I RACF data set full on ddname.

Explanation: Space has been exhausted on thespecified output RACF database.


System programmer response: Increase the size of theoutput database.

Problem determination: This message is accompaniedby message number IRR65018I, which can be used todetermine how much data has already been processed.

IRR65006I Unable to open dsname, ddname.

Explanation: If the database is for input, the utilityterminates. If the database is for output, onlyprocessing to that database is terminated.





IRR65007I Information retrieval for ddname failedwith error code code.

Explanation: RACF issued a dynamic allocationrequest (SVC 99) for information about the ddnameindicated in the message. However, the return codefrom dynamic allocation was unexpected.




v On MVS/ESA, see MVS/ESA SPL: ApplicationDevelopment Guide, GC28-1852.

IRR65000I • IRR65007I


IRR65008I dsname successfully opened for open-typeon ddname.

Explanation: The named database has beensuccessfully opened (BSAM open for INITIALIZATIONor BDAM open for PROCESSING) with the givenddname.

System action: Utility processing continues normally.

IRR65009I No input DD statements found -Processing terminated.

Explanation: The utility cannot perform without atleast one input RACF database.

System programmer response: Ensure that at leastone DD statement has been allocated.

Problem determination: Check the JCL DD statementsto verify this.

IRR65010I LOCK function requested, ddname already| now locked.

Explanation: To prevent updates to the databaseindicated by ddname, the LOCK function is requested.If the database was not located previously, it is lockedat this time.


IRR65011I Lock recovery disposition successful forddname.

Explanation: This message reports the results of theattempt to turn the extend bit OFF in the ICB for thelisted ddname. If lock recovery is not successful, the bitwill still be ON in that ICB. If lock recovery issuccessful, the bit has been turned OFF.


IRR65012I profile-name in class class-name fromddname is duplicate of same name fromddname.

Explanation: The named profile could not be copiedto an output database because it has the same name asa profile already copied from another input database.Either the profile is in a class other than DATASET orthe NODUPDATASETS option is in effect.


Problem determination: Check the PARM field of theEXEC statement for this utility. For duplicate names,option DUPDATASETS must be in effect. Also, check tosee what class the profile is actually in.

IRR65013I Index entry entry-name on ddname pointsto a tape volume set of which it is not amember.

Explanation: The index entry indicated by entry-namedoes not appear in the volume list of the profile for thetape volume set to which it points.

System action: The index entry is not copied to anoutput database. The tape volume set is copied if noother errors exist.


Problem determination: Ensure that the index entryand database specified by DD statement are bothcorrect.

IRR65014I A tape volume set from ddname isinconsistent with the range table,member names follow: member-namemember-name ...

Explanation: The range table specified with theTABLE keyword does not designate all of the membersof the set to be copied to the same output database.The member names listed are not prefixed by thecharacters TAPEVOL-, but the prefix was used wheninterrogating the range table.

System action: The tape volume set is not copied tooutput.

IRR65015I A tape volume set from ddname1contains a duplicate of entry-name fromddname2, member names follow:member-name member-name ...

Explanation: Two tape volume sets contain the samename in their volume lists. Therefore, only one of thesets can be copied to the output database.

System action: The entire tape volume set whosemembers are listed is not copied to output.

IRR65016I abend-code abend during utilityprocessing.

Explanation: The specified abnormal terminationoccurred during the execution of the utility.



Problem determination: Use the indicated abend codeand any previous messages issued by this utility, todetermine the appropriate action. See your MVS systemcodes manual for more information about the abendindicated in the message.

IRR65008I • IRR65016I


IRR65017I Unable to establish recoveryenvironment. Processing terminated.

Explanation: Processing is terminated becauseadequate recovery cannot be provided.


System programmer response: Ensure that RACF andthe operating system are properly installed. If they are,contact your IBM support center.

IRR65018I Output processing to ddname terminatedwhile processing entry entry-name.

Explanation: Because of an error identified by themessage immediately preceding this message on theoutput, no further processing of the data set indicatedby ddname is attempted. The data set should not beused as a RACF database.


Problem determination: Use the information given byboth this and the preceding message to determine theproper corrective action.

IRR65019I Output processing to ddname terminateddue to failure during data setinitialization.

Explanation: An error occurred while performinginformation retrieval, opening, writing a block, or usingBSAM to write empty blocks. This message followsmessages IRR65003, IRR65006, and IRR65007. See theprevious message description for more information.


System action: Processing to the database isterminated.




IRR65020I Specified options: parm

Explanation: The parameters specified by the user onthe EXEC statement are listed.

System action: Utility processing continues normally.

IRR65021I Parameter error. Text beginning with‘text’ contains an undefined keyword.

Explanation: The listed text does not start with akeyword defined to the utility.


System programmer response: Check the PARM field

of the EXEC statement in the JCL.

Problem determination: Ensure that any abbreviationsfor keywords contain enough significant characters tomake the abbreviation uniquely identifiable to theutility.

IRR65022I Parameter error. Keyword ‘keyword’ isambiguous.

Explanation: The utility has more than one keywordwith the character string indicated by keyword.


System programmer response: Ensure thatabbreviations for keywords contain enough significantcharacters to make the abbreviation uniquelyidentifiable to the utility.

IRR65023I Parameter error. Text beginning with‘text’ is redundant or contradictory to aprevious specification.

Explanation: Either the keyword contained in the textor its opposite form was specified previously. Theutility uses the first specification of the keyword.


System programmer response: Ensure thatabbreviations for keywords contain enough significantcharacters to make the abbreviation uniquelyidentifiable to the utility.

Problem determination: For a complete description ofall parameters supported by this utility, see RACFSystem Programmer's Guide.

IRR65024I Parameter error. Keyword‘keyword(value)’ contains an unacceptablevalue.

Explanation: The value specified is not acceptablewhen associated with the keyword listed.



Problem determination: For a complete description ofall parameters supported by this utility, see SPL: RACF.

IRR65025I Options in effect: options

Explanation: All options, including default options, ineffect for the execution of this utility are listed.

System action: Processing continues normally.

IRR65017I • IRR65025I


IRR65026I Options in Effect: UNLOCKINPUT

Explanation: UNLOCKINPUT is the only optionspecified for this execution of the utility.

System action: The utility unlocks the inputdatabases. The utility does not copy the databases.

IRR65027I UNLOCKINPUT is the only optionallowed. Processing terminated.

Explanation: More than one option was specified.UNLOCKINPUT must be the only option requested forexecution.


System programmer response: Specify theUNLOCKINPUT parameter without any other option.

IRR65028I UNLOCK function requested, ddnamealready unlocked.

Explanation: The database indicated by ddname wasunlocked before this attempt to unlock it.


IRR65029I UNLOCK function requested, ddnamenow unlocked.

Explanation: The database indicated by ddname hasbeen unlocked and is now ready for updates.


IRR65030I UNLOCK was not successful for ddname

Explanation: An error occurred while attempting tounlock an input database One of the followingsituations has occurred:

v The database indicated by ddname was not found.

v Unable to open ddname.

v Retrieval error for ddname.

v Permanent I/O error.

System action: The database indicated by ddname wasnot unlocked. Processing terminated.

System programmer response: To recover from theproblem, do the following:

v Ensure that the DD statement is specified correctly.

v Check if ddname is already allocated.

v Check if there were other error messages previous tothis one.

Problem determination: If other error messagespreceded this one, refer to those message explanationsto determine the cause of the problem.

IRR65031I No locking parameter was specified.Processing will terminate after thefollowing message.

Explanation: Without a locking parameter, the utilitycannot continue processing.

System action: Utility processing terminates after thefollowing message.

System programmer response: See following message.

IRR65032I One of the following parameters isrequired: LOCKINPUT,NOLOCKINPUT, or UNLOCKINPUT.

Explanation: Without a locking parameter, the utilitycannot continue processing.


System programmer response: Specify a lockingparameter and invoke the utility again.

IRR65033I Incorrect ICB found on ddname.Processing will terminate.

Explanation: The ICB related to the RACF databaseindicated by the ddname in the message cannot be usedby the utility. This message may also be issued whenthe database is empty.


System programmer response: Check that you havespecified the correct ddname and that it represents theRACF database you want to use. If it is, and the RACFdatabase was not previously formatted using this utilitywith the PARM=‘NEW’ specification on MVS or withthe RACINITD EXEC on VM, then rerun the utilitywith PARM=‘NEW’.

Problem determination: The validity check thatcaused the failure can result from an invalid ICB valuefor the number of templates or BAMs, or an invalidRBA (relative byte address). List the contents of thedata set defined by the SYSRACF DD statement todetermine the cause of the problem.

IRR65034I Incorrect blocksize found on ddname,IRRUT400 expects a blocksize of 4096.Processing will terminate.

Explanation: The DCB for the input ddname datasetindicates a block size other than 4096. IRRUT400 willonly process a data set with LRECL and BLOCKSIZEequal to 4096.


System programmer response: Ensure that the dataset name specified on the ddname DD statement is arestructured RACF database. ICHUTxxx utilities shouldonly be run against nonrestructured RACF databases.IRRUTxxx utilities should only be run against

IRR65026I • IRR65034I


restructured RACF databases.

RACF Database Unload Utility (IRRDBU00) Messages andRACF SMF Data Unload Utility (IRRADU00) Messages

Some messages are issued by both utilities. Some messages are issued only byIRRDBU00, and some messages are issued only by IRRADU00.

IRR67000I Incorrect input to message writingroutine attempting to write messagenumber message-number

Explanation: This is an error internal to the utility.The specified message number was not found.


Problem determination: Record the specified messagenumber and contact your IBM support center.


Explanation: An ESTAE environment could not beestablished.



Problem determination: See “System ProgrammerResponse.”

IRR67002I Data set conversion utility hassuccessfully finished processing.

Explanation: No errors were encountered during thedatabase conversion.

System action: Utility processing terminates. If theLOCKINPUT parameter was specified, the inputdatabases remain locked.

IRR67003I Data set conversion utility completedunsuccessfully.

Explanation: An error was encountered during utilityprocessing.

System action: If the error is a write error, utilityprocessing terminates. If the error is a read error, utilityprocessing continues and the failing profile is flagged.The RACF-manager return and reason codes are issued.If the LOCKINPUT parameter was in effect and theinput databases were not already locked prior to theinvocation of the conversion utility, these databases areunlocked before the utility terminates.

Problem determination: This message is accompaniedwith other error messages, which can be used to help

pinpoint what caused the conversion process toterminate.

IRR67004I utility-name UNSUCCESSFUL: CANNOTOPEN SYSPRINT.

Explanation: The sysprint DCB could not be openedin order to enable messages to be printed.


Problem determination: Ensure that SYSPRINT hasbeen allocated in the JCL.

Note: This is a WTO with routing code 11.

IRR67005I RACF is not active.

Explanation: RACF is not installed on system or it isinactive.


System programmer response: Ensure that RACF isproperly installed on system.

Problem determination: Contact your IBM supportcenter if this problem recurs.

IRR67006I RACF is not at appropriate release level.

Explanation: RACF is installed, but is not at leastversion 1.9.0.


System programmer response: Install RACF 1.9.0 orlater on your system.

Problem determination: Contact your IBM supportcenter if this problem recurs.

IRR67007I The blocksize was taken from DDddname and the data set was closed.

Explanation: The block size was successfully readfrom the specified database.


IRR67008I The blocksize was taken from DDddname but an error occurred whileclosing the data set.

Explanation: The block size was successfully read

IRR67000I • IRR67008I


from the specified data set, but this data set could notbe closed.


Problem determination: This message is accompaniedby messages issued by DFP. Follow the problemdetermination procedure for the DFP messages. Theseare contained in the MVS system messages manual.

IRR67010I Specified option: option

Explanation: The parameter specified with thePARM= field in the EXEC statement is listed here. Theparameters NOLOCKINPUT, LOCKINPUT andUNLOCKINPUT can be abbreviated to a minimum ofN,L and U, respectively. If no option is specified,message IRR67021I is issued.


IRR67011I Parameter error. Text beginning with‘text.’ contains an undefined keyword.

Explanation: An incorrect parameter was passed tothe utility.


System programmer response: Ensure that only oneof the following was specified: NOLOCKINPUT,LOCKINPUT, or UNLOCKINPUT.

Problem determination: Check the PARM= field ofthe EXEC statement.

IRR67012I Parameter error. Text beginning with‘text.’ is longer than valid keywords.

Explanation: An incorrect parameter was passed tothe utility.



Problem determination: Check the PARM= field ofthe EXEC statement.

IRR67013I Option in effect: option

Explanation: The full text of the option that the utilitywill process (based on the PARM operand of the EXECstatement) is displayed here.


IRR67014I Incorrect blocksize on INDD1. It shouldhave a blocksize of 1024.

Explanation: The input RACF database does not havethe required block size of 1024.


System programmer response: Ensure INDD1 isallocated to a valid RACF database with a block size of1024.

Problem determination: Check the DD field in theEXEC statement.

IRR67015I Incorrect blocksize on OUTDD1. Itshould have a blocksize of 4096.

Explanation: The new format database does not havethe required block size of 4096.


System programmer response: Ensure that OUTDD1is allocated to a preformatted RACF database with ablocksize of 4096.

Problem determination: Check the DD field in theEXEC statement.

IRR67016I RACF unable to build an ACEE.RACINIT return code is return-code.

Explanation: The accessor environment element(ACEE) could not be built for either the input or outputRACF database.


System programmer response: Ensure that RACF isproperly installed on system.

Problem determination: Record RACINIT return codeand this message ID, contact your IBM support center.

IRR67017I RACF created a down level ACEE. Dataset convert requires at least a level 2ACEE.

Explanation: The accessor environment element(ACEE) must be at least level 2.


System programmer response: Ensure that RACFversion 1.9.0 or later is properly installed on system.

Problem determination: If this message recurs, contactyour IBM support center.

IRR67020I Parameter error. Text ‘text’ is incorrect.Only one parameter may be specified.

Explanation: More than one parameter was passed tothe utility on the EXEC statement.



Problem determination: Check the PARM= field inthe EXEC statement.

IRR67010I • IRR67020I


IRR67021I No parameter specified. One of thefollowing is required: LOCKINPUT,NOLOCKINPUT, or UNLOCKINPUT.

Explanation: No parameters were passed to the utility.


System programmer response: Ensure that one of thefollowing is specified: NOLOCKINPUT, LOCKINPUT,or UNLOCKINPUT.

Problem determination: Check the PARM= field inthe EXEC statement.

IRR67030I RACF manager load module module-namecould not be loaded.

Explanation: An error occurred while attempting toload the specified manager-load module.


Problem determination: Ensure that RACF is properlyinstalled on the system.

IRR67031I Unable to obtain the number of recordsper track for dsname DD ddname.

Explanation: An error occurred in attempting to readthe number of records per track for the specified RACFdatabase.


Problem determination: Check for other errors relatedto the disk pack on which the database resides. Makesure the correct ddname and data set name werespecified.

IRR67032I RACF data set dsname DD ddname cannotbe used - incorrect ICB.

Explanation: An error occurred while validating theICB (inventory control block) of the specified RACFdatabase.


System programmer response: Ensure that thespecified database is properly initialized.

Problem determination: This error message isproduced if any of the following is true:

v The initialization routine, ICHMIN00, failed tocompletely initialize the RACF database.

v No block availability masks (BAM's) exist for thisdatabase.

v The RACF templates are not at least version 1.8 orlater.

v The relative byte addresses (RBA's) for this databaseare zero.

IRR67033I RACF unable to locate module-name inLPA.

Explanation: On MVS, RACF searched the link packarea and could not locate the specified modulenecessary for RACF processing; on VM, the modulewas not in RACFLPA LOADLIB. Processing cannotcontinue.


System programmer response: On MVS, ensure thatthe system parameters MLPA and LNK have beenspecified correctly. Make sure that the system has beeninstalled correctly.

Problem determination: See “System ProgrammerResponse.”

IRR67034I RACF data set dsname not at appropriaterelease level.

Explanation: The specified RACF database was foundto be not at least level 1.8.0.


System programmer response: Ensure that thepre-RACF 1.9 templates exist.

Problem determination: If the RACF database is onMVS, be sure it is cataloged and online. Also that thedevice on which the RACF database is mounted isfunctioning properly. Ensure that templates of thecorrect level were added to the RACF database if thedatabase was updated by the RACF databaseinitialization program ICHMIN00. (Down-leveltemplates can cause a RACF-manager error.)

IRR67035I I/O error occurred while trying to readthe ICB for dsname DD ddname.

Explanation: The ICB (inventory control block) for thespecified RACF database could not be read.






For further problem determination, see the section onstatus information following an I/O operation inMVS/DFP Version 3 Release 2: Macro Instructions forNon-VSAM Data Sets for an MVS/ESA system, orMVS/XA Data Administration: Macro Instruction Referencefor an MVS/XA system.

IRR67021I • IRR67035I


IRR67060I *** Profile processing not started ***

Explanation: Database processing was not attemptedbecause of a prior failure in setting up the utility.


System programmer response: Ensure that the properinitializations were made prior to executing the utility.Rerun the utility after correcting errors identified inprevious messages.

Problem determination: This message is usuallydisplayed after an error has been encountered. Use themessage(s) prior to this one to help determine what thespecific problem is.

IRR67090I Unexpected RACF manager return codewhile reading the data base. The nextmessage contains diagnosticinformation.

Explanation: While attempting to read the RACFdatabase, a return code was returned by RACFindicating an error during the READ operation.


Problem determination: The next message, IRR67092I,contains the return code, the reason code, and the entrythat was being processed. Use this information andinformation about ICHEINTY return codes from RACFMacros and Interfaces to determine the proper action.

IRR67091I Unexpected RACF manager return codewhile writing the data base. The nextmessage contains diagnosticinformation.

Explanation: While attempting to write to the RACFdatabase, a return code was returned by RACFindicating an error during the WRITE operation.

System action: The conversion job is terminated.

Problem determination: The next message, IRR67092I,contains the return code, the reason code, and the entrythat was being processed. Use this information andinformation about ICHEINTY return codes from RACFMacros and Interfaces to determine the proper action.

A common error is:

Return CodeExplanation

X'14' (20)The output database did not contain enoughspace for the conversion to complete.

IRR67092I Return code: return-code reason code:reason-code entry name: entry-name.

Explanation: This message is issued after eitherIRR67090I or IRR67091I. This message contains thereturn code, reason code, and entry name that were

returned from the failing request. A blank entry nameindicates that the utility was processing the first entryin the profile type.


Problem determination: Use the return code andreason code to determine the cause of the problem.RACF Macros and Interfaces contains these ICHEINTYreturn and reason codes.

IRR67093I Processing profile-type profiles.

Explanation: This is an informational messageidentifying the type of profiles that the utility is nowprocessing.


IRR67094I profile-count profile-type [class-name]profile(s) have been converted.

Explanation: This is an informational messageidentifying the number and the type of the profiles thatthe Database Conversion Utility has just converted. Theclass-name is only displayed for general resourceprofiles.


IRR67095I *** Conversion not completed. ***

Explanation: The Database Conversion Utilitydetected an error condition. Output is not complete.

System action: Processing halts.

Problem determination: Examine the previousmessages.

IRR67096I Userdata was found for connect profileentry name. This data cannot be copiedto the converted data base.

Explanation: The restructured RACF database doesnot store user data for connect profiles.


IRR67097I The connect profile entry name refers toa user profile which does not exist. Theconnect profile is not converted.

Explanation: The non-restructured RACF databasepermitted a connect profile to relate a group with anonexistent user. In a restructured database, this is notallowed.


IRR67060I • IRR67097I


IRR67098I The RACF manager experienced an errorwhile writing out the IRRDSC00performance buffers.

Explanation: An error occurred while the RACFmanager was processing on behalf of the IRRDSC00utility. The conversion was near completion. One of thelast tasks to be performed is writing out theperformance buffers. The conversion did not completesuccessfully and the output database is not usable.

System action: The database convert utilityterminates.

System programmer response: Check the console logfor I/O errors on the output restructured database.Look for IRR401I messages for information pertainingto I/O errors on the output database. If I/O errors arefound, locate and correct these problems and rerun thejob. Otherwise, save all documentation and contactyour support center.

IRR67120I abend-code abend during utilityprocessing. Reason code reason-code.

Explanation: A system abend occurred during utilityprocessing.

System action: Utility processing continues withrecovery procedures.

Problem determination: For more information aboutthe indicated abend, see an MVS/XA or MVS/ESAsystem codes manual.

IRR67121I The module in control at time of abendwas module-name.

Explanation: The internal module which was incontrol at the time of the abend is listed here fordebugging purposes.

System action: Utility processing continues withrecovery procedures.

Problem determination: This message is accompaniedby message number IRR67120I. If the problem recursafter following the problem determination for theabove message number, then record all informationprovided by these two messages and contact your IBMsupport center.

IRR67122I *** Utility ESTAE error routine incontrol. ***

Explanation: The recovery procedure for the utility isnow processing.

System action: Recovery processing begins.

IRR67123I Profile processing DID finish before theabend. Output should be complete.

Explanation: The recovery routine has determined thatthe abend specified in message number IRR67120Ioccurred after all profiles had been processed. Theoutput file should be complete. The abend must haveoccurred during resource cleanup.

System action: Recovery processing continues.

Problem determination: Verify that the utilitycompleted, using the IRRUT200 verification utility (ifyou are running data set convert).

IRR67124I Profile processing DID NOT finishbefore the abend. Output is NOTcomplete.

Explanation: The recovery routine has determined thatthe abend specified in message number IRR67120Ioccurred before the completion of the utility.

System action: Recovery processing continues.

Problem determination: If you are runningIRRDBU00, the output file was too small. Allocate abigger output file and rerun the utility. If you arerunning IRRDSC00, the output database may have tobe reformatted before rerunning the utility.

IRR67125I Utility ESTAE error routine will nowattempt clean-up processing.

Explanation: An attempt will be made to free all mainstorage that was used by the utility.

Note: If message IRR67124I was issued before thismessage, and you specified the LOCKINPUT parameterto lock the databases, the databases will be leftunlocked unless they were already locked before theutility was invoked.

IRR67150I Processing count RACF data set(s).

Explanation: The database utility expects to processthe indicated number of RACF databases. This numberis taken from the system ICHRDSNT.


IRR67151I LOCKINPUT parameter specified. DDddname is now locked.

Explanation: The LOCKINPUT parameter wasspecified in the input specifications for the utility. TheRACF database is locked. Others cannot write to theRACF database until the database is unlocked. If youhave a restructured database, use IRRUT400 orIRRDBU00 to unlock the database. This can be done byrunning the utility with the UNLOCKINPUT parameterspecified.

IRR67098I • IRR67151I



IRR67152I LOCKINPUT parameter specified. DDddname was already locked. Processingcontinues with this DDNAME.

Explanation: The LOCKINPUT parameter wasspecified in the input specifications for the utility, butthe specified RACF database was already locked.Others cannot write to the RACF database until thedatabase is unlocked. This can be done by running thedatabase conversion utility with the UNLOCKINPUTparameter specified.


IRR67153I Unexpected DD statement ddnamefound.

Explanation: You specified more DD statements thanthe RACF utility expected. For IRRDSC00, the numberof INDDx and OUTDDx statements must be either 1 orthe number displayed by message IRR67150I. ForIRRDBU00, the message applies only to INDDx becausethe utility only uses one OUTDD.

System action: Processing stops.

System programmer response: Ensure that thenumber of INDDx statements is 1 or the same as thenumber indicated by message IRR67150I. ForIRRDSC00, there must be exactly x INDDx andOUTDDx ddnames, where x is either 1 or the numbershown in message IRR67150I.

IRR67154I Blocksize is incorrect for data-set-name onvolume volume.

Explanation: The block size specified for the indicateddata on the indicated volume is incorrect.


System programmer response: Omit the BLKSIZEparameter on the DD statement, or specify the correctvalue for the indicated RACF database.

IRR67155I INDD1 is neither a primary nor backupdata set. No other input data set can bea primary or backup data set.

Explanation: The utility is processing a database thatis not being used by RACF as either a primary orbackup database.


System programmer response: Make sure that anyupdates to the primary or backup database areincorporated in the database that is produced by theutility.

IRR67156I DD ddname specifies a primary orbackup data set, but a non-primary ornon-backup data set was expected.

Explanation: The DD statement for INDD1 specifies anonprimary or nonbackup data set. Therefore, theutility expects all data sets to be nonprimary ornonbackup datasets. However, the ddname indicated inthe message specifies a primary or backup data set.

System action: The utility stops processing.

System programmer response: Correct the DDstatements and rerun the job.

IRR67157I DD ddname is not a primary data set.The following message shows theexpected primary data set.

Explanation: The DD statement for INDD1 specifies aprimary data set. Therefore, the utility expects all datasets to be primary data sets. However, the ddnameindicated in the message specifies a nonprimary dataset.



IRR67158I DD ddname is not a backup data set. Thefollowing message shows the expectedbackup data set.

Explanation: The DD statement for INDD1 specifies abackup data set. Therefore, the utility expects all datasets to be backup data sets. However, the ddnameindicated in the message specifies a nonbackup dataset.



IRR67159I Data set specified for INDD1 is primaryor back up, but it is not the first entryin ICHRDSNT.

Explanation: The DD statement for INDD1 specifies adata set that is either primary or backup. Therefore,INDD1 must be the first data set listed in ICHRDSNT.The ddname indicated in the message specifies a dataset that is either primary or backup and not the firstentry in ICHRDSNT.


System programmer response: Correct the DDstatements, and rerun the job.

IRR67152I • IRR67159I


IRR67160I Internal error in the utility.

Explanation: An error occurred in the processing ofthe utility.


System programmer response: Report this message toyour IBM support center. Please include the followinginformation: Interpreted JCL and SYSOUT. RACF/VMusers should provide the console log or other logwhere utility messages are logged.

IRR67161I Failed write for DD ddname.

Explanation: An error occurred while writing to theindicated data set.


System programmer response: This could be causedby a problem with the ddname indicated in themessage.

Problem determination: This message is accompaniedby messages issued by DFP. Follow the problemdetermination procedure for the DFP messages.

IRR67162I Dataset is data-set-name on volumevolume.

Explanation: This message identifies a RACF databasedescribed in an earlier message. If the devicecontaining data-set-name has been dynamicallyreconfigured from the system, *NA will replace thevolume information in the message.

System action: See “System Action” for the earliermessage.

IRR67163I INDD1 is a primary data set. All inputdata sets must be primary data sets.

Explanation: The DD statement for INDD1 specifies aprimary data set. Therefore, the utility expects all datasets to be primary data sets.


IRR67164I INDD1 is a backup data set. All inputdata sets must be backup data sets.

Explanation: The DD statement for INDD1 specifies abackup data set. Therefore, the utility expects all datasets to be backup data sets.


IRR67165I The RACF data set names table(ICHRDSNT) indicates that there are nn.RACF data sets, but only one wasspecified.

Explanation: The utility can process either your entire

RACF database or a single data set of a multi-data setdatabase. The utility has determined that you areprocessing a single data set from a multi-data setdatabase.


System programmer response: You may ignore thecount in IRR67150I if you are attempting to process asingle data set from a multi-data set database.

IRR67166I Processing continues using as input thedata set specified as INDD1.

Explanation: The utility can process either your entireRACF database or a single data set of a multi-data setdatabase. The utility has determined that you areprocessing a single data set from a multi-data setdatabase.

Be sure to examine the output of the utility for anyoccurrences of the IRR67091 and IRR67092 messagewith a return code of X'00000012' and reason code ofX'00000000' which can occur when a user profile iscontained in a separate database from its connectprofiles. This can happen if your range table splits thedatabase at a boundary between user profiles andconnect profiles.

Note: This can only occur if your range table splits thedatabase with a value that has two consecutive nullvalues, such as X'C10000C1'. If your range table hassuch a value, you must process all parts of yourdatabase in one execution of the utility.

IRR67167I Multiple OUTDD statements werespecified, but only one INDD wasspecified.

Explanation: The number of INDDx statements mustbe identical to the number of OUTDDx statements.


System programmer response: Execute the utilityspecifying the same number of INDDx and OUTDDxstatements.

IRR67168I Multiple INDD statements werespecified, but only one OUTDD wasspecified.

Explanation: The number of INDDx statements mustbe identical to the number of OUTDDx statements.


System programmer response: Execute the utilityspecifying the same number of INDDx and OUTDDxstatements.

IRR67160I • IRR67168I


IRR67180I Unable to open data-set-name associatedwith DD ddname.

Explanation: An error occurred while attempting toopen the specified database.






IRR67181I Information retrieval for DD ddnamefailed with error code error-code.

Explanation: The utility issued a dynamic allocationrequest (SVC 99) for information about the ddnameindicated in the message. However, the return codefrom dynamic allocation was unexpected.





v On MVS/ESA, see MVS/ESA SPL: ApplicationDevelopment Guide, GC28-1852.

IRR67182I data-set-name associated with DD ddnamehas been successfully opened.

Explanation: The specified data set is now open sothat the utility can read from it or write to it.


IRR67183I DD ddname not found.

Explanation: The specified DD was expected, but notfound. For IRRDSC00, the number of INDDx andOUTDDx statements must be either 1 or the numberdisplayed by message IRR67150I. For IRRDBU00, themessage only applies to INDDx because the utility onlyuses OUTDD.

If you are processing a single data set of a multi-dataset database, you may ignore this message for INDD2.

System action: If the ddname is INDD2, processingcontinues. For any other ddname, processing stops.

System programmer response: Ensure that thenumber of INDDx statements is one or the same as thenumber indicated by message IRR67150I. For

IRRDSC00, there must be exactly x INNDx andOUTDDx ddnames, where x is either 1 or the numbershown in message IRR67150I.

Problem determination: Check the job's DDstatements to verify that the correct number of INDDsand OUTDDs are allocated.

IRR67240I DD ddname could not be unlockedbecause of a write failure.

Explanation: An error occurred while attempting tounlock the specified input database.



v Ensure that the DD statement is correct.

v On VM, ensure that the database specified by the DDstatement is on a minidisk that has been formattedfor an OS data set.

v On VM, reinitialize the RACF service machine. Thismight correct errors in the FILEDEF statements.

v If you are processing primary databases, switch to abackup RACF database (using the RVARY SWITCHcommand).

Note: For complete information on recovering fromthe problem, see the section on RACF databaserecovery in RACF System Programmer's Guide. Payparticular attention to the section on failures duringI/O operations on the RACF database.

Problem determination: Other messages might havebeen issued for this problem. On VM, these messagesmight appear on the console log of the RACF servicemachine, or the system console or the security console,or end users might receive them. An analysis of thosemessages might help you determine the cause of theproblem. In particular, look for message ICH51011I,which reports a return code from the RACF manager.

IRR67241I Unlock was successful. DD ddname isnow unlocked.

Explanation: The RACF database indicated by theddname can now be updated.


IRR67242I DD ddname is already unlocked.

Explanation: You asked to unlock a database that isalready unlocked.


IRR67180I • IRR67242I


IRR67243I DD ddname could not be unlockedbecause of a read failure.

Explanation: An error occurred while attempting toread the specified input data set's ICB to determine itslock status.



v Ensure that the DD statement is correct.

v On VM, ensure that the database specified by the DDstatement is on a minidisk that has been formattedfor an OS data set.

v On VM, reinitialize the RACF service machine. Thismight correct errors in the FILEDEF statements.

v If you are processing primary databases, switch to abackup RACF database (using the RVARY SWITCHcommand).


Problem determination: Other messages might havebeen issued for this problem. On VM, these messagesmight appear on the console log of the RACF servicemachine, or the system console or the security console,or end users might receive them. An analysis of thosemessages might help you determine the cause of theproblem. In particular, look for message ICH51011I,which reports a return code from the RACF manager.

IRR67270I error-message-text on ddname whileattempting a request of a block at RBArba

Explanation: The indicated error occurred whileattempting a BDAM read (READ) or BDAM write(WRITE).

System action: The ddname of the file on which theerror occurred is listed, along with the RBA (relativebyte address) of the byte being accessed.





IRR67330I RACF manager load module module-namecould not be loaded.

Explanation: An error occurred while attempting toload the specified manager load module.


Problem determination: Ensure that RACF is properlyinstalled on the system.

IRR67331I Unable to obtain the number of recordsper track for dsname DD ddname.

Explanation: An error occurred in attempting to readthe number of records per track for the specified RACFdatabase.


Problem determination: Check for other errors relatedto the disk pack on which the database resides. Makesure the correct ddname and data set name werespecified.

IRR67332I RACF data set dsname DD ddname cannotbe used - incorrect ICB.

Explanation: An error occurred while validating theICB (inventory control block) of the specified RACFdatabase.


System programmer response: Ensure that thespecified database is properly initialized.

Problem determination: This error message isproduced if any of the following is true:

v The initialization routine, IRRMIN00, failed tocompletely initialize the RACF database or was neverrun against it.

v No block availability masks (BAM's) exist for thisdatabase.

v The RACF templates are not at least version 1.9 orlater.

v The relative byte addresses (RBA's) for this databaseare incorrect.

IRR67333I RACF unable to locate module-name inLPA.

Explanation: The specified module was not found inthe link pack area.

Explanation: On MVS, RACF searched the link packarea and could not locate the specified modulenecessary for RACF processing; on VM, the modulewas not in RACFLPA LOADLIB. Processing cannotcontinue.


System programmer response: On MVS, ensure that

IRR67243I • IRR67333I


the system parameters MLPA and LNK have beenspecified correctly. Make sure that the system has beeninstalled correctly.

IRR67335I I/O error occurred while trying to readthe ICB for dsname DD ddname.

Explanation: The ICB (inventory control block) for thespecified RACF database could not be read.






IRR67336I I/O error occurred while trying toupdate the ICB for dsname DD ddname.

Explanation: The ICB could not be written back to thespecified output database after it had been updatedwith the necessary RACF options.


System programmer response: Specify a SYSUDUMPcontrol card on the JCL used to invoke the utility sothat the register contents can be viewed. Register 15contains the status indicators and a pointer to the erroranalysis routine.

IRR67402I Database unload utility has successfullyfinished processing.

Explanation: No errors were encountered whileunloading the database.

System action: Utility processing terminates. If theLOCKINPUT parameter was specified, the inputdatabases are unlocked.

IRR67403I Database unload utility completedunsuccessfully.

Explanation: An error was encountered during utilityprocessing.

System action: If the error is an index read error,utility processing terminates. If the error is a non-indexread error, utility processing continues and the failingprofile is flagged. The RACF manager return andreason codes are issued. If the LOCKINPUT parameterwas in effect and the input databases were not alreadylocked before you invoked the unload utility, thesedatabases are unlocked before the utility terminates.

Problem determination: This message is accompaniedby other error messages, which can be used to help

pinpoint what caused the unload utility to terminate.

IRR67417I RACF created a down level ACEE.Database unload requires at least a level2 ACEE.

Explanation: The accessor environment element(ACEE) must be at least level 2.


System programmer response: Ensure that RACFversion 1.9.0 or later is properly installed on thesystem.

Problem determination: If this message recurs, contactyour IBM support center.

IRR67422I Incorrect blocksize specified for INDD1.The blocksize must be 4096.

Explanation: The data set that is specified as INDD1must be a restructured format RACF database, whichhas a blocksize of 4096. The data set specified asINDD1 had a blocksize of other than 4096.


System programmer response: Specify a restructureddatabase as INDD1.

Problem determination: Check the INDD1 DDstatement.

IRR67423I Open failed for OUTDD.

Explanation: An error occurred while attempting toopen the output data set.


Problem determination: Ensure that OUTDD isspecified.

IRR67460I *** Profile unloading not started ***

Explanation: Database unloading was not attemptedbecause of a prior failure in setting up the utility.


System programmer response: Ensure that the properinitializations were made before executing the unloadutility. Rerun the utility after correcting errors identifiedin previous messages.

Problem determination: This message is displayedafter an error has been encountered. Use the message(s)before this one to help determine what the specificproblem is.

IRR67335I • IRR67460I


IRR67494I profile-count profile-type [class-name]profile(s) have been unloaded.

Explanation: This is an informational messageidentifying the number and the type of the profiles thatthe Database Unload Utility has just unloaded. Theclass-name is only displayed for general resourceprofiles.


IRR67495I *** Unloading not completed. ***

Explanation: The Database Unload Utility detected anerror condition. Output is not complete.


Problem determination: Examine the previousmessages.

IRR67500I The Field Definition Table (FDT) andthe ACTN area do not match. Theunknown field is cccccccc.

Explanation: An internal error has occurred.

System action: The database unload utility terminates.

User response: Call the IBM support center.

Severity: Error


Explanation: An ESTAE environment could not beestablished.

System action: Utility processing stops.

User response: Ensure that RACF and the operatingsystem are properly installed. If they are, report thismessage (and its message ID) to your IBM supportcenter.

IRR67522I Open failed for OUTDD.

Explanation: An error occurred while attempting toopen the output data set.


User response: Ensure that OUTDD is specified.

IRR67524I A pre-RACF 1.9 record was encounteredin the input stream. The record isignored.

Explanation: The input contains a record created byan unsupported version of RACF. Because this utilitycan process only SMF records that were created byRACF Version 1.9.0 or later, the record is ignored.Message IRR67581I identifies the failing record in moredetail.


IRR67534I IRRADU00 UNSUCCESSFUL:CANNOT OPEN SDUPRINT.

Explanation: IRRADU00 could not open the requiredsysprint file ADUPRINT. This message is issued via awrite-to-operator (WTO) request.


User response: Allocate the file ADUPRINT beforeexecuting the utility.

IRR67540I The LRECL of the output data setallocated to OUTDD has been changedfrom original_lrecl to new_lrecl.

Explanation: The logical record length (LRECL) of theoutput data set was original_lrecl, which was smallerthan that which is required by the utility. The utilityhas set the LRECL of the output data set to new_lrecl.


IRR67541I The BLKSIZE of the output data setallocated to OUTDD has been changedfrom original_block_size to new_block_size.

Explanation: The block size of the output data set wasoriginal_block_size, which was smaller than that which isrequired by the utility. The utility has set the BLKSIZEof the output data set to new_block_size. Note that theblock size of the output data set must be at least 4bytes larger than the logical record length.


IRR67550I abend_code abend during utilityprocessing. Reason code rsncode.

Explanation: A system abend occurred during utilityprocessing.

System action: Utility processing continues with therecovery procedure.

User response: For more information about theindicated abend, see an MVS/XA or MVS/ESA systemcodes manual.

IRR67551I The module in control at time of abendwas module_name.

Explanation: The internal module that was in controlat the time of the abend is listed here for debuggingpurposes.

System action: Utility processing continues with therecovery procedure.

User response: This message is accompanied bymessage number IRR67550I. If the problem recurs afterfollowing the problem determination for the above

IRR67494I • IRR67551I


message number, then record all the informationprovided by these two messages and contact your IBMsupport center.

IRR67552I *** Utility ESTAE error routine incontrol. ***

Explanation: The recovery procedure for the utility isnow running.

System action: Recovery processing begins.

IRR67580I Unexpected relocate section found intype record_type record for event codeevent_code/event_code_qualifier. Therelocate number is relocate_number.

Explanation: This error message indicates that theSMF record being processed contained an unexpectedrelocate section. The type of the record is record_type.The unexpected relocate section is relocate_number.Event_code/event_code_qualifier are the event code andevent code qualifier for the record.

Message IRR67581I identifies the failing record in moredetail.


User response: Perform these steps:

1. Obtain a hexadecimal print of the failing recordfrom the input supplied to the utility. You can usethe MVS utilities IDCAMS or DITTO or theirequivalent for this.

2. Compare the relocate sections that you find in therecord with the relocate sections that are defined asvalid for the specific event code. You can find a listof event codes, relocate sections, and thecomponents that created the record, in MVS/ESASystem Management Facilities and RACF Macros andInterfaces.

3. Contact the IBM support center.

IRR67581I The failing record, relative_record, wascreated on date at time for user userid in

group groupid on system smf_id.

Explanation: This message is printed along withmessage IRR67580I or message IRR67524I. It identifiesthe failing record by the date(date), time(time), user ID(userid), group ID (groupid), and system (smf_id) that therecord was created. The record number of the failingrecord is also shown as relative_record.


User response: This information is used to find thefailing record so that you can find the failing profile.Relative_record may be useful when using print utilitiessuch as IDCAMS and DITTO that allow thespecification of a relative record number. See theDFSMS/MVS Access Method Services for the ICF andMVS/DITTO U. G. Reference for more information onthese utilities.

Note that the relative record number is the number ofthe record as it was passed to IRRADU00. This numbermay differ from the relative record number in the dataset that was input to IFASMFDP if the IFASMFDPcontrol statements suppressed the processing of somerecord type. See the MVS/ESA System ManagementFacilities for more information on the control statementsfor IFASMFDP.

IRR67582I The data associated with the relocatesection is “relocate_data” and has a lengthof relocate_data_length.

Explanation: This message describes the data(relocate_data) associated with the unexpected relocatesection that was identified in message IRR67580I. Thelength associated with the relocate section is shown asrelocate_data_length. If the length of the data exceeds 16bytes, only the first 16 bytes are shown in the message.


Messages issued by the REXX RACVAR function

IRR71001E No arguments were specified for thefunction.

Explanation: A variable name was not specified forthe RACVAR function. A variable name is required inthe form RACVAR(variable-name).

System action: EXEC processing terminates.

User response: Correct the RACVAR function andspecify a variable name.

IRR71002E This system variable xxx is notsupported for RACVAR processing.

Explanation: The variable name specified for theRACVAR function is not valid.


User response: Correct the RACVAR function andspecify a valid variable name in the formRACVAR(variable-name).

IRR71003E Multiple arguments are not allowed forthe RACVAR function.

Explanation: The RACVAR function was specifiedwith multiple arguments. Only one variable name isallowed for the RACVAR function.

IRR67552I • IRR71003E



User response: Correct the RACVAR function andspecify one variable name in the formRACVAR(variable-name).

IRR71004E No security information is available forthe RACVAR function.

Explanation: No ACEE was available from which theinformation could be extracted.


User response: Log off and log on again. Reenter therequest that caused this message. If this message isissued again, report the message (and the request youwere making) to your system programmer.

Messages issued by the RACF Subsystem

IRRA001I UNABLE TO OBTAIN STORAGE FORname SUBSYSTEM ONINITIALIZATION.

Explanation: The subsystem has not been successfullyinitialized due to the failure of GETMAIN to obtainstorage for the main subsystem control block.

System action: The initialization for the indicatedsubsystem is terminated.


System programmer response: Make sure thatsufficient storage is available in the common storagearea (CSA) for this control block. Refer to RACF SystemProgrammer's Guide for information on CSA storageestimates.


IRRA002I name SUBSYSTEM HAS NOT BEENINITIALIZED.

Explanation: The indicated subsystem has not beensuccessfully initialized. One or more previous messageshave been issued providing specific information.

System action: The initialization for the subsystem isterminated.


System programmer response: Refer to the previousmessages for more specific information.


IRRA003I name SUBSYSTEM INITIALIZATIONTERMINATED IN ABENDHANDLING.

Explanation: The initialization task for the indicatedsubsystem has detected an abend while attempting toprocess a previous abend.

System action: The task is terminated.


System programmer response: Determine the causefor the abend from previous error messages.


IRRA004I UNABLE TO LOCATE MODULE nameIN PROGRAM PROPERTIES TABLE.

Explanation: Initialization for the RACF subsystemwas not able to find the indicated module defined inthe Program Properties Table.

System action: The address space discontinuesinitialization.

Operator response: See the System ProgrammerResponse or contact your system programmer.

System programmer response: Make sure that theproper PPT entry is defined in Parmlib memberSCHEDxx for the RACF subsystem mainline module.

IRRA080I name SUBSYSTEM INITIALIZATIONENCOUNTERED AN ERROR. ABENDCODE IS cde-rc.

Explanation: The initialization task for the indicatedsubsystem has encountered an abnormal condition.

System action: The task will attempt to restart.

Operator response: See the System ProgrammerResponse or contact your system programmer.

System programmer response: The system abenddump contains more detailed information regarding theproblem encountered by the indicated subsysteminitialization task.


These messages are also issued by the RACF Subsystem

IRRB000I name SUBSYSTEM NOT DEFINED TOSYSTEM, TERMINATING.

Explanation: The subsystem name could not be

located in the SSCT control blocks. The name beingsearched for is indicated in the message.

System action: The subsystem is terminated.

IRR71004E • IRRB000I



System programmer response: Add the subsystemname to the appropriate MVS subsystem name table(see IEFSSNxx PARMLIB member).


IRRB001I name SUBSYSTEM v.r.m IS ACTIVE.

Explanation: The message indicates the version vrelease r, and modification m of indicated subsystem isactive.

System action: None.



IRRB002I INITIALIZATION COMPLETE FORname SUBSYSTEM

Explanation: All of the initialization for the indicatedsubsystem environment has been completed.

System action: The subsystem is ready to acceptoperator commands.


Problem determination: None.


IRRB003I name SUBSYSTEM NOT RUNNING ASA STARTED TASK.

Explanation: The indicated subsystem was not startedas a started task.



System programmer response: Restart the indicatedsubsystem as a started task. (This message could reflectan error in the ICHRIN03 started task table).


IRRB004I name SUBSYSTEM ALREADY ACTIVE.

Explanation: An attempt was made to start asubsystem with a duplicate name (name) while the firstsubsystem was still active. IBM recommends that youdo not have more than one subsystem active at onetime.

System action: The second subsystem is terminated.


IRRB005I name SUBSYSTEM TERMINATION ISCOMPLETE.

Explanation: The indicated subsystem has beencompletely terminated.


Operator response: Check accompanying message andtake appropriate action.


IRRB006I name SUBSYSTEM MAIN TASKABENDED IN ABEND HANDLING.

Explanation: While attempting to handle an abend theindicated subsystem task encountered another abend inabend-handling code.



System programmer response: Examine console logand system abend dumps for more detailedinformation. Determine the cause of the first abend andrestart.

Destination: Destination code is 6. Routing code is 2.

IRRB007I RESTART LIMIT nn EXCEEDED FORTASK taskname IN name SUBSYSTEM.

Explanation: The task indicated by taskname hasexceeded the limit nn for automatic restarts by themain task in the indicated subsystem.

System action: Task taskname will not be restarted.


System programmer response: Examine the consolehardcopy log for abend messages about the particularproblem.


IRRB008I name IS NOT OPERATING IN ANAUTHORIZED MODE.

Explanation: The job step failed APF authorization.

System action: The indicated subsystem is terminated.


System programmer response: Ensure that RACFsubsystem modules are linked into an authorizedlibrary with AC(1).


IRRB001I • IRRB008I


IRRB009I name SUBSYSTEM MODULE xxxxxxxxCOULD NOT BE FOUND.

Explanation: The named subsystem could not locatethe indicated subsystem interface module.



System programmer response: Ensure that themodule indicated in the message is in LNKLSTxxlibrary.


IRRB010I name SUBSYSTEM INITIALIZATIONHAS FAILED TO BUILD THESUBSYSTEM VECTOR TABLE.

Explanation: The subsystem interface module foundthat the number of address vectors contained in theaddress vector table module exceeded the availablenumber of entries in the SSVT table.

System action: The indicated subsystem is terminated.


System programmer response: Make sure that theaddress vector table module is at the proper level withrespect to the size of the SSVT table.


IRRB011I UNABLE TO OBTAIN STORAGE FORname SUBSYSTEM INITIALIZATION

Explanation: Initialization for the indicated subsystemcould not obtain storage for subsystem control forsubsystem control blocks in common storage.



System programmer response: Determine the cause ofthe storage shortage, fix the problem, and restart theaddress space.

Note: Storage for subsystem control blocks is in CSA(not ECSA).


IRRB012I name SUBSYSTEM INITIALIZATIONHAS RETURNED AN UNKNOWNRETURN CODE rc.

Explanation: Initialization for the indicated subsystemreturned an unexpected return code.



System programmer response: Report the exact text ofthis message to your IBM support along with a list ofrecently applied RACF maintenance.


IRRB013I RACF IS NOT ACTIVE. nameSUBSYSTEM TERMINATED.

Explanation: The subsystem will not operate unlessRACF is active.



System programmer response: Determine cause ofRACF failure, reactive RACF, and restart the subsystem.


IRRB014I name SUBSYSTEM IS NOTOPERATING UNDER ARACF-DEFINED USERID.

Explanation: The subsystem does not have a validuser ID in the started task table or in the RACFdatabase.



System programmer response: Enter a valid RACFuser ID in the started task table for the subsystemnamed in the message. Refer to RACF Program Directoryfor MVS Installations for information about defining andinstalling RACF subsystems.


IRRB015I taskname TASK IN name SUBSYSTEMHAS TERMINATED ABNORMALLY.

Explanation: During the shutdown process, thesubtask taskname in the subsystem name would notvoluntarily shut down. The main task has waited asufficient interval for the subtask to terminate, withoutsuccess. The subtask is forcefully terminated.

System action: Subtask taskname is terminatedabnormally. The subsystem continues the shutdownprocess.


System programmer response: Examine any systemdumps obtained.




IRRB016I name SUBSYSTEM NOT SUPPORTEDIN THIS ENVIRONMENT

Explanation: The subsystem name is only supportedon MVS systems at or above the 3.1.3 level. Thesubsystem has detected that the current operatingenvironment does not meet this requirement. You canalso get this message when RACF initialization fails tocomplete successfully.

System action: Subsystem name terminates.

System programmer response: Do not attempt toexercise this function on an MVS system below theindicated level.



IRRB017I taskname TASK HAS ABENDED WITHA CODE OF cde-rc IN nameSUBSYSTEM.

Explanation: The main task has detected an MVSsystem completion code in subtask taskname asindicated by completion code cde, reason code rc insubsystem name.

System action: The current command is ignored. Thesubsystem attempts to restart the subtask.


System programmer response: Determine the cause ofthe subtask abend.


IRRB031I TSO STACK HAS RETURNED ARETURN CODE OF xx FOR nameSUBSYSTEM.

Explanation: The STACK macro returned a nonzeroreturn code (xx) when an attempt was made to directthe input and output of a TSO command to specifiedfiles.



System programmer response: Using the xx value,determine the cause of the condition and correct it. Foran explanation of the return code, see one of thefollowing:


v If TSO/E is installed, see one of the following: TSOExtensions Guide to Writing a Terminal Monitor Programor a Command Processor or see TSO Extensions

Programming Services For the order number of thebook you need, see the TSO Extensions GeneralInformation.


IRRB032I name SUBSYSTEM UNABLE TOOBTAIN STORAGE FOR xxxxCONTROL BLOCK.

Explanation: The storage requested by the GETMAINfor the xxxx control block was not available. Thepossible values for xxxx are PSCB, UPT, ECT and LWA.

System action: Subsystem name is terminated.


System programmer response: Ensure that a sufficientregion size is specified on the subsystem JCL.

Problem determination: See message IRRB038I foradditional problem-determination information.


IRRB033I name SUBSYSTEM UNABLE TOALLOCATE FILE name FOR STACKUSAGE.

Explanation: The dynamic allocation request for theinput or output file to be used by the TSO STACKmacro has failed. See message IRRB034I for moredynamic-allocation error information.



System programmer response: Ensure that thesubsystem JCL permits dynamic allocation.


IRRB034I DYNAMIC ALLOCATIONINFORMATION: S99INFO IS xxxx,S99ERROR IS yyyy.

Explanation: Dynamic allocation failed for either aninput or an output file for use with the TSO STACKmacro. This message follows the IRRB033I message. Fora description of the S99INFO and S99ERROR codes, seeMVS/XA System Programming Library: System Macros andFacilities Volume 1.



System programmer response: Restart the subsystemafter taking the action indicated for thedynamic-allocation error condition.




IRRB036I OPERATOR RECOGNITIONCHARACTER x MAY NOT BE ASSPECIFIED IN IEFSSNxx FOR nameSUBSYSTEM.

Explanation: Either the initialization module failed toinitialize the subsystem or an operator was told torestart the subsystem manually with PARM=INITIAL.The subsystem prefix character will be used for thesubsystem.

System action: Subsystem initialization continues.


System programmer response: Fix the problem beforethe next IPL. Use the default prefix character for thisIPL. (Look in your PARMLIB for the default character.)


IRRB037E RESTART LIMIT OF nn EXCEEDED.name SUBSYSTEM TERMINATED.

Explanation: The indicated subsystem mainline taskhas exceeded the limit for automatic restarts.



System programmer response: Examine the consolehardcopy log and any relevant system dumps todetermine cause of abends. Attempt manual restart ofthe system using PARM=INITIAL option.

Destination: Descriptor code is 11. Routing code is(1,9).

IRRB038I STORAGE REQUESTED IS yyyy;SUBPOOL IS zzz.

Explanation: This message is issued after IRRB032I.and indicates the storage and subpool requested by theGETMAIN.

System action: See message IRRB032I.

Operator response: See message IRRB032I.

System programmer response: See message IRRB032I.


IRRB039E ABEND ENCOUNTERED BEFORE nameSUBSYSTEM INITIALIZED.

Explanation: The indicated subsystem encountered aninitialization failure and further processing for thesubsystem was aborted.



System programmer response: Examine the consolelog and the system abend dump for more information.

Destination: Descriptor code is 11. Routing code is(1,9).

IRRB040I RESTART BEING ATTEMPTED FORtttttttt TASK.

Explanation: The task indicated by tttttttt hasencountered an abend and is attempting to restart.

System action: The subsystem will attempt to restartby detaching and reattaching the tttttttt task.

Operator response: Report the exact text of themessage to your system programmer.

System programmer response: Examine the consolelog for previously issued RACF messages or dumpsand determine the cause of the problem.


IRRB041I tttttttt TASK ENDED WITH A CODEOF cde-rc IN name SUBSYSTEM.

Explanation: The task indicated by tttttttt detachedwith an incomplete return code as indicated in abendcode cde, reason code rc

System action: RACF subsystem continues normaloperation.


System programmer response: Refer to the consolelog or dumps, if any, to determine the problem.


More messages issued by the RACF Subsystem

IRRC001I MAXIMUM NUMBER nn OFCOMMAND TASKS EXCEEDED FORname SUBSYSTEM. LAST COMMANDIGNORED.

Explanation: The RACF subsystem allows nnsimultaneously active command-processing modulesand ignores all requests in excess of this number.

System action: The RACF subsystem continuesoperation.

Operator response: Reenter the command.



IRRC002I name SUBSYSTEM COMMAND SCAN

IRRB036I • IRRC002I


ERROR. CODE IS cde-rc.

Explanation: The TSO command scan service failedwith return code cde, reason code rc.

System action: RACF subsystem name terminates.

Operator response: Report the complete text of thismessage to your system programmer.

System programmer response: Determine the cause ofthe command scan error.



IRRC003I COMMAND command-name IS NOTVALID.

Explanation: Command command-name is notsyntactically correct.

System action: The RACF subsystem ignores therequest and continues operation.

Operator response: Reenter the command with thecorrect syntax.



IRRC004I COMMAND cccccccc IS NOTSUPPORTED.

Explanation: The RACF subsystem does not supportthe entered command.





IRRC005I UNABLE TO LOAD MODULEmodule-name FOR name SUBSYSTEM.COMMAND NOT EXECUTED.

Explanation: Command module module-name couldnot be loaded.





IRRC006I name SUBSYSTEM COMMANDHANDLING TASK TERMINATED INABEND PROCESSING.

Explanation: The indicated subsystemcommand-handling task experienced an abend duringthe handling of a previously encountered abend.

System action: The indicated subsystem detaches theabending command-processing task and attempts toreattach the task. If the task continues to abend, thetask permanently remains detached and the addressspace continues operation.


System programmer response: Examine abend dumpsand fix the problem before the next IPL.


IRRC080I name SUBSYSTEM COMMANDHANDLING TASK ENCOUNTEREDAN ERROR. ABEND CODE IS cde-rc.

Explanation: The command task for subsystem nameencountered an abend. The return code is cde and thereason code is rc.

System action: Subsystem name attempts to restart.

Operator response: Make sure that the restart issuccessful. Report the exact text of this message to yoursystem programmer.

System programmer response: Examine the consolelog and abend dumps for more problem determinationinformation. Correct the problem before the next IPL.


IRRC130I SYSTEM SSL FUNCTION xRETURNED ERROR CODE nnnDURING OPERATION NUMBER opcodeWHILE PROCESSING THEPASSWORD ENVELOPE FOR USERname.

Explanation: An unexpected error was detected whenusing System SSL functions to create a PKCS #7password envelope containing the new password foruser name.

System action: The system continues processing.

System programmer response: Use the following tableto identify the problem:

x nnn Possible cause

'02'X ’03353009’X The key database or the stashfile is not found.

’03353001’X Insufficient storage isavailable.

IRRC003I • IRRC130I


x nnn Possible cause

’03353007’X An input/output request failedfor either the key database orthe stash file.

’0335300A’X The key database file iscorrupted.

’03353017’X The file permissionsdo not allow access.

’03353018’X The key database is openfor update by another process.

’0335303E’X The key database or stashfile name is not valid.

’0335303F’X Unable to open the keydatabase.

'04'X ’0335300E’X There is no default keyfor the database.

'40'X ’03353033’X No recipient certificates have beenadded to the key ring, or thecertificates do not have TRUSTstatus.

See the section, SSL Certificate Management in z/VM:TCP/IP User's Guide for or information on theGSK_TRACE environment variable and the GSKTRACEcommand.


IRRC133I RACF ENCOUNTERED INCORRECTAPPLDATA SYNTAX IN THE[PASSWORD|PASSPHRASE].ENVELOPE PROFILE WHILEPROCESSING USER name. DEFAULTVALUES ARE USED.

Explanation: While processing a password orpassword phrase update for user name, an error wasencountered while interpreting the APPLDATA stringin the PASSWORD.ENVELOPE RACFEVNT profilewhich covers the resource identified in the message inthe RACFEVNT class. The APPLDATA is used tospecify the signing hash algorithm and encryptionstrength to use when building a PKCS#7 passwordenvelope for a user.

System action: RACF uses the default values of MD5for the signing hash algorithm and triple DES forencryption.

Security Administrator Response: Correct theAPPLDATA. For more information on defining thePASSWORD.ENVELOPE or PASSPHRASE.ENVELOPEprofile resource, see RACF Security Administrator'sGuide. Note that a generic profile may be used to covereither or both or these resources. This will be indicatedin the output of an RLIST command issued against theresource name.

IRRC135I RACF ENCOUNTERED AN EXTRACTERROR FOR PROFILE profile-name INCLASS classname WHILE PROCESSINGUSER name. RETURNCODE=return-code, RACF RETURNCODE=racf-return-code, RACF REASON

CODE=racf-reason-code.

Explanation: A RACROUTE REQUEST=EXTRACTwas attempted but an unexpected return code wasencountered. RACF was processing a change logrequest, or an enveloping request for the password orpassword phrase for user name. None of the functionssucceeded.

Note: For RACFEVNT class resources, profile-namemay really be a resource name which is covered by ageneric profile. This will be indicated in the output ofan RLIST command issued against the resource name.


System programmer response: Contact the customersupport center.


IRRC136I RACF ENCOUNTERED A RACROUTEREQUEST=AUTH ERROR WHILEPROCESSING USER name. RETURNCODE=return-code, RACF RETURNCODE=racf-return-code, RACF REASONCODE=racf-reason-code.

Explanation: A RACROUTE REQUEST=AUTH wasattempted but an unexpected return code wasencountered. RACF was attempting to check a user'seligibility for PKCS#7 password or password phraseenveloping, by checking the user's access toPASSWORD.ENVELOPE or PASSPHRASE.ENVELOPEin the RACFEVNT class. The user's password orpassword phrase was not enveloped.




IRRC138I RACF ENCOUNTERED ANUNEXPECTED PKCS#7 ENVELOPINGERROR WHILE PROCESSING USERname. R15=contents, OPERATIONCODE=opcode, RC1=rc1, RC2=rc2,RC3=rc3.

Explanation: An unexpected error was encounteredduring PKCS#7 envelope processing for user name. Thevarious diagnostic values are displayed. The user'spassword or password phrase was not enveloped.




IRRC133I • IRRC138I


IRRC139I THE NUMBER OF RECIPIENTCERTIFICATES IN THE KEYDATABASE EXCEEDS THE MAXIMUMOF 20.

Explanation: A PKCS#7 password or password phraseenvelope was being processed by RACF. RACF onlysupports up to 20 recipients, each of which is identifiedby a certificate in the key database.

System action: The password or password phrase hasbeen enveloped for only the first 20 certificatesencountered (not including the default certificate in thekey database). The system continues processing.

Security Administrator Response: To avoid having thismessage displayed every time a password or passwordphrase envelope is requested, remove some certificatesfrom the key ring using the GSKKYMAN utility.


IRRC142I LDAP server unavailable. RACF changelogging records are being queued.

Explanation: The LDAP server required by RACF forchange logging in not started or configured. Changelogging records are being queued. Records willcontinue to be queued until a correctly configuredLDAP server is started, or the number of queuedrecords exceeds 256. Once the 256 maximum queue sizethreshold has been reached, new change log recordswill be discarded.

System action: RACF will wait for an LDAP serverconfigured for change logging to become available andautomatically process the queue (without userintervention). If z/VM is restarted before the queue hasbeen processed, all records on the queue will be lost.

Security Administrator Response: Start an LDAPserver configured for change logging.

DISPLAY command messages

IRRD000I DISPLAY ENCOUNTERED AN ERRORWHILE USING TSO PARSE, PARSERETURN CODE WAS nn

Explanation: During the parse of the DISPLAYcommand image, the TSO Parse facility returned a codethat is documented in TSO Extensions ProgrammingServices in the section discussing IKJPARS.

System action: The DISPLAY command terminatesfurther processing and does not display any of therequested information.

Operator response: Verify that the DISPLAY commandwas correctly entered with the desired keywords andassociated operands. Reenter the command, and if thecondition persists, notify your system programmer.

System programmer response: Examine the originalDISPLAY command image for possible specificationerrors. Use the nn value to determine the specific causeof the TSO Parse condition.

User response: See operator response.

Destination: Descriptor code is 5. There are no routingcodes for this message.

IRRD001I UNIDENTIFIED TEXT OR KEYWORDtext IN DISPLAY COMMAND

Explanation: The text character string was present inthe DISPLAY command image and was not recognizedas a valid keyword.

System action: The DISPLAY command is terminated.

Operator response: Examine the DISPLAY commandimage and correct the text indicated by the text string.Refer to RACF Command Language Reference forinformation on the DISPLAY command.

System programmer response: See operator response.



IRRD002I NOT AUTHORIZED TO ISSUE THEDISPLAY COMMAND

Explanation: The user attempting to issue theDISPLAY command is not authorized to the properprofile in the OPERCMDS resource class.

System action: The DISPLAY command is terminatedwithout further processing.

Operator response: Notify either the securityadministrator or the system programmer.

System programmer response: Either define thecorrect profile to the OPERCMDS class or notify thesecurity administrator.

User response: See the operator response.


IRRD003I DISPLAY COMMAND TERMINATEDIN ABEND PROCESSING

Explanation: During the recovery processing of anabend condition another abend was detected.


Operator response: Notify either the systemprogrammer or the security administrator. Notewhether the DISPLAY command provided any previousmessages (such as IRRD080I), and whether a systemdump has been taken.

IRRC139I • IRRD003I


System programmer response: Determine whatkeywords and operands are contained in the DISPLAYcommand. Examine the console log prior to thismessage for the presence of other messages that mightprovide further information. Also, examine the systemdump data sets for the presence of a dump resultingfrom this condition.



IRRD004I RACF v.rr.m SUBSYSTEM

Explanation: This message is for information only andindicates the current version v, release rr, andmodification level m of the installed RACF product.Depending on the operands, one of the followinggroups of message lines may be displayed. “LU” inthese messages is the abbreviation for “logical unit”.

When the APPL keyword is specified with no otherkeywords:

LU NAME LU NAME ... LU NAMEapplname1 applname2 ... applname7

When the POE keyword is specified without the USER,GROUP, or SECLABEL keywords:

REMOTE LU NAME(S) ASSOCIATED WITH ACTIVE LOCAL LUNAME applnameLU NAME LU NAME ... LU NAMEpoename1 poename2 ... poename7

When USER, GROUP, or SECLABEL keywords arespecified:

LOCAL LUapplname FOR REMOTE LU poenameHAS THE FOLLOWING

USER(S):USER = useridGROUP = groupSECLABEL = seclabel

When the POE keyword is specified and there are nomatches for a particular APPL:

NO REMOTE LU NAMES MATCHINGpoename WERE FOUNDFOR LOCAL LU applname

When the user-group-seclabel combination cannot belocated:

NO USERS MEET THE SPECIFIED CRITERIA

System action: The DISPLAY command continuesprocessing any specified operands.

Destination: Descriptor codes are 5, 8, and 9. Thereare no routing codes for this message.

IRRD005I DISPLAY COMMAND UNABLE TOLOCATE APPL APPL-name

Explanation: The APPL-name specified in the APPLkeyword could not be found in the table of currentlocal LU (logical unit) names. This message is producedfor explicit APPL-name.


Operator response: Check that the APPL-name nameentered in the APPL keyword is correct. Reenter thecommand with the proper value. If the problempersists notify the system programmer or the securityadministrator.

System programmer response: If the APPL-name isknown to exist in the table of current local LU-names,obtain diagnostic information such as a system dumpcontaining the table of local LU names.



IRRD006I DISPLAY COMMAND UNABLE TOLOCATE A MATCH FOR APPLAPPL-name

Explanation: The APPL(APPL-name) specification wasnot matched by an entry in the table of local LU(logical unit) names. This message is produced whenthe APPL-name specification is of the form APPL(ABC*)or APPL(*).

System action: The DISPLAY command is terminatedwithout processing.

Operator response: Check the APPL-name entered inthe APPL keyword for correctness. Reenter thecommand with the proper value. If the problempersists notify the system programmer or the securityadministrator.

System programmer response: If the APPL-name isknown to match at least one entry in the table ofcurrent local LU names, obtain diagnostic informationsuch as a system dump containing the table of local LUnames.

User response: See the Operator Response.


IRRD007I DISPLAY COMMAND FOUND THATTHERE WERE NO LOCAL LUSCURRENTLY ACTIVE

Explanation: The DISPLAY command could notdisplay any information because the table of local LU(logical unit) names was empty.

IRRD004I • IRRD007I



Operator response: No specific response is requiredfor this message unless it is known that the tableshould not be empty. In that case, notify the systemprogrammer or the security administrator.

System programmer response: If this message reflectsa condition that should not be present, examine theconsole log to determine what operations have beenperformed on the table of local LU names.



IRRD008I DISPLAY COMMAND UNABLE TOLOCATE USER INFORMATION FORREMOTE LU NAME poename

Explanation: The DISPLAY command could notdisplay any information because the list of signed-onusers is empty.


Operator response: No specific response is requiredfor this message unless it is known that the list shouldnot be empty. In that case, notify the systemprogrammer or the security administrator.

System programmer response: If this message reflectsa condition that should not be present, examine theconsole log to determine what operations have beenperformed on the list of signed-on users.



IRRD009I DISPLAY COMMAND FOUND THATTHERE WERE NO USERS CURRENTLYSIGNED ON

Explanation: There are no users in the signed-on listor lists.


Operator response: No response is required unless itis known that users are currently signed on. If users aresigned on, verify that the DISPLAY command wascorrectly entered with the desired keywords andassociated operands. If the command was enteredcorrectly and users should be signed on, reenter thecommand and if the condition persists, notify yoursystem programmer.

System programmer response: Examine the originalDISPLAY command image for possible specification

errors. Examine the console logs to determine whetherusers have been signed off or some abnormal conditionhas occurred.



IRRD010I DISPLAY COMMANDENCOUNTERED AN INTERNALERROR. RETURN CODE IS return-code

Explanation: The DISPLAY command encountered aninternal error. The return code describes the type oferror that was encountered.

Code (Decimal)Description

16 Storage problem20 Storage unavailable24 Incorrect length exception28 Inconsistency exception36 Inconsistency exception40 Operation rejected exception44 Incorrect control data exception60 Unexpected exception64 Incorrect offset exception68 Incorrect key definition exception

Operator response: Report this message along withthe return code to your system programmer.

System programmer response: Report this messagealong with the return code to your IBM Support Center.

IRRD080I DISPLAY COMMANDENCOUNTERED AN ERROR. ABENDCODE IS abend_code-reason_code

Explanation: During the normal processing of theDISPLAY request an abnormal condition was detected.The abend_code and reason_code are displayed. Displaythe system dump data sets for an accompanyingdiagnostic dump.

System action: The DISPLAY command terminatesprocessing.


System programmer response: Report this message IDand its contents to your IBM support center. For adescription of the abend code and reason code, refer toChapter 6, “RACF Abend Codes,” on page 251. If theabend code and reason code displayed in the messagedo not appear in this manual, refer to the system codesmanual for the MVS system at your installation.

User response: Notify the system programmer.


IRRD008I • IRRD080I


SIGNOFF command messages

IRRE000I SIGNOFF ENCOUNTERED AN ERRORWHILE USING TSO PARSE, PARSERETURN CODE WAS nn

Explanation: During the parse of the SIGNOFFcommand image, the TSO parse facility returned returncode nn, which is documented in TSO ExtensionsProgramming Services in the section discussing IKJPARS.

System action: The SIGNOFF command terminatesprocessing and does not display any of the requestedinformation.

Operator response: Verify that the SIGNOFFcommand entered was correctly entered with thedesired keywords and associated operands. Reenter thecommand and if the condition persists, notify yoursystem programmer.

System programmer response: Examine the originalSIGNOFF command image for possible specificationerrors. Use the nn value to determine the specific causeof the TSO Parse condition.



IRRE001I UNIDENTIFIED TEXT OR KEYWORDtext IN SIGNOFF COMMAND.

Explanation: The text character string was present inthe SIGNOFF command image and was not recognizedas a valid keyword.

System action: The SIGNOFF command is terminated.

Operator response: Examine the SIGNOFF commandimage and correct the text indicated by the text string.Refer to RACF Command Language Reference forinformation on the SIGNOFF command.

System programmer response: See the OperatorResponse.



IRRE002I NOT AUTHORIZED TO ISSUE THESIGNOFF COMMAND

Explanation: The user attempting to issue theSIGNOFF command is not authorized to the properprofile in the OPERCMDS resource class.

System action: The SIGNOFF command is terminatedwithout further processing.

Operator response: Notify either the securityadministrator or the system programmer.

System programmer response: Either define the

correct profile to the OPERCMDS class or notify thesecurity administrator.



IRRE003I SIGNOFF COMMAND TERMINATEDIN ABEND PROCESSING

Explanation: During the recovery processing of anabend condition another abend was detected.


Operator response: Notify either the systemprogrammer or the security administrator. Notewhether the SIGNOFF command has provided anyprevious messages and whether a system dump hasbeen taken.

System programmer response: Determine whatkeywords and operands are contained in the SIGNOFFcommand. Examine the console log prior to thismessage for the presence of other messages that mightprovide further information. Also, examine the systemdump data sets for the presence of a dump resultingfrom this condition.



IRRE004I SYSTEM AUTHORIZATION FACILITYREQUEST ENDED WITH A RETURNCODE OF code

Explanation: The attempt to issue a SIGNOFF requestended with a return code of code. This code has beenreturned by the System Authorization Facility (SAF)router. See the section describing the RACROUTEmacro and its return codes in Resource Access ControlFacility (RACF) Macros and Interfaces, SC28-1345.

System action: The SIGNOFF command is terminatedwithout further processing. Message IRRE006I willfollow this message with information about the returnand reason codes from the RACF SIGNOFF request.


System programmer response: Determine whatkeywords and operands are contained in the SIGNOFFcommand. Examine the portion of console log recordednear the time of this message for the presence of othermessages that might provide further information. Also,

IRRE000I • IRRE004I


examine the system dump data sets for the presence ofa dump resulting from this condition. MessageIRRE006I will follow this message with informationabout the return and reason codes from the RACFSIGNOFF request.



IRRE005I THE RACF SIGNOFF REQUEST WASUNABLE TO LOCATE USER = useridGROUP = group

Explanation: The user ID-group combination couldnot be located by the RACF SIGNOFF process.

System action: The SIGNOFF command continueswith requests for other APPL values if specified.

Operator response: Verify that the SIGNOFFcommand was correctly entered with the desiredkeywords and associated operands. If the commandwas entered correctly and userid should be present,reenter the command and if the condition persists,notify your system programmer.

System programmer response: Examine the originalSIGNOFF command image for possible specificationerrors. Examine the console logs to determine whetherthe specified user ID was previously signed off or someother type of abnormal condition occurred.



IRRE006I RACROUTE TYPE=SIGNOFFREQUEST ENDED WITH A RETURNCODE OF return-code, REASON CODEOF reason-code

Explanation: This message can occur for either of thefollowing conditions:

v The System Authorization Facility (SAF) returned acode of zero, but the RACF SIGNOFF requestreceived an unexpected return code.

v The System Authorization Facility (SAF) received anonzero return code that was previously shown inmessage IRRE004I.



System programmer response: Determine whatkeywords and operands are contained in the SIGNOFFcommand. Examine the portion of the console log

recorded before this message for the presence of othermessages that might provide further information. Also,examine the system dump data sets for the presence ofa dump resulting from this condition. Refer toRACROUTE for an explanation of the return code andreason code.



IRRE007I SIGNOFF COMMAND REQUIRES THEkeyword KEYWORD TO BE SPECIFIED

Explanation: The SIGNOFF command requires thatthe APPL, POE and USER keywords be specified.


Operator response: Reenter the command with thecorrect keywords.

System programmer response: See the OperatorResponse.



IRRE008I SIGNOFF COMMAND DOES NOTALLOW PARTIAL GENERICS FORTHE keyword KEYWORD

Explanation: Partial generics (A*) were specified forthe keyword keyword, which only allows for fullgenerics or nongenerics.

System action: The SIGNOFF command is terminated.

Operator response: Reenter the command specifying afully qualified operand for keyword.

System programmer response: None.



IRRE009I SIGNOFF COMMAND COMPLETED

Explanation: This message is produced when theSIGNOFF command has completed its processingwithout error.

System action: The SIGNOFF command continues tonormal termination.




IRRE010I SIGNOFF COMMAND UNABLE TOLOCATE APPL APPL-name

Explanation: The APPL-name specified in the APPLkeyword could not be found in the table of currentlocal LU (logical unit) names. This message is producedfor explicit APPL-name.


Operator response: Check the APPL-name entered inthe APPL keyword for being correct. Reenter thecommand with the proper value. If the problempersists notify the system programmer or the securityadministrator.

System programmer response: If the APPL-name isknown to exist in the table of current local LU names,obtain diagnostic information such as a system dumpcontaining the table of local LU names.



IRRE011I SIGNOFF COMMAND UNABLE TOLOCATE A MATCH FOR APPLAPPL-name

Explanation: The APPL(APPL-name) specification wasunable to find a match in the table of local LU (logicalunit) names. This message is only produced when theAPPL-name specification is of the form APPL(ABC*) orAPPL(*).


Operator response: Check the APPL-name entered inthe APPL keyword for being correct. Reenter thecommand with the proper value. If the problempersists notify the system programmer or the securityadministrator.

System programmer response: If the APPL-name isknown to match at least one entry in the table ofcurrent local LU-names, then obtain diagnosticinformation such as a system dump containing thetable of local LU names.



IRRE012I SIGNOFF COMMAND FOUND THATTHERE WERE NO APPLS CURRENTLYSIGNED ON

Explanation: The SIGNOFF command could notsuccessfully execute because the list of local LU (logicalunit) names does not exist.


Operator response: No specific response is requiredfor this message unless it is known that the list shouldnot be empty. In that case, notify the systemprogrammer or the security administrator.

System programmer response: If this message reflectsa condition that should not be present, examine theconsole log to determine what operations have beenperformed on the list of local LU names.



IRRE080I SIGNOFF COMMANDENCOUNTERED AN ERROR. ABENDCODE IS abend_code-reason_code .

Explanation: During the normal processing of theSIGNOFF request an abnormal condition was detected.The abend_code and reason_code are displayed. Displaythe system dump data sets for an accompanyingdiagnostic dump.

System action: The SIGNOFF command terminatesprocessing.


System programmer response: Report this message IDand its contents to your IBM support center. For adescription of the abend code and reason code, refer toChapter 6, “RACF Abend Codes,” on page 251. If theabend code and reason code displayed in the messagedo not appear in this manual, refer to the system codesmanual for the MVS system at your installation.

User response: Notify the system programmer.




Chapter 5. Additional z/VM RACF Messages

RACF running on z/VM has several independent components that generatemessages: CP, RACF, VS1 System, CMS sub-tasking (CST), and RACF support. Themessages are received by the end user, the OPERATOR, and the RACF servicemachine.

The character string tttttttt in some messages represents the time of day.

Unnumbered RACF Messages

Unnumbered RACF Initialization Messages

COULD NOT VERIFY RACFCOMMAND SEPARATION - SYSTEMSECURITY/INTEGRITY IN JEOPARDY!

Explanation: During initialization, RACF could notdetermine that the RACF commands were inRACFCMDS LOADLIB.



Make sure that the RACF PERMIT command is in theRACFCMDS LOADLIB; it should not be located in anyother LOADLIB.

Unnumbered RACF Execution Messages

RACF APPEARS INACTIVE — ENTERDIRECTORY PASSWORD IFPROMPTED

Explanation: This message only appears when you areattempting to log on to the primary or secondary RACFservice machine ID and the currently active servicemachine is not functioning correctly.

User response:

Enter the directory password when prompted to beable to log on to the service machine ID.

RACF IS BEING REIPL'ED ANDRESTARTED

Explanation: An abend occurred in a RACF servicemachine, and all levels of recovery have failed. Thesystem dumps the service machine virtual storage andissues a re-IPL of the virtual machine. This shouldresult in an automatic restart.

Operator response:

Report this message to your system programmer.

Unnumbered Operator Messages

A COMMAND SESSIONABNORMALLY TERMINATED.

Explanation: As the user attempted to issue a RACFcommand during an established command session, anabnormal condition occurred which resulted in thetermination of the command session.

Operator response:


AN AUTHORIZATION REQUEST HASTERMINATED ABNORMALLY

Explanation: The RACF service machine failed while

processing your authorization request.

Operator response:

Notify system support if recovery is unsuccessful.

AN AUTHORIZATION REQUESTFAILED - ATTEMPTING RECOVERY

Explanation: Indicates that the RACF service machinedetected an error from RACF.

Operator response:



RACF AUTHORIZATIONCOMMUNICATION INTERFACEREADY

Explanation: Indicates that the RACF service machineis ready to begin processing.

Operator response:

This is an informational message; no response isnecessary.

Unnumbered Report Writer Messages

ENTER RACFRW COMMAND OREND

Explanation:

RACF issues this message to request that you issue aRACFRW command. RACF will not issue this messageif you have executed RACFRW with the RACRPORTEXEC.

keyword KEYWORD IGNORED IN VMENVIRONMENT

Explanation:

RACF issues this message when your RACFRWcommand contains the indicated keyword that isinvalid in the VM environment (invalid keywords areDATASET, DSNAME, or SAVE).

Unnumbered Messages from CSTALLOC (Dataset AllocationProgram)

‘NEW’ DATA SET ALREADY EXISTS -REPLY ‘REUSE’ OR ‘END’

Explanation: You attempted to allocate a data set for aRACF database on a volume where a data set with thesame name already exists. This message will not appearunless your system has been modified.

Operator response:

If you reply, ‘REUSE’, the system will scratch andreallocate the data set. If you reply, “END,” the systemwill not allocate the data set.

‘OLD’ DATA SET DOES NOT EXIST -REPLY ‘ALLOC’ OR ‘END’

Explanation: You attempted to reallocate a data set fora RACF database on a volume that does not contain thedata set. This message will not appear unless yoursystem has been modified.

Operator response:

Reply ‘ALLOC’ or ‘END’. If you specify ‘END’, thesystem will not allocate the data set.

ALLOCATION COMPLETE

Explanation:

The system successfully allocated a data set for a RACFdatabase.

DDNAME NOT SPECIFIED

Explanation:

The system invoked CSTALLOC to allocate a data setfor a RACF database, but you did not specify addname in the PARM field of the INIT command. As aresult, the data set was not allocated. This message will

not appear unless your system has been modified.

DDNAME DOES NOT DEFINE AN OSDATA SET

Explanation:

The system invoked CSTALLOC to allocate a data setfor a RACF database but the ddname you specifieddefined an FCB that did not contain an OS data setname. This message will not appear unless your systemhas been modified.

NO FILEDEF PROVIDED

Explanation:

The system invoked CSTALLOC to allocate a data setfor a RACF database but could not find an FCB for theddname you specified in the PARM field. As a result,the data set was not allocated. This message will notappear unless your system has been modified.

UCB COULD NOT BE FOUND FORDATASET ALLOCATION

Explanation:

The system could not allocate a data set for a RACFdatabase because because it could not find a UCB.There is probably a problem with the FILEDEFcommand. This message will not appear unless yoursystem has been modified.

DDNAME ERROR

Explanation:

The name you specified in the PARM= field of the CSTINIT command was invalid. This message will notappear unless your system has been modified.


VOLUME ID MUST BE SPECIFIED INFILEDEF

Explanation:

You did not specify the VOLID option of the ddnamepassed to CSTALLOC. This message will not appearunless your system has been modified.

ALLOCATION CANNOT BE DONEWITHOUT PRIMARY SPACEQUANTITY

Explanation:

You did not specify a primary space quantity on the

FILEDEF statement of the ddname passed toCSTALLOC. This message will not appear unless yoursystem has been modified.

ALLOCATION FAILED

Explanation: The system did not allocate the RACFdatabase. The reason should appear in anaccompanying message.

Note: If the accompanying message is CSTINT004Iwith COMPLETION CODE = 0014, it indicates that thereason for the allocation failure is insufficient storagefor the allocation.

Numbered Messages for RACF on z/VM

CST messages

CSTABE001T ABEND uuuccc CALLED FROM aaaaaaIN SUB-TASK ssssssss UNDER tttttttt(MAIN)

Explanation: A program executing under a subtaskattached by task tttttttt, with program name ssssssss,issued an abend SVC at address aaaaaaaa. This canhappen if CMS is IPLed from the RACF servicemachine console during a RACF command session, orif the RACF service machine is forced off or logged offduring a RACF command session. For moreinformation about the abend, see Chapter 6, “RACFAbend Codes,” on page 251.

Note: If a user IPL's CMS in the user's own virtualmachine while a RACF command session is inprogress, a 003E6 abend will occur.

System programmer response: Report the completetext of this message to your IBM support center.

CSTDDD00E SVC 99 FOR DDDYNAM CALLEDFOR UNSUPPORTED REQUEST

Explanation: A program issued an SVC 99 for anunsupported request. This is a different message frommessage DMSSVT121S (UNSUPPORTED SVC svc...). Thismessage will not occur unless there are usermodifications in the RACF service machine.

CSTDET001I SUB-TASK tttttttt ABENDED WHILEDETACHING ssssssss – ERROR cccc(msg)

Explanation: Subtask tttttttt was abended while tryingto DETACH subtask ssssssss. The reason for the abendis given as cccc and explained as msg. This abend couldoccur during an attempt to quiesce an active RACFservice machine with the 0END command, and thereare tasks still active.

cccc msg318 (X'013E')

Subtask not completed (DETACH SVC).574 (X'023E')

Detacher is not parent (DETACH SVC).2563 (X'0A03')

Task still has subtasks (task termination). Tasktttttttt may have attempted to terminate whileit still had subtasks attached.

System programmer response: To recover, IPL 490again.

CSTERP001W Warning: Device xxx was configuredas shared, now configured asnon-shared.

Explanation: RACF/VM initially assumes that allRACF database devices are configured to be sharedwith other systems. If this is not the case, this systemwarning message will appear for all devices.

User response: If the RACF database which resides atthe specified address is not shared, no user action isrequired. However, if you intend the RACF database atthe specified address to be shared, you should checkthe configuration of the device because RACF hasdetermined that it is not shared.

CSTHSV001E SVC IGC00xxx NOT AVAILABLE -(BLDL FAILED)

Explanation: A CSTHSVC macro was issued. Itsparameter list contained an SVC that the system couldnot find either in the RACFLPA LOADLIB or in thelibraries specified with the GLOBAL command. xxx isthe name created from the SVC number by convertingthe SVC number and unpacking it. If a program issuesthe SVC, CST does not support it; the RACF servicemachine handles it. If CMS does not support the SVC,the RACF service machine issues an error message. If

• CSTHSV001E

Chapter 5. Additional z/VM RACF Messages 173

CMS supports the SVC and the support is not wantedor insufficient, the results are unpredictable. Thismessage will not appear unless your system has beenmodified.

CSTIGC001E ERROR cccc WRITING uuuuuuuuNOTIFY FILE

Explanation: When an FSWRITE was issued for filename uuuuuuuu, file type NOTIFY, and file mode A1,the system returned a nonzero return code cccc fromthe file system.

Operator response: Check the status of the RACFservice machine's A-disk. If full, report this message toyour system programmer.

CSTINT001I INVALID CHARACTER IN PARM ORPRIORITY FIELDS

Explanation: The CST initiator/terminator received anINIT command containing the PARM= or PRIORITYoption containing invalid data. This message will notappear unless your system has been modified.

CSTINT002I INVALID PRIORITY SPECIFICATION -NOT 0-250

Explanation: The priority specification on the CSTINIT command cannot be greater than 250. (251 to 256are reserved for system priorities.) This message willnot appear unless your system has been modified.

CSTINT003I INITIATOR ACTIVATED

Explanation: This is an information messageindicating that the CST INIT command started aprogram.

CSTINT004I PROGRAM ‘nnnnnnnn’ ENDED.COMPLETION CODE = cccc

Explanation: Program nnnnnnnn, which was startedwith the CST INIT command, completed without anabend. The completion code returned by the programwas cccc.

CSTINT005I PROGRAM ‘nnnnnnnn’ ABNORMALLYTERMINATED. COMPLETION CODE =cccccc

Explanation: Program nnnnnnnn, which was startedwith the CST INIT command, abended with abendcode cccccc.


CSTINT006I NO MORE SUB-TASKS

Explanation: A program started with the CST INITcommand completed, and there were no other tasks torun.

System action: CST gives control back to the RACFservice machine.

CSTINT007I FILEDEF FOR DDNAME ‘dddddddd’HAS NO UCB. PERHAPS FILEDEFWAS ISSUED WITH DISK NOTACCESSED.

Explanation: The initiator/terminator found an FCBfor an OS data set, but could not find a UCB for it. Thisis an information message to alert the user that theremay be a problem.

CSTIOS001T CSTIOS RAN OUT OF FREE RQES'

Explanation: The system issued an EXCP/EXCPVRSVC, but the I/O supervisor could not obtain an RQEwith which to schedule the I/O operation.

System action: The program is abended.


1. Increase the DATA BLOCK OPTION in ICHRDSNT(data set name table). This allows a portion ofvirtual storage to contain part of the RACFdatabase. This means that a request (such asRACINIT) can check virtual storage first to satisfythe request. This requires no I/O (thus no RQE) andis much faster.

2. Move the RACF database to a disk pack with lowI/O.

3. Put heavily used minidisks into theglobal-access-checking table.

4. Reduce the number of events being audited.

CSTIOS002T CSTIOS FOUND DEVICE NOTOPERATIONAL DURING SENSEOPERATION

Explanation: An I/O operation completed with anerror; when the system issued the SENSE operation, thedevice was not operational (possibly detached). Theprogram abends.

CSTIOS003W INVALID PURGE REQUEST -ABORTED.

Explanation: The program issued a PURGE SVCrequesting an unsupported function. The system abortsthe PURGE request, but allows the program tocontinue. This message will not appear unless yoursystem has been modified.

CSTIGC001E • CSTIOS003W


CSTIOS004W DEVICE device DISABLED OR NOTATTACHED. INTERVENTIONREQUIRED SIMULATED

Explanation: A SIO instruction resulted in anonoperational condition. The RACF service machinesimulated an intervention-required condition.

CSTPGM001T ppppppppppppppppppppp EXCEPTIONOCCURRED AT aaaaaa IN SUB-TASKssssssss UNDER tttttttt (MAIN)

Explanation: An error occurred in RACF processing.

System action: The system issues messageCSTINT001I, which contains an abend code.

Operator response: Save the complete text of thismessage and call your system programmer.


CSTPGM002T ppppppppppppppppppppp EXCEPTIONOCCURRED AT aaaaaa DURING SPIEEXIT ROUTINE FOR SUB-TASK ssssssssUNDER tttttttt (MAIN)





CSTPGM003T ppppppppppppppppppppp EXCEPTIONOCCURRED AT aaaaaa IN SYSTEMROUTINE nnnnnnnn, RE-IPL CMS





CSTPGM004T ppppppppppppppppppppp EXCEPTIONOCCURRED AT aaaaaa IN ROUTINEcccccccc WHILE “UFDBUSY” = xx,RE-IPL CMS





CSTSET001I CMS SUB-TASKING SUPERVISORINITIALIZED.

Explanation: Initialization for Extended OS Simulationis complete.

CSTSET002W WARNING - ECMODE NOT SET ON

Explanation: During CST initialization, ECMODE wasnot set on.

System programmer response: Alter the RACF servicemachine's directory entry to include OPTIONECMODE.

CSTSET003T ERROR DURING CSTINITIALIZATION OR EXITPROCESSING - CST TERMINATED

Explanation: An error occurred while trying to extendthe OS Simulation environment. There should beaccompanying messages indicating the cause of theerror. Depending on the state of the initialization, CSTterminates or abends. If CST terminates successfully,control goes back to the RACF service machine;otherwise, re-IPL.

CSTSET004I MULTIPLE CONSOLE SUPPORT NOTAVAILABLE

Explanation: During CST initialization, the systemcould not find the CSTCONS TEXT file on one of theRACF service machine's minidisks. During thisexecution of CST WTO/WTOR, the system only printsmessages at the virtual machine console.

CSTTER001I CST TERMINATED

Explanation: CST has completed execution and isreturning control to the RACF service machine.

CSTUCB001I TYPE INFO FOR DEVICE deviceCOULD NOT BE DETERMINED. UCBTYPE FIELD NOT SET.

Explanation: When the system tried to define a UCB,it discovered that the device type was not a disk, 3705,or channel-to-channel adapter, and the FILEDEFcommand did not specify the UCBTYPE information.This message does not appear unless your system hasbeen modified.

CSTWTO001E ‘nn’ IS AN INVALID REPLYNUMBER.

Explanation: While CST was active, you entered areply number; however, a WTOR starting with thatnumber was not outstanding.

CSTIOS004W • CSTWTO001E


CSTWTO002E NO ENDING QUOTE - RE-ENTER.

Explanation: Your reply to a WTOR did not containan ending quote.

CSTWTO003E REPLY TOO LONG - RE-ENTER.

Explanation: Your reply to a WTOR was too long.

CSTWTO004E ‘a’ IS INVALID UNDER CST. HASREPLY NUMBER BEEN OMITTED?

Explanation: You replied with a single letterabbreviation of a command. This can cause seriousundesirable results; for example, if you were to enter

“I” (IPL). If you really want to enter the the command,enter an abbreviation that contains more than onecharacter.

CSTWTO005E ERROR(eeee)

Explanation: The CP or CMS command you issuedcompleted with an error (eeee).

CSTWTO006E UNKNOWN CP/CMS/CSTCOMMAND

Explanation: You entered a command for which avalid CP or CMS (SUBSET) command could not befound.

DMS messages

DMSFLD22E INVALID DATASET DISPOSITION

Explanation: FILEDEF detected an error in the DISPparameter.

User response: Determine which FILEDEF is detectingthe error. Most FILEDEFs are done in EXECs. Becausethis parameter is immediately before the DISP in the

FILEDEF, this error can be caused by having anincorrect data set name (for example, more than twoqualifiers). A correct name would be, for example,RACF.DATASET. If the RACF data set FILEDEF isfailing, check how it is defined in the data set namestable (ICHRDSNT).

HCP messages

HCPRPD001I REQUEST TO SET RACF [ACTIVE |INACTIVE ] MADE BY uuuuuuuu

Explanation: A user who is logged on to the RACFservice machine (indicated by uuuuuuuu in themessage) issued the SETRACF command.

Operator response: If the request was to deactivateRACF, look for message HCPRPD002A, which willrequire a reply. Otherwise, no action is necessary.

HCPRPD002I REPLY YES TO ALLOWDEACTIVATION - ANYTHING ELSEWILL CANCEL REQUEST

Explanation: A user logged on to the RACF servicemachine issued the SETRACF command to deactivateRACF. (Message HCPRPD001I, which precedes thismessage, indicates which RACF service machine therequest was issued from.)

The RACF service machine will not be able to run untilyou reply to this message. Therefore, all authorizationrequests that it receives, including LOGON, are delayeduntil you reply.

If you reply with “YES”, RACF is deactivated and ALLsecurity will be based on CP directory processing.

Operator response: You should contact the security oroperations managers, or both, immediately if a decisionprocedure is not in place. If a “YES” reply isappropriate, enter “YES” at the console. Any otherreply you enter cancels the request and releases theRACF service machine indicated in the previous

message. Do not respond to this message with a “YES”unless you have positively identified the person loggedon to the user ID making the request.

HCPRPD003I DEACTIVATE REQUEST DENIED BYOPERATOR

Explanation: The operator responded to thedeactivation request (message HCPRPD002A) withsomething other than YES.

User response: Call the operator or the securityadministrator, or both, and make arrangements todeactivate RACF.

HCPRPD004I VERIFICATION REQUIRED BYOPERATOR, PLEASE WAIT

Explanation: The system sends this message to theRACF service machine console when a user ID requestsSETRACF INACTIVE. The operator has alreadyreceived messages HCPRPD001I and HCPRPD002Aprompting for a YES or NO reply.

User response: If you have not already contacted theoperator to coordinate this request, do so immediately.The RACF service machine can do no other processinguntil the operator makes a reply.

HCPRPD005I DEACTIVATE REQUEST CANCELED

Explanation: The operator denied the request todeactivate RACF.

CSTWTO002E • HCPRPD005I


HCPRPD006I RACF DEACTIVATED

Explanation: The system issues this message when theoperator responds with a “YES” to messageHCPRPD002A. The system sends it to both the operatorand the RACF service machine console.

Operator response: Monitor the situation closely.RACF should be reactivated as soon as possible. Anoperator response is not necessary but notification ismade at the operator console when RACF isreactivated.

HCPRPD007I RACF DEACTIVATION WILL FORCESERVER IPL ON SUBSEQUENTACTIVATION

Explanation: A SETRACF INACTIVE command isbeing run on a system which is a member of an SSIcluster. If the RACF deactivation is approved, thenwhen RACF is subsequently activated all the connectedRACF servers running on the system will be re-IPLed.

Operator response: Look for message HCPRPD002A,A reply of YES will allow the RACF deactivation. Anyother response will cancel the request.

HCPRPI035I CP/RACF communication pathestablished to service machine serverid

Explanation: The RACF service machine (serverid)completed initialization and requested an IUCVconnection with CP. CP accepted the request andestablished an IUCV path.

HCPRPI036E CP/RACF communication path brokento service machine serverid

Explanation: The IUCV path between the RACFservice machine (serverid) and CP was severed.

Operator response: If this message is a result ofnormal operations (such as maintenance) no action isrequired. Otherwise, monitor the operator console. Ifthe path is not reestablished automatically, initiaterecovery procedures.

HCPRPI037I Entering authorization quiesce state forservice machine serverid

Explanation: The RACF service machine (serverid) hasreceived more authorization requests than it can handleat the time. CP delays sending further requests untilthe RACF service machine issues a RESUME to CP.

Operator response: Monitor the operator console.Message HCPRPI038I appears when the RACF servicemachine resumes the active state. If the message doesnot appear, contact system support to investigate theproblem.

HCPRPI038I Returning to authorization active statefor service machine serverid

Explanation: The RACF service machine (serverid)(also identified in previously issued messageHCPRPI037I) has completed a sufficient number ofauthorization requests so that additional requests canbe received. CP sends any pending authorizationrequests received while the RACF service machine wasin the quiesce state.

Operator response: No action required.

HCPRPD006I • HCPRPI038I


Password Messages on z/VM

Note:

Initial password prompt for LOGON, AUTOLOG, XAUTOLOG, and RACF CONNECT(command session) –

Enter your PasswordorTo change your password,

enter: ccc/nnn/nnnwhere ccc=current passwordand nnn=new password

A password message may be accompanied by one of the following prompts:

v During normal LOGON

To change your password,enter: ccc/nnn/nnnwhere ccc=current passwordand nnn=new passwordor,Enter LOGOFF to cancel

v During AUTOLOG, XAUTOLOG, and the RACF command session

To change your password,enter: nnn/nnnwhere nnn=new passwordor,Enter CANCEL

Although prompts only refer to passwords, they also apply to password phrases.

HCPRPW001E Password too long

Explanation: The new password you entered wasgreater than 8 characters long or the new passwordphrase you entered was greater than 100 characters.

User response: Choose a password with up to 8characters or password phrase with up to 100characters and enter it instead.

HCPRPW002E Password syntax invalid

Explanation: The new password you entered wasinvalid.

User response: Choose a different new password andenter it instead.

HCPRPW003E New and verify passwords don'tmatch

Explanation: While you were changing your passwordor password phrase, you were asked to enter your newpassword or password phrase twice. The second entry(the verify password or password phrase) did notmatch the first.

User response: Reenter the new and verify passwordsor password phrases. If you wish to cancel the request,enter the LOGOFF command.

HCPRPW004I Password changed

Explanation: You requested a password or passwordphrase change and the change was successful.

User response: This is an informational messageconfirming the change.

HCPRPW005I RACF appears inactive - enterdirectory password if prompted.

Explanation: Although RACF is installed on thissystem, it appears to be inactive.

User response: If the system prompts you for apassword, enter the password defined in your directoryentry.

If the system does not prompt you for a password,report this message to system support.

HCPRPW006I Verify password required

Explanation: While you are changing your passwordor password phrase, you are asked to enter your newpassword or password phrase twice. The second entryis the verify password or password phrase, and must beentered to confirm the spelling of the new password orpassword phrase.

User response: Enter the new password or passwordphrase again.

HCPRPW007I Old and new password type mismatch

HCPRPW001E • HCPRPW007I


Explanation: While you were changing yourauthenticator (a password or password phrase), youeither specified your current password and a newpassword phrase, or you specified your currentpassword phrase and a new password. This is notallowed.

User response: Reenter the new and verify

authenticators. Your current, new, and verifyauthenticators must all be either passwords orpassword phrases. They cannot be mixed. If you wishto cancel the request, enter the LOGOFF command.

Once you have logged on, you can use the RACFPASSWORD or PHRASE command to change yourpassword or password phrase.

ICH messages

Messages Issued by the ICHDIRMV EXEC for RACF on z/VM

ICHDIR001I ICHDIRMV was unsuccessful inmoving the directory.

Explanation: An error occurred during ICHDIRMVprocessing, and the directory move was not performed.

System action: Processing ends.

User response: Examine the accompanying errormessages to determine how to correct the failure.

ICHDIR002I Return code is return-code fromcommand "command-text".

Explanation: An error occurred when the CMS orRACF command named in command-text was issued.return-code is the return code from the command.

System action: Processing may or may not continue,depending on the severity of the error. If processingstops, message ICHDIR001I is issued also.

User response: If the command is a RACF command,see RACF Command Language Reference for adescription of RACF command return codes. If thecommand is a CMS command, see z/VM CMS CommandReference for a description of the command and itsreturn codes.

ICHDIR003I The new directory structure was created,but RACF profiles still remain from theold directory structure.

Explanation: The directory was successfully moved,but an error occurred while deleting RACF profilesfrom the directory structure that existed before themove.

System action: The directory move completessuccessfully.

User response: Examine the accompanyingICHDIR002I message(s) to determine the cause of theerror. After correcting the error, use the RAC DELDIRor RAC DELFILE command to delete the profile(s).

ICHDIR004I Output from the command is:

Explanation: The error message or output from thecommand in error is displayed. This messageaccompanies message ICHDIR002I, which names the

command text and return code.


User response: If the command is a RACF command,you can find the error description in this book. If thecommand is a CMS command, see z/VM SystemMessages and Codes for a description of the errormessage.

ICHDIR005I You must have a minidisk or SFSdirectory accessed in R/W mode, and itmust not be in the directory structurebeing moved.

Explanation: To run ICHDIRMV, you need a minidiskor SFS directory accessed in R/W mode. It must not bethe directory being moved or a subdirectory of thedirectory being moved.


User response: Access a minidisk or SFS directory inR/W mode, which is not in the directory structurebeing moved, and reissue ICHDIRMV.

ICHDIR006I Directory dirid cannot be processed.Return code from the LISTDIRcommand is return-code.

Explanation: The LISTDIR command was issued toextract information about the input directory dirid, butthe command failed.


User response: If you entered the directory nameincorrectly, correct the directory name and reissueICHDIRMV. If the directory is a valid directory,examine the return code of the LISTDIR command todetermine what caused the error. See z/VM CMSCommand Reference for a description of the LISTDIRcommand and its return codes.

ICHDIR007I Unable to issue RACF commands usingRAC. Return code is return-code.

Explanation: The ICHDIRMV exec requires the use ofthe RAC command processor, but return codereturn-code was received from the RAC LISTUSERcommand.

ICHDIR001I • ICHDIR007I



System programmer response: The RAC commandprocessor is placed on the system 19E disk duringinstallation of RACF. Ensure that your general usershave access to the RAC EXEC and its components inorder to use ICHDIRMV.

User response: If you do not have access to the RACcommand processor, report the message to your systemprogrammer.

ICHDIR008I Incorrect debugging option specified.Valid options are "SHOW" or "SHOWNOCMD".

Explanation: You entered ICHDIRMV with more thantwo input parameters, and they are interpreted asdebugging options. The only valid debugging optionsare "SHOW" and "SHOW NOCMD".


User response: Correct the debugging options andissue ICHDIRMV again, or to run ICHDIRMV with nodebugging options, issue ICHDIRMV with only twoinput parameters.

ICHDIR009I You cannot rename or relocate a topdirectory.

Explanation: You issued ICHDIRMV specifying a topdirectory as the first input directory. A top directorycannot be renamed or relocated, so the command isrejected.


User response: Correct the first input directory name,which is the name of the SFS directory to be moved,and reissue ICHDIRMV.

ICHDIR010I Directory dirid is not valid. Return codefrom the LISTDIR command isreturn-code.

Explanation: The name you entered for the secondinput directory is not valid. Some possible errorsinclude:

v You specified a file mode that is not associated withan SFS directory

v You specified a directory name with no file pool, andyou have no default file pool currently assigned

v You specified a directory name with an incorrectformat


User response: Examine return-code, which is thereturn code from the LISTDIR command. See z/VMCMS Command Reference for a description of theLISTDIR command and its return codes.

ICHDIR011I Subdirectory name change is not valid.Only the last qualifier of a subdirectorycan be renamed.

Explanation: You specified ICHDIRMV to change thename of a directory, but more than one qualifier isdifferent between the old directory name and the newdirectory name. When renaming a directory withICHDIRMV, only the last qualifier of that directoryname may be renamed. For example, the directoryA.B.C.D may be renamed to directory A.B.C.X becausethey both specify A.B.C.


User response: Reissue the command, specifying thedirectory names correctly.

ICHDIR012I An error occurred while backing outchanges made to the directory structure.

Explanation: An error occurred while processing thedirectory move, and ICHDIRMV attempted to back outchanges already made to the directory structure. Whilebacking out the changes, another error occurred, andthe initial directory structure could not be restored.


User response: Examine the accompanying errormessages to determine which commands failed duringthe backout processing. Correct the errors indicated bythese messages and reissue ICHDIRMV.

ICHDIR013I Two input directories are required. Issue"ICHDIRMV ?" for a complete syntaxdescription.

Explanation: ICHDIRMV was entered with nooperands or one operand, but two operands arerequired.


User response: Enter ICHDIRMV again with twoinput directory names, or issue "ICHDIRMV ?" for adescription of the operands required.

ICHDIR014I Too many subdirectory levels inresulting directory structure.

Explanation: The directory move was not performedbecause the resulting directory structure would containmore than 8 subdirectory levels. The total number ofsubdirectory levels is determined by looking at thenumber of the subdirectories in the target directory andadding the number of subdirectories that will beconcatenated at the end.


User response: Reissue the command, specifying twodirectory names that result in a structure containing nomore than 8 subdirectory levels.



ICHDIR015I A directory cannot be relocated withinitself.

Explanation: You specified a target directory that iswithin the directory to be moved. A directory cannot bemoved within its own directory structure.


User response: Reissue the command, specifying atarget directory that is not within the directory to bemoved.

ICHDIR016I A directory cannot be relocated withinthe same parent directory.

Explanation: You specified a target directory that isthe parent directory of the directory to be moved. Youcannot move a subdirectory to its own parent directory.


User response: Reissue the command, specifying atarget directory that is not the parent of the directory tobe moved.

ICHDIR017I Error writing to recovery file filenamefiletype filemode. Return code isreturn-code.

Explanation: As ICHDIRMV runs, it creates a recoveryfile containing commands that can be used to back outSFS and RACF changes if ICHDIRMV encounters anerror. When ICHDIRMV attempted to write to thisrecovery file, an error occurred. As a result, therecovery file might not contain an accurate list of thecommands needed to recover the original directorystructure that existed before ICHDIRMV was issued.

return code is the return code issued from a stagecommand in CMS Pipelines that attempted to write tothe file.


User response: Do the following:

v If other error messages were issued with thismessage, examine them for possible actions to take.

v To allow ICHDIRMV to recover from any changesthat were recorded in the recovery file before theerror occurred, reissue ICHDIRMV with noparameters.

v Examine the SFS directory structure for the directorythat was being moved to be sure:

– It contains all its subdirectories and files

– No locks remain for the directory and itssubdirectories

ICHDIR018I Recovery file filename filetype filemode isnot valid. It will be erased.

Explanation: The named ICHDIRMV recovery filecontained records that were not correct or were not inthe correct format. The file is erased.


ICHDIR019I Recovery file filename filetype filemode isbeing processed.

Explanation: The named file was found on anaccessed R/W disk or directory and is being processedto recover from an error during a previous invocationof ICHDIRMV. If you entered any directory names onthe ICHDIRMV command, the recovery file isprocessed before the directory names are processed.


ICHDIR020I Command being recovered iscommand-text.

Explanation: An ICHDIRMV recovery file is beingprocessed to recover from an error during a previousinvocation of ICHDIRMV. The command listed in theerror message is the previous ICHDIRMV commandwhich is being recovered.


ICHDIR021I Processing of recovery file filenamefiletype filemode was { successful |unsuccessful }.

Explanation: The named file was used to attempt torecover from changes made during a previousinvocation of ICHDIRMV. The message indicateswhether the recovery was successful.

System action: Processing continues if the recoverywas successful. Processing ends if the recovery wasunsuccessful.

User response: If the recovery was unsuccessful:

1. Examine accompanying messages to determinewhat actions to take.

2. Reissue ICHDIRMV with no parameters to processthe recovery again.

If errors persist and the errors do not indicate that aproblem exists in the directory structure (for example,an ERASE directory command is failing because thedirectory no longer exists), you can erase the recoveryfile.

ICHDIR022I Directory directory-id is not protected byRACF, so it will not be moved.

Explanation: ICHDIRMV is intended to movedirectories that are protected by RACF, but the nameddirectory is not protected by RACF.




User response: Reissue ICHDIRMV, specifying adirectory that is protected by RACF.

ICHDIR023I The directory structure was restored, butrecovery file filename filetype filemodecould not be erased. Erase the filebefore issuing ICHDIRMV again.

Explanation: An error occurred during ICHDIRMVprocessing. The changes were properly backed out butan error occurred when erasing the named recoveryfile.


User response: Erase the named file.

ICHDIR024I Correct the errors described in theprevious error messages, and thenreissue ICHDIRMV with no parameters.

Explanation: An error occurred during ICHDIRMVrecovery processing. The recovery process did notcomplete.


User response: Examine the accompanying errormessages and determine the appropriate actions totake. Reissue ICHDIRMV with no parameters toattempt the recovery again.

ICHDIR999I Undefined message number inICHDIRMV EXEC. Number =msg-number.

Explanation: An internal error occurred.


User response: Contact the IBM support center withthe exact text of this message.

Messages Issued by the ICHSFS EXEC for RACF on z/VM

ICHSFS002A When executing batch files, would youlike RACF messages displayed on theterminal screen? (Enter YES, NO, orQUIT to end.)

Explanation: When you run a batch file of RACFcommands, RACF messages are saved in a reader file.You can choose whether to display the messages on theterminal screen as well.

System action: The utility waits until a response isentered.

User response: Enter one of the following:

v YES to display RACF messages on the terminalscreen

v NO to have no RACF messages displayed on theterminal screen

v QUIT to stop further processing

ICHSFS003A Enter the ID of the file pool migratingto RACF. (Enter QUIT to end.)

Explanation: Because you entered no parameters forthe ICHSFS utility, you are prompted to enter the nameof a file pool to be processed.



v The name of a file pool that is to be migrated toRACF.

v QUIT to stop further processing.

ICHSFS004I File pool administrator authority isrequired to extract SFS security

information from file pool "file-pool".

Explanation: Because you entered a file pool forICHSFS to process, QUERY ENROLL ADMINISTRATOR wasissued to determine if you are defined as a file pooladministrator for file pool file-pool. The command failedto indicate that you have file pool administratorauthority.

System action: Processing continues with the next filepool. If no other file pool is specified, processing ends.

User response: Enter a file pool for which you havefile pool administrator authority or run the utility froma user ID that has file pool administrator authority forfile pool file-pool. To specify a different file pool, do oneof the following:

v If you invoked ICHSFS with no parameters, you areprompted to enter a different file pool.

v If you specified an input file when you invokedICHSFS, you must edit the input file to specify adifferent file pool. Reissue ICHSFS.

ICHSFS005I The SETROPTS command failed toactivate generic processing. No batchfiles will be run. Return code isreturn-code.

Explanation: The RAC SETROPTS command wasissued to activate generic processing for the FILE andDIRECTRY classes, but the command failed. The RACFreturn code from the SETROPTS command isreturn-code.

System action: Processing continues and batch filescan be created, but the RACF commands in the batchfiles cannot run.

User response: See RACF Command Language Reference

ICHDIR023I • ICHSFS005I


for a description of return codes for the RAC commandprocessor. After the problem is corrected, restart theICHSFS utility to run the batch files again.

ICHSFS006A Input file "filename filetype filemode" wasnot found. Enter new file name, filetype and file mode. (Enter QUIT toend.)

Explanation: You entered an input file of file pool IDsas a parameter to the ICHSFS utility, but the specifiedfile does not exist.



v The name of an existing file that contains a list of filepool IDs to be migrated to RACF.


ICHSFS007I Unable to issue RAC LISTUSERcommand to determine RACF securityauthorization. Return code is return-code.

Explanation: The RAC LISTUSER command wasissued to verify the command issuer has RACFSPECIAL authority. The return code from the commandis return-code.

System action: Processing continues, but no batch filescan run.

User response: See RACF Command Language Referencefor a description of return codes for the RAC commandprocessor. After the problem is corrected, restart theICHSFS utility.

ICHSFS008A WARNING: You do not have RACF"SPECIAL" authority. Batch files createdby this exec cannot be run from thisuser ID.

Explanation: You need RACF "SPECIAL" authority torun the batch files of RACF commands created by theutility.

System action: Processing continues and batch filescan be created, but the RACF commands in the batchfiles cannot run.

User response: After the utility has created the batchfiles, you may send the files to another user ID that hasthe RACF "SPECIAL" attribute. From that user ID, youcan invoke ICHSFS to run the batch files of RACFcommands.

ICHSFS009I You do not have a minidisk or SFSdirectory in R/W mode.

Explanation: The ICHSFS utility requires a R/Wminidisk or SFS directory to be accessed in the searchorder.

System action: Processing halts. No batch files havebeen created.

User response: Access a minidisk or SFS directory inR/W mode and restart the ICHSFS utility.

ICHSFS010I An error occurred while writing a recordto "filename filetype filemode" from aninternal variable. Return code isreturn-code.

Explanation: An error occurred while attempting towrite a record to the batch file of RACF commands.The return code from the EXECIO command isreturn-code.

System action: Processing continues with the next filepool. If no other file pool is specified, processing halts.

User response: Correct the error and restart theICHSFS utility. See z/VM CMS Command Reference for adescription of return codes from the EXECIOcommand.

ICHSFS011I An error occurred while extracting a listof users enrolled in file pool "file-pool".Return code is return-code.

Explanation: An error occurred while running thecommand QUERY ENROLL USER FOR ALL file-pool.

System action: Processing for file pool file-pool ends.Processing continues with the next file pool, if one isspecified.

User response: To process the file pool named in themessage, correct the error and restart the ICHSFSutility. See z/VM CMS Command Reference for adescription of return codes from the QUERY ENROLLcommand.

ICHSFS012A Would you like to continue processingthe rest of the input file? (Enter YES,NO, or QUIT to end.)

Explanation: An error occurred processing a previousfile pool, and there are more file pools specified in theinput file. You can choose to continue processing theother file pools or to stop further processing.



v YES to continue processing the other file pool IDs inthe input file.

v NO to skip processing of other file pool IDs in theinput file. If any batch files were already created, youare prompted to run them.


ICHSFS006A • ICHSFS012A


ICHSFS013I An error occurred while accessingdirectory dirid. ACCESS return code isreturn-code.

Explanation: The directory dirid was being accessed inorder to extract the file authorizations from within it,but the ACCESS command failed with return codereturn-code.

System action: Processing continues with the nextdirectory.

User response: See z/VM CMS Command Reference fora description of return codes from the ACCESScommand. Correct the error and restart the ICHSFSutility to recreate the batch file for the file pool thatcontains the directory in error.

ICHSFS014I The file "filename filetype dirid" containslowercase characters. It is not added toRACF.

Explanation: RACF does not support the creation ofdiscrete profiles containing lowercase characters. TheSFS authorities for the named file are not translatedinto RACF authorities.

To protect SFS files that contain lowercase characters,you must use generic profiles. For example, to protectthe file

OFSMAIL OFSLOGfl POOL1:USER1.DIR1

(note the lowercase 'fl') you could use any of thefollowing file profile names:

OFSMAIL OFSLOG* POOL1:USER1.DIR1OFSMAIL OFSLOG%% POOL1:USER1.DIR1* OFSLOG%% POOL1:USER1.DIR1* OFSLOG%% POOL1:USER1.DIR1.**

System action: The file name is recorded in the fileICHSFS NOTADDED and processing continues with thenext file.


1. Use the RACF ADDDIR command to create ageneric profile to protect the file named in themessage.

2. List the SFS authorities for the file using theQUERY AUTHORITY command.

3. See RACF Security Administrator's Guide todetermine which RACF commands you shouldissue to translate SFS authorities into correspondingRACF authorities.

4. Issue those RACF commands.

ICHSFS015I Processing of file pool IDs from theinput file is complete.

Explanation: Each file pool ID from the input file hasbeen processed.


ICHSFS016I File pool file-pool is being processed.

Explanation: The ICHSFS utility has begun processingof file pool file-pool.


ICHSFS017A Do you want to migrate another filepool to RACF? (Enter YES, NO, or QUITto end.)

Explanation: No input file of file pool IDs wasspecified on the invocation of the ICHSFS utility, soyou are prompted to enter a file pool ID to beprocessed.



v YES to process another file pool.

v NO to end the input process of file pool IDs.


ICHSFS018I File IDs were found with lowercaseletters. These were not processed. Seefile "ICHSFS NOTADDED filemode" fordetails.

Explanation: At least one file name or file type wasfound to contain lowercase letters. The file ICHSFSNOTADDED contains a list of files that contain lowercasecharacters.

RACF does not support the creation of discrete profilescontaining lowercase characters, so the SFS authoritiesare not translated into RACF authorities for files withlowercase characters.

To protect SFS files that contain lowercase characters,you must use generic profiles. For example, to protectthe file

OFSMAIL OFSLOGfl POOL1:USER1.DIR1

(note the lowercase 'fl') you could use any of thefollowing file profile names:

OFSMAIL OFSLOG* POOL1:USER1.DIR1OFSMAIL OFSLOG%% POOL1:USER1.DIR1* OFSLOG%% POOL1:USER1.DIR1* OFSLOG%% POOL1:USER1.DIR1.**


User response: For each file listed in ICHSFS NOTADDED,do the following:

1. Use the RACF ADDDIR command to create ageneric profile to protect the file.

2. List the SFS authorities for the file using theQUERY AUTHORITY command.

ICHSFS013I • ICHSFS018I


3. See RACF Security Administrator's Guide todetermine which RACF commands you shouldissue to translate SFS authorities into correspondingRACF authorities.

4. Issue those RACF commands.

ICHSFS019I ICHSFS processing ended.

Explanation: The ICHSFS utility has completed itsprocessing.

ICHSFS020A Incorrect response. Valid responses are:response1 response2 response3. Try again.

Explanation: The response you entered for a previousprompting message was incorrect.

System action: The previous prompting message isdisplayed again.

User response: Enter one of the valid responses.

ICHSFS021A Do you want to run the batch filefilename filetype filemode now? (Enter YES,NO, or QUIT to end.)

Explanation: You may optionally run the RACFcommands in the batch file filename filetype filemode.



v YES to run the RACF commands in the batch file.

v NO to bypass running the RACF commands in thebatch file.


ICHSFS022A Do you want to display the batch fileunder XEDIT? (Enter YES or NO.)

Explanation: You have chosen to run the RACFcommands in a batch file, and you have the option toedit the file before running it.



v YES to edit the batch file.

v NO to run the RACF commands in the batch file.


ICHSFS023I filename SFSUT1 filemode batch file isbeing run. Please wait.

Explanation: The RACF commands in the batch fileare being run.


ICHSFS024I There were no RACF messages issuedwhile running the batch file.

Explanation: RACF commands from a batch file wererun, and there were no RACF messages issued.


ICHSFS025I The output reader file of RACFmessages has a file ID of reader-number.

Explanation: RACF commands from a batch file wererun, and the RACF messages issued were saved in areader file.


User response: You may look at the reader file byissuing PEEK reader-number.

ICHSFS026A Do you want to delete the batch filefilename SFSUT1 filemode? (Enter YES,NO, or QUIT to end.)

Explanation: You can optionally delete the batch filefilename SFSUT1 filemode if you have run the RACFcommands in it or do not plan to run the RACFcommands in it.



v YES to delete the batch file.

v NO to save the batch file.


ICHSFS027I filename SFSUT1 filemode has beendeleted.

Explanation: You requested that filename SFSUT1filemode be deleted, and the deletion was successfullycompleted.

ICHSFS028I Batch file creation of filename SFSUT1filemode is {complete | incomplete}.

Explanation: The batch file filename SFSUT1 filemodewas created and contains either a full or partial set ofRACF commands corresponding to the SFS authoritiesin the file pool. If the file is incomplete, messageICHSFS010I was issued previously describing the batchfile error. If the file is complete, no error wasencountered writing records to the batch file.


User response: If the file is incomplete, see messageICHSFS010I for further information.

ICHSFS019I • ICHSFS028I


ICHSFS029I No users are defined for file pool"file-pool", so no migration will beperformed for this file pool.

Explanation: The file pool file-pool does not containany user files and directories to be migrated.

System action: Processing continues with the next filepool. If no other file pool is specified, processing ends.

ICHSFS030I RACF command "racf-command"completed with return code return-code.

Explanation: While running the RACF commands in abatch file, a RACF command completed with anon-zero return code.


User response: See RACF Command Language Referencefor a description of return codes for the RAC commandprocessor. You can edit the batch file and run it againby restarting the ICHSFS utility.

ICHSFS031I The following ICHSFS batch filesalready exist and may be run now.

Explanation: When the ICHSFS utility was invoked, atleast one ICHSFS batch file already existed and may beprocessed.

System action: The batch files are listed, and thesystem prompts you as to whether each one should berun.

ICHSFS999A Undefined message number in ICHSFSEXEC. Number = msg-number.

Explanation: An internal error occurred.


User response: Contact the IBM support center withthe exact text of this message.

IKJ Messages During A RACF Command SessionRACF commands were originally TSO commands. (TSO, or Time Sharing Option,is the means by which interactive users gain access to z/OS systems.) In a RACFcommand session, or when using the RAC command, the RACF commands aretreated as TSO commands.

TSO messages (which have a prefix of IKJ) can result from syntax errors madewhile issuing a RACF command in a RACF command session, or when using theRAC command.

If a user makes a mistake entering a RACF command in a RACF commandsession, IKJ messages such as “INVALID KEYWORD” and “REENTER THISOPERAND” appear describing the syntax error found and prompting the user forto reenter the input. To escape from this prompt, enter hx. When you get a READYprompt, enter hx again. At this point, you can continue the RACF commandsession, or type END to exit.

IKJ56700A ENTER missing-data

Explanation: The user did not enter neededinformation. The TSO/E parse service routine isprompting the user for a correct value.

User response: Check the spelling of the keyword ordata set name, and enter it again.

IKJ56701I MISSING missing-data

Explanation: The user did not enter neededinformation and is in no-prompt mode.

If the message states that an entity name is missing,check the resource name or profile name specified.

IKJ56702A ENTER DATASET WHICH IS TOHAVE ACCESS LIST ALTERED -or-ENTER USER NOT DEFINED TORACF -or- ENTER NAME OF DATASETTO BE RACF PROTECTED

Explanation: These are second-level messages issuedfor message IKJ56718A, and are displayed when theuser enters ? in response to message IKJ56718A.

If ENTER USER NOT DEFINED TO RACF was displayed,then the user ID specified on the command is alreadydefined to RACF. Check the spelling of the user ID,and if correct, use the ALTUSER command.

IKJ56702I INVALID invalid-data

Explanation: The user entered data considered invalidby the system.

User response: This message could be issued when

ICHSFS029I • IKJ56702I


attempting to create a profile in a class that is notactive. If the message relates to generic profiles, thenthe generic profile checking facility must be active forthe class (GENERIC operand on SETROPTS command).Check the spelling of the class name specified on thecommand. If you have spelled the class name correctly,see your RACF security administrator for informationabout the class.

IKJ56703A REENTER –

Explanation: If the user is in prompt mode, he isprompted with this message until he enters the correctinformation or the processing of the command isstopped. In a RACF command session, stop theprocessing by entering hx.

Restart the command session by entering hx again.

IKJ56706I ENDING QUOTE ASSUMED, data

Explanation: The user did not enter an ending quoteand the end of the buffer is reached. The quote isassumed at the end of the buffer.

IKJ56707I RIGHT PARENTHESIS ASSUMED, data

Explanation: The user omitted the right parenthesis. Itis assumed to be at the end of the buffer.

IKJ56709I INVALID DATA SET NAME, dsname

Explanation: The user entered an invalid data setname.

IKJ56712I INVALID KEYWORD, keyword

Explanation: The user entered an invalid keyword.

IKJ56713I INVALID VALUE, value

Explanation: The user entered an invalid value(operand on IKJPOSIT macro).

IKJ56715I INVALID STRING, string

Explanation: The user entered invalid stringinformation. A string is an operand on the IKJPOSITmacro.

IKJ56716I EXTRANEOUS INFORMATION -IGNORED, data

Explanation: The user entered more information thanis necessary to process a command and parse cannotgive it a disposition.

System action: The command is processed without theignored data.

IKJ56717I INVALID invalid information

Explanation: The user entered invalid information.

IKJ56718A REENTER+ –

Explanation: This is a prompt for informationdescribed by a previous message. The user is promptedwith this message until the correct information isentered by the user or the processing of the commandis stopped. In a RACF command session, stop theprocessing by entering hx.

Restart the command session by entering hx again.

IKJ56760I NO INFORMATION AVAILABLE

Explanation: This message is issued when the userenters ? to receive a second-level message, but there areno second-level messages available.

IKJ56801I DATASET NOT USABLE – CANNOTOPEN DATASET

Explanation: SYS1 HELP file may not be present.

User response: Ensure that the SYS1 HELP file is onthe RACF 305 disk and has a file mode of 4.

IKJ56802I HELP NOT AVAILABLE+

Explanation: A HELP command was entered for aninvalid command or subcommand or one with noHELP on the system.

IKJ56806I command-name keyword KEYWORD NOTFOUND

Explanation: A HELP command was entered for avalid RACF command (or subcommand), but theportion of the help identified by keyword could not befound.

User response: Check the spelling of keyword specifiedon the HELP command.

IKJ56703A • IKJ56806I


RAC messages

RACSEC001A The RACSEC EXEC could not locatethe RPIQSEC MODULE on any disk.

Explanation: The RACSEC EXEC requires theRPIQSEC MODULE, but the RPIQSEC MODULE doesnot appear in the user's CMS search order.

System action: The RACSEC EXEC cannot continuewithout the RPIQSEC MODULE.

User response: Notify your system support personnel.

Programmer response: The RPIQSEC MODULE mustbe placed on the CMS system disk.

RACSEC002I Userid userid is not currently loggedon, or does not have a security label.

Explanation: User userid is either not logged on, or islogged on but does not have a security label currentlyassigned. This can happen if

v the RACF SECLABEL class is not active when theuser enters the system through the LOGON,AUTOLOG, or XAUTOLOG command

v The RACF user profile for that user does not have adefault SECLABEL assigned to it

RACSEC003A RACF is currently unable to return thesecurity label.

Explanation: RACF was unable to retrieve the user'ssecurity label because either RACF has been madeinactive (by the SETRACF INACTIVE command), orthe IUCV path between CP and the RACF servicemachine is broken. If RACF is inactive, then anadministrator has intentionally caused this condition. Ifthe IUCV path is broken, it may be the result ofintentional administrative intervention, or it could bethe result of an error condition.

User response: Reenter the request. Notify systemsupport personnel if the problem persists.

Programmer response: If RACF is inactive, then setRACF active when appropriate. If the IUCV path isbroken, then the operator will have already receivedmessage HCPRPI036E and should be taking theappropriate action as described in that message.

RACSEC004I The security label for user userid isseclabel.

Explanation: The current security label (seclabel) foruser userid is identified in the message text.

RACUTL001E nnnnnnnn REJECTED - CHECKRACINIT MACRO FOR COMPLETIONCODE OF cccccc

Explanation: RACINIT processing failed when

ICHUT100 was running. nnnnnnnn is the user ID of theuser invoking ICHUT100. cccccc is the return code fromthe RACINIT macro (in hexadecimal).

User response: If the return code is X'20', ensure thatyou are executing ICHUT100 from RACMAINT. If youare, report the complete text of this message to yourIBM support center.

If the return code is other than X'20', the explanationfor the RACINIT return code should help youinvestigate the problem. For an explanation of thereturn code, refer to the description of the macro returncode in one of the following:

v For releases before RACF 1.8.1 and 1.8.2, see RACFSystem Programmer's Guide.

v For RACF 1.8.1 or RACF 1.8.2, see RACF Macros andInterfaces.

v For RACF 1.9 or later, see RACROUTE.

RACUTL002E nnnnnnnn REJECTED - CHECKRACINIT MACRO FOR RETURNCODE OF cccccc

Explanation: RACINIT processing failed whenICHUT100 was running. nnnnnnnn is the user ID of theuser invoking ICHUT100. cccccc is the return code fromthe RACINIT macro (in hexadecimal).

User response: If the return code is X'20', ensure thatyou are executing ICHUT100 from RACMAINT. If youare, report the complete text of this message to yourIBM support center.

If the return code is other than X'20', the explanationfor the RACINIT return code should help youinvestigate the problem. For an explanation of thereturn code, refer to the description of the macro returncode in one of the following:




RACUTL003E nnnnnnnn REJECTED - CHECKRACINIT MACRO FOR RETURNCODE OF cccccc

Explanation: RACINIT processing failed whenDSMON was running. nnnnnnnn is the user ID of theuser invoking DSMON. cccccc is the return code fromthe RACINIT macro (in hexadecimal).

User response: If the return code is X'20', ensure thatyou are executing DSMON from RACMAINT. If youare, report the complete text of this message to yourIBM support center.

If the return code is other than X'20', the explanation

RACSEC001A • RACUTL003E


for the RACINIT return code should help youinvestigate the problem. For an explanation of thereturn code, see the description of the macro returncode in one of the following:




RPI messages

RPIADU001A IPL the system CMS before you runthis utility.

Explanation: The RACFADU utility found that the 490disk containing RACF's modified copy of CMS isaccessed as file mode S. You must IPL the system CMSin order to process this utility.

System action: The RACFADU input panel will not bedisplayed and processing ends.

User response: IPL CMS and restart this utility.

RPIADU002A Load module IRRADU00 not found inthe RACFLINK LOADLIB.

Explanation: The IRRADU00 load module must bepresent in the RACFLINK LOADLIB in order for theunload utility to perform successfully.


System programmer response: Ensure that the userattempting to run RACFADU has read access to theRACF service machine's 305 disk. Ensure that the loadmodule IRRADU00 is present in the RACFLINKLOADLIB. If the IRRADU00 load module was notfound in the RACFLINK LOADLIB, ensure that theVMSES/E installation and build procedures weresuccessful and the correct VMSES/E build lists wereused.


RPIADU003A Cannot access the RACF/VM servicemachine's "305" disk.

Explanation: The RACF/VM 305 disk must be linkedwith at least READ access.


User response: Contact your system securityadministrator for access to the disk.

RPIADU004A Undefined key pressed.

Explanation: An undefined PF key was pressed.

System action: A message is issued on the panelmessage line.

User response: Press a valid key.

RPIADU006A Panels cannot be displayed on a linemode device.

Explanation: Panels cannot be displayed because theutility is not being run on a display terminal.


User response: Use command invocation or use adisplay terminal.

RPIADU009A Virtual address of input SMFminidisk is required.

Explanation: A virtual address was not entered in theinput SMF disk address field. It is a required field.

System action: If the error occurs during panelinvocation, the user is prompted for an entry in thisfield.

User response: Enter the virtual address of the inputSMF minidisk in the designated field on the panel or asa parameter when using command invocation.

RPIADU010A Virtual address of output minidisk isrequired.

Explanation: A virtual address was not entered in theoutput minidisk field. It is a required field.

System action: If the error occurs during panelinvocation, the user can reenter correct values.

User response: Enter the virtual address of the CMSformatted minidisk in the designated field on the panelor as a parameter when using command invocation.

RPIADU011A SMF data file was not found onminidisk at virtual address xxxx.

Explanation: The utility did not find an input SMFdata disk on the user-designated input virtual addressfield.

System action: If the error occurs during panelinvocation, the user can reenter correct values. If theerror occurs during command invocation, processingends.

User response: Check that there is a SMF data disk atthe virtual address specified which contains the SMFrecords in the file SMF DATA.

RPIADU001A • RPIADU011A


RPIADU014A Device type at virtual address xxxx isnot valid.

Explanation: The device type of the disk at thespecified virtual address cannot be a OS formattedminidisk.


User response: Supply the virtual address of a CMSformatted minidisk which contains the SMF records tobe processed by the RACFADU utility. The minidiskmust contain the SMF records in the file SMF DATA.

RPIADU016A Input address at xxxx is undefined.

Explanation: The minidisk specified at virtual addressxxxx is not CP-defined or linked to the user ID.

System action: If the error occurs during panelinvocation, the user can reenter correct values. If erroroccurs during command invocation, processing ends.

User response: Verify that the input SMF disk addresswas entered correctly and linked to the user ID runningthe RACFADU utility.

RPIADU017A Output address at xxxx is undefined.

Explanation: The output minidisk specified at virtualaddress xxxx is not CP-defined or linked to the user ID.


User response: Verify that the output disk addresswas entered correctly and is linked to the user ID.

RPIADU018A Output virtual address cannot be a OSformatted minidisk.

Explanation: The virtual address specified to containthe unloaded output was found to be OS formatted.The output file cannot be written to OS formattedDASD.


User response: Supply the address of a CMSformatted minidisk.

RPIADU019A Output virtual address must be linkedR/W.

Explanation: The virtual address specified to containthe unloaded output was found NOT to be R/Waccessible. The output minidisk must be linked as R/W.


User response: Supply a virtual address of a minidiskwith read/write access.

RPIADU020A Required parameter(s) not specified.

Explanation: The required parameters for commandinvocation of RACFADU were not specified. Values forinput database and output minidisk must be supplied.

System action: A message is issued on the CMSscreen and processing ends.

User response: Correct the command invocationsyntax and reenter.

RPIADU021I All input fields are correct. Press PF2 toexecute.

Explanation: The RACFADU utility has verified allinput and is ready to be invoked.

User response: Press PF2 to run the utility.

RPIADU022I Please correct the above condition(s) andrestart this utility.

Explanation: This message is issued with messagesRPIADU001A, RPIADU002A, and RPIADU003A.

User response: The RACFADU panel is not displayedand processing ends.

RPIADU025I File filename filetype exists on outputminidisk. It will be backed up asfilename filetype1. Press PF2 to execute.

Explanation: The file specified for the utility outputalready exists on the output minidisk.

System action: The utility renames the existing fileand continues processing.

RPIADU026A Input address at xxxx is not aminidisk. Device type = device-type

Explanation: The input address is not valid because itis not a minidisk. The address device specified isdisplayed as device-type.

System action: If the error occurs during panelinvocation, the user can reenter correct values. If the

RPIADU014A • RPIADU026A


error occurs during command invocation, processingends.

User response: Supply the address of a minidisk thatcontains the SMF records to be processed.

RPIADU027A Too many virtual address parametersspecified.

Explanation: More than two virtual addresses wereentered in a command invocation of the utility.


User response: Invoke the utility again specifying twovirtual addresses.

RPIADU029A Unable to access virtual address xxxx.

Explanation: The specified device appears to havebeen defined but not formatted.

System action: If the error occurs during panelinvocation, the panel is redisplayed. If the error occursduring command invocation, processing ends.

User response: If the error occurs during panelinvocation, either enter another device virtual addressor exit the panel and format the specified virtualdevice. If the error occurs during command invocation,format the specified device and reenter the command.

RPIADU033I SMF unload completed successfully.View the RACFADU MESSAGES filefor additional details.

Explanation: The SMF unload utility (IRRADU00) hassuccessfully completed processing. The RACFADUMESSAGES file contains detailed informationconcerning the unload.

System action: The RACFADU input panel isredisplayed. Command invocation returns to the CMSready prompt.

User response: Examine the CMS file RACFADUMESSAGES for additional information on theprocessing of the utility.

RPIADU034A RACFADU was unsuccessful. Viewthe RACFADU MESSAGES file for errordetails.

Explanation: The unload utility (IRRADU00) did notcomplete successfully. The RACFADU MESSAGES filecontains detailed information concerning the errorcondition.

System action: The RACFADU input panel isredisplayed. Command invocation returns to the CMSready prompt.

User response: Examine the CMS file RACFADUMESSAGES for additional information on theprocessing of the utility.

RPIADU036A RACFADU was unsuccessful. Theoutput minidisk may not be largeenough to contain the output file.

Explanation: RACFADU was not able to completeprocessing of all the SMF records. It appears that theoutput minidisk may not be large enough to hold all ofthe processed records.

System action: The RACFADU input panel isredisplayed. Command invocation ends.

User response: Determine if the output minidisk isapproximately twice as large as the input SMFminidisk. If it is not, allocate another minidisk.

RPIADU039A Disk cannot be used for both inputand output.

Explanation: The same virtual address was specifiedfor both the input and output minidisks.

System action: If the error occurs during panelinvocation, the user can reenter the correct values. Ifthe error occurs during command invocation,processing ends.

User response: Enter the virtual address of the inputSMF minidisk in the designated field on the panel or asa parameter when using command invocation. Enter aunique virtual address for the output CMS formattedminidisk.

RPIADU998A Undefined variable in line nnn.

Explanation: An internal error occurred in processing.



RPIADU999A Undefined message number inRACFADU XEDIT macro. Number = xx.


System action: Processing continues, if possible.


RPIALC001E FILEDEF for disk XX does not exist.

Explanation: A FILEDEF for the disk that wasattempting to be allocated does not exist. TheRACALLOC EXEC may not have been used to allocateDASD.


System programmer response: Ensure RACALLOC isused to allocate DASD.

RPIADU027A • RPIALC001E


RPIALC002E FILEDEF for DDNAME xxxxxxxx is notfound at file mode XX.

Explanation: A FILEDEF for the specified ddname hasnot been issued. The RACALLOC EXEC may not havebeen used to allocated DASD.


System programmer response: Ensure RACALLOC isused to allocate DASD and issue the FILEDEF for theappropriate ddname.

RPIALC003E FILEDEF for DDNAME xxxxxxxx at filemode XX has no associated data setname.

Explanation: A FILEDEF was issued without the DSNoperand. The RACALLOC EXEC may not have beenused to allocate DASD.


System programmer response: Ensure RACALLOC isused to allocate DASD and issue the FILEDEF with theDSN operand specified.

RPIALC004E TRACKS per CYLINDER cannot bedetermined for device xxxx.

Explanation: An unsupported DASD device has beenencountered.


System programmer response: Allocate a supportedDASD device and reissue.

RPIALC005E I/O error processing disk xxxx. Devicepresented condition code 3; sense isXXXXXX. Device presented conditioncode 1; R15 is XXXXXXXX. Devicepresented condition code 2; R15 isXXXXXXXX.

Explanation: The DASD has presented an errorcondition as indicated by the condition code and senseinformation.

System action: Processing abends.

System programmer response: Analyze the conditioncode and sense information.

RPICLM001E IUCV INIT error, IPRCODE=iprcode

Explanation: An error occurred when the changelogserver attempted to connect to the *RPI system service.

System action: Processing continues but passwordand password phrase enveloping and change loggingare not enabled.

User response: If you received an IUCV INIT error,IPRCODE=F, then add the following statement:

IUCV *RPI PRIORITY MSGLIMIT 100

to the CP directory entry for your LDAP server(LDAPSRV). For all other errors, please call the IBMsupport center.

RPICLM002E IUCV CONNECT has been rejected

Explanation: A connect request by the changelogserver to the *RPI system service was rejected.

System action: Processing continues but passwordand password phrase enveloping and change loggingare not enabled

System programmer response: Call the IBM supportcenter.

Security Administrator Response: Make sure that thechangelog server has READ access to theIRR.CHANGELOG profile in the FACILITY class. If itdoes not have READ access, issue the following RACFcommands:

RDEFINE FACILITY IRR.CHANGELOG UACC(NONE)PERMIT IRR.CHANGELOG CLASS(FACILITY) ID(LDAPSRV)

ACCESS(READ)SETROPTS RACLIST(FACILITY) REFRESH

If this is not the problem, call the IBM support center.

RPICLM003E IUCV connection has been severed

Explanation: The changelog server connection to the*RPI system service has been unexpectedly severed.

System action: Processing continues but passwordand password phrase enveloping and change loggingare no longer enabled.

RPICLM004E IUCV Receive error, IPRCODE=iprcode

Explanation: An error occurred while handling anincoming message interrupt. The IUCV RECEIVEinstruction returned a non-zero condition code and thereported IPRCODE. To interpret the IPRCODE, seeChapter 5. IUCV Function in z/VM: CP ProgrammingServices.



RPICLM006E srv_cl_init is already running

Explanation: An initialization request was sent to thealready initialized changelog dll.



RPIALC002E • RPICLM006E


RPICLM007E IUCV send queue error.

Explanation: The IUCV request queue handlerexperienced an unexpected error.

System action: Processing continues but passwordand password phrase enveloping and change loggingrequest will be lost.

RPICLS101E - UNABLE TO OPEN THE RACF DATABASE.

Explanation: An attempt to open the RACF databaseto read the ICB (index control block) failed.

System action: See “System Action” for messageRPICLS104W.



v Reinitialize the RACF service machine. This mightcorrect errors related to FILEDEF statements (VMonly).

v If necessary, switch to a backup RACF database(using the RVARY SWITCH command).



RPICLS102E - PERMANENT I/O ERROR HASOCCURRED PROCESSING THE RACFDATA BASE.

Explanation: A permanent I/O error was detectedwhen an attempt was made to read or write the ICB(index control block) for the primary RACF database.




Note: For complete information on recovering from theproblem, see the section on RACF database recovery inRACF System Programmer's Guide. Pay particularattention to the section on failures during I/Ooperations on the RACF database.


RPICLS103E - DYNAMIC ALLOCATION ERRORENCOUNTERED FOR THE RACFDATA BASE.

Explanation: While attempting to allocate the RACFdata set (using SVC 99) an error was encountered.








RPICLS104W - DEFAULT SETTINGS WERE MADEFOR ALL AUDITABLE ANDCONTROLLABLE VM EVENTS.

Explanation: During RACF initialization the currentRACF database's primary ICB (index control block) wasread and there was no saved copy of CP's ACI bit map.

System action: The ACI bit map in CP (in moduleHCPRWA) will be set with the following defaults:

RPICLM007E • RPICLS104W


v Auditing is set off for all defined events.

v Access checking is set on for all events defined ascontrollable events by the VM operating system.

Operator response: If message RPICLS101E,RPICLS002E, RPICLS003E, or RPICLS005E precedes thismessage, report that message to your systemprogrammer. Otherwise, take no action.

System programmer response: If messageRPICLS101E, RPICLS002E, RPICLS003E, or RPICLS005Eprecedes this message, see “System ProgrammerResponse” for that message. Otherwise, take no action.

Problem determination: If message RPICLS101E,RPICLS002E, RPICLS003E, or RPICLS005E precedes thismessage, see “Problem Determination” for thatmessage. Otherwise, take no action.

RPICLS105E - READ ERROR OCCURRED WHILEATTEMPTING TO RETRIEVE A COPYOF THE PROFILE NAMES FROM THERACF DATA BASE.

Explanation: The RACF service machine was unableto read the primary ICB (index control block) for thecurrent RACF database.








RPICLS106E - WRITE ERROR OCCURRED WHILEATTEMPTING TO STORE THE AUDITAND CONTROL PROFILE NAMES INTHE ICB.

Explanation: The RACF service machine was unableto update the primary ICB (index control block) for thecurrent RACF database.

System action: RPICLS continues processing andattempts to update the VM event settings in CP (inmodule HCPRWA).







RPICLS107E - INITIALIZATION FAILED. THEBUFFER CREATED TO CONTAIN ALLACTIVE VM EVENTS IS TOO SMALL.

Explanation: A request was made to update the VMevent settings in CP (in module HCPRWA), but this bitmap has never been created.

System action: RACF initialization fails.


System programmer response: Check that RACF/VMis properly installed. You must generate the CP nucleuswith the new copy of module HCPRWA, whichcontains a space for the VM event settings.

Problem determination: If the module HCPRWA is atthe correct level, report this problem to your IBMsupport center.

RPICLS105E • RPICLS107E


RPICLS108E - VM EVENT STATUS UPDATEFAILED. INVALID FUNCTION CODEWAS PASSED TO THE DIAGNOSEHANDLER.

Explanation: An invalid DIAGNOSE subfunction codewas passed to the RACF DIAGNOSE handler (moduleHCPRPD).

System action: The VM event settings in CP (inmodule HCPRWA) will be set with the followingdefaults:




System programmer response: Check that RACF/VMis properly installed. Module HCPRPD may beback-level with respect to the current release ofRACF/VM.

Problem determination: If module HCPRPD is at thecurrent release level, report this problem to your IBMsupport center.

RPICLS109E - VMXEVENT CLASS IS NOT ACTIVE.

Explanation: The VMXEVENT class must be activebefore installation-defined VM event settings can bemade.

System action: The VM event settings are made withthe following defaults:




System programmer response: Activate theVMXEVENT class using the SETROPTS command withCLASSACT specified.

RPICLS110E - VMXEVENT CLASS IS NOTDEFINED TO RACF.

Explanation: The VMXEVENT class must have anentry in the class-descriptor table beforeinstallation-defined VM event settings can be made.





System programmer response: Ensure that the

VMXEVENT class has an entry in the class-descriptortable.

RPICLS111E - PROFILE NAME: profile-name FOUNDIN THE RACF DATA BASE DOES NOTEXIST.

Explanation: The profile indicated in the messagecannot be found in class VMXEVENT.





System programmer response: First, determine whichprofile in class VMXEVENT should be used for the VMevent settings on this system. If none exists, see RACFSecurity Administrator's Guide for information oncreating one. After ensuring that a valid VMXEVENTprofile exists, issue the SETEVENT command with thename of the VMXEVENT profile specified on theREFRESH operand.

RPICLS112W - IN PROFILE profile-name, THEFOLLOWING MEMBER IS INVALID:event-name

Explanation: During RACF initialization, the VMevent settings on the system are reset. To do this, RACFuses a copy of the VMXEVENT profile indicated in themessage. This message identifies one of the members inthe copy of the VMXEVENT profile that is incorrectlyspecified.

System action: Processing continues with the nextmember name.


System programmer response: Use the RALTERcommand to correct the invalid member name in theVMXEVENT profile indicated in the message. Thenissue the SETEVENT command, specifying the name ofthe VMXEVENT profile on the REFRESH operand. Thisrefreshes the system and corrects the copy of the profileused by RACF.

RPICLS113W - IN PROFILE profile-name, THEMEMBER LIST HAS A DUPLICATEENTRY FOR: event-name

Explanation: During RACF initialization, the VMevent settings on the system are reset. To do this, RACFuses a copy of the VMXEVENT profile indicated in themessage. Two entries are in the member list of theprofile, with one entry turning control (or auditing) on

RPICLS108E • RPICLS113W


and the other turning control (or auditing) off for thesame event.

System action: If control was specified in the eventname, control is turned on for the event.

If auditing was specified in the event name, auditing isturned off for the event.



RPICLS114W - TURNING CONTROL ONAUTOMATICALLY FOR: event-name

Explanation: This message does not necessarilyrepresent an error. A controllable event (indicated in themessage) was not found in the member list of theVMXEVENT profile specified on the SETEVENTcommand.

System action: Control is turned on for the eventindicated in the message.

RPICLS115E - A PROBLEM WITH {RACSTAT |RACXTRT | RACHECK} RETURNCODE = return-code, DURING THEPROCESSING OF A PROFILE STOREDIN THE RACF DATA BASE.

Explanation: There was a problem issuing aRACSTAT, RACXTRT, or RACHECK macro.

System action: RACF terminates system refresh of VMevent settings.



Problem determination: For an explanation of thereturn code, see the description of the macro returncode in one of the following:


v For RACF 1.8.1 and RACF 1.8.2, see RACF Macrosand Interfaces.


RPICLS116E - IN PROFILE profile-name THEFOLLOWING IS NOT ACONTROLLABLE VM EVENT:member-name

Explanation: During RACF initialization, the VMevent settings on the system are reset. To do this, RACFuses a copy of the VMXEVENT profile indicated in themessage. One of the members in the profile is not acontrollable VM event.

System action: Processing continues with the nextmember name.



RPICLS117I - REFRESH IS FROM PROFILE:profile-name, WHICH HAS NO VALIDAUDITABLE MEMBERS. AUDITINGWILL BE TURNED OFF FOR ALLEVENTS.

Explanation: During RACF initialization, the VMevent settings on the system are reset. To do this, RACFuses a copy of the VMXEVENT profile indicated in themessage. There were no valid members in the copy ofthe profile.

System action: Auditing is set off for all definedevents.

Operator response: If your installation does not auditVM events, this message does not indicate an error.

If your installation does audit VM events, report theexact text of this message to your system programmer.

System programmer response: If your installationaudits VM events, first determine which profile in classVMXEVENT should be used for the VM event settingson this system. If none exists, see RACF SecurityAdministrator's Guide for information on creating one.After ensuring that an appropriate VMXEVENT profileexists, issue the SETEVENT command, specifying thename of the VMXEVENT profile on the REFRESHoperand. This refreshes the system and updates thecopy of the profile used by RACF.

RPICLS118I - REFRESH IS FROM PROFILE:profile-name, WHICH HAS NO VALIDCONTROLLABLE MEMBERS.CONTROLLABLE EVENTS ARECONTROLLED.

Explanation: During RACF initialization, the VM

RPICLS114W • RPICLS118I


event settings on the system are reset. To do this, RACFuses a copy of the VMXEVENT profile indicated in themessage. There were no valid members in the copy ofthe profile.

System action: Access checking is set off for alldefined events except the CP commands SPOOL, LINK,TAG, ST HOST, and TRANSFER (class C and G), forwhich access checking is activated.

Operator response: If your installation has notchanged which VM events are controlled, this messagedoes not indicate an error.

If your installation has changed which VM events arecontrolled, report the exact text of this message to yoursystem programmer.

System programmer response: If your installation haschanged which VM events are controlled, firstdetermine which profile in class VMXEVENT should beused for the VM event settings on this system. If noneexists, see RACF Security Administrator's Guide forinformation on creating one. After ensuring that anappropriate VMXEVENT profile exists, issue theSETEVENT command, specifying the name of theVMXEVENT profile on the REFRESH operand. Thisrefreshes the system and updates the copy of theprofile used by RACF.

RPICLS119E - NOT ENOUGH VIRTUAL STORAGEFOUND TO CONTAIN THEAUDITABLE AND CONTROLLABLEVM EVENTS.

Explanation: The RACF service machine does nothave enough virtual storage available for the VMevents that are to be audited and controlled.

System action: RACF does not change the VM eventsettings.


System programmer response: Specify a larger virtualstorage size for the RACF service machine.

RPICLS120E - HCPDA0 COULD NOT STORE THEVM EVENT SETTINGS. RETURNCODE = return-code.

Explanation: Module HCPDA0 could not record theVM event settings.

System action: RACF does not change the VM eventsettings.



RPICLS121E Unexpected return code xxx fromHCPRPEPX. RACF will not be used forOpenEdition functions.

Explanation: During initialization of the RACF servicemachine, RACF attempted to register itself to VM as anExternal Security Manager, which supportsOpenExtensions functions. VM provides theHCPRPEPX entry point for that purpose. However,RACF encountered an unexpected return code xxx fromHCPRPEPX. The return code is displayed in decimal.

System action: RACF initialization continues.However, VM will not utilize RACF forOpenExtensions related functions. Specifically, VM willuse OpenExtensions information defined within the CPdirectory rather than the information defined withinthe OVM segment of USER and GROUP profiles. Also,VM will not call RACF for authorization and auditingof certain OpenExtensions events.


System programmer response: This message mightmean there is a service mismatch or a storage overlay.Complete the steps in the problem determinationsection of this message and verify that the RACF codein CP is at the correct level. If so, report the text of thismessage, including the return code, to the IBM supportcenter.

Problem determination: Verify that the correct valuefor NGROUPS_MAX, as specified on the ICHNGMAXmacro in HCPRWA, is defined at the entry definitionfor HCPRWANM within HCPRWA. If the value is notcorrect, there might be a storage overlay condition.

For a description of the HCPRPEPX return codesdefined by VM, see z/VM CP Planning andAdministration. For a description of the ICHNGMAXmacro, see RACF Macros and Interfaces.

RPICLS122E Unexpected return code rc fromHCPPWAPF.

Explanation: RACF attempted to register its supportof extended passwords to z/VM, but encountered anunexpected return code rc while calling the registrationinterface in CP.

System action: System operation continues, but userscan only authenticate to RACF using an upper casepassword of 8 characters or less.



RPICLS119E • RPICLS122E


RPICLS123I RACF Extended password supportregistered

Explanation: RACF has registered its support ofextended passwords to z/VM. Users can authenticatewith mixed case passwords and with passwordphrases, assuming the options have been enabled bythe RACF administrator.

RPICMD001T INVALID OPTION - PLEASERE-ENTER

Explanation: BATCH is the only valid option on theRACF command. You entered an option other thanBATCH.

User response: Reenter the RACF command withBATCH, or with no option.

RPICMD002E COMMAND SESSIONTERMINATED - CONNECTIONSEVERED.

Explanation: During a RACF command session, theRACF service machine severed the IUCV path becausea severe problem resulted in an abend or because theservice machine was re-IPLed.

User response: Restart the command session andcontinue. If the session was in batch mode and manyRACF commands were being processed, try todetermine which commands were completed, andeliminate those commands from the batch stream. Ifyou are unable to eliminate them, you must reprocessthe entire stream of commands. This creates twoproblems for you:

v Any ADD or DELETE commands successfullyprocessed in the previous run will fail because theprofiles have already been created or deleted.

v If any commands involved changes to profiles,reprocessing those commands will cause the samechanges to be entered.

RPICMD003I RACF/VM COMMAND SESSIONCOMPLETE

Explanation: You ended the RACF command sessionby entering “END” at the terminal.

RPICMD004E CANNOT CONNECT TO THERACF/VM SERVICE MACHINE

Explanation: This message will appear for one of twopossible reasons. 1) The IUCV connection between CPand the RACF service machine is broken, so thecommand session cannot be established. 2) The user IDattempting to establish a RACF command session isitself a RACF service machine. RACF commands maynot be issued from a RACF service machine.

User response: 1) Wait a few moments and try again.If the problem persists, contact support personnel. 2) If

you are attempting to establish a RACF commandsession from a RACF service machine, try again from adifferent user ID.

RPICMD005E ERROR READING CONSOLE -PLEASE RE-ENTER

Explanation: The system encountered a console I/Oerror while trying to read data.

Programmer response: Reenter the input data.

RPICMD006I SIMULATED ATTENTION (¬)SUBSTITUTED FOR “HX”

Explanation: You entered “HX” during a commandsession. “HX” is normally used to terminate acommand in CMS; the system translates it to asimulated attention character and terminates the RACFcommand. The command session itself is notterminated.

User response: Enter a new RACF command or enterEND to terminate the command session.

RPICMD009E IUCV ERROR : ffffffff CC=1, RC=nn

Explanation: While trying to perform IUCV functionffffffff during a RACF command session, the systemencountered an IUCV error. The condition codereceived from IUCV was 1 and the the return code wasnn.


User response: The IUCV return codes can be foundin z/VM CP Programming Services,. If the problempersists, report this message to your systemprogrammer.

RPICMD009E IUCV ERROR : ffffffff CC=n

Explanation: While trying to perform IUCV functionffffffff during a RACF command session, the systemencountered an IUCV error. The condition codereceived from IUCV was 2 or 3.


User response: The IUCV return codes can be foundin z/VM CP Programming Services,. If the problempersists, report this message to your systemprogrammer.

RPICMD009W IUCV INTERRUPT OF TYPE tt WASUNEXPECTED

Explanation: During a command session, the user endof the IUCV path received the unexpected interrupt.


RPICLS123I • RPICMD009W


User response: If the problem persists, report thismessage to your system programmer.

RPICMD010E RACF session terminated due to xxxxxcommand.

Explanation: A command was entered that caused theRACF session to terminate.

User response: If you want to use a RACF commandsession, you must reestablish the session.

RPICMD012E PASSWORD INCORRECT

Explanation: Your installation requires a password orpassword phrase in order to establish a RACFcommand session. An incorrect password or passwordphrase was given.

User response: Enter the correct password orpassword phrase.

RPICMS001E An invalid operand was entered.

Explanation: RPIUCMS received an invalid parameterin the input parameter list when it was called by theuser.

System action: Control is returned to the caller.

User response: Reissue the command with a validparameter. Valid parameters are INIT, TERM, or blank(blank defaults to INIT).

RPICMS002E HNDIUCV SET error, IPRCODE=code.

Explanation: A non-zero IUCV return code wasreturned from HNDIUCV SET. The return code fromthe IUCV parameter list (IPARML) is displayed in themessage.


User response: Re-IPL CMS and reissue theinitialization sequence. If the problem persists, reportthis message to system support.

RPICMS003E CMSIUCV CONNECT error,IPRCODE=code.

Explanation: A non-zero IUCV return code wasreturned from CMSIUCV CONNECT. The return code(code) from the IUCV parameter list (IPARML) isdisplayed in the message.

Note: The CMSIUCV return code is equal to: code +1000

System action: The RACROUTE interface isterminated and control is returned to the caller.

Operator response: If the value of code is 15, makesure the user has IUCV authorization in the CPdirectory by performing one of these two steps:

1. To provide global IUCV authorization, so any userin the system can connect to the RACF servicemachine, update the RACF service machine's CPdirectory entry by adding this IUCV statement:

IUCV ALLOW

2. To give IUCV authorization to a single user, updatethe user's CP directory entry by adding an IUCVstatement that specifies the RACF service machinewith which the user will be communicating, forexample:

IUCV RACFVM PRIORITY MSGLIMIT 255


RPICMS004E Nucleus storage allocation error,RC=code.

Explanation: An attempt at obtaining nucleus freestorage failed. The return code from DMSFREE isdisplayed in the message.



RPICMS005E Error creating nucleus extension,RC=code.

Explanation: An attempt was made to create anucleus extension and failed. The return code from theNUCEXT function is displayed in the error message.



RPICMS006E Error releasing nucleus extension,RC=code.

Explanation: An attempt was made to release anucleus extension and failed. The return code from theNUCEXT function is displayed in the error message.



RPICMD010E • RPICMS006E


RPICMS007E Installation RACF ID file does notexist.

Explanation: An attempt at locating the installationparameter file was made, and failed to locate it. Thisfile must reside on a system disk or a user's disk.


User response: The MAINT 19E disk should beaccessed. If the RACF SERVMACH file still does notexist, then report this message to system support.

RPICMS008E Error reading the Installation RACF IDfile x

Explanation: An attempt at reading the installationparameter file was made, and failed.



RPICMS009W IUCV communication has beensevered.

Explanation: RPIUCMS received an IUCV interrupttype of X'03' from the RACF service machine.

System action: RACF issues an IUCV SEVER requestand cleans up the communication path.

User response: Reissue the initialization sequence.

RPICMS010E RACXTRT failed in authorizationattempt, contact system support.

Explanation: The RACROUTE REQUEST=EXTRACTauthorization attempt was failed for the ICHCONNprofile in the FACILITY class.


User response: Report this message to system support.

RPICMS011E You are not authorized to connect toRACF.

Explanation: You tried to connect to the RACF servicemachine, but you are not authorized to do so.


Operator response: Make sure the user hasappropriate access to the ICHCONN profile in theFACILITY class:

1. Create a profile called ICHCONN in the FACILITYclass:

RDEFINE FACILITY ICHCONN UACC(NONE)

2. Give READ or UPDATE access authority to theappropriate service machines:

PERMIT ICHCONN CLASS(FACILITY)ID(user-ID|group-ID)ACCESS(appropriate-access)

where appropriate-access is one of the following:NONE Prevents use of the RACROUTE macroREAD Allows use of the RACROUTE macro

request types that do not requireAPF-authorization on MVS (such asREQUEST=AUTH)

UPDATEAllows use of the RACROUTE macrorequest types that do requireAPF-authorization on MVS (such asREQUEST=VERIFY).

Note: Refer to the description for thespecific request to determine which level ofauthority is required.

3. Activate the FACILITY class (if this class is notalready active):

SETROPTS CLASSACT(FACILITY)


RPICMS012E Initialization has not been performed.

Explanation: An attempt was made to terminateRPIUCMS, but the initialization was never performed.


User response: Issue the command with the INITparameter specified before attempting to terminate.

RPICMS013E FACILITY class is inactive, contactsystem support.

Explanation: The class FACILITY is inactive, so aRACHECK can not be performed to check the user'sauthorization. System support should be notified toactivate the class.



RPICMS014E IUCV Receive error, IPRCODE=code

Explanation: A non-zero IUCV return code wasreturned from IUCV RECEIVE. The return code fromthe IUCV parameter list (IPARML) is displayed in themessage.


User response: Re-IPL CMS and reissue theinitialization sequence. If the problem persists, report

RPICMS007E • RPICMS014E


|

this message to system support.

RPICMS015E A communication error has occurred,Re-IPL CMS.

Explanation: An invalid parameter list was passedbetween RPIUCMS and either RPIURIM or RPIURCM.This may cause the user to be in an infinite wait state,a re-IPL is required.


User response: Re-IPL CMS and reissue theinitialization sequence.

RPICMS016I USER/RACF VM RACROUTEcommunication path is established.

Explanation: The user's machine is initialized andready to issue RACROUTE requests.


RPICMS017I USER/RACF VM RACROUTEcommunication path has beenterminated.

Explanation: The user's machine has severed to RACFand is no longer a nucleus extension.


RPICMS018I RACINIT failed in an attempt to createan ACEE for you, contact systemsupport.

Explanation: An attempt was made to build an ACEEusing a RACROUTE REQUEST=VERIFY and failed.


RPICMS019I SFSAUTOACCESS=access-level is ineffect for the RACROUTE interface.

Explanation: RPIUCMS INIT was issued to initializethe RACROUTE interface and the RACF SERVMACHfile contains the SFSAUTOACCESS value specified inaccess-level.

If the user receiving this message is a SFS file poolserver, some authorization requests for SFS files anddirectories will be granted without sending the requestto the RACF service machine for processing. Bypassingcalls to the RACF service machine results in substantialperformance improvements.

If the user receiving this message is not a SFS file poolserver, this message can be ignored.

System action: The RACROUTE interface continues toinitialize.

User response: For more information about the

SFSAUTOACCESS option, see RACF SystemProgrammer's Guide.

RPICMS020I Incorrect value 'access-level' was specifiedfor SFSAUTOACCESS in the RACFSERVMACH file.

Explanation: RPIUCMS INIT was issued to initializethe RACROUTE interface and the second record in theRACF SERVMACH file contains an incorrect value ofaccess-level specified for SFSAUTOACCESS.

Values allowed for access-level are NONE, READ,UPDATE, CONTROL, and ALTER. The value specifiedmust not contain leading or imbedded blanks, buttrailing blanks are accepted.

System action: The SFSAUTOACCESS value is set toNONE and the RACROUTE interface continues toinitialize. Message RPICMS019I is also issued toindicate SFSAUTOACCESS=NONE is in effect.

User response: If you do not wishSFSAUTOACCESS=NONE to be in effect, correct theSFSAUTOACCESS value in the RACF SERVMACH fileand re-initialize the RACROUTE interface with theRPIUCMS INIT command.

For more information about the SFSAUTOACCESSoption and how to specify the option in RACFSERVMACH, see RACF System Programmer's Guide.

RPICMS021E RACF has not completed SSI databaseinitialization.

Explanation: An attempt to establish an IUCVconnection for RACROUTE requests was made beforethe server was fully initialized.

System action: The RACF server rejects theconnection.

User response: Retry the connection after the server isfully initialized.

RPIDBU001A “490” disk must be IPLed to run thisutility.

Explanation: The 490 minidisk must be IPLed beforeRACFDBU can be run.

System action: The RACFDBU input panel will not bedisplayed and processing terminates.

User response: IPL the 490 disk of the RACF/VMservice machine and restart this utility.

RPIDBU002A Load module IRRDBU00 not found.

Explanation: The IRRDBU00 load module must bepresent in the RACFLINK LOADLIB in order for theunload utility to perform successfully.

System action: The RACFDBU input panel will not bedisplayed and processing ends.

RPICMS015E • RPIDBU002A


System programmer response: Ensure that the userattempting to run RACFDBU has read access to theRACF service machine's 305 disk. Ensure that the loadmodule IRRDBU00 is present in the RACFLINKLOADLIB. If the IRRDBU00 load module was notfound in the RACFLINK LOADLIB, ensure that theVMSES/E installation and build procedures weresuccessful and the correct VMSES/E build lists wereused.


RPIDBU003A Cannot access the RACF/VM servicemachine's “305” disk.

Explanation: The RACF/VM 305 disk must be linkedwith at least READ access.

System action: The RACFDBU input panel will not bedisplayed and processing terminates.

User response: Contact your system programmer foraccess to the disk.

RPIDBU004A Undefined key pressed.

Explanation: An undefined PF key was pressed.


User response: Press a valid key.

RPIDBU005A Multiple files found on input FBAdatabase disk. Specify file name andtype.

Explanation: More than 1 CMS file was found on theuser–designated FBA input disk. The utility is unable todetermine which file contains the RACF database.

System action: The panel prompts the user for entryof the database file name and file type. If this erroroccurs during command invocation, the commandterminates.

User response: Supply the RACF database file nameand file type at the system prompts. If you were doingcommand invocation, correct the command syntax andreissue the command.

RPIDBU006A Panels cannot be displayed on a linemode device.

Explanation: Panels cannot be displayed because theutility is not being run on a display terminal.

System action: A message is issued and processingterminates.

User response: Use command invocation or use adisplay terminal.

RPIDBU007I FBA DASD can have only 1 inputdatabase. All others will be ignored.

Explanation: Optional database input fields werespecified and are not valid for FBA DASD. The RACFdatabase cannot be split into parts if you are using FBADASD.

System action: Optional database input fields areignored and processing continues.

User response: Do not supply optional input databasevirtual addresses for FBA DASD.

RPIDBU008I Status of input database has beendefaulted to “1”.

Explanation: No entry was made in the “Status ofinput database” field.

System action: The utility uses a default value of 1(NOLOCKINPUT) for input status of the RACFdatabase.

RPIDBU009A Virtual address of input database isrequired.

Explanation: A virtual address was not entered in theinput database address field. It is a required field.

System action: Prompts user for an entry in this field.If the error occurs during command invocation,processing terminates.

User response: Enter the virtual address of the inputdatabase in the designated field on the panel or as aparameter when using command invocation.

RPIDBU010A Virtual address of output minidisk isrequired.

Explanation: A virtual address was not entered in theoutput minidisk field. It is a required field.

System action: If the error occurs during panelinvocation, the user can reenter correct values. If theerror occurs during command invocation, processingterminates.

User response: Enter the virtual address of theCMS-formatted minidisk in the designated field on thepanel or as a parameter when using commandinvocation.

RPIDBU011A No files found on minidisk at virtualaddress xxxx.

Explanation: The utility did not find an input RACFdatabase on the user-designated input virtual address.


RPIDBU003A • RPIDBU011A


User response: Check that there is a RACF database atthe virtual address specified.

RPIDBU012A Input database status is not valid.

Explanation: An entry other than 1, 2, or 3 was madein the “Status of input database” field.


User response: Reply 1, 2, or 3 for the “Status of inputdatabase” field.

RPIDBU013A Blocksize at virtual address xxxx is not“4096”.

Explanation: The block size of all input databases tothe unload utility must have a block size of 4096,indicating a restructured database.


User response: Supply the virtual address of an inputdatabase that is in the restructured format (block size4096).

RPIDBU014A Device type at virtual address xxxx isnot valid.

Explanation: The device type of the disk at thespecified virtual address was not “OS” or “FBA”. TheRACF database can only exist on OS–formatted or FBAminidisks.


User response: Supply the virtual address of an inputdatabase that is OS–formatted or on an FBA minidisk.

RPIDBU015A Input address xxxx type is not valid.

Explanation: An optional virtual address was enteredthat is not the same type DASD as the previous partsentered.


User response: Ensure that all input database partsexist on the same device type.

RPIDBU016A Input address at xxxx is undefined.

Explanation: The input database specified at virtualaddress xxxx is not CP-defined or linked to the user ID.

System action: If the error occurs during panelinvocation, the user can reenter correct values. If erroroccurs during command invocation, processingterminates.

User response: Verify that the input database addresswas entered correctly and linked to the user ID.

RPIDBU017A Output address at xxxx is undefined.

Explanation: The output minidisk specified at virtualaddress xxxx is not CP-defined or linked to the user ID.


User response: Verify that the output databaseaddress was entered correctly and is link accessible.

RPIDBU018A Output virtual address cannot be“OS”.

Explanation: The virtual address specified to containthe unloaded output was found to be OS–formatted.The output file cannot be written to OS–formattedDASD.


User response: Supply the address of aCMS-formatted minidisk.

RPIDBU019A Output virtual address must be linkedR/W.

Explanation: The virtual address specified to containthe unloaded output was found NOT to be R/Waccessible. The output minidisk must be linked as R/W.


User response: Supply a virtual address of a minidiskwith read/write access.

RPIDBU020A Required parameter(s) not specified.

Explanation: The required parameters for commandinvocation of RACFDBU were not specified. Values forinput database and output minidisk must be supplied.

System action: A message is issued on the CMSscreen and processing terminates.



User response: Correct the command invocationsyntax and reenter.

RPIDBU021I All input fields are correct. Press PF2 toexecute.

Explanation: The RACFDBU utility has verified allinput and is ready to be invoked.

User response: Press PF2 to run the utility.

RPIDBU022I Please correct the above condition(s) andrestart this utility.

Explanation: This message is issued with messagesRPIDBU001A, RPIDBU002A, and RPIDBU003A.

System action: The RACFDBU panel is not displayedand processing terminates.

RPIDBU023A Specified file not found on xxxx

Explanation: If your RACF database resides on FBADASD, the input file specified was not found.


User response: Supply the correct file name and filetype of your input RACF database.

RPIDBU024A Running with a LOCKINPUT orUNLOCKINPUT status requires R/Winput database(s).

Explanation: When LOCKINPUT or UNLOCKINPUT(2 or 3) is specified for the input database, the user IDmust have R/W access to the database.


User response: Ensure that the user ID running theutility has R/W access to the input database whenLOCKINPUT or UNLOCKINPUT is specified.

RPIDBU025I File filename filetype exists on outputminidisk. It will be backed up asfilename filetyp1. Press PF2 to execute.

Explanation: The file specified for the utility outputalready exists on the output minidisk.

System action: The utility will rename the existingfile.

RPIDBU026A Input address at xxxx is not aminidisk. Device type = devtype.

Explanation: The input address is not valid because itis not a minidisk. The address device specified isdisplayed as devtype.


User response: Supply the address of a minidisk onwhich the RACF database exists.

RPIDBU027A Too many virtual address parametersspecified.

Explanation: More than five virtual addresses wereentered in a command invocation of the utility.


User response: Up to four input virtual addresses andone output virtual address can be specified for “OS”DASD. Correct the command and reenter.

RPIDBU028A Input address xxxx is not valid.

Explanation: The input RACF database cannot existon a virtual address that is four characters in length.


User response: Supply a valid address for the inputRACF database. Correct the command and reenter.

RPIDBU029A Unable to access virtual address xxxx.

Explanation: The specified device appears to havebeen defined but not formatted.

System action: If the error occurs during panelinvocation, the panel is redisplayed. If the error occursduring command invocation, processing terminates.

User response: If the error occurs during panelinvocation, either enter another device virtual address,or exit the panel and format the specified virtualdevice. If the error occurs during command invocation,format the specified device and reenter the command.If the device is an input device, it must beOS/FBA–formatted. If the device is for output, it mustbe CMS–formatted with a block size of 4096.

RPIDBU030A Unable to determine blocksize atvirtual address xxxx.

Explanation: RACFDBU issued a CMS LISTDScommand to obtain information about the input deviceat the specified virtual address. Either the commandfailed or the output was not valid.

System action: If the error occurs during panelinvocation, the panel is redisplayed. If the error occurs

RPIDBU021I • RPIDBU030A


during command invocation, processing terminates.

User response: Contact your system programmerconcerning the LISTDS command failure.

RPIDBU031A Unable to process blocksize data forvirtual address xxxx.

Explanation: RACFDBU issued a CMS READCARDcommand to retrieve the LISTDS command output.This is used to determine the input device block size.


User response: Contact your system programmerconcerning the READCARD command failure.

RPIDBU032A Unable to set up the RACFenvironment. Return code fromRACSETUP = xxx.

Explanation: The RACF environment in which theRACFDBU utility runs could not be properly set up.The RACSETUP EXEC failed with the specified returncode.


User response: Contact your system programmerconcerning the RACSETUP EXEC failure.

RPIDBU033I Database unload completed successfully.View the RACFDBU MESSAGES filefor additional details.

Explanation: The database unload utility (IRRDBU00)has successfully completed processing. The RACFDBUMESSAGES file contains detailed informationconcerning the unload.

System action: The RACFDBU input panel isredisplayed. Command invocation returns to the CMSready prompt.

User response: Examine the CMS file RACFDBUMESSAGES for additional information on the executionof the utility.

RPIDBU034A Database unload was unsuccessful.View the RACFDBU MESSAGES filefor error details.

Explanation: The database unload utility (IRRDBU00)did not complete successfully. The RACFDBUMESSAGES file contains detailed informationconcerning the error condition.

System action: The RACFDBU input panel isredisplayed. Command invocation terminates.

User response: Examine the CMS file RACFDBU

MESSAGES for detailed information describing theerror.

RPIDBU036A RACFDBU was unsuccessful. Theoutput minidisk may not be largeenough to contain the output file.

Explanation: The database unload utility (IRRDBU00)did not complete successfully. The RACFDBUMESSAGES file contains detailed informationconcerning the error condition.

System action: The RACFDBU input panel isdisplayed. Command processing stops.

User response: Examine the CMS RACFDBU MESSAGESfile for detailed information describing the error.

RPIDBU037I RACFDBU is creating a R/W copy of 1or more RACF databases that arecurrently R/O. Please wait.

Explanation: RACFDBU is attempting to create copiesof any active databases that are linked in read-only(R/O) mode. All active databases are required to belinked read/write (R/W) mode when RACF is to bebrought up dynamically.


RPIDBU038A Disk at virtual address address cannotbe accessed.

Explanation: The disk specified at virtual addresscannot be accessed.

System action: Processing ends and control returns toCMS.

System programmer response: If any system defineddatabase minidisk cannot be accessed, check the CPdirectory definition of the problem DASD. If this iscorrect, try a different DASD pack to determine if thesubject pack is defective.

User response: Make sure that all disks containing thesystem-defined databases are available. Re-link anydatabase minidisks that do not show up in theexecuting user ID virtual DASD list.

RPIDBU039A Error occurred while copying R/Odatabase at address to temporary DASD.DDR return code = return-code.

Explanation: The RACFDBU EXEC uses the DDRcommand supplied by CMS to copy the contents ofR/O RACF databases to temporary DASD. DDRreturned a non-zero return code (return-code) toRACFDBU.


System programmer response: Verify that the copy of



the DDR MODULE on the system disk is at the samelevel as the current CMS installation.

RPIDBU040A RACF database at virtual addressaddress could not be accessed todetermine if it is R/O. Processing cannotcontinue.

Explanation: RACFDBU attempted to access a R/ORACF database and the ACCESS command returned anon-zero return code.


System programmer response: Verify that theACCESS command that is part of the 490 disk nucleusis the one supplied by IBM. If correct, contact the IBMsupport center.

User response: Verify that no downlevel module orexec named ACCESS exists on an accessed disk.

RPIDBU041A Temporary DASD could not beobtained for copying of R/O database.

Explanation: The RACFDBU EXEC tried to definetemporary DASD of the same type as the R/O RACFdatabase to copy. The CP DEFINE command returned anon-zero return code.


System programmer response: Make sure thatsufficient temporary DASD, that is the same type as theRACF database, is available to the executing user ID. Ifthis is not the problem, ensure that the DEFINEcommand executed is compatible with the executingsystem CP.

User response: Verify that sufficient temporary DASDof the same type as the RACF database is available tothe executing user ID for each R/O database. Issue theDEFINE command manually and check the return codein the appropriate VM publication.

Problem determination: RACFDBU issues a DEFINEcommand to allocate temporary DASD that is the samesize and type as the R/O database being processed. Anon-zero return code was returned by the DEFINEcommand. A return code of 91 means that temporaryDASD is not available in the amount requested.

RPIDBU042A This utility must be run from an XAmode virtual machine.

Explanation: The RACFDBU utility can only be runfrom an XA mode virtual machine.



1. Issue the CP command: SET MACHINE XA

2. IPL the RACFVM 490 disk

3. Restart the RACFDBU utility

RPIDBU044A Not enough space on the disk vdev tocopy the database.

Explanation: The user-specified disk vdev hadinsufficient space to copy the database.


User response: Rerun the RACFDBU utility, specifyingthe virtual device address of a disk with sufficientspace.

RPIDBU045A Disk vdev not available.

Explanation: The user-specified disk vdev does notexist.


User response: Rerun the RACFDBU utility, specifyingthe virtual device address of a suitable disk.

RPIDBU046A Unable to access vdev.

Explanation: The user-specified vdev could not beaccessed. vdev may not be a suitable device type.


User response: Rerun the RACFDBU utility, specifyingthe virtual device address of a suitable disk.

RPIDBU047A Cannot establish a R/W link to diskvdev.

Explanation: The user-specified disk vdev was notlinked R/W.


User response: Rerun the RACFDBU utility, specifyingthe virtual device address of a suitable disk linkedR/W.

RPIDBU998A Undefined variable in line nnn.

Explanation: Internal error occurred in processing.



RPIDBU999A Undefined message number inRACFDBU XEDIT macro. Number = xx.


System action: Processing continues, if possible.




RPIDEV001E Device type for device xxxx could notbe determined.

Explanation: RPIDEV could not determine the devicecharacteristics of the DASD.


System programmer response: Ensure RACALLOC isused to allocate DASD and reissue.

RPIDSF001A IPL the system CMS before you run thisutility.

Explanation: The RACDSF utility found that the 490disk, (which contains RACF's modified copy of CMS),is accessed as file mode S. You must IPL the systemCMS in order to execute this utility.


User response: IPL the system CMS and restart theRACDSF utility.

RPIDSF002A The specified virtual address vaddr isnot valid. QUERY VIRTUAL return code= rcode.

Explanation: The RACDSF utility issued a CP QUERYVIRTUAL command to determine if the specifiedvirtual address exists. The return code (rcode) from theQUERY VIRTUAL command was not zero.

System action: The cursor is positioned at the inputfield of the virtual address that was found to be notvalid.

System programmer response: Make sure that theMDISK statement for the user ID's virtual address isdefined correctly in the CP directory. If it is correct,take steps as described in the proper CP manual for theQUERY VIRTUAL return code.

User response: If the return code = 40, the virtualaddress probably was not correctly defined to CP. Fordescriptions of other nonzero return codes, consult theproper CP manual.

RPIDSF003A You must change disk label disk-label tocontain all alphanumeric characters.

Explanation: Minidisk label disk-label contains one ormore characters that are not alphanumeric. TheRACDSF utility requires that all labels contain onlyalphanumeric characters.

System action: The input panel is redisplayed withthe cursor positioned at the specified minidisk label.

User response: Replace the minidisk label with a labelcontaining only alphanumeric characters.

RPIDSF004I All specified disks have beenOS-formatted successfully.

Explanation: All specified virtual addresses have beenOS-formatted successfully.


RPIDSF005A An error occurred during formatting foraddress vaddr. Return code from formatprogram ICKDSF MODULE = rcode.

Explanation: The ICKDSF MODULE, which is calledby the RACDSF utility to perform OS formatting,returned a nonzero return code for virtual addressvaddr.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at thevirtual address being processed at the time of the error.

System programmer response: Consult Device SupportFacilities for a description of the nonzero ICKDSF returncode and the action to take.

RPIDSF006A Undefined key pressed. Press a validkey.

Explanation: Either the enter key or a PF key that isnot defined by the RACDSF utility was pressed.

System action: The input panel is redisplayed with anerror message.

User response: Select a valid PF key. PF1 brings up ahelp panel, PF2 verifies and OS-formats alluser-specified virtual addresses and PF3 exits theRACDSF screen.

Note: The enter key is only used to submit CP or CMScommands from the RACDSF command line.

RPIDSF007A Virtual addresses and disk labels mustbe specified.

Explanation: The RACDSF utility found no entries toprocess on the input screen. Either no virtual addresseswere specified on the display screen or only disk labelswere entered. Disk labels must be entered withcorresponding virtual addresses.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at the firstvirtual address entry field.

User response: Enter one or more virtual addresses toOS-format in the specified screen locations.

RPIDSF008A ICKDSF MODULE is required by theRACDSF utility and must be on anaccessible disk.

Explanation: The RACDSF utility calls the ICKDSFMODULE to do OS formatting. The ICKDSF MODULE

RPIDEV001E • RPIDSF008A


was not found on an accessible disk.

System action: Processing does not proceed.

System programmer response: If running CMS 7.0 orhigher, the ICKDSF MODULE should be part of thesystem S-disk or Y-disk. If it is not, take the appropriateactions.

User response: Verify that the ICKDSF MODULE is onan accessible disk.

RPIDYNAL001E The following dataset could not beallocated: dataset.name.

Explanation: The user issued the block update utilityusing the syntax: BLKUPD dataset.name. The data setthat the user specified is not allocated to RACF/VM.

User response: Enter the correct data set name fromthe RACF data-set-name table.

RPIGCS001E An Invalid operand was entered.

Explanation: RPIATGCS received an invalid parameterin the input parameter list when it was called by theuser.


User response: Reissue the command with a validparameter. Valid parameters are INIT, TERM, or blank(blank defaults to INIT).

RPIGCS002E Initialization has not yet beenperformed.

Explanation: An attempt was made to terminateRPIUGCS, but the initialization was never performed.


User response: Issue the command with the INITparameter specified before attempting to terminate.

RPIGCS003E IUCVINI Set error.

Explanation: A non-zero IUCV return code wasreturned from IUCVINI SET.


User response: Re-IPL GCS and reissue theinitialization sequence. If the problem persists, reportthis message to system support.

RPIGCS004E IUCVCOM Connect error.

Explanation: A non-zero IUCV return code wasreturned from IUCVCOM CONNECT.


User response: Re-IPL GCS and reissue the

initialization sequence. If the problem persists, reportthis message to system support.

RPIGCS005E Error deleting entry point from storage.

Explanation: An attempt was made to delete an entrypoint from storage but failed.



RPIGCS006W IUCV communication has beensevered.

Explanation: RPIUCMS received an IUCV interrupttype of X'03' from the RACF service machine.

System action: RACF issues an IUCV SEVER requestand cleans up the communication path.

User response: Reissue the command. If the messagepersists report this message to system support.

RPIGCS007E RACXTRT failed in authorizationattempt, contact system support.

Explanation: An attempt was made to create anACEE, but a non-zero return code was received fromthe RACINIT.



RPIGCS008E You are not authorized to connect toRACF.

Explanation: An attempt was made to connect to theRACF service machine, but the requesting user was notauthorized to do so.



RPIGCS009E FACILITY class is inactive, contactsystem support.

Explanation: The class FACILITY is inactive, so aRACHECK cannot be performed to check the user'sauthorization. System support should be notified toactivate the class.



RPIDYNAL001E • RPIGCS009E


RPIGCS010E IUCV Receive error, IPRCODE=code.

Explanation: A non-zero IUCV return code wasreturned from IUCV RECEIVE. The return code fromthe IUCV parameter list (IPARML) is displayed in themessage.



RPIGCS011E A communication error has occurred,Re-IPL GCS.

Explanation: An invalid parameter list was passedbetween RPIUGCS and either RPIURIM or RPIURCM.This may cause the user to be in an infinite wait state;a re-IPL is required.


User response: Re-IPL GCS and reissue theinitialization sequence.

RPIGCS012I USER/RACF VM RACROUTEcommunication path is established.

Explanation: The user's machine is initialized andready to issue RACROUTE requests.


RPIGCS013I USER/RACF VM RACROUTEcommunication path has beenterminated.

Explanation: The user's machine has severed to RACFand is no longer a nucleus extension.


RPIGCS014E Error opening Installation parameterfile.

Explanation: An attempt at reading the installationparameter file was made, and it failed.



RPIGCS015E RACINIT failed in an attempt to createan ACEE for you, contact systemsupport.

Explanation: RACF/VM was in the process ofverifying the identity of the machine that wasattempting to use RACROUTE, but was unable to doso.



RPIINIT001E IUCV interrupt type type wasunexpected.

Explanation: RPIINIT received a value in the IPTYPEfield within the IUCV parameter list (IPARML) thatwas not a valid interrupt type for RPIINIT. The invalidinterrupt type is displayed in the error message.

System action: RACF issues an IUCV SEVER requestto the user and cleans up the communication path.

RPIINIT002E Out of IQEs, contact system support.

Explanation: RPIINIT attempted to remove aninterrupt queue element (IQE) from the interruptrequest block (IRB) but there were no more IQEsavailable. The path ID that has run out of IQEs isdisplayed in the error message.


RPIINS001I STEP1 - CMS formatting the 591 disk.

Explanation: CMS is formatting the backup A-diskfound at virtual address 591.

In RACINSTL Install Mode, this message is issued with“Please Wait” displayed until processing is completed.

System action: Control is passed to the CMS formatcommand and the 591 disk will be formatted.

RPIINS002I STEP2 - CMS formatting the SMFdisk_type (vaddr) disk.

Explanation: CMS is formatting the SMF recordingdisks:

v disk_type indicates either primary or alternate

v vaddr indicates either 301 or 302

In RACINSTL Install Mode, this message is issued with“Please Wait” displayed until processing completes.

System action: Control is passed to the CMS formatcommand. The 301 and 302 disks will be formatted.

RPIINS003I STEP3 - CMS formatting the vaddrdiskname disk.

Explanation: CMS is formatting the 305 disk and, ifavailable, the backup disk at virtual address 505.


v diskname indicates production (for 305 disk) orbackup (for 505 disk).

RPIGCS010E • RPIINS003I


In RACINSTL Install Mode, this message is issued with“Please Wait” displayed until processing hascompleted.

System action: Control is passed to the CMS formatcommand. The 305 disk will be formatted and, ifavailable, the backup 505 disk.

RPIINS004I STEP4 - CMS formatting the vaddrdiskname disk.

Explanation: CMS is formatting the 490 system diskand, if available, the backup 590 disk.


v diskname indicates production (for 490 disk) orbackup (for 590 disk).


System action: Control is passed to the CMS formatcommand. The 490 disk will be formatted and, ifavailable, the backup 590 disk.

RPIINS005I STEP5 - Loading system disk (490).

Explanation: RACINSTL is using the VMFPLC2command to load the contents of the RACF install tape1, file number 2 onto the 490 system disk.


System action: Control is passed to the CMSVMFPLC2 command and the contents are loaded to the490 disk.

RPIINS006I STEP6 - Loading RACF libraries, EXECs,new source, and macros to the 305 disk.

Explanation: RACINSTL is using the VMFPLC2command to load the contents of the RACF install tape1, file number 3 onto the 305 service machine disk.


System action: Control is passed to the CMSVMFPLC2 command and the contents are loaded to the305 disk.

RPIINS007I STEP7 - Loading modules to the generaluser system disk (vaddr).

Explanation: RACINSTL is using the VMFPLC2command to load the contents of the RACF install tape1, file number 4 onto the user designated CMS Y-disk.The screen default virtual address (vaddr) is 19E.


System action: Control is passed to the CMS

VMFPLC2 command and the contents are loaded to theY-disk.

RPIINS008I STEP8 - Loading ISPF panels to thedesignated ISPF disk (vaddr).

Explanation: RACINSTL is using the VMFPLC2command to load the contents of the RACF install tape2, file number 1 onto the user designated ISPF disk.This is not done if the tape is not mounted at the userspecified virtual address (vaddr). The screen defaultvirtual address is 182.


System action: Control is passed to the CMSVMFPLC2 command and the contents are loaded to theISPF disk.

RPIINS009I STEP9 - Creating the PROFILE EXECand SMF CONTROL file for the servicemachine 191 disk.

Explanation: RACINSTL issues a CMS COPYFILEcommand to copy the PROFILE SAMPLE file and SMFCONTROL file from the already loaded 305 disk to theservice machine 191 disk. As part of the copy, PROFILESAMPLE will be renamed PROFILE EXEC.

Note:

1. If PROFILE EXEC already exists, messageRPIINS025A is displayed to warn that PROFILEEXEC will backed up as PROFILE EXEC1.

2. If SMF CONTROL already exists, messageRPIINS025A is displayed to warn that SMFCONTROL will be backed up as SMF CONTROL1.

System action: Control is passed to the CMSCOPYFILE command and the contents of PROFILESAMPLE and SMF CONTROL are copied to the 191disk. PROFILE SAMPLE is renamed PROFILE EXEC.

RPIINS010I STEP10 - Generating a new CMSnucleus.

Explanation: RACINSTL is using the GENNUC EXECfrom the 305 disk to generate a new CMS nucleus thatwill reside on the 490 system disk. CMS is IPLed twiceas part of the GENNUC processing. Control will bereturned to the RACINSTL step screen when GENNUCprocessing has completed and the install will continuewith the next sequential step.

System action: Control is passed to the GENNUCEXEC and a new CMS nucleus is generated.

RPIINS004I • RPIINS010I


RPIINS011I STEP11 - Performing a DDR COPY of490 system production disk to 590system backup disk.

Explanation: The contents of the 490 system disk arecopied to the backup 590 disk, if it exists, using theCMS DDR command. If the 590 disk does not exist, thisstep is bypassed and message RPIINS036A is displayed.


System action: Control is passed to the CMS DDRcommand and the contents of the 490 disk are copiedto the 590 disk.

RPIINS012I STEP12 - Formatting the RACF databaseminidisk at virtual address vaddr.

Explanation: RACINSTL is using the RACDSF EXECto OS format the disk for use as a RACF database. IfFBA DASD is to be used, RACINSTL issues a CMSFORMAT command instead for the disk.


System action: Control is passed to the RACDSFEXEC or the CMS FORMAT command (for FBA DASD)and the minidisks for the RACF database areformatted.

RPIINS013I STEP13 - Allocating the RACF databasespace on the vaddr disk.

Explanation: RACINSTL is using the RACALLOCEXEC to allocate the database space on the databaseDASD. This step is bypassed if the RACF database is toreside on FBA DASD.


System action: Control is passed to the RACALLOCEXEC and database space is allocated on the 200 and300 disks.

RPIINS014I STEP14 - Initializing the vaddr disk as aRACF database.

Explanation: RACINSTL is using the RACINITDEXEC to initialize the database DASD for the disk as aRACF database.



System action: Control is passed to the RACINITDEXEC and the 200 and 300 disks are initialized asRACF databases.

RPIINS015I STEP15 - Creating CMS file of RACFcommands to initialize the RACFdatabase.

Explanation: RACINSTL is using the RPIDIRCT EXECto create a CMS file of RACF commands that willinitialize the newly created databases with data fromthe CP directory. RPIDIRCT is passed the CP directoryfilename and filetype. If DIRMAINT CLUSTER files areused as part of the directory, this CLUSTER is accessedas mode “G”, as required by RPIDIRCT, prior to itsinvocation. The file created by RPIDIRCT is namedRPIDIRCT SYSUT1 and will reside on the output diskyou specified. After RACF is activated, this file is inturn used by the RPIBLDDS EXEC to execute eachcommand.

In RACINSTL Install Mode, the screen will be clearedand RPIDIRCT will prompt you for information. Whenprocessing has completed, message RPIINS041I willindicate that RACF for VM installation has beencompleted successfully.

System action: Control is passed to the RPIDIRCTEXEC and a CMS file of RACF commands is created.

When RPIDIRCT has completed its processing, messageRPIINS041I is displayed.

RPIINS016A Undefined key pressed. Press a validfunction key.

Explanation: A PF key was pressed that is not definedby the RACINSTL utility.

User response: Select a valid PF key as listed at thebottom of the display screen.

RPIINS017A Press PF12 to cancel the action. Presspf_key to continue action.

Explanation: An interrupt key (for example, Enter orPA1) was pressed while RACINSTL was processing thespecified action (installation or demo). This cleared thescreen and placed the session in a CMS READ state.You then pressed Enter. When RACINSTL completedthe step that was being processed, this message wasdisplayed.

System action: Processing is temporarily suspended.

User response: Press a PF key:

v PF12 to cancel processing and return to thepreviously displayed screen

v PF2 to continue with the installation

v PF5 to continue with the demonstration.

RPIINS018I action cancelled at your request.

Explanation: This message is displayed when the userpresses PF12 in response to message RPIINS017A. Theaction (Install or Demo) has been canceled.



System action: RACINSTL redisplays the screen fromwhich the action was chosen.


RPIINS019I All input field information has beensaved.

Explanation: From RACINSTL screen 2, you pressedPF4 to save values contained in input fields. All inputvariables (except passwords) are saved in the LASTINGGLOBAL file and are redisplayed as part of the screenon the next invocation.

System action: Values contained in input fields(except passwords) are saved in the LASTINGGLOBALV file.

RPIINS020I Demonstration (Demo Mode) complete.

Explanation: RACINSTL has verified all links forrequired disks and your entries as well as walkedthrough each step of the installation processing(highlighting each step as it is being demonstrated).

System action: RACINSTL has used CP LINK toverify the required disk links.

RPIINS021A Unable to link highlighted addresses inexclusive write mode. At least 1 isrequired.

Explanation: RACINSTL has performed links inread/write (R/W) mode to each of the required diskslisted on screen 1. At least 1 of these links failed and atleast 1 of these links was a required disk (not displayedon screen 1 as optional).

System action: Screen 1 is displayed with an arrow inthe left column and the entire line highlighted for thosedisks not linkable in MULTI mode.

System programmer response: Verify that the CPdirectory for the service machine that RACF is beinginstalled on is setup according to the requirementslisted in RACF Program Directory for VM Installations.All required disks must be owned by this servicemachine.

User response: Verify that the disks listed on screen 1of RACINSTL are accessible in MULTI mode. If thesedisks do not exist or are not linkable in MULTI mode,notify your system programmer. If the disks do existand are linkable in MULTI mode, make sure that noone else has these disks in read/write (R/W) mode byusing the CP QUERY LINKS xxx command.

Problem determination: RACINSTL issues:

CP LINK xxx yyy M DUMMYPW

v xxx indicates required/optional disk virtual address

v yyy indicates free virtual address that RACINSTLfound in the executing machine

v DUMMYPW is supplied to prevent CP minidiskpassword prompting.

RPIINS022A Unable to link highlighted optionaladdresses in exclusive write mode. Presspf_key to action.

Explanation: RACINSTL has performed links inMULTI (M) mode to each of the required disks listedon screen 1. At least 1 of these links failed and all wereoptional disks. In Install Mode, you have the option ofpressing PF2 and excluding these disks from anyprocessing that is to follow.

v pf_key indicates either PF2 (for Install Mode) or PF5(for Demo Mode)

v action indicates either “bypass their use” (for InstallMode) or “continue with demo” (for Demo Mode).

System programmer response: Verify that the CPdirectory for the service machine that RACF is beinginstalled on is set up according to the information inRACF Program Directory for VM Installations. Allrequired disks must be owned by the service machinefor the executing user ID.

User response: Check to verify that the disks listed onscreen 1 of RACINSTL are accessible in MULTI mode.If these disks do not exist or are not linkable in MULTImode, notify your system programmer. If they existand are linkable, ensure that no one else has thesedisks in read/write (R/W) mode by entering the CPcommand QUERY LINKS xxx where xxx is the diskvirtual address.

Problem determination: RACINSTL issues:

CP LINK xxx yyy M DUMMYPW



v DUMMYPW is supplied to prevent CP minidiskpassword prompting.

RPIINS023A Press PF4 to save any changes and exitor press PF3 again to EXIT withoutsaving changes.

Explanation: Whenever you change RACINSTL screen2 values and press PF3 this message appears. You cansave the input field entries and exit by pressing PF4 oryou can exit without saving the input field entries bypressing PF3.

System action: If you press PF4, the input fields aresaved in the LASTING GLOBALV file and the utilityends. If you press PF3 after this message is displayed,the input fields are not saved and the RACINSTLutility ends.

User response: Press PF4 to save the input fieldvalues before exiting or press PF3 to immediately exitand not save input field entries.

RPIINS019I • RPIINS023A


RPIINS024I Press PF12 to cancel processing andreturn to previous screen.

Explanation: This message is displayed before Step 1of Demo Mode actually begins and before Steps 1 and11 of Install Mode begins. It reminds you that you canpress PF12 anytime during processing to haltprocessing.

System action: If PF12 is pressed during processing,the screen will clear and the session will be placed intoa CMS read. You are required to press Enter. MessageRPIINS017A will be displayed.

User response: If you want to stop the demonstration,press PF12 and follow the instructions for messageRPIINS017A.

RPIINS025A File filename was found on 191 A-diskand will be backed up as filename_1.Press pf_key to action.

Explanation:

v pf_key indicates either PF2 (for Install Mode) or PF5(for Demo Mode)

v action indicates either installation or demo

Part of RACINSTL processing is to create the PROFILEEXEC and SMF CONTROL file on the service machine191 disk.

v If PROFILE EXEC1 already exists, it will beoverridden with a copy of the current PROFILEEXEC.

v If SMF CONTROL1 already exists, it will beoverridden with a copy of the current SMFCONTROL.

To continue with the install, you will be required topress PF2, which backs up the current file. In DemoMode this is merely an informational message and youmay save this file before performing the actual install.

System action: This message is displayed and thesystem will wait for you to press the appropriate PFkey.

User response: For a first-time install, this messagewill probably not appear. For a reinstall, you mustdecide if a file already exists and whether it is needed.If not, continue with the install. If it is needed, takeprecautions so that it will not be overwritten (forexample, by renaming the current file).

RPIINS026A The first-time install question must beanswered with Y or N.

Explanation: RACINSTL screen 1 requires you tospecify whether you are installing RACF for the firsttime. If you answer “Y” to this prompt, you will beallowed to create the RACF databases and create theRACF commands that will add user and diskinformation from the CP directory.

User response: Enter a “Y” at the designatedRACINSTL screen 1 field if you are installing RACF forthe first time. If you are reinstalling, answer “N” to thisprompt. RACINSTL determines which disks arerequired for the install based upon this response.

RPIINS027A Required LINK has failed becausecp_link_error.

Explanation: This message is issued when RACINSTLtries to LINK to a required disk that you eithersupplied or allowed to default in M or RR mode andthe LINK attempt fails. This can happen for a variety ofreasons.

The cp_link_error can be any one of the following:

v User ID user_ID not CP defined

v Virtual address vaddr is not valid

v CP LINK return code = xxxx for user_ID vaddr

v CP password required for user_ID vaddr

“This is required because tape is mounted at addressispf_tape_address.” is also displayed as part of themessage if the LINK is required because a tape wasfound at the specified ISPF tape address(ispf_tape_address), or if the “Load tape 2 (ISPF panels)TO” disk is not linkable in exclusive write mode (M).

System action: This message is displayed on theInstall screen and the install will not begin until theproblem is corrected. The cursor is positioned on theline of the disk that is in error.

User response: Check the fields on the line where thecursor is positioned. Ensure the user ID, virtual addressand LINK password are correct. If the error indicatesthe “Load tape 2 (ISPF panels) TO” disk field, ensurethat the LINK is possible and in the correct mode. Ifyou do not want to load the ISPF tape, enter null in the“Load tape 2 (ISPF panels) FROM” address field ordetach the tape mounted at this address.

Problem determination: RACINSTL issues: CP LINKxxx yyy M|RR password



v password indicates either the user-provided passwordor DUMMYPW if none is provided.

RPIINS028A Error accessing CP directory becausedirectory filename filetype was not foundon directory_ID directory_disk.

Explanation: The file you specified as the CP directorydoes not exist on the disk you specified. The defaultfilename is USER DIRECT.

System action: This message is displayed on theInstall screen and the install will not begin until theproblem is corrected. The cursor is positioned on the



CP user ID/virtual address disk line in error.

User response: Check the fields on the line where thecursor is positioned. Make sure the file name and filetype are correct, and make sure the file exists on the CPdirectory disk specified.

RPIINS029I Formatting of vaddr backup disk willnot be done because it is not accessible.

Explanation: RACINSTL has previously found thatthis backup disk was not linkable in exclusive writemode (M); processing for this disk will be bypassedbecause you elected to continue with the install.

v vaddr indicates the backup disk virtual address

System action: This message is displayed on theInstall screen and the formatting step is not performed.

User response: Ensure that your installation does notrequire this backup disk before proceeding.

Problem determination: Prior to the Install screenbeing displayed, RACINSTL notified you that this diskwas not linkable. Since it was a backup disk, you weregiven the option of proceeding without this backupdisk. You indicated that you wanted to proceed withoutthis disk.

RPIINS030A Error occurred while CMS formattingthe vaddr disk with return code of code.

Explanation: RACINSTL was CMS formatting the diskat the specified virtual address and the formatcommand returned a nonzero return code.

System action: This message is displayed on theInstall screen and the installation processing ends.

User response: Verify that the CMS FORMATcommand is working properly. There may be adownlevel copy residing on the 191 disk.

Problem determination: The CMS FORMATcommand returned a nonzero return code. There maybe a downlevel version of this command on your 191A-disk. The actual disk specification in the CP directorymay not coincide with what CMS thinks it is. You canverify this by issuing the command Q VIRTUAL xxx(where xxx is the disk address in error). After accessingthe disk issue the command, Q DISK y (where y is themode the disk in error is accessing). Compare theresults.

RPIINS031A Error occurred while tape_commandinstall tape (vaddr) with return code ofcode.

Explanation: A VMFPLC2 command was issuedagainst the install tape to either load files from it orforward space it, or the CP REWIND command wasissued to rewind the tape. A nonzero return code wasreturned by the command.

The tape_command can be any one of the following:

v Loading files from

v Forward spacing

v Rewinding

The virtual address is 181 and the screen default for the“Load tape 2 (ISPF panels) FROM” field is 182.

System action: This message is displayed on theInstall screen and the installation processing ends.

System programmer response: The VMFPLC2 or CPREWIND command failed. Make sure that the copy ofthis command is compatible with your installation. Ifthe copy is compatible and you cannot determine whatis causing the problem, notify your IBM support center.

User response: Make sure that no copy of theVMFPLC2 or CP REWIND command exists on the 191A-disk. If a copy does not, notify your systemsprogrammer.

Note: If tape_command is “loading files from” and codeis 100, the VMFPLC2 LOAD command does not haveenough available minidisk space to work. Either specifya larger minidisk, or delete unnecessary files from theminidisk.

RPIINS032I Step step_number skipped as specified inRACINSTL HISTORY file.

Explanation: RACINSTL found that the RACINSTLHISTORY file contained the word “SKIP” in the leftcolumn of this file for the specified step number. Theword “SKIP” was added to the file and tellsRACINSTL that this step is not to be executed.RACINSTL will continue to skip this step onsubsequent invocations of RACINSTL until you use aneditor to remove it from the file.

System action: This message is displayed on theInstall screen and the installation processing continueswith the step after this skipped step.

RPIINS033I Loading of ISPF panels will not be donesince tape 2 is not available.

Explanation: Prior to beginning the install, RACINSTLfound that a tape was not mounted at the specified“Load tape 2 (ISPF panels) FROM” address on screen 2or that this address was null or not applicable (N/A).When the installation processing begins, this message isdisplayed and the ISPF panels are not loaded to tape.

RACINSTL found that no valid tape was mounted atthe panel designated virtual address (The default is182). Step 8 of RACINSTL performs the loading of theISPF panels from tape 2 and will not be done since thistape was not found.

System action: This message is displayed on theInstall screen and the installation processing continueswith the step after this skipped step.



RPIINS034A RACINSTL is invoking GENNUC. CMSIPL will occur and eventually thisscreen will be redisplayed. Press PF2 tocontinue or PF12 to cancel.

Explanation: Before GENNUC is invoked as part ofstep 10, you are notified that CMS will be IPLed as partof the GENNUC processing. Control will eventually bereturned to RACINSTL and step 11 will beginexecuting.

System action: This message is displayed and thesystem waits for you to press PF2 to continue or PF12to cancel. When PF2 is pressed, control is passed to theGENNUC EXEC.

User response: Press PF2 to continue the installationprocessing or PF12 to cancel.

RPIINS035A The type of DASD being used for theRACF database cannot be determined.RACINSTL cannot continue.

Explanation: RACINSTL tried to determine whetherthe database DASD (200 and 300) is on FBA or CKDDASD. It could not be determined using Diagnose X'24'and X'210'.

System action: RACINSTL terminates processing.

System programmer response: The DASD defined forvirtual addresses 200 and 300 on the service machineuser ID in question is of a type that cannot bedetermined. RACINSTL first issues a DIAGNOSE X'24'to determine the type, if this comes back unknown thena DIAGNOSE X'210' is issued. If this fails to identifythe DASD type, then this message is displayed. ReplaceDASD for database with RACF-supported device typesas listed in the RACF Program Directory for VMInstallations.

User response: Verify that the DASD at 200 or 300 isCKD or FBA. If the DASD is neither CKD or FBA,notify your systems programmer.

RPIINS036I This step will be bypassed since the 590disk is not available.

Explanation: RACINSTL found (prior to starting theinstall) that the 590 disk was not linkable in MULTImode. You were notified and elected to continue theinstall without a 590 disk.

System action: This message is displayed in place ofthe DDR copy of the 490 system disk to the 590 backupsystem disk.

RPIINS037A The sizes of the 490 and 590 disks arenot the same; they must be equal.RACINSTL cannot continue.

Explanation: Before running Step 11 to DDR copy the490 to the 590 disk, RACINSTL found that their sizeswere not equal. RACINSTL cannot continue.

System action: The message is issued and RACINSTLterminates processing.

System programmer response: Verify that the CPdirectory disk definitions for the 490 and 590 disks areequal. If they are different, make the appropriatechanges in the CP directory and re-run RACINSTLstarting at Step 11.

User response: Make sure that there is no sizedifference. If there is, contact your systemsprogrammer.

RPIINS038A RACINSTL could not find 2 unusedvirtual addresses for its processing.Enter a CP DETACH command.

Explanation: RACINSTL searched for 2 unused virtualaddresses starting at 999 and proceeding backwards to1. RACINSTL requires the 2 free addresses so that itmay link to disks owned by other user IDs. Forexample, LINK MAINT 19E 999 M; the 999 in thiscommand was an unused virtual address thatRACINSTL found on the executing ID in its initialchecks.

User response: Free up 2 virtual addresses that arenot needed by issuing a CP DETACH command.

RPIINS039A The above step failed with acalled_program return code of codefor_disk_vaddr.

Explanation: RACINSTL invoked an external programto perform a particular task and a nonzero return codewas returned.

v called_program indicates RACDSF, RACALLOC,RACINITD, or RPIDIRCT

v code indicates the return code the called programfailed with

v for_disk_vaddr indicates the virtual address beingprocessed by the called program

System action: The message is issued and RACINSTLEXEC processing ends.

System programmer response: Make sure that theexternal programs (RACDSF, RACALLOC, RACINITD,and RPIDIRCT) are available on the install tape. If theyare available, verify that the databases 200 and 300 canbe processed by the EXEC in question by issuing theEXEC from the user ID.

User response: Ensure that no copy of the externalprogram in question resides on the 191 A-disk. If acopy does not reside on your A-disk, notify yoursystem programmer.

RPIINS034A • RPIINS039A


RPIINS040I This step will not be done because theRACF databases are on FBA DASD.

Explanation: The DASD at virtual addresses 200 and300 were determined to be FBA. The step that callsRACALLOC (step 13) to allocate the database spacewill not be executed for FBA DASD.

System action: RACINSTL will issue this message andpause momentarily.

RPIINS041I RACF for VM has been successfullyinstalled.

Explanation: The installation processing for RACF hascompleted successfully.

RPIINS042A Device type for the vaddr disk notsupported by RACF. Replace DASDwith supported device type.

Explanation: RACINSTL found that the device typefor the 200 or 300 disk is not supported by RACF forits database.

System programmer response: Check the DASD at200 and 300 to ensure that it is supported by RACF.(Refer to the RACF Program Directory for VMInstallations.)

User response: Notify your systems programmer.

RPIINS043A DDR copy from 490 system disk to 590backup disk failed with return code ofcode.

Explanation: In step 11, RACINSTL issues a CMSDDR command to copy the contents of the 490 systemdisk to the 590 backup disk. The DDR commandreturned a nonzero return code. Installation processingends.

System action: RACINSTL terminates processing.

System programmer response: Ensure that the DDRMODULE supplied on the CMS system S-disk (defaultvirtual address is 190) operates as described in theappropriate CMS manuals.

User response: Verify that the DDR being executed isthe one contained on the CMS system S-disk. This canbe done by issuing the command LISTFILE DDR MODULE* and viewing the displayed output. If a copy of DDRexists on a disk with a lower access mode than this,that copy is used. Rename or erase the other copy andrestart RACINSTL at step 11. If there is not anothercopy of DDR, contact your systems programmer.

RPIINS044I STEP12 - CMS formatting the vaddrdisk.

Explanation: This message will only be issued whenthe RACF databases exist on FBA DASD. If they exist

on FBA DASD, RACINSTL will use the CMS FORMATcommand to format.

RPIINS045A Required install tape not mounted atvirtual address 181. Properly mount tapeat 181.

Explanation: RACINSTL verifies that a tape ismounted at virtual address 181 when install steps 5, 6or 7 are to be performed. If a tape is not mounted at181, this message is issued and RACINSTL willterminate processing until a tape is mounted or steps 5,6 and 7 will not be run.

System programmer response: Verify that the tape isproperly mounted at the executing ID 181 virtualaddress. Issue a QUERY TAPE command to ensure thata tape is mounted at 181 and not being accessed by aminidisk.

User response: Verify that the install tape is mountedon your user ID at the 181 virtual address. If the tape ismounted at this address, notify your systemsprogrammer.

RPIINS046A RACINSTL beginning step must be awhole number from 1 to step_number.Enter a valid step number.

Explanation:

v step_number indicates either step 15 (for first-timeinstallations) or step 11 (for reinstall).

For first-time installs, the RACINSTL beginning stepmust be a whole number from 1 to 15. For reinstalls,the step must be from 1 to 11; steps 12 to 15 build theRACF databases and are not done when reinstalling.

User response: Enter the appropriate value at thescreen 2 location. For first-time installs, this numbermust be a whole number from 1 to 15. Whenreinstalling RACF, this number must be a wholenumber from 1 to 11.

RPIINS047A RACINSTL beginning step step_numberis not valid when reinstalling.

Explanation: Valid steps when reinstalling RACF are 1to 11. Because you indicated that this is a reinstall (youresponded “N” to the screen 1 “first time install”question), you must enter a number between 1 and 11inclusive.

User response: Enter a whole number for theRACINSTL beginning step from 1 to 11 or allowRACINSTL to set the value based on the RACINSTLHISTORY file.



RPIINS048I STEP 6 (continued) - Copying files from305 disk to (backup) 505 disk.

Explanation: After loading the contents of tape file 3onto the service machine 305 disk, RACINSTL thencopies the 305 contents to the backup 505 if it islinkable. This message is only issued if the 505 diskwas found to be linkable.


RPIINS049A Error occurred while copying files from305 disk to (backup) 505 disk withreturn code of code.

Explanation: RACINSTL issued a CMS COPYFILEcommand to copy all the files contained on the 305 diskto the backup 505 disk. The return code from theCOPYFILE command was nonzero and is displayed aspart of the message.

System programmer response: Check that theCOPYFILE command performs as described in theappropriate CMS publications.

User response: Refer to the CMS publications todetermine the meaning of the nonzero return code andtake the appropriate action. Also, check to see ifanother copy of the COPYFILE module exists on a diskaccessed prior to the system disk (S-mode). Also ensurethat a CMS alias does not exist that may issue anothercopy of the COPYFILE MODULE.

RPIINS050A RACINSTL help file (RACINSTLHELPRACF) was not found on anaccessed disk.

Explanation: When you pressed PF1 to display thehelp screens, RACINSTL checked for the RACINSTLHELPRACF file on an accessed disk. This message wasissued because the help screen file was not found.

System action: Processing will continue. No helpinformation is available.

System programmer response: Ensure that aRACINSTL HELPRACF file is included on install tape1, tape file 1. Also make sure that the RACF for VMinstall tape 1 is mounted at 181 virtual address.

User response: Verify that the command to loadRACINSTL onto the service machine 191 disk wascorrect. The correct command is VMFPLC2 LOAD * * Aand should have been issued after a tape REWIND wasexecuted.

RPIINS051A GENNUC exec was terminated at yourrequest. Process Class I reader files andrerun RACINSTL Step 10.

Explanation: As part of GENNUC processing, youmay be required to answer a prompt asking to purgeall class “I” reader files. If you answer NO, then this

message will be displayed and processing will end.

User response: Determine what is to be done withclass “I” reader files so that the GENNUC step may beallowed to execute. If they are not needed, allowGENNUC to purge them and proceed with the install.

RPIINS052A vaddr disk appears to already beinitialized as a RACF database. PressPF2 to overwrite database and continueor PF12 to cancel processing.

Explanation: RACINSTL determined that the RACFdatabases at virtual addresses 200 and 300 were alreadyinitialized. Since the database steps will be run, you arebeing warned that the databases will be rebuilt and alldata on them will be lost.

System action: In Install Mode, RACF continues onlyat your request.

User response: Determine whether you want theRACF databases rebuilt. If you do want them rebuilt,press PF2 to continue with the install. If you do notwant initialization to occur, restart RACINSTL andspecify “N” for the first-time install question on screen1.

RPIINS053W The diskname disk could not beaccessed. It will not be used.

Explanation: RACINSTL determined that the GCSsystem disk or the CP cluster file disk was notaccessible in the proper mode and therefore will not doany processing that requires these disks. Since thesedisks are optional, RACINSTL will continue with theRACF installation.

User response: If any of these disks were specifiedincorrectly and it was the intent that they were to beused, cancel the install and re-specify these values. Inmost cases, the default was left and the user had nointention of using either or both of these disks.

RPIINS054A The system CMS disk must be IPLed torun this utility.

Explanation: The utility found that the 490 disk, (theRACF modified copy of CMS), is accessed as file modeS. You must IPL the system CMS in order to executethis utility.

System action: Utility processing stops, and thesystem is placed in the CMS “ready” state.

User response: IPL the system CMS and restart theRACINSTL utility.

Problem determination: The system CMS must beIPL’ed in order to execute this utility.



RPIINS055I STEP7 (continued) - Copying files toGCS system disk (vaddr).

Explanation: The second part of step 7 is to copy theGCS-related files that were loaded onto the CMSsystem Y-disk in part 1 of this step. This part is onlyperformed if the user specified GCS user ID or disk isaccessible in MULTI mode.

System action: Issue message and perform copyfunction.

RPIINS056A Error accessing step 15 output disk atvirtual address vaddr.

Explanation: RACINSTL encountered an error whiletrying to access the disk you specified to contain theCMS file of RACF database initialization commands(RACINSTL Step 15).

System action: The installation terminates andRACINSTL waits for you to press the appropriate PFkey.

User response: Supply the proper user ID, virtualaddress and the MULTI password for the disk that willcontain the CMS file of RACF database initializationcommands (created in RACINSTL step 15).

Problem determination: If the specified output disk isnot owned by your user ID, RACINSTL links to thedisk in MULTI mode. If this disk is owned by youruser ID, RACINSTL determines if the disk is accessiblein R/W mode. Depending on the user ID selected tocontain the output, the above processing should betried manually to help determine what went wrong.

RPIINS057A Unable to access tape at virtual addressvaddr.

Explanation: If the “Load tape 2 (ISPF panels)FROM:” virtual address is 182 and a tape is notmounted there, unavailable, or blank, RACINSTL willverify that the tape exists. In this case, RACINSTLdetermined that what is at the specified address wasnot a tape.

System action: RACINSTL waits for you to intervene.

System programmer response: Make sure that thetape drive specified is valid and that the tape drive isfunctioning properly.

User response: Re-enter the correct virtual address ofthe RACF install tape (number 2) in the field and pressPF2 (Install) again. If you do not plan to use the ISPFtape, blank out the “Load tape 2 (ISPF panels) from:”field and press PF2 (Install) again.

RPILOG001E RACF ENCOUNTERED AN ERRORWHILE ATTEMPTING TO STORE A[PASSWORD|PASS PHRASE]ENVELOPE FOR USER userid.SAFRC=safrc RACF RC=racfrc, RACFRSN=racfrsn

Explanation: An attempt by the changelog server tostore a password or password phrase envelope for auserid failed. The contents of the password orpassword phrase envelope are not current with respectto the user's LOGON password or password phrase.The return codes and reason code reported in themessage are from the failing RACROUTEREQUEST=EXTRACT: Replace. For more information,see z/VM: RACF Security Server Macros and Interfaces.



System programmer response: If the codes reportedare: SAFRC=’4’X, RACF RC=’FFF’X, RACF RSN=’20’X,then ensure that the changelog server has UPDATEaccess to the ICHCONN profile in the FACILITY class.If this is not the problem, contact the customer supportcenter.

RPIMAC001A Error turning [ON|OFF] themandatory access control indicators inCP.

Explanation: The SETROPTS settings for theSECLABEL class were activated or deactivated, andwhile RACF was communicating the updated status ofthe SECLABEL class to CP, an error occurred.

System action: The RACF status of the SETROPTSsettings for the SECLABEL class remains the same. CPmay or may not be calling RACF correctly forSECLABEL authorizations. Results are unpredictable.

System programmer response: Make sure you haveinstalled RACF correctly, specifically the CP modulesshipped with RACF. (These modules are listed in RACFProgram Directory for VM Systems.) Otherwise, contactyour IBM support center.

User response: Contact your system programmer.

RPIMAC002A Error occurred while indicating thestatus of security label changes to CP.

Explanation: The SETROPTS settings for MLSTABLEand/or MLQUIET were changed, and while RACF wascommunicating the updated status of these settings toCP, an error occurred.

System action: The RACF status of the SETROPTSsettings MLSTABLE and MLQUIET remain the same.CP may or may not be calling RACF correctly forsecurity label changes. Results are unpredictable.

System programmer response: Make sure you have

RPIINS055I • RPIMAC002A


installed RACF correctly, specifically the CP modulesshipped with RACF. (These modules are listed in RACFProgram Directory for VM Systems.) Otherwise, contactyour IBM support center.


RPIMGR001E tttttttt: VSIUCV OPEN TO CPUNSUCCESSFUL - RC=cc

Explanation: The RACF service machine encounteredproblems initializing the IUCV support. The RACFservice machine terminates IUCV initialization becauseIUCV is essential to the operation of the servicemachine. tttttttt is the time of day.


System programmer response: Determine the cause ofthe problem based on VSIUCV and IUCV return codes.VSIUCV return codes are described in “VSIUCV ReturnCodes” on page 263.

Report the complete text of this message to your IBMsupport center.

RPIMGR002T tttttttt: CONNECT TO CP FAILED –VS RC=cc, IUCV RC=cc

Explanation: During initialization, the RACF servicemachine encountered problems when connecting withthe CP IUCV service routines. The RACF servicemachine terminates initialization because CP IUCV isessential to the operation of the service machine. ttttttttis the time of day.


System programmer response: Determine the cause ofthe problem based on VSIUCV and IUCV return codes.VSIUCV return codes are described in “VSIUCV ReturnCodes” on page 263.

Probable cause: Error in the IUCV specifications in theRACF service machine directory definitions.

RPIMGR003I tttttttt: CONNECTION COMPLETETO CP ON PATHID pppp

Explanation: This information message occurs when auser connects to the RACF command support using theCMS command RACF. tttttttt is the time of day.

RPIMGR004E tttttttt: userid REJECTED – CHECKRACINIT MACRO FOR COMPLETIONCODE OF cccc

Explanation: RACF returned an unexpected returncode during LOGON/CONNECT processing. tttttttt isthe time of day.

Operator response: Report the exact text of this

message to your system programmer.

System programmer response: Check the return codesfor the RACINIT macro to determine the cause of theproblem. For an explanation of the return code, see thedescription of the macro return code in one of thefollowing:




RPIMGR005I tttttttt: QUIESCE MODE ENTERED

Explanation: The number of outstanding authorizationrequests is greater than the RACF service machine canhandle. The system enters QUIESCE mode to stop CPfrom sending further requests until the number ofrequests is reduced CP saves further requests until theservice machine issues an IUCV RESUME. tttttttt is thetime of day.

Operator response: Monitor the operator console untilQUIESCE mode is terminated. If you do not receivemessage RPIMGR006I in a reasonable amount of time,report this message to your system programmer.

RPIMGR006I tttttttt: QUIESCE MODETERMINATED

Explanation: This information message followsmessage RPIMGR005I.

RPIMGR007I tttttttt: CONNECTION SEVERED BYCP - RECOVERY IN PROGRESS

Explanation: CP has waited too long for the reply toan authorization request and assumes a problem existswith the RACF service machine. The service machineprobably was not getting dispatched soon enough torespond to CP because of other severe systemperformance problems. For example, a continuouschannel interrupt could have occurred. tttttttt is thetime of day.

Operator response: If the problem persists or recoveryis not successful, report this message to your systemprogrammer.

RPIMGR008I tttttttt: CP RECONNECTED ONPATHID pppp, RECOVERY COMPLETE

Explanation: This is an information message wheretttttttt gives the time of day.

RPIMGR001E • RPIMGR008I


RPIMGR009E tttttttt: IUCV INTERRUPT FROM CPOF TYPE tt WAS UNEXPECTED

Explanation: The RACF service machine received anundefined IUCV interrupt code. No system action hasbeen taken. tttttttt is the time of day.


RPIMGR009W IUCV INTERRUPT OF TYPE tt WASUNEXPECTED

Explanation: During a command session, anunexpected IUCV interrupt occurred. The interruptoccurred on the primary path (between CP and theRACF service machine).


RPIMGR010T tttttttt: IUCV ERROR IN SEVERRESPONSE TO SEVER WITH CP —TERMINATING

Explanation: The RACF service machine received aSEVER from CP and incurred an error when it tried toissue a SEVER in response. tttttttt is the time of day.


RPIMGR011T tttttttt: CANNOT ISSUE A SEVER TORE-SYNCHRONIZE WITH CP –TERMINATING

Explanation: The RACF service machine had anunrecoverable IUCV error and incurred an error whenit tried to initiate a SEVER. tttttttt is the time of day.


RPIMGR012E tttttttt: IUCV ERROR WITH CP: ffffffffCC=1, RC=nn

Explanation: An IUCV error occurred while the RACFservice machine was trying to perform IUCV functionffffffff. The condition code received from IUCV was 1and the return code was nn. tttttttt is the time of day.

Operator response: If the problem persists, report theexact text of this message to your system programmer.

Problem determination: VSIUCV return codes aredescribed in “VSIUCV Return Codes” on page 263. TheIUCV return codes can be found in z/VM CPProgramming Services,.

RPIMGR013E tttttttt: IUCV ERROR WITH CP: ffffffffCC=n

Explanation: An IUCV error occurred while the RACFservice machine was trying to perform IUCV functionffffffff. The condition code received from IUCV was 2 or3. tttttttt is the time of day.


Problem determination: The IUCV return codes canbe found in z/VM CP Programming Services,.

RPIMGR014E tttttttt: IUCV ERROR DURINGASYNCHRONOUS EXIT FORAUTHORIZATION

Explanation: An IUCV error occurred in the IUCVsecond-level interrupt handler. The system issues aSEVER and initiates recovery procedures. tttttttt is thetime of day.


RPIMGR015T tttttttt: OUT OF IQES FOR PATHWITH CP — CONTACT SYSTEMSUPPORT

Explanation: The system will SEVER the IUCV pathand initiates recovery procedures. tttttttt is the time ofday.

Operator response: If the problem persists, report thismessage to your system programmer.

RPIMGR030I ACCESS APPROVED — USERAUTHORIZED

Explanation: This message only appears as aninformation message if the installation has set a DEFERmode option such that a resource authorized by RACFmust also be authorized by CP.

User response: For minidisks, the user may berequired to enter a password.

RPIMGR031E RESOURCE resource-name SPECIFIEDBY command COMMAND NOT FOUND

Explanation: You attempted to access a resource forwhich no profile is defined in the RACF database orthe resource class is inactive. RACF could notdetermine your access authority to the resource.

System action: Determined by the controller of theresource.

User response: Contact the owner of the resource,have it defined to RACF, and get RACF permission toaccess it, or have the security administrator activate theresource class.

RPIMGR009E • RPIMGR031E


RPIMGR032E YOU ARE NOT AUTHORIZED TOcommand TO resource-name

Explanation: You attempted to access a resource (suchas a minidisk) at a level higher than that to which youare permitted.

User response: Contact the owner of the resource (orsomeone with ALTER authority to the resource) and getRACF permission to access it at the level you need. Fora VM minidisk, the owner is the first part of theresource name. For example, if the resource name inthe message is SMITH.191, the user with user IDSMITH is its owner. For help in determining the userassociated with a user ID, see your RACF securityadministrator.

RPIMGR033E UNEXPECTED RACHECK RETURNCODE = return-code

Explanation: A return code greater than 8 wasreceived from a RACHECK SVC. The highest returncode expected is 8. The RACF service machine can alsoissue this message during ABEND (STAE) recoverywhile processing a RACHECK SVC. If this is the case,the STAE recovery routine issues the message ANAUTHORIZATION REQUEST FAILED - ATTEMPTING RECOVERYto the RACF service machine console.

User response: Retry the operation. If the problempersists, report the exact text of this message to yoursystem programmer.

RPIMGR035E INVALID RACF REQUEST.

Explanation: CP has called RACF with a functioncode that RACF does not recognize. This can onlyhappen if there are user modifications in CP.


RPIMGR038E FSWRITE ERROR...

Explanation: The listed error occurred whileattempting to write file name SURROGAT A1 to theRACF service machine's A-disk.


RPIMGR039E AUTHORITY NOT GRANTED,REQUEST HAS ABENDED.

Explanation: Subtask for an authorization requestabended.


RPIMGR040T User profile for user ID userid is notdefined.

Explanation: You attempted to logon to the system,but your user ID is not defined to RACF.

User response: Use a valid user ID or see your RACFsecurity administrator.

RPIMGR041T NOT AUTHORIZED

Explanation: The user ID or password you attemptedto logon with is not a valid RACF user ID, password,or password phrase.

Note: This message is followed by the CP messageHCPLGA050E (LOGON unsuccessful--incorrect useridand/or password).

User response: Use a valid RACF user ID andpassword. See your system security guidelines or yourRACF security administrator for information about thepassword rules at your installation.

If you are logging on to a shared user ID, make sureyou are supplying your own password, and not that ofthe shared user ID you are logging on to.

RPIMGR042I PASSWORD EXPIRED

Explanation: The user logged on with a validpassword or password phrase, but RACF determinedthat the password or password phrase has expired.

User response: If you want the logon process tocontinue, you must enter your new password orpassword phrase twice separated by a slash. If you donot choose to change your password or passwordphrase, you must logoff. RACF does not allow you tocontinue without changing your password or passwordphrase.

RPIMGR043E NEW PASSWORD INVALID

Explanation: The new password or password phrasethat you entered did not meet the rules established byyour installation, or you used the password orpassword phrase previously and may not use it againuntil your password or password phrase has beenchanged the minimum number of times defined byyour installation.

User response: Choose a different password orpassword phrase.

RPIMGR044T User ID userid is not defined to thegroup.

Explanation: You are attempting to LOGON to aRACF group for which you do not have a connection.The most probable cause is that there is an ACIGROUPcard in your directory entry, but you are not connectedto that group in the RACF database.

RPIMGR032E • RPIMGR044T


|

|||

||

||

User response: Ask your RACF security administratorto connect you to the group.

RPIMGR045T FAILED BY INSTALLATION EXIT

Explanation: A user was attempting to enter thesystem (e.g. using the LOGON or XAUTOLOGcommand) or a password check was being performedon behalf of the user (e.g. by an application usingDIAGNOSE X'A0' or RACROUTE REQUEST=VERIFY),but the request was failed by the RACROUTEREQUEST=VERIFY/X pre-processing exit, ICHRIX01.

Note that LOGON, AUTOLOG, and XAUTOLOG mayissue a subsequent message indicating that the user'spassword was incorrect, but this is not necessarily thecase.

User response: See the RACF security administrator.

RPIMGR046T User ID userid access has beenrevoked.

Explanation: This message occurs when a userattempts to logon to a user ID or a shared user ID, butwas not allowed because:

1. RACF revoked the user ID after too many incorrectpassword and password phrase attempts.

2. The RACF security administrator revoked the userID.

3. The user ID may have been inactive beyond thenumber of days specified in the INACTIVE operandand revoked.

User response: Ask the RACF security administratorto have the user ID resumed.

RPIMGR047T RACF INACTIVE

Explanation: The logon attempt cannot be authorizedbecause RACF is not active.


RPIMGR048T User ID userid access to group hasbeen revoked.

Explanation: You are attempting to LOGON to yourdefault group, but your access to the group has beenrevoked.

User response: Ask the RACF security administratorto resume your authority to access the group, or tellyou why your access has been revoked.

RPIMGR049T LOGON REJECTED - NOPASS USERNOT AUTHORIZED

Explanation: You are attempting to logon to aNOPASS user ID but the user ID is not permitted to theprofile named IRR.NOPASS in the FACILITY class.

User response: Contact system support personnel.

RACF Security Administrator Response: Ifappropriate, permit the user ID to the IRR.NOPASSprofile.

RPIMGR051T User ID userid is not authorized to usethis terminal.

Explanation: The user ID or the user's group is notauthorized to use the terminal from which the user isattempting to LOGON.

User response: See your RACF security administratoror logon to another terminal.

RPIMGR052T LOGON REJECTED - UNKNOWNRACINIT RETURN CODE

Explanation: RACF would not authorize the LOGONattempt; however, RACF does not recognize the reasonprovided by the RACINIT SVC return code.


RPIMGR053E RESOURCE rrrrrrrrrrrrrrrrrrrrr IS INACCESS WARNING MODE

Explanation: You do not have the proper authority toaccess the specified resource, but the owner of theresource, is allowing RACF to grant access with awarning. There are installation options that may requireyou to supply the directory password under theseconditions.

User response: Contact the owner of the resource andask to be authorized with the level of authority youneed. You should do this as soon as possible becauseyour installation may remove the warning mode at anytime.

RPIMGR054E ERROR cccc READING VIOLATIONREPORT FILE

Explanation: The FILE SYSTEM returned a nonzeroreturn code cccc when the RACF service machineissued FSREAD for a security NOTIFY file.

User response: Notify system support that a FILESYSTEM error has occurred on the RACF servicemachine's A-disk.

RPIMGR055E COMMAND xxxxxxxx NOT DEFINEDTO RACF

Explanation: A user attempted to use the indicatedcommand xxxxxxxx. CP called RACF to check the user'sauthorization to use the command. However, no profileexists that protects the command or the resource classis not active.

User response: Contact the owner of the resource,

RPIMGR045T • RPIMGR055E


have it defined to RACF, and get RACF permission toaccess it, or have the security administrator activate theVMCMD class.

Security Administrator Response: If you want to useRACF to control who can use the indicated command,define a profile protecting the indicated command inthe VMCMD class. Ensure that the user has theauthority to use the command. Also check that theVMCMD class is active. For more information oncreating VMCMD profiles, see RACF SecurityAdministrator's Guide.

RPIMGR056E YOU ARE NOT AUTHORIZED TOISSUE “xxxxxxxx”

Explanation: You attempted to issue a CP commandyou are not authorized to issue.


Security Administrator Response: If the user should beauthorized to use the indicated command, give the useraccess to the VMCMD profile that protects thecommand. For more information on controlling whocan issue CP commands, see RACF SecurityAdministrator's Guide.

RPIMGR057T NOT AUTHORIZED TO SECURITYLABEL

Explanation: You are not authorized to the securitylabel in your user profile.

User response: Ask your RACF security administratorto give you access to the security label in your userprofile.

RPIMGR058A Security label authorization failed forresource resource-name in the class-nameclass.

Explanation: This error occurs when RACF detects anattempt to access a resource that has a security labelassociated with it, and the access cannot be authorizedbecause the requester is running under aninappropriate security label.


User response: To determine which security label isassigned to the resource, enter the following command:

RAC RLIST class-name resource-name

To determine which security labels you are authorizedto log on with, enter the following RACF command:

RAC SEARCH CLASS(SECLABEL)

v If you require access to this resource, log on underan appropriate security label, and try the requestagain.

v If you are not authorized to log on under thesecurity label assigned to the resource, see yourinstallation security procedures or contact yourRACF security administrator.

RPIMGR059A Security label is missing for resourceresource-name in the class-name class.

Explanation: The resource listed in the messagerequires a security label. This error occurs when RACFdetects an attempt to access a resource that requires asecurity label, and one of the following is true:

v No security label is found for the profile that protectsthe resource.

v No profile is found that protects the resource.


User response: Contact your RACF securityadministrator.

RPIMGR060I Security label authorization failed forwrite access to minidisk-name; read accessgranted.

Explanation: The requester is running under aninappropriate security label to obtain write access tothe minidisk. The requester's security label is onlysufficient to obtain read access to the minidisk, so readaccess is granted by RACF.

System action: Read access to the minidisk is grantedby RACF.

User response: To determine which security label isassigned to the minidisk profile, enter the followingcommand:

RAC RLIST VMMDISK minidisk-name

To determine which security labels you are authorizedto log on with, enter the following RACF command:


v If you require write access to this minidisk, log onunder an appropriate security label, and try theaccess again.

v If you are not authorized to log on under thesecurity label assigned to the minidisk profile, seeyour installation security procedures or contact yourRACF security administrator.

RPIMGR061A Security label authorization failed.Access is denied.

Explanation: This error occurs when one of thefollowing is true:

v RACF detects a request which has a security labelassociated with it, and the request cannot beauthorized because the requester is running under aninappropriate security label.

RPIMGR056E • RPIMGR061A


v RACF detects a request which should have a securitylabel associated with it, but the security label ismissing.


User response: To determine which security labels youare authorized to log on with, enter the followingRACF command:


v Log on under an appropriate security label, and trythe request again.

v If you do not know the security label associated withthe request, see your installation security proceduresor contact your RACF security administrator.

Security Administrator Response: This message wasissued for a VM event that is protected with theVMMAC class. For information on the security labelauthorizations required for the VMMAC class, seeRACF Security Administrator's Guide.

RPIMGR062A Command failed. Userid is notauthorized to the security label.

Explanation: The default security label in the userprofile (userid) is incorrect or userid does not have theappropriate authority to the default security label. If asecurity label was specified on the SECLABEL option ofthe LOGON command, then the user does not have theappropriate authority to this security label.

If you are logging on to a shared user ID, then bothyour user ID and the shared user ID must haveauthority to use the security label, whether it wasspecified on the LOGON command, or is the defaultsecurity label in your user profile.


User response: Have your RACF securityadministrator either correct the default security label inthe user profile or authorize useridto the defaultsecurity label profile in the SECLABEL class (or to thesecurity label specified on the LOGON command).

RPIMGR063A Command failed. User-name does nothave a default security label.

Explanation: RACF detected that a security label ismissing from the user profile. A default security label isrequired in user profile user-name.


User response: Have your RACF securityadministrator define a security label in your userprofile.

RPIMGR064A The system is in a tranquil state andis not available for use at this time. Tryagain later.

Explanation: The SETROPTS MLQUIET option iscurrently in effect. Only users with the RACF SPECIALattribute may perform work while the MLQUIET statusis active.


User response: Try again later. The securityadministrator has set the MLQUIET option, most likelyto perform some sort of maintenance involvingSECLABEL changes. Once that task has beencompleted, the system will be taken out of the quietstate, and you may once again enter the system andperform work.

RPIMGR065A Surrogate user authorization failed foruser ID userid.

Explanation: A user attempted to log on to a shareduser ID, but was not allowed because one or more ofthe following is true:

1. The user ID is not permitted to the profile namedLOGONBY.shared-user in the SURROGAT class.

2. SECLABEL authorization failed to the profile namedLOGONBY.shared-user in the SURROGAT class.

3. The SURROGAT profile LOGONBY.shared-user isnot defined in the RACF database.

4. The SURROGAT class is not active.

System action: The system continues normally.

User response: Contact system support personnel.

RACF Security Administrator Response:

If appropriate,

1. Permit the user ID to the LOGONBY.shared-userprofile.

2. Give the user ID access to a SECLABEL that isequal to or higher than the SECLABEL defined inthe SURROGAT profile.

3. Define the SURROGAT class profileLOGONBY.shared-user and permit the user to thatprofile.

4. Activate the SURROGAT class. Verify that theLOGONBY.shared-user profile exists and the user IDis permitted.

RPIMGR066A User ID userid is defined as a shareduser ID that may not be logged on todirectly.

Explanation: A user attempted to log on directly to auser ID that can only be shared.

System action: The system continues normally.

User response: Log on to the user ID as a shared user

RPIMGR062A • RPIMGR066A


ID by issuing the command:

LOGON shared-user BY userid

For details on the LOGON command, see the CPCommand and Utility Reference. If that is unsuccessful,contact the RACF security administrator to get access tothe shared user ID.

RPIMGR067E RPITGP abended the commandpropagation task

Explanation: The number of putline requests from thiscommand is excessive, possible logic error.

User response: Contact IBM service.

RPIMGR068E PASSWORD CHANGE REJECTEDDUE TO INSTALLATION MINIMUMCHANGE INTERVAL

Explanation: The LOGON command has detected thatan insufficient number of days has passed since yourlast password change.

User response: Contact your security administrator todetermine your installation's minimum passwordchange interval, and to reset your password if it hasbeen compromised. Enter your current password tocontinue the logon process.

RPIMSG001E VMCF AUTHORIZE function failed.VMCF RETURN CODE = return-code.RACFVM SMSG functionUNAVAILABLE.

Explanation: The SMSG function to the RACF/VMserver is not available. Thus, no one can send messagesto the RACF/VM server. The VMCF return code equalsthe VM/CP return code from Diagnose X'68'.

User response: Contact the system programmer andprovide the return code.

RPIMSG002E Invalid command or reply number.

Explanation: The user entered an invalid command orreply number to RACF/VM through SMSG.

User response: Enter a valid command or replynumber.

RPIMSG003E Response cannot be handled at thistime.

Explanation: The RACF/VM server is overloadedwith SMSG requests.

User response: Retry later.

RPIOPN001E FILEDEF for DDNAME xxxxxxxx doesnot exist.

Explanation: A FILEDEF statement for the specifiedddname does not exist. The data set could not beopened. It is possible that either a RACF utility EXECis not being used or there is an error in the EXEC.


System programmer response: Ensure that you areusing a RACF utility EXEC and issue the correctFILEDEF for the ddname.

RPIOPN002E FILEDEF for ddname has no associateddata set name

Explanation: The DSN operand was not supplied onthe FILEDEF. It is possible that either a RACF utilityEXEC is not being used or there is an error in theEXEC.


System programmer response: Ensure that you areusing a RACF utility EXEC and issue the correctFILEDEF for the appropriate ddname.

RPIOPN003E ADT lookup failed for disk with filemode file-mode

Explanation: The ADT lookup failed. The indicatedfile mode for the disk could not be found. Either thefile mode was missing or there was a CMS problem.


System programmer response: Ensure the file mode iscorrect and reissue.

RPIOPN004E ADT lookup indicates disk with filemode file-mode is not an O/S disk.

Explanation: The specified disk at file-mode is not anOS disk.


System programmer response: Format the disk as anOS disk.

RPIOPN005E DASD dasd has not been properlyformatted by ICKDSF.

Explanation: The specified DASD has not beenOS-formatted.


System programmer response: Format the disk as anOS disk using ICKDSF.

RPIMGR067E • RPIOPN005E


RPIOPN006E I/O is being attempted to disk withddname before being opened.

Explanation: I/O was attempted before the indicatedddname data set was opened.



RPIRAC001E No command specified; RC isreturn-code.

Explanation: RAC was entered without a commandoperand. The return code from the RAC module is 24.

System action: Command processing halts.

User response: Reenter the command with acommand operand.

RPIRAC002E Command failed by installation exit;exit RC is rc.

Explanation: In the user's virtual machine, thecommand translation exit (RCMDRFMT) failed thesyntax of the RAC command. A return code of 40 isreturned if the RCMDRFMT EXEC does not return anydata.


User response: Examine the user exit for the returncode from the failed command. Adjust your commandsyntax as required.

RPIRAC003E VMCF Authorize failed; VMCF RC isrc.

Explanation: There is a problem with VMCF. Thereturn code displayed is from CP from a Diagnose X'68'invocation.



RPIRAC004E RACF command failed; RACF RC is rc.

Explanation: The RACF command you entered failed.


User response: Analyze the return code. It willusually either be from the RACF command processoror the RAC command interface. See “RAC CommandReturn Codes” on page 264. If the return code is notthere then check “RACF-Manager Return Codes” onpage 265.

RPIRAC005E RACF command timed out; RACF RCis rc.

Explanation: The RAC module timeout value has beenexceeded. The return code from the RAC module is 44.


User response: Increase the timeout value for runningthe command. See RACF System Programmer's Guide fordetails.

RPIRAC006E Command length exceeds themaximum of number characters.

Explanation: The user has entered more than theallowable number characters of RACF command text.

System action: The RAC exec ends without sendingthe command to the RACF service machine forprocessing.

User response: Split the command into separatecommands. For example, if you are trying to enter

then enter the following instead

ADDUSER PEGGY OVM(PROGRAM(pathname))ALTUSER PEGGY OVM(FSROOT(pathname))

RPIRAC007E Enter RACF command text. The totalcommand must not exceed numbercharacters. Enter a null line to indicateyou are finished.

Explanation: You issued the RAC command withoutany operands. This message is prompting you to enterthe RACF command data on as many lines as arenecessary. To end the command, a null line must beentered by hitting the ENTER key without havingtyped anything, including blanks, on the commandline. The command will then be sent to the RACFservice machine for processing.

System action: The system waits for you to enter theRACF command.

User response: Enter as many lines of input as arenecessary for the RACF command, within the limit ofnumber characters. Multiple lines will be necessarywhen entering a command that is too large to fit on asingle command line (for example, when specifying alarge OpenExtensions path name on a RACFcommand). You must enter a null line to show that youhave completed entering the command. Blanks will notbe inserted between lines for you, so if a blank isrequired at the end of a line of input, you must provideit.

ADDUSER PEGGY OVM(PROGRAM(pathname) FSROOT(pathname))

RPIOPN006E • RPIRAC007E


||||||

RPIRAC008I ICHSFSDF EXEC encountered an error.Return code is return-code.

Explanation: The ICHSFSDF EXEC was called fromthe RPIRAC module to process a RACF command andan unexpected error occurred. The ICHSFSDF EXEC isexpected to send a decimal return code of zero or fourto its caller, but decimal return-code was sent instead. Areturn code of 40 is returned if the ICHSFSDF EXECdoes not return any data.


System programmer response: Ensure the ICHSFSDFEXEC has been installed correctly on the general usersystem disk, which is usually MAINT's 19E minidisk.For more information about the ICHSFSDF EXEC, seeRACF System Programmer's Guide.

If the ICHSFSDF EXEC has not been modified and hasbeen installed correctly, contact the IBM support centerwith the exact text of this message.


RPIRAC009W If you are inactivating a primarydatabase, you might not be able toreactivate it. Use the RACF commandsession instead. Enter 'yes' to continue.Any other response stops the commandfrom processing.

Explanation: You used the RAC exec to issue anRVARY INACTIVE command. You should not use RACto inactivate a primary database. Each RACF commandissued through RAC causes a new securityenvironment to be created. Inactivating the primarydatabase will subsequently prevent a new securityenvironment from being created. Therefore, you willnot be able to perform any work that requires RACFauthorization, including the ability to reactivate thedatabase.

System action: The RAC exec waits for your response.

v If your response is 'yes', the RVARY INACTIVEcommand is sent to the RACF service machine.

v If your response is other than 'yes', RAC stops thecommand from processing.

User response: If you are inactivating a primarydatabase, enter any response other than 'yes'. Thenissue the RVARY INACTIVE from within a RACFcommand session and stay within this session until youneed to reactivate the database.

If you are inactivating a backup database, you mayignore this warning Enter 'yes' to send the command tothe RACF service machine.

Note: In a multiple server environment with no backupdatabase, you might have to use RAC to issue RVARYINACTIVE against the primary database. In this case,you should first make sure that you can re-IPL the 490disk on the RACF service machine when you need to

or you will have to re-IPL CP in order to reactivate thedatabase. There are a few ways you can restart theRACF service machine after the primary database hasbeen made inactive.

v From the primary system operator, FORCE andXAUTOLOG the RACF server.

v From a user ID defined as the secondary console ofthe RACF server, use the SEND command to issueIPL 490 and RACSTART on the RACF server.

v LOGON to the RACF server, provided the CPdirectory password is known. Issue IPL 490 andRACSTART.

v LOGON BY to the RACF server, provided CPdirectory authorization exists for a given user ID,and the user ID's directory password is known. IssueIPL 490 and RACSTART.

RPIRAC010W If you are inactivating a primarydatabase, you might not be able toreactivate it. Also be aware that thiscommand will be propagated to allRACF servers in the SSI. Enter 'yes' tocontinue. Any other response stops thecommand from processing.

Explanation: You used the RAC exec to issue anRVARY INACTIVE command. Inactivating a primarydatabase is very risky. Each RACF command issuedthrough RAC causes a new security environment to becreated. Inactivating the primary database maysubsequently prevent a new security environment frombeing created. Therefore, you may not be able toperform work that requires RACF authorization,including the ability to reactivate the database.

System action: The RAC exec waits for your response.

v If your response is 'yes', the RVARY INACTIVEcommand is sent to all the RACF service machines inthe SSI cluster.

v If your response is other than 'yes', RAC stops thecommand from processing.

User response: If you are inactivating a backupdatabase, you may ignore this warning Enter 'yes' tosend the command to the RACF service machine.

Note: If you do issue RVARY INACTIVE against theprimary database and are subsequently unable toreactivate the database, you will have to FORCE allRACF servers on all member nodes in the SSI clusterand then XAUTOLOG each RACF server in turn.

RPIRND001E TRACKS per CYLINDER cannot bedetermined for device xxxx.

Explanation: An unsupported device has beenencountered by RPIRND.


RPIRAC008I • RPIRND001E


System programmer response: Allocate a supportedDASD device and reissue.

RPIRND002E I/O error processing disk xxxx. Devicepresented condition code 3; sense isXXXXXX. Device presented conditioncode 1; R15 is XXXXXXXX. Devicepresented condition code 2; R15 isXXXXXXXX.

Explanation: An I/O error has been encountered byRPIRND.



RPIRND003E TTR conversion failed for blocknumber xxxxxxxx on disk xxxx.

Explanation: TTR conversion failed. This is expected ifyou are running the RACUT200 utility.

System action: Processing halts if not executing theRACUT200 utility.

System programmer response: If you are not runningthe RACUT200 utility, report the complete text of thismessage to your IBM support center.

RPIRND004E I/O error on RACF dataset - EXCP

Explanation: An I/O error has been encountered byRPIRND while attempting to initiate an I/O operationto the RACF dataset using the execute channel program(EXCP) SVC.

System action: Processing ends with an abend.

System programmer response: Make sure that theRACF service machine has the database minidiskslinked in R/W mode. If this problem persists, reportthis message to your IBM Support Center.

RPIRPG001A Security label authorization failed.Access is denied.

Explanation: This error occurs when one of thefollowing is true:

v RACF detects a request which has a security labelassociated with it, and the request cannot beauthorized because the requester is running under aninappropriate security label.

v RACF detects a request which should have a securitylabel associated with it, but the security label ismissing.


User response: To determine which security labels youare authorized to log on with, enter the followingRACF command:


v Log on under an appropriate security label, and trythe request again.

v If you do not know the security label associated withthe request, see your installation security proceduresor contact your RACF security administrator.

Security Administrator Response: This message wasissued for a VM event that is protected with theVMMAC class. For information on the security labelauthorizations required for the VMMAC class, seeRACF Security Administrator's Guide.

RPIRTE001E Invalid data was passed to RPIROUTE.

Explanation: When RPIROUTE received control,register 1 pointed to an input parameter list. Validitychecking was then attempted by by RPIROUTE andfound invalid data.

System action: RPIROUTE terminates. RACF issues anIUCV SEVER request to the user and cleans up thecommunication path.

Operator response: Report this message to systemsupport.

RPIRTE002E VSIUCV OPEN was unsuccessful,RC=code.

Explanation: RPIROUTE attempted to issue a VSIUCVOPEN to set up the IUCV usage. The return code fromVSIUCV is displayed in the message. VSIUCV returncodes are described in “VSIUCV Return Codes” onpage 263.


Operator response: Report the exact text of thismessage to system support.

RPIRTE003E VSIUCV ACCEPT to ........ failed,RC=code, IUCV RC=code.

Explanation: RPIROUTE attempted to issue a VSIUCVACCEPT to the user specified in the message. Thereturn code from VSIUCV is displayed in the message.VSIUCV return codes are described in “VSIUCV ReturnCodes” on page 263.



RPIRTE004E Out of IQEs for path ID code, contactsystem support.

Explanation: RPIROUTE attempted to remove aninterrupt queue element (IQE) from the interruptrequest block (IRB) but there were no more IQEs

RPIRND002E • RPIRTE004E


available. The path ID that has run out of IQEs isdisplayed in the message.



RPIRTE005E IUCV interrupt type code wasunexpected.

Explanation: RPIROUTE received a value in theIPTYPE field within the IUCV parameter list (IPARML)that was not a valid interrupt type for RPIROUTE. Theinvalid interrupt type is displayed in the message.



RPIRTE006E An unauthorized attempt was made toconnect to RACF.

Explanation: A user tried to connect to the RACFservice machine, but the attempt was failed by RACFauthorization checking.


Operator response: Make sure the RACROUTE issuerhas appropriate access to the ICHCONN profile in theFACILITY class:

1. Create a profile named ICHCONN in the FACILITYclass:

RDEFINE FACILITY ICHCONN UACC(NONE)

2. Give READ or UPDATE access authority to theappropriate service machines:

PERMIT ICHCONN CLASS(FACILITY)ID(user-ID|group-ID)ACCESS(appropriate-access)

where appropriate-access is one of the following:NONE Prevents use of the RACROUTE macroREAD Allows use of the RACROUTE macro

request types that do not requireAPF-authorization on MVS (such asREQUEST=AUTH)

UPDATEAllows use of the RACROUTE macrorequest types that do requireAPF-authorization on MVS (such asREQUEST=VERIFY).

Note: Refer to the description for thespecific request to determine which level ofauthority is required.

3. Activate the FACILITY class (if this class is notalready active):

SETROPTS CLASSACT(FACILITY)

RPIRTE007E RACXTRT on profile ICHCONN CLASS= FACILITY failed.

Explanation: RPIROUTE attempted to perform aRACXTRT on the profile IUCVCONN, but received anon-zero return code.

System action: The connection between RACF and therequesting user is terminated. RACF issues an IUCVSEVER request to the user and cleans up thecommunication path.

Operator response: Report the exact text of thismessage to your RACF security administrator.

RPIRWI001E INITIAL STACK FAILED WITH CODErc; PROCESSING ABORTED

Explanation: This message is issued by way ofLINEDIT to indicate an internal error processing theSTACK DATASET=* macro. The message appears at theterminal or on the RACF service machine console. rc isreplaced by the hex return code from the STACKmacro. RPIRWI terminates with return code 24.

User response: Retry the RACRPORT EXEC, and ifthe error persists, initiate standard problem reportingand resolution procedures.

RPIRWI002E FILE STACK FAILED WITH CODE rc;PROCESSING ABORTED

Explanation: This message indicates an errorprocessing the STACK macro for SYSTSPRT orSYSTSIN. The message appears at the terminal or onthe RACF service machine console. rc will be replacedby the hex return code from the STACK macro. RPIRWIterminates with return code 24. Return code values:

00000004 - Internal error. Retry RACRPORT. If theerror persists, initiate standard problem reportingand resolution procedures.

00000008 - SYSTSIN was present but could not beopened. Probable error in FILEDEF specifications(bad file name, type, mode, or DCB information) orother error as indicated by an associated CMSmessage.

0000000c - SYSTSPRT was present, but could not beopened. Probable error in FILEDEF specifications(bad file name, type, mode, or DCB information) orother error as indicated by CMS.

00000010 - SYSTSIN was present and was a PDSwith no member name given. Correct the FILEDEF.

00000014 - Internal error. Retry RACRPORT. If theerror persists, initiate standard problem reportingand resolution procedures.

RPIRTE005E • RPIRWI002E


RPIRWI003E PUTGET FAILED WITH CODE rc;PROCESSING ABORTED

Explanation: This message indicates an internal errorprocessing the PUTGET macro to obtain the RACFRWcommand from the file defined by the SYSTINFILEDEF, RACFRW CONTROL, in the RACRPORTEXEC. The message appears at the terminal or on theRACF service machine console. rc is replaced by thehex return code from the PUTGET. RPIRWI terminateswith return code 24.


RPIRWI004E COMMAND SCAN FAILED WITHCODE rc; PROCESSING ABORTED

Explanation: This message indicates an internal errorusing the IKJSCAN routine to find the command namein the RACFRW command from the file defined by theSYSTIN FILEDEF, RACFRW CONTROL, in theRACRPORT EXEC. The message appears at theterminal or on the RACF service machine console. rc isreplaced by the hex return code from IKJSCAN.RPIRWI terminates with return code 24.


RPIRWI005E INVALID COMMAND ENTERED.FLAG = nn; PROCESSING ABORTED

Explanation: This message indicates that IKJSCANfound an error in the RACFRW command obtainedfrom the RACRPORT CONTROL file. The messageappears at the terminal or on the RACF servicemachine's console. nn is replaced by the hex flag valuefrom IKJSCAN. RPIRWI terminates with return code24.

User response: Correct the error in the RACRPORTCONTROL file. Ensure that there is correct commandbeginning with the word RACFRW. FLAG meanings:

04 Command name started with a percent sign(%)

08 Command name syntactically invalid

20 Command was a question mark (?)

RPIRWI006E COMMAND ENTERED WAS NOT‘RACFRW’; PROCESSING ABORTED

Explanation: This message indicates that the firstcommand in the RACRPORT CONTROL file was notRACFRW. The message appears at the terminal or onthe RACF service machine console. RPIRWI terminateswith return code 24.

User response: Correct the RACRPORT CONTROL

file, and rerun the RACRPORT EXEC.

RPIRWI007E PARSE FAILED WITH CODE rc;PROCESSING ABORTED

Explanation: This message indicates an error parsingthe RACFRW command obtained from the RACRPORTCONTROL file. The message appears at the terminal oron the RACF service machine console. rc is replaced bythe hex return code from IKJPARS. RPIRWI terminateswith return code 24. If the return code is 00000004, theprobable cause is an incorrect RACFRW command inRACRPORT CONTROL. In this case, IKJPARS can notprompt the user for a correction, and so the parse fails.IKJPARS issues further messages to the terminal or toSYSTSPRT. Any other return code indicates an internalerror.

User response: Retry RACRPORT, and if the errorpersists, initiate standard problem reporting andresolution procedures.

RPISEL001E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.VMEVENT CLASS IS NOT ACTIVE.

Explanation: The RACF VMEVENT class has not beenactivated.


User response: Activate the VMEVENT class with thefollowing RACF command:

SETROPTS CLASSACT(VMEVENT)

RPISEL002E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.VMEVENT CLASS IS NOT DEFINEDTO RACF.

Explanation: The RACF VMEVENT class was notdefined in the CDT (class-descriptor table).


User response: Verify that the proper level of the CDT(ICHRRCDX) has been installed on your system.

RPISEL003E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.RACSTAT MACRO FAILED WITHRETURN CODE rc.

Explanation: RACSTAT macro failure.


User response: Report this message with its returncode to your RACF administrator.

Programmer response: Analyze the return code fromRACSTAT. See RACROUTE.

RPIRWI003E • RPISEL003E


RPISEL004E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.RACXTRT MACRO FAILED WITHRETURN CODE rc.

Explanation: RACXTRT macro failure.



Programmer response: Analyze the return code fromRACXTRT. See RACROUTE.

RPISEL005W USERSEL PROFILE FOR USER userCONTAINS AT LEAST ONEDUPLICATE ENTRY.

Explanation: Two entries for the same VM event arein the member list of the VMEVENT profile specifiedon the SETEVENT REFRESH command. For this event,on entry turns control on and the other entry turnscontrol off.

System action: Control is turned on for the duplicatedevent.

User response: Use the RALTER command to deleteone of the duplicated VM event member list entries,then issue the SETEVENT REFRESH command again.

RPISEL006W USERSEL PROFILE FOR USER userATTEMPTED TO CONTROL A VMEVENT WHICH IS NOTCONTROLLABLE.

Explanation: The VMEVENT profile specified on theREFRESH operand of the SETEVENT commandcontains at least one member that is not a controllableVM event.

System action: Command processing continues withthe valid members found in the VMEVENT USERSELprofile.

User response: Use the RALTER command to deletemembers that were specified with CTL or NOCTL butare not controllable VM events. For information onwhat VM events are controllable, see RACF SecurityAdministrator's Guide.

RPISEL007W USERSEL PROFILE FOR USER userCONTAINS AT LEAST ONE INVALIDMEMBER.

Explanation: At least one member found in theUSERSEL VMEVENT profile is neither an auditable orcontrollable VM event.

System action: These invalid member list entries areignored.

User response: Use the RALTER command to deleteVM events which are not auditable or controllable. For

information on what VM events are auditable orcontrollable, see RACF Security Administrator's Guide.

RPISEL008W FOR USER user CONTROL WASTURNED ON AUTOMATICALLY FORAT LEAST ONE CONTROLLABLE VMEVENT.

Explanation: This message does not necessarilyrepresent an error. A controllable event was not foundin the member list of the VMEVENT profile specifiedon the SETEVENT REFRESH command.

System action: Control is turned on for thecontrollable event(s).

User response: If you want to turn control off for acontrollable VM event, use the RALTER command tochange the VMEVENT USERSEL profile specified in theSETEVENT command. If you do not want to turncontrol off, take no action.

RPISEL009I USERSEL PROFILE FOR USER userCONTAINS NO MEMBERS. ALLAUDITING IS TURNED OFF ANDCONTROLLABLE EVENTS ARECONTROLLED.

Explanation: A USERSEL profile was specified on theREFRESH operand of the SETEVENT command, butthere were no valid members in the profile.

System action: Control is turned on for all controllableVM events and auditing is turned off.

User response: Use the RALTER command to addvalid members to the VMEVENT profile. Also thiscommand can be used to delete any invalid memberlist entries, if they exist.

RPISEL010E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.NOT ENOUGH VIRTUAL STORAGECOULD BE OBTAINED IN THE RACFSERVICE MACHINE.

Explanation: The RACF service machine does nothave enough virtual storage for the VM events to beaudited or controlled.



RPISEL101E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.VMXEVENT CLASS IS NOT ACTIVE.

Explanation: The RACF VMXEVENT class has notbeen activated.


User response: Activate the VMXEVENT class with

RPISEL004E • RPISEL101E


the following RACF command:

SETR CLASSACT(VMXEVENT)

RPISEL102E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.VMXEVENT CLASS IS NOT DEFINEDTO RACF.

Explanation: The RACF VMXEVENT class was notdefied in the CDT (class-descriptor table).


User response: Verify that the proper level of the CDT(ICHRRCDX) has been installed on your system.

RPISEL103E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.RACSTAT MACRO FAILED WITHRETURN CODE rc.

Explanation: RACSTAT macro failure.



Programmer response: Analyze the return code fromRACSTAT. See RACROUTE.

RPISEL104E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.RACXTRT MACRO FAILED WITHRETURN CODE rc.

Explanation: RACXTRT macro failure.



Programmer response: Analyze the return code fromRACXTRT. See RACROUTE.

RPISEL105W USERSEL PROFILE FOR USER userCONTAINS AT LEAST ONEDUPLICATE ENTRY.

Explanation: Two entries for the same VM event arein the member list of the VMEVENT profile specifiedon the SETEVENT REFRESH command. For this event,on entry turns control on and the other entry turnscontrol off.

System action: Control is turned on for the duplicatedevent.

User response: Use the RALTER command to deleteone of the duplicated VM event member list entries,then issue the SETEVENT REFRESH command again.

RPISEL106W USERSEL PROFILE FOR USER userATTEMPTED TO CONTROL A VMEVENT WHICH IS NOTCONTROLLABLE.

Explanation: The VMEVENT profile specified on theREFRESH operand of the SETEVENT commandcontains at least one member that is not a controllableVM event.

System action: Command processing continues withthe valid members found in the VMEVENT USERSELprofile.

User response: Use the RALTER command to deletemembers that were specified with CTL or NOCTL butare not controllable VM events. For information onwhat VM events are controllable, see RACF SecurityAdministrator's Guide.

RPISEL107W USERSEL PROFILE FOR USER userCONTAINS AT LEAST ONE INVALIDMEMBER.

Explanation: At least one member found in theUSERSEL VMEVENT profile is neither an auditable orcontrollable VM event.

System action: These invalid member list entries areignored.

User response: Use the RALTER command to deleteVM events which are not auditable or controllable. Forinformation on what VM events are auditable orcontrollable, see RACF Security Administrator's Guide.

RPISEL108I FOR USER user CONTROL WASTURNED ON AUTOMATICALLY FORAT LEAST ONE CONTROLLABLE VMEVENT.

Explanation: This message does not necessarilyrepresent an error. A controllable event was not foundin the member list of the VMEVENT profile specifiedon the SETEVENT REFRESH command.

System action: Control is turned on for thecontrollable event(s).

User response: If you want to turn control off for acontrollable VM event, use the RALTER command tochange the VMEVENT USERSEL profile specified in theSETEVENT command. If you do not want to turncontrol off, take no action.

RPISEL109E USERSEL PROFILE FOR USER userCONTAINS NO MEMBERS. ALLAUDITING IS TURNED OFF ANDCONTROLLABLE EVENTS ARECONTROLLED.

Explanation: A USERSEL profile was specified on theREFRESH operand of the SETEVENT command, butthere were no valid members in the profile.

RPISEL102E • RPISEL109E


System action: Control is turned on for all controllableVM events and auditing is turned off.

User response: Use the RALTER command to addvalid members to the VMEVENT profile. Also thiscommand can be used to delete any invalid memberlist entries, if they exist.

RPISEL110E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.NOT ENOUGH VIRTUAL STORAGECOULD BE OBTAINED IN THE RACFSERVICE MACHINE.

Explanation: The RACF service machine does nothave enough virtual storage for the VM events to beaudited or controlled.



RPISEL111E AUDIT AND CONTROL SETTINGSWERE NOT MADE FOR USER user.VM APAR 39725 MUST FIRST BEINSTALLED.

Explanation: CP updates must be installed to utilizeauditing and controlling of individual users.



RPISEQ001E TRACKS per CYLINDER cannot bedetermined for device xxxx.

Explanation: An unsupported device has beenencountered by RPISEQ.


System programmer response: Allocate a supporteddevice and reissue.

RPISEQ002E I/O error processing disk xxxx. Devicepresented condition code 3; sense isXXXXXX. Device presented conditioncode 1; R15 is XXXXXXXX. Devicepresented condition code 2; R15 isXXXXXXXX.

Explanation: An I/O error has been encountered byRPISEQ as indicated by the condition code and senseinformation.



RPISET041E SETEVENT FAILED. THE USERIDMUST BE FROM ONE TO EIGHTCHARACTERS IN LENGTH.

Explanation: The SETEVENT command was issuedwith a user profile name that contains a user ID of lessthan 1 or greater than 8 characters in length.


User response: Reissue the SETEVENT command withthe correct syntax for the individual VM event profilename.

RPISET101E SETEVENT FAILED. USER IS NOTAUTHORIZED TO ISSUE THESETEVENT COMMAND.

Explanation: You are not defined to RACF withsufficient authority and cannot issue the SETEVENTcommand, or RACF is not active.



RPISET102E SETEVENT FAILED. operand IS NOT AVALID SETEVENT OPERAND.

Explanation: The SETEVENT command was issuedwith an operand that the system cannot recognize.


User response: Correct the spelling of the operandand issue the SETEVENT command again. See RACFCommand Language Reference for a description of theoperands on the SETEVENT command.

RPISET103I xxxxxxxx IGNORED. IT ISEXTRANEOUS.

Explanation: The SETEVENT command was issuedwith information considered extraneous by the system.xxxxxxxx is the extraneous information.

System action: RACF executes the command withoutthe extraneous information.

User response: If the extraneous information was aSETEVENT operand, see RACF Command LanguageReference for a description of the operands on theSETEVENT command, then issue the command againto get the function you wanted.

RPISET104E SETEVENT FAILED. VMXEVENTCLASS IS NOT ACTIVE.

Explanation: The VMXEVENT class must be active inorder for a profile from this class to be refreshed.


System programmer response: If appropriate, issuethe SETROPTS command with

RPISEL110E • RPISET104E


CLASSACT(VMXEVENT) specified.


RPISET105E SETEVENT FAILED. VMXEVENTCLASS IS NOT DEFINED TO RACF.

Explanation: The VMXEVENT class must be definedto RACF in order for a profile from this class to berefreshed.


System programmer response: Check that RACF/VMis properly installed. Class VMXEVENT must be in theclass-descriptor table for the SETEVENT command tobe issued.


Problem determination: If the class-descriptor table isproperly installed, report this problem to your IBMsupport center.

RPISET106E SETEVENT FAILED. PROFILESPECIFIED FOR REFRESH DOES NOTEXIST.

Explanation: The profile from which the VM eventsettings are to be refreshed either does not exist or doesnot conform to RACF profile naming conventions.


User response: Check the spelling of the profile namespecified on the REFRESH operand of the SETEVENTcommand. Use the RLIST command to verify that theprofile exists. If the profile does not exist, see RACFSecurity Administrator's Guide for information ondefining VMXEVENT profiles.

RPISET107W THE FOLLOWING MEMBER ISINVALID: member-name

Explanation: The profile specified on the REFRESHoperand contains invalid member(s). The invalidmember(s) are displayed in the message.


User response: Use the RALTER command to correctthe member name in the profile specified on theREFRESH operand of the SETEVENT command. Forinformation on member names in VMXEVENT profiles,see RACF Security Administrator's Guide.

RPISET108E SETEVENT FAILED. UNABLE TOOPEN RACF DATA BASE.

Explanation: An attempt was made to open the RACFdatabase to read the ICB (index control block) andfailed.








RPISET109E SETEVENT FAILED. PERMANENT I/OERROR HAS OCCURREDPROCESSING THE RACF DATA BASE.

Explanation: A permanent I/O error was detectedwhen a read or write request was attempted on theRACF database. An attempt was made to read or writethe ICB (index control block) of the primary RACFdatabase.



Note: For complete information on recovering from theproblem, see the section on RACF database recovery inRACF System Programmer's Guide. Pay particularattention to the section on failures during I/Ooperations on the RACF database.



RPISET105E • RPISET109E


RPISET110E SETEVENT FAILED. DYNAMICALLOCATION ERRORENCOUNTERED FOR THE RACFDATA BASE.

Explanation: While attempting to allocate the RACFdatabase (using SVC 99) an error was encountered.








RPISET111W WARNING. DEFAULT SETTINGSFOR ALL AUDITABLE ANDCONTROLLABLE VM EVENTS AREIN EFFECT.

Explanation: An attempt was made to read the ICB(index control block) of the current primary RACFdatabase, but there was no copy of VM event settingsin the RACF database.




System programmer response: If messageRPISET108E, RPISET109E, or RPISET110E precedes thismessage, see “System Programmer Response” for thatmessage. Otherwise, take no action.

User response: If message RPISET108E, RPISET109E,or RPISET110E precedes this message, report thatmessage to your system programmer. Otherwise, takeno action.

Problem determination: If message RPISET108E,RPISET109E, or RPISET110E precedes this message, see“Problem Determination” for that message. Otherwise,take no action.

RPISET112W DUPLICATE ENTRY FOUND INMEMBER LIST FOR THEFOLLOWING: event-name

Explanation: Two entries for the same VM event arein the member list of the VMXEVENT profile specifiedon the SETEVENT command. For that event, one entryturns control (or auditing) on and the other turnscontrol (or auditing) off.

System action: If control was specified in the eventname, control is turned on for the event.

If auditing was specified in the event name, auditing isturned off for the event.

User response: Use the RALTER command to correctthe error, then issue the SETEVENT command again.

RPISET113W TURNING CONTROL ONAUTOMATICALLY FOR: event-name

Explanation: This message does not necessarilyrepresent an error. A controllable event (indicated in themessage) was not found in the member list of theVMXEVENT profile specified on the SETEVENTcommand.

System action: Control is turned on for the eventindicated in the message.

User response: If you want to turn control off for theindicated event, use the RALTER command to changethe VMXEVENT profile specified in the SETEVENTcommand. If not, take no action.

RPISET114W SETEVENT FAILED. THE BUFFERCREATED TO CONTAINCONTROLLABLE AND AUDITABLEVM EVENTS WAS TOO SMALL.

Explanation: A SETEVENT REFRESH command wasissued. The buffer created by the SETEVENT commandprocessor is too small to contain all the controllable andauditable VM events required.




RPISET110E • RPISET114W


RPISET115E SETEVENT FAILED BECAUSE OFPROBLEM WITH {RACSTAT |RACXTRT | RACHECK} RETURNCODE = return-code

Explanation: There was a problem issuing aRACSTAT, RACXTRT, or RACHECK macro.




Problem determination: For an explanation of thereturn code, see the description of the macro returncode in one of the following:




RPISET116W THE FOLLOWING IS NOT ACONTROLLABLE VM EVENT:event-name

Explanation: The VMXEVENT profile specified on theREFRESH operand of the SETEVENT commandcontains a member that is not a controllable VM event.The member name is indicated in the message.


User response: Use the RALTER command to correctthe member name in the profile specified on theREFRESH operand of the SETEVENT command. Forinformation on member names in VMXEVENT profiles,see RACF Security Administrator's Guide.

RPISET117W YOU ARE NOT AUTHORIZED TOUPDATE CONTROL BITS. ONLYAUDIT BITS WERE UPDATED.

Explanation: The profile that was specified for aSETEVENT REFRESH command had members thatattempted to turn control on or off for one or more VMevents. However, users who have only the AUDITORattribute cannot turn control on or off.

System action: The control bits in the VM eventsettings in CP are not changed.

User response: If the control bits must be updated,ask a user with the SPECIAL attribute to issue theSETEVENT command.

RPISET118W YOU ARE NOT AUTHORIZED TOUPDATE AUDIT BITS. ONLYCONTROL BITS WERE UPDATED.

Explanation: The profile that was specified for aSETEVENT REFRESH command had members thatattempted to turn auditing on or off for one or moreVM events. However, users who have only theSPECIAL attribute cannot turn auditing on or off.

System action: The audit bits in the VM event settingsin CP are not changed.

User response: If the audit bits must be updated, aska user with the AUDITOR attribute to issue theSETEVENT command.

RPISET119E SETEVENT FAILED. DUPLICATEOPERANDS WERE SPECIFIED.

Explanation: The SETEVENT command was issuedwith one or more operands repeated.


User response: See RACF Command Language Referencefor a description of the operands on the SETEVENTcommand, then issue the command again to get thefunction you wanted.

RPISET120E SETEVENT FAILED. CONFLICTINGOPERANDS WERE SPECIFIED.

Explanation: The SETEVENT command was issuedwith mutually exclusive operands.


User response: See RACF Command Language Referencefor a description of the operands on the SETEVENTcommand, then issue the command again to get thefunction you wanted.

RPISET121E SETEVENT FAILED. YOU ARE NOTAUTHORIZED TO ISSUE THESETEVENT COMMAND WITHPRE-LOGON OPERANDS.

Explanation: You are not defined to RACF withsufficient authority and cannot issue the SETEVENTcommand, or RACF is not active.



RPISET122E SETEVENT FAILED. INVALIDFUNCTION CODE WAS PASSED TOHCPRPD.

Explanation: An invalid DIAGNOSE subfunction codewas passed to the RACF DIAGNOSE handler (moduleHCPRPD).


RPISET115E • RPISET122E





System programmer response: Check that RACF/VMis properly installed. The HCPRPD module, theSETEVENT command processor, or both may beback-level.



Problem determination: If the SETEVENT commandprocessor and the module HCPRPD are at the samelevel, report this problem to your IBM support center.

RPISET123I REFRESH IS FROM A PROFILE WITHNO VALID AUDITABLE MEMBERS.AUDITING WILL BE TURNED OFFFOR ALL EVENTS.

Explanation: A profile name was specified on theREFRESH operand of the SETEVENT command, butthere were no valid members in the profile.

System action: Auditing is set off for all definedevents.

User response: Check the spelling of the profile namespecified on the SETEVENT command. If it is theprofile you intended to use, issue the RALTERcommand to add members to the profile. Forinformation on member names in VMXEVENT profiles,see RACF Security Administrator's Guide.

RPISET124I REFRESH IS FROM A PROFILE WITHNO VALID CONTROLLABLEMEMBERS. ALL CONTROLLABLEEVENTS ARE CONTROLLED.


System action: Access checking is set on for all eventsdefined as controllable events by the VM operatingsystem.


RPISET125I REFRESH IS FROM A PROFILE WITHNO VALID MEMBERS. ALLAUDITING IS TURNED OFF ANDCONTROLLABLE EVENTS ARECONTROLLED.






RPISET126I SETEVENT COMPLETEDSUCCESSFULLY.

Explanation: A zero return code was found at the endof all SETEVENT processing.

System action: The system performed the requestedSETEVENT function.

RPISET127I SETEVENT IS UNAVAILABLE FORUSE NOW. TRY AGAIN LATER.

Explanation: The SETEVENT command processorissued an ENQ macro for the RACF database, but theRACF database is already being used by the RACFmanager.



User response: Try the command in a few minutes. Ifthe problem persists, report this message to yoursystem programmer.

Problem determination: The RACF manager hasissued an ENQ macro on the RACF database foranother user request.

RPISET128E SETEVENT FAILED. YOU MUST FIRSTISSUE SETEVENT REFRESH WITH APROFILE SPECIFIED.

Explanation: The SETEVENT command was issuedwith a pre-LOGON operand. This requires that theSETEVENT command be previously issued with aprofile name specified on the REFRESH operand.


RPISET123I • RPISET128E


User response: Issue the SETEVENT command with aVMXEVENT profile name specified on the REFRESHoperand. The profile does not need to have members.

RPISET129E SETEVENT FAILED. YOU ARE NOTAUTHORIZED TO REFRESH WITHTHE PROFILE YOU SPECIFIED.

Explanation: You do not have sufficient authority tothe VMXEVENT profile that was specified on theSETEVENT command.



RPISET130E SETEVENT FAILED. NOT ENOUGHVIRTUAL STORAGE FOUND TOCONTAIN THE AUDITABLE ANDCONTROLLABLE VM EVENTS.

Explanation: The RACF service machine does nothave enough virtual storage available for the VMevents to be audited and controlled.


System programmer response: Specify a larger virtualstorage size for the RACF service machine.


RPISET131E SETEVENT FAILED. HCPDA0 COULDNOT STORE THE VMXEVENTSETTINGS. RETURN CODE =return-code.

Explanation: Module HCPDA0 could not record theVM event settings.




RPISET132E SETEVENT FAILED. NO USER VMEVENT SETTINGS EXIST FORUSERID xxxxxxxx. SYSTEM SETTINGSARE BEING USED.

Explanation: Individual VM event settings were notfound for user ID xxxxxxxx. Occurs with the RESET orLIST operand on the SETEVENT command.

System action: The user is controlled and audited byoptions set in the system VM event settings.

User response: A individual VM event profile mayexist but user settings are currently suspended. Whenthe user logs on again, is AUTOLOG'ed or theSETEVENT REFRESH USERSEL.userid command is

issued against the user, the user is controlled andaudited by options set in the individual VM eventprofile.

If no individual VM event profile exists, and oneshould exist, create it.

RPISET133E SETEVENT FAILED. USER IS NOTCURRENTLY LOGGED ON.

Explanation: The indicated user is not currentlylogged on. A VMBLK for the specified user is notcurrently defined.


User response: Reissue command when user is loggedon.

RPISET134E SETEVENT FAILED. USER VM EVENTPROFILE DOES NOT EXIST FORUSERID xxxxxxxx.

Explanation: Individual VM event profile for theVMEVENT class is not found in the RACF data set.Occurs on the SETEVENT REFRESH USERSEL.useridcommand.


User response: Define the individual VM event profilein the VMXEVENT class.

RPISET135I USER VM EVENT SETTINGS AREDISABLED FOR USERID xxxxxxxx.WARNING: THESE SETTINGS WILLTAKE EFFECT AT LOGON UNLESS“USERSEL” PROFILE IS DELETED.

Explanation: The SETEVENT RESET USERSEL.useridcommand completed successfully.

System action: The individual VM event settings forthe user ID specified have been suspended. The user iscontrolled and audited by options set on the systemVM event settings.

User response: Individual VM event settings aretemporarily suspended for the user specified. When theuser logs on again or is AUTOLOG'ed, the user willagain be controlled and audited by the individual VMevent settings. The SETEVENT REFRESHUSERSEL.userid command will also cause the user to becontrolled and audited by the individual VM eventsettings.

To delete the individual VM event settingspermanently, issue RDELETE VMXEVENTUSERSEL.userid followed by SETEVENT RESETUSERSEL.userid.

RPISET129E • RPISET135I


RPISET136E SETEVENT FAILED. USER PROFILENAME IS MISSING OR INCORRECT.

Explanation: The SETEVENT RESET command wasissued with a user profile name the system cannotrecognize.


User response: Reissue the command with the correctsyntax for the individual VM event profile name. Thecorrect syntax is SETEVENT RESET USERSEL.userid.

RPISET137E USERID xxxxxxxx IS EXEMPT FROMALL CONTROL AND AUDITING OFVM EVENTS.

Explanation: No audit and control options have beenset for user ID xxxxxxxx. The user ID specified isexcluded from audit and control of all auditable andcontrollable events.

System action: No auditable and controllable eventswill be audited or controlled for the user ID specified.RACF will be called for LOGON, LOGOFF, andAUTOLOG.









RPISMF001E An abend has occurred in RACF SMSGroutine

Explanation: An abend has occurred in the RACF/VMSMSG processor.

System programmer response: Contact your IBMsupport center.


RPISMF050E SYNTAX ERROR IN SMF CONTROLCARD

Explanation: The card in the file named SMFCONTROL is in error.

Note: You can ignore this message if it is issued whileyou are running the RACUT100 exec or theRACDSMON exec.

System action: System action is indicated in anaccompanying message.

System programmer response: Ensure that the card inthe SMF CONTROL file includes the following:

CLOSE 1

RPISMF051E CURRENT DISK NOT EQUAL TOPRIMARY OR SECONDARY

Explanation: The CURRENT disk defined in the SMFCONTROL file must be the same as either thePRIMARY or the SECONDARY disk.

System programmer response: Correct the card in theSMF CONTROL file.

RPISMF052E ERROR READING ‘SMF CONTROL A’

Explanation: The SMF CONTROL file was available tobe read but an error occurred trying to read it. Theremay be an accompanying CMS message indicating theproblem.

System programmer response: Make sure the disk isstill linked and the file has not been rewritten since thedisk was last accessed.

RPISMF053E CANNOT ACCESS CURRENT DISKSPECIFIED IN ‘SMF CONTROL’

Explanation: During initialization, the disk specifiedin the SMF CONTROL file either could not be linked(in WRITE mode), or an error occurred when RACFtried to access it.

System programmer response: Use the CMS formatcommand to ensure that the disks specified in the SMFCONTROL file are properly formatted in RACF servicemachine's directory definition.

RPISMF054I SMF RECORDING NOT STARTED

Explanation: During initialization, or restarting ofSMF recording, an error occurred that prevented SMFrecording from being started. The RACF servicemachine is operating properly, but RACF is notrecording any violation attempts or other SMF data.There should be accompanying messages indicating thespecific reason that recording could not be started.

RPISET136E • RPISMF054I


Note: You can ignore this message if it is issued whileyou are running the RACUT100 exec or theRACDSMON exec.

System programmer response: Correct the error basedon accompanying messages.

RPISMF055I PRIMARY SMF DISK IS FULL -SWITCHING TO SECONDARY

Explanation: This information message signals achange in the SMF recording devices.

Operator response: See message RPISMF056I.

RPISMF056I DUMP AND ERASE PRIMARYDATASET AS SOON AS POSSIBLE

Explanation: This instruction message specifies theaction to be taken for message RPISMF055I.

Operator response: Perform the specified action.

RPISMF057I SECONDARY SMF DISK IS FULL -RETURNING TO PRIMARY

Explanation: This information message signals achange in the SMF recording devices.

Operator response: See message RPISMF058I.

RPISMF058I DUMP AND ERASE SECONDARYDATASET AS SOON AS POSSIBLE

Explanation: This instruction message specifies theaction to be taken for message RPISMF057I.

Operator response: Perform the specified action.

RPISMF059E PRIMARY AND SECONDARY SMFDISKS FULL - SMF RECORDINGSTOPPED

Explanation: The SMF disk currently being recordedon is full, and RACF attempted to switch to thealternate disk; however, RACF found that a file namedSMF DATA already existed on the alternate disk.

Operator response: Dump the file on one of the SMFdisks and erase the SMF DATA file. Restart SMFrecording by using the SMF command. You can onlyuse this command in the RACF command environment.

RPISMF060E ERROR ON PRIMARY SMF DISK -ATTEMPTING SWITCH TOSECONDARY

Explanation: An error occurred while trying to write arecord on the primary SMF disk.


System programmer response: Correct the problem,

dump the SMF DATA file on the primary disk to tape,and erase the file. The disk is then available for thenext switch.

RPISMF061E ERROR ON SECONDARY SMF DISK -ATTEMPTING SWITCH TO PRIMARY

Explanation: An error occurred when RACF tried torecord a record on the secondary SMF disk.


System programmer response: Correct the problem,dump the SMF DATA file on the secondary disk totape, and erase the file. The disk is then available forthe next switch.

RPISMF062E SMF ERROR OCCURRED DURINGRECOVERY - SMF RECORDINGSTOPPED

Explanation: An error occurred when RACF tried towrite to one of the SMF disks. An error also occurredin recovery when RACF tried to switch to the alternateSMF disk.


System programmer response: Correct the problem,dump the SMF DATA file on the secondary disk totape, and erase the file. Restart SMF recording usingthe SMF command. This command only can be used inthe RACF command environment.

RPISMF063E CANNOT ACCESS ALTERNATE SMFDISK

Explanation: While trying to switch from the currentSMF disk to the alternate, RACF could not link (inWRITE mode) or incurred an error when it tried toACCESS the alternate disk specified in the SMFCONTROL file.


System programmer response: Make sure that thedisks specified in the SMF CONTROL file are in theRACF service machine's directory and that they areproperly formatted with the CMS format command.Other actions may be prescribed based onaccompanying error messages.

RPISMF064E SMF RECORDING IS ALREADYSTARTED

Explanation: The operator issued an SMF command torestart SMF recording, but recording was alreadystarted.

RPISMF055I • RPISMF064E


RPISMF065I SMF RECORDING RESTARTED

Explanation: The operator successfully issued an SMFcommand to restart SMF recording.

RPISMF066I SWITCHED TO SECONDARY DISK

Explanation: The operator issued an SMF command toswitch SMF minidisks. Recording was switched to thesecondary SMF disk.

RPISMF067I SWITCHED TO PRIMARY DISK

Explanation: The operator issued an SMF command toswitch SMF minidisks. Recording was switched to theprimary SMF disk.

RPISMF068E INVALID SMF SUB-COMMAND

Explanation: The operator issued an SMF commandfor a request that was neither RESTART nor SWITCH.

Operator response: Reissue the command correctly.

RPISMF069E SWITCH NOT PERFORMED - SMFRECORDING IS CURRENTLYSTOPPED

Explanation: The operator issued an SMF command toswitch SMF minidisks, but recording was stopped atthe time.

Operator response: Issue the SMF RESTARTcommand first, then reissue the SWITCH request.

RPISMF070E CANNOT SWITCH - SMF DATAEXISTS ON ALTERNATE DISK

Explanation: An SMF command was issued to switchSMF minidisks, but an SMF DATA file already existedon the alternate minidisk.

Operator response: Dump and erase the SMF DATAfile on the alternate minidisk. Then reissue theSWITCH request. The alternate disk is the one in theSMF CONTROL file that is not specified as theCURRENT disk.

RPISMF071I BUFFER SIZE SPECIFIED IN SMFCONTROL MISSING OR INVALID —USING 1024.

Explanation: The buffer size specified in the SMFCONTROL file was not specified or was specifiedincorrectly.

Programmer response: Correct the card in the SMFCONTROL file.

RPISMF072I SMF RECORD GREATER THANMAXIMUM ALLOWED - TRUNCATED

Explanation: RACF issued an SMF write SVC torecord an SMF record larger than the maximumallowed. The record was written, but was truncated tothe maximum allowed.

Programmer response: Increase the buffer size valueon the card in the SMF CONTROL file.

RPISMF073I CP/RACF IUCV PATH IS BEINGSEVERED.

Explanation: There was a problem that preventedRACF from being able to continue SMF recording, andSEVER YES is specified in the SMF CONTROL file.There should be accompanying messages indicating thespecific reason that recording could not be continued.

Programmer response: Correct the problem based onthe accompanying messages.

RPISMF074E UNABLE TO WRITE AUDIT RECORDSTO SMF LOG. RACF STOPPING.

Explanation: There was a problem that preventedRACF from starting SMF recording, and SEVER YES isspecified in the SMF CONTROL file. There should beaccompanying messages indicating the specific reasonthat recording could not be started.

Programmer response: Correct the problem based onthe accompanying messages.

RPISTR001I Program program initiated.

Explanation: RPISTART has started the program namethat appears in the message insert.

System action: RACF continues processing. This is aninformational message.

Programmer response: No action is required.

RPISTR002I Program program ended. Completioncode = rc.

Explanation: The program name that appears in themessage insert has completed.

System action: RACF continues processing.

Programmer response: If the name that appears in themessage insert is CSTDYNST and the completion codeis non-zero, you should examine the RACF console logfor other IRR520xx messages relating to the RACFdynamic parse function. Follow the responsesassociated with the IRR520xx messages to determinethe nature of the problem.

RPISMF065I • RPISTR002I


|||

|||||

||

|||

|||||

||

RPISTR003I Subtask program initiated.

Explanation: The program name that appears in themessage has been started as a subtask.

System action: RACF continues processing. This is aninformational message.

Programmer response: No action is required.

RPISTR004E RPISTART only executes during RACFIPL.

Explanation: This message is issued if you attempt tostart RPISTART using the INIT command. RPISTARTruns only during the RACF initialization process andcannot be started using the INIT command.

System action: RACF continues processing.

RPISVR001A CMS must be ipled to run this utility.IPL the system CMS and restart thisutility.

Explanation: The utility found that the 490 disk, (theRACF-modified copy of CMS), is accessed as file modeS. You must IPL the system CMS in order to executethis utility.

System action: Utility processing stops, and thesystem is placed in the CMS “ready” state.

User response: IPL the system CMS and restart theRACFSVRS utility.

Problem determination: The system CMS must beIPL’ed in order to execute this utility.

RPISVR002A Primary service machine userid is arequired field.

Explanation: The primary service machine useridmust be specified. The RACFSVRS utility uses the disksowned by this userid as the source of the files it willcopy to the additional service machine’s disks forinitialization.

System action: The cursor is positioned at this inputfield.

System programmer response: Make sure that aRACF service machine has been allocated as describedin the RACF Program Directory for VM Installations.

User response: Enter the userid of the primary servicemachine at the specified panel location. This should bethe userid of your installation’s designated RACFservice machine.

Problem determination: The primary userid field,initialized with a default of “RACFVM,” was blankedout by the user. This is a required input entry.

RPISVR003A Service machine serverid must bedefined in the CP directory.

Explanation: The designated service machine useridserverid is not defined in the CP directory. All specifiedservice machine userids must be defined to CP.

System action: The input panel is redisplayed withthe cursor positioned at the service machine userid inerror.

System programmer response: The RACFSVRS utilityuses a CP DIAGNOSE 8 with a “QUERY userid”command to determine if the user is defined to CP.Verify that the DIAGNOSE is working properly.

User response: Define the service machine to CP andrestart this exec.

Problem determination: Make sure that the specifiedservice machine userid serverid is defined to CP. If not,contact your CP administrator to define this userid. Ifthe userid is defined, contact your systemsprogrammer.

RPISVR004A Undefined key pressed.

Explanation: A PF key that is not defined by theRACFSVRS utility was pressed.

System action: The input panel is redisplayed with anerror message.

User response: Select a valid PF key or the enter keyas listed on the fourth line from the bottom of theRACFSVRS panel. PF1 brings up a help panel, PF2verifies and initializes all designated service machines,PF3 exits the RACFSVRS panel, and the enter keyverifies user input without initializing the designatedservice machines.

RPISVR005A Service machine serverid is alreadyspecified. Erase or respecify.

Explanation: A duplicate service machine userid(serverid) was specified. The same userid cannot bespecified in more than 1 panel input field on the sameinvocation of the RACFSVRS utility.

System action: The input panel is redisplayed with anerror message and the cursor is positioned on theduplicate userid.

User response: Erase the duplicate userid from theRACFSVRS panel and press the enter or PF2 key.

RPISVR006A At least one additional service machineuserid must be specified.

Explanation: At least one additional service machineuserid must be specified. This message is displayed ineither of two cases: 1) Only a primary service machinehas been specified on the panel or 2) Both a primaryservice machine and a backup service machine have

RPISTR003I • RPISVR006A


been specified, but the backup service machine is inuse as a backup and cannot be used as an additionalservice machine.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at the firstinput additional service machine entry field.

User response: At the designated input location,supply a userid that is defined to both CP and RACF.

Problem determination: There are two cases wherethis message is issued: 1) There is no additional servicemachine userid to initialize. 2) The RACFSVRS utilitydetermines if the backup service machine userid isbeing used as a backup machine or as an additionalservice machine by checking the 191 disk of this servicemachine. If the 191 disk contains an SMF CONTROLfile and a PROFILE EXEC, the RACFSVRS utilityassumes that the userid specified is the backup servicemachine userid. If these files are not found, theRACFSVRS utility assumes that this userid is that of adesired additional service machine, and a warningmessage is issued. The user may blank out the backupservice machine userid field and specify an additionalservice machine userid. Note that in this case, while theinstallation may be running with a backup servicemachine, the RACFSVRS utility will not be aware ofthat backup.

RPISVR007A Link failed. Primary service machine191 disk must be accessible in READmode.

Explanation: The RACFSVRS utility could not link tothe primary service machine’s 191 disk in READ mode.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at theprimary service machine userid entry field.

System programmer response: Verify that the CPLINK to the primary service machine 191 disk isworking properly for the executing userid. If a RACFprofile for the LINK command or primary servicemachine’s 191 minidisk exists, make sure that theexecuting userid is included in the profile access listswith at least read access.

User response: Enter the userid of the system-definedprimary service machine at the specified panel inputlocation. This userid must be defined to CP as theowner of the RACF system disks (305 and 490).

Problem determination: The RACFSVRS utilityattempts a CP LINK to the primary service machine’s191 disk in READ mode. If this link fails for anyreason, this message will occur. A CP LINK to theprimary service machine’s 191 disk should beinvestigated as to why it did not work. It may be that a191 disk is not defined to CP for this userid, or thatRACF is somehow preventing the executing useridaccess to this disk.

RPISVR008A Link failed. Primary service machine305 disk must be accessible in READmode.

Explanation: The RACFSVRS utility could not link tothe primary service machine’s 305 disk in READ mode.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at theprimary service machine userid entry field.

System programmer response: Verify that the CPLINK to the primary service machine 305 disk isworking properly for the executing userid. If a RACFprofile for the LINK command or primary servicemachine’s 305 minidisk exists, make sure that theexecuting userid is included in the profile access listswith at least read access.

User response: Enter the userid of the system-definedprimary service machine at the specified panel inputlocation. This userid must be defined to CP as theowner of the RACF system disks (305 and 490).

Problem determination: The RACFSVRS utilityattempts a CP LINK to the primary service machine’s305 disk in READ mode. If this link fails for anyreason, this message will occur. A CP LINK to theprimary service machine’s 305 disk should beinvestigated as to why it did not work. It may be that a305 disk is not defined to CP for this userid, or RACFis somehow preventing the executing userid access tothis disk.

RPISVR009A Link failed. Service machine serveridvaddr disk must be accessible in[READ|WRITE] mode.

Explanation: The RACFSVRS utility could not link toservice machine serverid’s vaddr disk in the specifiedmode. The value of vaddr will be 191, 301, or 302.

System action: The input panel is redisplayed with anerror message and the cursor is positioned at theservice machine userid in error entry field.

System programmer response: Verify that the CPLINK to the specified service machine’s vaddr disk isworking properly for the executing userid. If a RACFprofile for the LINK command or specified servicemachine vaddr minidisk exists, make sure that theexecuting userid is included in the profile access listswith at least write access. Also verify that a vaddr diskis CP defined for the service machine userid in error(serverid).

User response: Verify that the specified additionalservice machine contains the disk specified by vaddrand make sure that the executing userid has access to itin the specified mode.

Problem determination: The RACFSVRS utilityattempts a CP LINK to the specified service machine’svaddr disk in the specified mode. If this link fails forany reason, this message will occur. A CP LINK to the

RPISVR007A • RPISVR009A


specified service machine’s vaddr disk should beinvestigated as to why it did not work. It may be that avaddr disk is not defined to CP for this userid, or RACFis somehow preventing the executing userid thespecified access to this disk.

RPISVR010W Service machine serverid vaddr diskappears to already be initialized. If youwish to re-initialize this userid, pressPF2.

Explanation: The service machine serverid’s vaddr diskcontains files that are part of service machineinitialization. Determine whether or not to continueand re-initialize this userid.

System action: The input panel is redisplayed with awarning message and the cursor is positioned at theservice machine userid that was found to have thenoted condition.

User response: Make sure that the specified servicemachine userid is to be re-initialized before you pressPF2. If re-initialization is not desired, either change thespecified userid or exit the panel.

Problem determination: The RACFSVRS utility checksthe 191 disk of the service machine about to beinitialized for the existence of an SMF CONTROL fileand a PROFILE EXEC. If the files are found, thiswarning message is issued. The RACFSVRS utilitychecks the 301 and 302 disks of the service machineabout to be initialized for the existence of SMF DATAfiles. If these files exist, this warning message is issued.In either case, the user must decide if they wish tore-initialize the specified service machine.

RPISVR011W Service machine serverid does notappear to be initialized as a backup. Ifyou wish to initialize it as an additionalservice machine, press PF2.

Explanation: The specified backup service machineserverid does not contain files that are part of servicemachine initialization. This userid will be initialized asan additional service machine if the user elects to doso.

System action: The input panel is redisplayed with awarning message and the cursor is positioned at thebackup service machine userid.

User response: 1) If the current installation is to meantto be run without a backup service machine, continue.Note that if a backup service machine is not used thenthe installation may have as many as 9 additionalservice machines. 2) If the backup service machineuserid (serverid) was specified incorrectly, correct themistake. 3) If the current installation is meant to be runwith a backup service machine, and you have specifiedthe userid correctly, exit the utility and check the RACFProgram Directory for VM Installations for the steps totake to define a backup service machine.

Problem determination: The RACFSVRS utility checksthe 191 disk of the backup service machine about to beinitialized for the existence of an SMF CONTROL fileand a PROFILE EXEC. The utility also checks thebackup service machine’s 301 and 302 disks for theexistence of SMF DATA files. If none of these files arefound, this warning message is issued.

RPISVR012A Required initialization files not foundon Primary service machine serverid.

Explanation: The specified primary service machine191 and 305 disks did not contain an active SMFCONTROL on the 191, a source SMF CONTROL on the305 and a PROFILE SAMPLE on the 305 disk. Thesefiles are propagated to the new server 191 disk and arerequired.

System action: The input panel is redisplayed withthe error message and the cursor is positioned at theprimary service machine userid.

User response: Ensure that the proper userid isspecified for the primary service machine userid. It isusually the userid of the server where the RACF forVM source code was installed.

Problem determination: If the specified primaryservice machine userid is correct verify that the CPdirectory entry has the proper definition for the 191and 305 disks. If the directory entry is correct, theRACF for VM product may need to be reinstalled onthis primary service machine to place the proper fileson the required disks.

RPISVR013A All userids have been verified. PressPF2 to execute.

Explanation: All userids on the entry panel for theRACFSVRS utility are defined to CP and are accessiblein the proper mode. The initialization phase will notproceed until you press PF2.

System action: The input panel is redisplayed withthis message. No action is taken until a key is pressed.

User response: Press PF2 to proceed with theinitialization of the specified service machines or pressanother valid key to take another action.

RPISVR014I Formatting serverid's vaddr disk.

Explanation: The RACFSVRS utility is formatting thespecified disk in CMS format. When formatting iscompleted, either the next formatting message will bedisplayed or the initialization complete message will bedisplayed.

System action: The disk is being formatted.

RPISVR010W • RPISVR014I


RPISVR015I Server initialization has completedsuccessfully.

Explanation: The RACFSVRS utility has completed theinitialization of all specified service machines and noerrors occurred.

RPISVR016A No R/W disk is accessed.

Explanation: The RACFSVRS utility expects a disk tobe accessed in R/W mode. This disk is where theRACFSVRS HISTORY file is written.

System action: The RACFSVRS input panel will notbe displayed and processing terminates.

User response: Access a disk in R/W mode andrestart this utility.

RPISVR017A The RACF command “RAC” is notavailable to RACFSVRS from this userID.

Explanation: The RACFSVRS utility issues the RACFcommand “RAC” to determine whether or not RACF isactive. The RAC command code must be on a disk thatis accessible to the user ID invoking the RACFSVRSutility.


System programmer response: Make sure that theRAC command code is accessible to the properlyauthorized user IDs.

User response: Make sure that the RAC command ison an accessible disk. This is normally the system “S”or “Y” disk but is always found on the RACF servicemachine “305” disk.

RPISVR018A RACF must be active to runRACFSVRS.

Explanation: The RACF service machine must beactive when this utility is invoked. RACF will authorizethe links required by this utility provided the profileshave been properly defined without prompting for linkpasswords.

Either the RACF IUCV connection has been severed, orRACF has been made inactive by the SETRACFINACTIVE command.


User response: Notify the proper system personnel tomake sure that the RACF service machine is active andthat the proper RACF authorities have been granted tothe executing user ID.

RPITMP001I RACF/VM SESSION ESTABLISHED.TO TERMINATE ENTER “END”

Explanation: The user has entered the RACFcommand environment.

User response: This is an informational message. Nouser action is required.

RPITMP002I ENTER RACF COMMAND OR “END”TO EXIT.

Explanation: The system is ready for the user to entera RACF command.

User response: Enter a command or “END”.

RPITMP003E RACF CMND ERROR (cccc)

Explanation: The last RACF command executed endedwith an error. The return code was cccc. There wereprobably other messages indicating what the error was.

User response: Refer to the other messages todetermine the action to be taken.

RPITMP004E ‘command-name’ IS AN INVALID RACFCOMMAND

Explanation: You entered a command that could notbe executed by RACF.

User response: Enter a valid RACF command or“END”.

RPITMP005I - QUIESCE MODE ENTERED

Explanation: During a command session, you tried tosend more data than the session processor could handleat one time. With the current support, this conditionshould not occur.


RPITMP006I - QUIESCE MODE TERMINATED

Explanation: During a command session, the sessionprocessor had previously entered quiesce mode.Processing continued, and the session processor cannow accept more data.

RPITMP007I tttttttt: CONNECTION SEVERED BYuuuuuuuu — SESSION TERMINATED

Explanation: User uuuuuuu was in a command sessionand caused the path to be severed. This can be done byIPLing CMS during the session. tttttttt is the time ofday.

RPISVR015I • RPITMP007I


RPITMP008E tttttttt: RECEIVED A REPLY FROMUSERID uuuuuuuu BUT COULD NOTFIND THE MSG BUFFER

Explanation: Terminal output was sent to useruuuuuuuu by way of IUCV, and the area containing thedata was saved until the user received it. When thereply arrived indicating the data was received, themessage buffer could not be found. tttttttt is the time ofday.

Programmer response: A system error occurred.Report this message to your system programmer.

RPITMP008I tttttttt: USER uuuuuuuuRECONNECTED ON PATHID nnnn,RECOVERY COMPLETE

Explanation: The command processor received anIUCV connect request during a RACF commandsession while path nnnn was currently in a severedstate. The reestablishment of the path constitutesrecovery. tttttttt is the time of day.

RPITMP009E tttttttt: IUCV INTERRUPT ON PATHTO uuuuuuuu OF TYPE tt WASUNEXPECTED

Explanation: During a command session, useruuuuuuu received an IUCV interrupt that should notoccur. The unexpected interrupt was received at thesession processor end of the IUCV path. tttttttt is thetime of day.

RPITMP010T tttttttt: IUCV ERROR IN SEVERRESPONSE TO SEVER —TERMINATING SESSION WITHuuuuuuuu

Explanation: During a command session with useruuuuuuuu, the RACF service machine received an IUCVsever. As a proper response, the service machine issueda sever in return, but that sever failed. The session isbeing terminated; however, in this situation, the sessionwould have been terminated anyway after the user'ssever response was complete. tttttttt is the time of day.

RPITMP011T tttttttt: CANNOT ISSUE A SEVER TORESYNCHRONIZE — TERMINATINGUSERID uuuuuuuu

Explanation: During a command session with useruuuuuuuu, an IUCV error occurred. In an attempt toreach some common synchronization point, a sever wasissued, but failed. The user's session is terminated.tttttttt is the time of day.


RPITMP012E tttttttt: IUCV ERROR with uuuuuuuu:ffffffff CC=1, RC=nn

Explanation: An IUCV error occurred while the RACFservice machine was trying to perform IUCV functionffffffff with uuuuuuuu. The condition code received fromIUCV was 1 and the return code was nn. tttttttt is thetime of day.

Operator response: The IUCV return codes can befound in z/VM CP Programming Services,. If the problempersists, report this message to your systemprogrammer.

RPITMP013E IUCV ERROR : ffffffff CC=n

Explanation: An IUCV error occurred while the RACFservice machine was trying to perform IUCV functionffffffff with uuuuuuuu. The condition code received fromIUCV was 2 or 3.

Operator response: The IUCV return codes can befound in z/VM CP Programming Services,. If the problempersists, report this message to your systemprogrammer.

RPITMP014E LAST COMMAND TERMINATEDABNORMALLY

Explanation: The session processor received controlback from a command processor that terminatedabnormally. This normally occurs if the user replies to aprompt from a command with a simulated attention (¬)or HX. It will also occur if the command processorencounters a problem that results in an abend.

User response: Retry the command if desired. If theproblem persists, report this message to your systemprogrammer.

RPITMP015E tttttttt: IUCV ERROR DURINGASYNCHRONOUS EXIT FOR uuuuuuuu

Explanation: During a command session with useruuuuuuuu, the session IUCV interrupt handlerattempted an IUCV operation and received an error. Arecovery attempt is scheduled by the command session.tttttttt is the time of day.

User response: If the problem persists, report thismessage to your system programmer.

RPITMP016T tttttttt: OUT OF IQES ON PATH FORuuuuuuuu — CONTACT SYSTEMSUPPORT

Explanation: During a command session, the usertried to send more data than the session processorcould handle at one time. RACF issued a quiesce, but itcould not take effect quickly enough, and the sessionprocessor exhausted its IQEs. With the current support,this condition should not occur. tttttttt is the time ofday.

RPITMP008E • RPITMP016T



RPITMP017E TIME NOT SUPPORTED

Explanation: During a command session, you issued aTIME command. The TIME command is a standardTSO/E command, but is not supported in a RACFcommand session on VM.

User response: If the time is desired, use a standardCP command such as QUERY TIME or INDICATEUSER. During a command session, these commandsshould be preceded by a line end character—usually apound sign (#).

RPITMP018E tttttttt: VSIUCV OPEN FOR uuuuuuuuUNSUCCESSFUL - RC=cc

Explanation: The RACF service machine encounteredproblems activating IUCV support for indicated user IDuuuuuuuu. Initialization is terminated since IUCV isessential to operate a command session. tttttttt is thetime of day.

System programmer response: Determine the sourceof the problem based on VS and IUCV return codes.VSIUCV return codes are described in “VSIUCV ReturnCodes” on page 263.


RPITMP019T tttttttt: CONNECT TO uuuuuuuuFAILED — VS RC=cc, IUCV RC=cc

Explanation: The RACF service machine encounteredproblems connecting with user uuuuuuuu duringinitialization. Initialization is terminated since IUCV isessential to operate a command session. tttttttt is thetime of day.


System programmer response: Determine the cause ofthe problem based on VS and IUCV return codes.VSIUCV return codes are described in “VSIUCV ReturnCodes” on page 263.

RPITMP020T CANNOT AUTHORIZE RACFCOMMANDS - CONTACT SYSTEMSUPPORT

Explanation: The PERMIT command could not befound in the RACFCMDS LOADLIB.

System programmer response: Check the GLOBALstatement in the RACSETUP EXEC for an entry ofRACFCMDS.


RPITMP021E ‘command-name’ RACF COMMANDMUST BE ISSUED WITH RAC ON ASINGLE SYSTEM IMAGE NODE

Explanation: You entered a command that can only beissued with RAC when running in a single systemimage cluster.

User response: Enter an acceptable RACF commandor “END”.

RPITRNQL001E RALTER failed. RACF is unable tocomplete link checking. Notify yoursystem programmer.

Explanation: RACF SETROPTS options have been setwhich enable tranquility for minidisks. However,RACF/VM was unable to determine if the minidiskwas currently in use.

System action: The RALTER command is failed.


RPITRNQL002E RALTER failed. One or more usersare linked to xxxxxxxx.xxx.

Explanation: RACF SETROPTS options have been setwhich enable tranquility for minidisks. However,RACF/VM determined that the RALTER commandwould change the SECLABEL of a minidisk while thedisk was in use.


User response: Retry the command or determine theusers that have the disk in use and have those usersDET the disk.

RPITRNQL003E RALTER failed. Profile name ismissing or incorrect.

Explanation: RACF SETROPTS options have been setwhich enable tranquility for minidisks. However,RACF/VM determined that the profile name specifiedon the RALTER command was not specified or wasinvalid.


User response: Check your spelling of the profilename specified on the RALTER command. If it iscorrect, verify that the profile exists. Retry thecommand.

RPIUTL001E RPIUTL must be invoked throughOSRUN command.

Explanation: RPIUTL must be initiated using theOSRUN command.


RPITMP017E • RPIUTL001E


System programmer response: Invoke RPIUTL usingthe OSRUN command.

RPIVAL001E No userid specified

Explanation: The RPIVAL MODULE was invoked tovalidate a user's password or password phrase, but nouser id was input to the module.


System programmer response: Reenter RPIVAL withthe correct user id parameter.

RPIVRT001E I/O error reading VTOC from xxxx disk.Device presented condition code 3;sense is XXXXXX. Device presentedcondition code 1; R15 is XXXXXXXX.

Explanation: RPIVRT was encountered an I/O error.



RPIVRT002E DSN xxxxxxx cannot be located on diskxxxx.

Explanation: RPIVRT was unable to locate thespecified data set on the specified disk. It either doesnot exist or there is an error in the EXEC.


RPIVPHSD001E LOAD failed for RPIVPHSD,Abend code abend, Reason code reason

Explanation: Database sharing check of the datasetname table and the range table was aborted becauseRPIVPHSD could not be loaded.

System action: The RACF server startup is aborted.

Operator response: Ensure that RACFLPA andRACFLINK LOADLIBs are on an accessed disk (usually305).

RPIVPHSD002E Entry count in RPIVPHSD out ofbounds.

Explanation: The format of either the dataset nametable or the range table is not valid.


Operator response: Correct the error in RPIVPHSD.

RPIVPHSD003E Wrong number of parameters

Explanation: RPIVPHSD has been invoked with thewrong number of parameters.


Operator response: If the RACSETUP EXEC has been

incorrectly modified, it must be corrected.

RPIVPHSD004E Error getting information for virtualdevice vdev

Explanation: An unexpected error occurred.


Operator response: Ensure that virtual device vdev isattached or linked to by the RACF server and holds aRACF data base partition.

RPIVPHSD005E Another server on this system isalready running with its database ondevice_details

Explanation: RACF database sharing check failedbecause at least one server on this system has adatabase running with one of the followingcharacteristics:

v On an FBA device

v On a device that does not support virtualRESERVE/RELEASE

and so did not conform to the restriction that it mustsupport virtual RESERVE/RELEASE and cannot beeither FBA.


Operator response: Move the RACF database toconforming devices.

RPIVPHSD006E Virtual device vdev holding theRACF databaseis FBAis non-full pack minidiskdoes not support RESERVE/RELEASEdoes not support virtualRESERVE/RELEASE

Explanation: RACF SSI handshaking check failedbecause device vdev did not conform to the restrictionthat it must support RESERVE/RELEASE and cannotbe either FBA or a non-full pack minidisk.


Operator response: Move the RACF database toconforming devices.

RPIVPHSD007E The system is not in JOINed state

Explanation: The system is not in JOINed state.


Operator response: Only attempt to restart the RACFserver once the system's SSI state is JOINed.

RPIVAL001E • RPIVPHSD007E


RPIVPHSD008E An unexpected error wasencountered trying to communicate withother nodes in the SSI

Explanation: RACF SSI handshaking check failedbecause of an unexpected error.


Operator response: Report the error to IBM.

RPIVPHSD009E Hand shaking data has a mismatchon the dsnt entry attribute

Explanation: RACF SSI handshaking check failedbecause the attribute associated with the dataset nametable entry for the starting RACF server did not matchthe equivalent attribute from servers already started inthe SSI. The mismatched attribute may be one of thefollowing:

v Primary dataset name

v Backup dataset name

v Primary dataset UUID

v Backup dataset UUID

v Update duplication flag


Operator response: All RACF servers in the SSI mustshare the same database and use the same datasetname table (ICHRDSNT).

RPIVPHSD010E Hand shaking data has a mismatchin the range table at entry number entry

Explanation: RACF SSI handshaking check failedbecause the range table entry number entry for thestarting RACF server did not match the same rangetable entry from servers already started in the SSI.


Operator response: Use the same range table(ICHRRNG) on all RACF servers in the SSI.

RPIVPHSD011E Virtual device vdev is not in R/Wmode

Explanation: The RACF server cannot be started if itsdatabase is on a R/O disk.


Operator response: Detach the device vdev and attachor link to it again in R/W mode before trying to startthe RACF server.

RPIVPHSD012E One or more dataset name tableentries have the dataset name specifiedas an asterisk

Explanation: One or more dataset name tabledefinitions are specified as an asterisk (*). This method

is not supported in an SSI system, and is notrecommended in a non-SSI system because filedefinitions will have to be provided manually by theoperator before replying to the accompanying ICH502Amessage.

System action: The RACF server will only be allowedto come up if it is in non-ssi mode or in repair mode.

Operator response: In a non-SSI system or if in repairmode, before responding to the subsequent ICH502Amessage correct the database file definitions. Forexample:

RPIVSC001E DASD dasd has not been properlyformatted by ICKDSF.

Explanation: The DASD specified has not beenOS-formatted.


System programmer response: OS-format the DASDusing ICKDSF.

RPIVSC002E BLK parameter not specified or invalid.

Explanation: The BLK parameter was not specified.


System programmer response: Reissue with the blockparameter (specified in the RPIVSC EXEC).

RPIVSC003E SIZE parameter on BLK parameter is notspecified or is invalid.

Explanation: The SIZE parameter on the BLKparameter is missing or invalid.


System programmer response: Reissue with the sizeparameter (specified in the RPIVSC EXEC).

RPIVSC004E MODE parameter is not specified or isinvalid.

Explanation: The mode parameter specified is missingor invalid.


System programmer response: Reissue with thecorrect file mode parameter.

CP SEND RACFVM FIledefRACFVM : SYSRACF DISK FILE SYSRACF R *RACFVM : RACFBKUP DISK FILE RACFBKUP Q *Ready; T=0.01/0.01 22:56:36CP SEND RACFVM FI SYSRACF R DSN RACF DATASETReady; T=0.01/0.01 22:56:52CP SEND RACFVM FI RACFBKUP Q DSN RACF BACKUPReady; T=0.01/0.01 22:57:07

RPIVPHSD008E • RPIVSC004E


RPIVSC005E FILE MODE parameter of MODEparameter is not specified or is invalid.

Explanation: The file mode parameter specified ismissing or invalid.


System programmer response: Reissue with thecorrect file mode parameter.

RPIVSC006E ADT lookup failed for disk with filemode xx.

Explanation: ADT lookup failed for the specified disk.The file mode for the disk could not be found. Eitherthe file mode was missing or there was a CMSproblem.


System programmer response: Ensure the file mode iscorrect and reissue.

RPIVSC007E Disk accessed as file mode xx is not anO/S disk.

Explanation: The specified disk at file mode xx is notan O/S disk.


System programmer response: Format the disk as anOS disk.

RPIVSC008E Data set(s) found on disk xxxx, DASDcannot be allocated.

Explanation: One or more data sets have been foundon the specified disk. RPIVSC will not permit allocationif the DASD previously contains allocated data set(s).


System programmer response: Correct the specifiedDASD or remove the data sets from the specified disk.

RPIVSC009E I/O error processing disk xxxx. Devicepresented condition code 3; sense isXXXXXX. Device presented conditioncode 1; R15 is XXXXXXXX.

Explanation: RPIVSC has encountered an I/O error.



RPIVSC005E • RPIVSC009E


Chapter 6. RACF Abend Codes

This chapter lists and explains the RACF-related abend codes that the systemissues to indicate the abnormal completion of a task. Completion codes appear inhexadecimal.

182

Explanation: RACF could not successfully establish anESTAE recovery environment when processing aRACHECK request.






See RACF Diagnosis Guide for information ondiagnosing abends and reporting abend problems toIBM.

Note: For batch jobs, if you need to do dump analysisbut do not have a dump, run the job again. For batchjobs using DSMON, a RACF command, or the RACFreport writer, specify a SYSABEND DD statement inthe job. This will ensure that a dump is taken.

183

Explanation: RACF could not successfully establish anESTAE recovery environment when processing aRACINIT request.

System action: The system terminates the task.







185

Explanation: RACF could not successfully establish anESTAE recovery environment when processing aRACDEF request.


Problem determination: Register 15 contains thenonzero return code passed back from the ESTAEmacro. For a description of the ESTAE return code, seethe MVS macros and interfaces reference for yoursystem.


Note: For batch jobs, if you need to do dump analysisbut do not have a dump, run the job again. For batchjobs using DSMON, a RACF command, or the RACFreport writer, specify a SYSABEND DD statement inthe job. This will ensure that the system produces adump.

282

Explanation: An error was detected by RACF in theparameters passed to RACF for RACHECK requestprocessing.


Programmer response: Register 15 contains ahexadecimal reason code (message ICH409I, if issued,also contains this reason code):

Reason CodeExplanation

04 Invalid parameter list length.10 APF authorization, or system key 0-7, or

supervisor state required for CSA, LOG,


PRIVATE, PROFILE, ACEE, UTOKEN,USERID, or GROUPID option.

14 Invalid ATTR option specified.18 Volume serial required but not supplied.1C Inconsistent PROFILE/ENTITY flag settings.20 No resource name or PROFILE specified.24 No CLASS name specified.2C Invalid LOG option specified. (This code is

used only through RACF Version 1.4.)30 Volume serial specified for class other than

DATASET.34 File sequence number invalid.38 File sequence number specified for nontape

data set.3C Tape label parameter specified for nontape

data set.40 Tape label option invalid.44 Erase-on-scratch request invalid.48 USERID = * was specified on the RACHECK. *

is an invalid RACF user ID.4C For the ENTITYX keyword, both the entity

name length and the buffer length are zero.50 Invalid length entered for the buffer length:

v Less than zerov Greater than 255v Not zero but less than the entity name

length.54 Invalid length entered for the entity name

length:v Less than zerov Greater than 44 if CLASS=DATASET, or

greater than the length for that class asdefined in the class-descriptor table

v Greater than 44 if CLASS=DATASET, orgreater than the maximum length for thatclass as defined in the class-descriptor table.

58 The in-storage profile provided to theRACHECK request was not at the versionrequired by RACF. Ensure that the version ofthe in-storage profile (addressed by theENTITY parameter with CSA specified) is atthe required version number.

5C The entity name contains a blank.

If the ENTITYX keyword is specified and theentity name length is given, the name has ablank in the beginning, in the middle, or at theend.

60 RTOKEN keyword is mutually exclusive withthe CSA and PRIVATE parameters of theENTITY keyword.

64 Invalid ACEE

Identify and correct the indicated error.

Problem determination: Use the reason code inRegister 15 to identify the error. If the issuer of theRACF macro is a user routine (such as an installationexit), correct the parameter list specified for the RACFmacro in the installation exit. If the issuer of the RACFmacro is an IBM routine, see RACF Diagnosis Guide for

information on diagnosing abends and reporting abendproblems to IBM.


283

Explanation: An error was detected by RACF in theparameters passed to RACF for RACINIT requestprocessing.


Programmer response: Register 15 contains ahexadecimal reason code. (Message ICH409I, if issued,also contains this reason code.)


04 Invalid parameter list length.14 ENVIR data specified was invalid.18 USERID specified did not conform to length

requirements.1C PASSWRD or PHRASE specified did not

conform to length requirements.20 GROUP specified did not conform to length

requirements.24 NEWPASS or NEWPHRASE specified did not

conform to length requirements.30 Invalid combination of ENVIR keyword data

and USERID, PASSWRD, NEWPASS, TERMID,APPL, SESSION, TRUSTED, REMOTE,SECLABEL, EXENODE, SUSERID, SNODE,SGROUP, POE, TOKNIN, and STOKENspecified.

PHRASE or NEWPHRASE is specified withENVIR other than CREATE.

34 Invalid combination of ENVIR keyword dataand GROUP specified.

38 ENVIR = CHANGE specified but no ACEEexits.

3C User ID specified is *NONE* and RACINIT isnot branch entered.

40 Reserved44 ENVIR=CREATE and SESSION=APPCTP were

specified but POE was not specified and isrequired in this case.

UTOKEN is a default token and no passwordand no password phrase specified.

48 ENVIR=CREATE and SESSION=APPCTP werespecified but APPL was not specified and isrequired in this case.

4C The ACEE specified does not appear to be avalid ACEE.

50 The ENVRIN keyword was specified and theENVR object storage area address was zero, or,either the ENVRIN or ENVROUT keyword

283


was specified and the ENVR object storagearea was not on a doubleword boundary.

54 The ENVRIN keyword was specified and theENVR object contained in the ENVR objectstorage area was larger than the ENVR objectstorage area specified.


Problem determination: Use the reason code inRegister 15 to identify the error. If the issuer of theRACF macro is a user routine (such as an installationexit), correct the parameter list specified for the RACFmacro in the installation exit. If the issuer of the RACFmacro is an IBM routine, see RACF Diagnosis Guide forinformation on diagnosing abends and reporting abendproblems to IBM.


285

Explanation: RACF detected an error in theparameters passed to it for RACDEF requestprocessing.




04 Invalid parameter list length.08 Invalid level number.0C Invalid TYPE option specified. (This code is

used only through RACF Version 1.3.)10 Resource name required.14 New data set name or old volume serial

specified but address is zero.18 Volume serial required but not specified.1C New data set name and old volume serial

flags both set.24 Parameters supplied which are inconsistent for

a general resource class other than DATASET.These incorrect parameters might be modelname, model volume serial, VSAM data set biton, old volume serial, or new data set name.

28 Model resource information supplied withtype other than DEFINE for DATASET class.

2C Model name supplied but model volume serialnot supplied.

30 Unqualified data set name specified.34 Old volume serial number is absent for

CHGVOL request.38 Unit field has invalid length.3C Invalid AUDIT value.40 Invalid OWNER specified.

44 Invalid UACC value.48 Invalid rename request; either ENTITY name

or NEWNAME name, but not both, is ageneric name. This reason code could occurbecause of the attempt to create a data setprofile with a single-qualifier name, whenRACF protection for single-qualifier names hasnot been activated (SETROPTS command withPREFIX specified). Note that there are severalcases in which data set profiles can be createdautomatically: when users with the ADSPattribute create data sets, whenPROTECT=YES is specified in JCL, and whena user issues the ADDSD command.

4C Type=CHGVOL specified for TAPE.50 Invalid parameters specified for TAPE.54 FILESEQ omitted when required for TAPE.58 Invalid operands specified for DASD.5A The in-storage profile provided to the

RACHECK request was not at the versionrequired by RACF. Ensure that the version ofthe in-storage profile (addressed by theENTITY parameter with CSA specified) is atthe required version number.

5C Invalid FILESEQ value.60 Invalid TAPELBL value.64 Invalid EXPDT/RETPD value.68 Invalid NOTIFY user ID.6C RESOWNER specified for other than

TYPE=DEFINE.70 Invalid RESOWNER.74 MGMTCLAS and/or STORCLAS specified

without RESOWNER.78 Invalid length for MGMTCLAS.7C Invalid length for STORCLAS.80 Invalid length for RESOWNER.84 Invalid SECLABEL is specified.88 Invalid buffer length specified with ENTITYX

keyword:v Less than zerov Greater than 255v Not zero but less than the entity name

length.8C Invalid name length specified with ENTITYX

keyword.v The specified length is less than zero.v The specified length is greater than 44 if

CLASS=DATASET or greater than themaximum length for that class as defined inthe class-descriptor table.

v The name which was supplied is longerthan 44 if CLASS=DATASET or longer thanthe maximum length for that class asdefined in the class-descriptor table.

90 For the ENTITYX format, both the entity namelength and the buffer length are zero.

94 Invalid buffer length specified with MENTXkeyword:v Less than zerov Greater than 255

285

Chapter 6. RACF Abend Codes 253

v Not zero but less than the entity namelength.

98 Invalid name length specified with MENTXkeyword.v The specified length is less than zero.v The specified length is greater than 44 if

CLASS=DATASET or greater than themaximum length of that class as defined inthe class-descriptor table.

9C For the MENTX keyword, both the entityname length and the buffer lengths are zero.

A0 Invalid buffer length specified withNEWNAMX keyword:v Less than zerov Greater than 255v Not zero but less than the entity name

length.A4 Invalid name length specified with

NEWNAMX keyword.v The specified length is less than zero.v The specified length is greater than 44 if

CLASS=DATASET or greater than themaximum length for that class as defined inthe class-descriptor table.

v The name which was supplied is longerthan 44 if CLASS=DATASET or longer thanthe maximum length for that class asdefined in the class-descriptor table.

A8 For the NEWNAMX keyword, both the entityname length and the buffer lengths are zero.

AC The profile name for the FILE and DIRECTRYclass does not contain at least two validqualifiers for keyword ENTITY or ENTITYX.v The profile name contains only one qualifier.v The profile name begins with a period.v The second qualifier is longer than 8

characters.B0 The profile name for the FILE and DIRECTRY

class does not contain at least two validqualifiers for keyword MENTITY or MENTX.v The profile name contains only one qualifier.v The profile name begins with a period.v The second qualifier is longer than 8

characters.B4 The profile name for the FILE and DIRECTRY

class does not contain at least two validqualifiers for keyword NEWNAME orNEWNAMX.v The profile name contains only one qualifier.v The profile name begins with a period.v The second qualifier is longer than 8

characters.B8 The entity name contains a blank:

If the ENTITYX keyword is specified and theentity name length is given, the name has ablank in the beginning, in the middle, or at theend.

BC The model profile name contains a blank.

If the MENTX keyword is specified and thename length is given, the name has a blank inthe beginning, in the middle, or at the end.

C0 The new profile name contains a blank.

If the NEWNAME keyword is specified andthe new name length is given, the name has ablank in the beginning, in the middle, or at theend.


Problem determination: Use the reason code inRegister 15 to identify the error. If the issuer of theRACF macro is a user routine (such as an installationexit), correct the parameter list specified for the RACFmacro in the installation exit. If the issuer of the RACFmacro is an IBM routine, see RACF Diagnosis Guide forinformation on diagnosing abends and reporting abendproblems to IBM.


382

Explanation: The RACHECK preprocessing orpostprocessing exit routine passed an invalid returncode to RACF. The return code was not part of thedefined interface.

System action: The system abnormally terminates thetask.

Programmer response: Possible user error. Register 15contains the return code from the exit routine. Verifythat the exit routine is issuing valid return codes. SeeRACROUTE for the correct return codes.

Problem determination: If the installation exit isissuing a correct return code and RACF still issues thisabend, call your IBM support center for advice aboutwhether this is a documentation error or an incorrectoutput error. See RACF Diagnosis Guide for informationon reporting documentation errors or incorrect outputto IBM.

Note: Before calling IBM, make sure the return codepassed by the installation exit is correct.

383

Explanation: The RACINIT preprocessing orpostprocessing exit routine passed an invalid returncode to RACF. The return code was not part of thedefined interface.

This abend occurs for an incorrect return code from thenew password and new password phrase exits as wellas the preprocessing and postprocessing exits.

382 • 383



Programmer response: Possible user error. Register 15contains the return code from the exit routine. Verifythat the exit routine is issuing valid return codes. SeeRACROUTE for the correct return codes.



385

Explanation: The RACINIT preprocessing orpostprocessing exit routine passed an invalid returncode to RACF. The return code was not part of thedefined interface.


Programmer response: Possible user error. Register 15contains the return code from the exit routine. Verifythat the exit routine is issuing using valid return codes.See RACROUTE for the correct return codes.



3C7

Explanation: While RACF was processing a non-SVCrequest, an error occurred in the RACF storagemanager.

System action: The system terminates the servicerequest.



04 BAD LENGTH: The length of the area to getor free is not greater than zero.

08 BAD ALIGNMENT: The pointer to the area tofree is not on a doubleword boundary.

0C DUPLICATE FREEMAIN: The area to free hasalready been freed.

10 INCORRECT SUBPOOL: The subpool for thearea to free is not the subpool in which thearea is allocated.

14 INVALID OVERLAP: Part of the area to freeequals part of the area allocated, but the matchis not correct for either a full or partialFREEMAIN.

18 NOT FOUND: The area to free does not havea corresponding GETMAIN entry in thetracking table, and the caller did not specifythat it should not have.

1C FOUND: The area to free has a correspondingGETMAIN entry in the tracking table, and thecaller specified that it should not have.

20 NOT FREED: There is a temporary area stillallocated at the end of processing.

A0 A RACF module issued a get-space request.However, register 1 is not equal to zero anddoes not point to a buffer previously createdby the program.

A4 A RACF module issued a get-space request.However, the subpool in register 0 is not thesubpool in which the previously created bufferis allocated.

A8 A RACF module issued a free-space request.However, register 1 is equal to zero.

AC A RACF module issued a free-space request.However, register 1 does not point to thebuffer previously created by the program.


Problem determination: Using IPCS or PRDMP,format the dump taken for this abend. For anexplanation of the dump title, see RACF DiagnosisGuide.

482

Explanation: While RACF was processing aRACHECK request, the RACF manager returned aninvalid return code.


Programmer response: Register 15 contains thehexadecimal return code. (Message ICH409I, if issued,also contains this reason code.) See “RACF-ManagerReturn Codes” on page 265 for an explanation ofRACF-manager return codes.

Problem determination: Using IPCS or PRDMP,format the dump taken for this abend. For anexplanation of the dump title, see the dump titlebeginning ICHRST00-RACF SVCS in RACF DiagnosisGuide.

385 • 482


483

Explanation: While RACF was processing a RACINITrequest, the RACF manager returned an invalid returncode.


Programmer response: Register 15 contains the returncode from the RACF manager. See “RACF-ManagerReturn Codes” on page 265 for an explanation ofRACF-manager return codes.


485

Explanation: While RACF was processing a RACDEFrequest, the RACF manager returned an invalid returncode.


Programmer response: Register 15 contains the returncode from the RACF manager. See “RACF-ManagerReturn Codes” on page 265 for an explanation forRACF-manager return codes.


4C7

Explanation: While RACF was processing a non-SVCrequest, an error occurred in the RACF storagemanager.











20 NOT FREED: There is a temporary area stillallocated at the end of processing.






Problem determination: Using IPCS or PRDMP,format the dump taken for this abend. For anexplanation of the dump title, see the RACF DiagnosisGuide.

582

Explanation: While processing a RACHECK request,RACF was unable to verify a user.


Programmer response: Register 15 contains ahexadecimal reason code. (Message ICH409I, if issued,also contains this return code.)


00 No accessor control environment (ACEE) wasavailable to describe the user.

Note: This is normal if a job started or a userlogged on while RACF was inactive but hassince been reactivated.

04 Reserved


Problem determination: Run the job again, or havethe user log on again while RACF is active. If theabend occurs again, see RACF Diagnosis Guide forinformation on diagnosing abends and reporting abendproblems to IBM.

483 • 582


585

Explanation: While processing a RACDEF request,RACF encountered an error.


Programmer response: Register 15 contains ahexadecimal reason code. (Message ICH409I, if issued,also contains this return code.)


00 No accessor environment element (ACEE) wasavailable to describe the user.

Note: This is normal if a job started or a userlogged on while RACF was inactive but hassince been reactivated.

04 No UCB was found to contain a volume serialthat matched the volume serial passed toRACF in the RACDEF macro instruction for aTYPE=DEFINE operation.

08 The ADDVOL or CHGVOL function wasrequested but the user did not have at leastUPDATE authority to the data set.

0C The ADDVOL function was requested and (1)the volume serial number is already defined(for DATASET class), or (2) the new tapevolume is already defined (for TAPEVOLclass).

The CHGVOL function was requested and adata set profile with ENTITY name and a newvolume serial number is already defined.


Problem determination: For reason code 00, run thejob again, or have the user log on again while RACF isactive. If the abend occurs again, see RACF DiagnosisGuide for information on diagnosing abends andreporting abend problems to IBM. For the other reasoncodes, correct the problem indicated by the reasoncode. For assistance in gathering additional informationabout the request that caused this abend (such asobtaining a dump or identifying the caller of RACF),see RACF Diagnosis Guide for information ondiagnosing abends. If an IBM program issued theRACDEF macro, see RACF Diagnosis Guide forinformation on reporting abend problems to IBM.

683

Explanation: The module calling RACINIT is notauthorized (is not APF-authorized, in system key 0-7,or in supervisor state).

Note: If the NEWPASS keyword is not specified on theRACINIT request, you can authorize the calling moduleby entering it in the RACF-authorized caller table.However, IBM does not recommend placing entries inthe RACF-authorized caller table.


Programmer response: Possible user error. Verify thatthe module is an authorized caller.

Problem determination: On z/OS, if the requestoriginated as a RACF command (that in turn resultedin the issuing of the RACINIT request), check to makesure the RACF command is in the list ofAPF-authorized commands for your system.

If the module making the request is an IBM routine, seeRACF Diagnosis Guide for information on diagnosingabends and reporting abend problems to IBM.

684

Explanation: The module calling the RACF manageror the RACLIST function is not authorized (is notAPF-authorized, in system key 0-7, or in supervisorstate).

System action: The system abnormally terminates thetask. (Is not APF-authorized, in system key 0-7, or insupervisor state).

Note: If the NEWPASS keyword is not specified on theRACINIT request, you can authorize the calling moduleby entering it in the RACF-authorized caller table.However, IBM does not recommend placing entries inthe RACF-authorized caller table.


Programmer response: Possible user error. Verify thatthe module is an authorized caller.

Problem determination: On MVS, if the requestoriginated as a RACF command (that in turn resultedin a call to the RACF manager or the RACLISTrequest), check to make sure the RACF command is inthe list of APF-authorized commands for your system.


685

Explanation: The module calling RACDEF is notauthorized (is not APF-authorized, in system key 0-7,or in supervisor state). To issue a RACDEF request, thecalling module must be authorized (APF-authorized, insystem key 0-7, or in supervisor state).


Programmer response: Possible user error. Verify thatthe calling module was executing in an authorizedstate.

Problem determination: On MVS, if the requestoriginated as a RACF command (that in turn resultedin the issuing of the RACDEF request), check to makesure the RACF command is in the list of

585 • 685


APF-authorized commands for your system.


9C7

Explanation: RACROUTE functions dealing withtokens (such as VERIFY, VERIFYX, TOKENBLD,TOKENMAP) will issue an abend 9C7 when an invalidtoken is detected.


Programmer response: This is possibly a user error.Verify that the token interface is correct.

Problem determination: Check the reason code andmake sure you pass the correct token in the request.

The following reason codes will be issued with abend9C7.


01 STOKEN area is too small.02 TOKNIN area is too small.04 The request is TOKENMAP. TOKNIN is a

required parameter. Either it was not specifiedor both its length and version fields are 0.

08 The request is VERIFYX, TOKENBLD,TOKENMAP, or TOKENXTR. TOKNOUT is arequired parameter. Either it was not specifiedor both its length and version fields are 0.

0C Version of 0 can only be used in conjunctionwith a length of 0, as an alternate method ofnot specifying a token parameter. This token isnot valid because the token’s version is 0 butits length is not.

10 VERSION=0.14 USERID has length greater than 8 characters.18 Either the password or the password phrase

has greater than its allowed maximumcharacters.

1C GROUPID has length greater than 8characters.

20 Either the new password or the new passwordphrase is greater than its allowed maximumcharacters.

24 EXENOSDE has length greater than 8characters.

28 SUSERID has length greater than 8 characters.2C SNODE has length greater than 8 characters.30 SGROUP has length greater than 8 characters.34 TOKNOUT version is greater than the current

maximum.3C No password or password phrase was

specified with *BYPASS*, PASSCHK=YESspecified.

D82

Explanation: While RACF was processing aRACHECK request, an error occurred in the RACFstorage manager.











20 NOT FREED: There is a temporary area stillallocated at the end of SVC processing.







D83

Explanation: While RACF was processing a RACINITrequest, an error occurred in the RACF storagemanager.

9C7 • D83



















D84

Explanation: While RACF was processing a RACLISTrequest, an error occurred in the RACF storagemanager.












44 Too many actions specified on ICHEINTYmacro.







D85

Explanation: While RACF was processing a RACDEFrequest, an error occurred in the RACF storagemanager.





D84 • D85















E82

Explanation: SVC 130 (RACHECK macro) wasinvoked; however, SVC 130 is inactive because RACF isnot properly installed on the system.



Problem determination: If you have installed RACFon your system, make sure that RACF is properlyinstalled on your system.

If you have not installed RACF on your system, thisabend could be issued when a data set has the RACFindicator bit on. This could occur if the data set camefrom a system with RACF installed.

E83

Explanation: SVC 131 (RACINIT macro) was invoked;however, SVC 131 is inactive because RACF is notproperly installed on the system.




E84

Explanation: SVC 132 (RACLIST macro) was invoked;however, SVC 132 is inactive because RACF is notproperly installed on the system.




E85

Explanation: SVC 133 (RACDEF macro) was invoked;however, SVC 133 is inactive because RACF is notproperly installed on the system.




E82 • E85


Abend Codes from RACF Modules in the z/VM Control Program

RPG001

Explanation: This abend occurs in HCPRPG when aprocessor attempts to release an internal lock that itdoes not currently hold.

System action: The VM control program is abnormallyterminated.

Programmer response: Refer to z/VM: RACF SecurityServer Diagnosis Guide for information on gathering thedocumentation you need to assist IBM in diagnosingthe problem, then contact your IBM Support Centerpersonnel.

Problem determination: Register 9 contains theaddress of the data area in HCPRPF (mapped by theCACHBLOK DSECT) in which the lockword is defined.Register 0 contains the CPU address of the CPUattempting to release the lock. When a CPU holds thislock, its address should be contained in the lockword.Otherwise the lockword should contain X'FFFFFFFF'.Attempt to determine why that CPU's address was notcontained in the lockword at the time the CPUattempted to release the lock.

RPI001

Explanation: This abend occurs in HCPRPI when aprocessor attempts to release an internal lock that itdoes not currently hold.


Programmer response: Refer to z/VM: Diagnosis Guidefor information on gathering the documentation youneed to assist IBM in diagnosing the problem, thencontact your IBM Support Center personnel.

Problem determination: Register 9 contains theaddress of the data area in HCPRWA (mapped by theRACFWA DSECT) in which the lockword is defined.Register 0 contains the CPU address of the CPUattempting to release the lock. When a CPU holds thislock, its address should be contained in the lockword.Otherwise the lockword should contain X'FFFFFFFF'.Attempt to determine why that CPU's address was notcontained in the lockword at the time the CPUattempted to release the lock.

RPI002

Explanation: A nonzero condition code was receivedfrom a STCK instruction in HCPRPI.


Programmer response: Refer to z/VM: Diagnosis Guidefor information on gathering the documentation youneed to assist IBM in diagnosing the problem, then

contact your IBM Support Center personnel.

Problem determination: A nonzero return code from aSTCK instruction is caused by hardware, not software.For a description of the possible condition codes, seeESA/390 Principles of Operation.

RPI003

Explanation: A nonzero condition code was receivedfrom an IUCV ACCEPT macro in HCPRPI.


Programmer response: Refer to z/VM: Diagnosis Guidefor information on gathering the documentation youneed to assist IBM in diagnosing the problem, thencontact your IBM Support Center personnel.

Problem determination: When a user ID issues anIUCV CONNECT to the *RPI system service, theHCPRPICN entry point is invoked. HCPRPICN willverify that the invoker is defined as a RACF servicemachine in HCPRWA, and if so, HCPRPICNimmediately issues an IUCV ACCEPT. It is possiblethat the storage containing the IUCV interrupt bufferhas been corrupted. Register 4 contains the address ofthe interrupt buffer that was specified on the IUCVACCEPT. The interrupt buffer is mapped by theIPARML control block provided by the VM operatingsystem.

RPG001 • RPI003


Appendix. Return Codes

This appendix lists and explains return codes for:v IUCV (z/VM only)v RAC command (z/VM only)v RACF command session (z/VM only)v RACF managerv RACF utilities

IUCV Return Codes

CMSIUCV Return CodesThis section lists and explains some of the CMSIUCV return codes. These returncodes are only displayed as part of the following messages:

RPICMS002ERPICMS003ERPICMS014ERPIGCS010E

They are not issued separately as return codes from a routine or macro.

Note: For this message text:IPRCODE=code

the CMSIUCV return code is equal to:code + 1000

Code Explanation11 (X'0B')

CP could not find the resource or gateway, or, the resource or gateway isnot available for connections, and no TSAF virtual machine is currentlyoperating on your system.

12 (X'0C')Your communication partner has not invoked the HNDIUCV SET or IUCVDCLBFR function.

13 (X'0D')Your virtual machine already has the maximum number of connections.

14 (X'0E')Your communication partner already has the maximum number ofconnections.

15 (X'0F')Your virtual machine is not authorized to connect to the resource.

VSIUCV Return CodesThis section lists and explains the VSIUCV return codes. These return codes areonly displayed as part of the following messages:

RPIMGR001ERPIMGR002T


RPIMGR012ERPIRTE002ERPIRTE003ERPITMP018E

They are not issued separately as return codes from a routine or macro.

Code Explanation00 Normal completion, no errors encountered.04 Issuer not in supervisor state.08 Invalid request operation code.0C Caller already active (OPEN request).10 Reserved.14 Caller inactive (all requests except OPEN).18 IUCV (in CP) detected an error (connect, accept, sever).1C No connect pending (accept).20 Invalid path ID (accept, sever).24 Caller does not own specified path (accept, sever).28 Path not active (sever).2C IUCV support not active.30 VSIUCVPL not on doubleword boundary (connect, accept, sever).

RAC Command Return CodesThis section lists and explains the RAC command return codes.

Return CodeDescription

4 RACF has been deactivated through the SETRACF INACTIVE command,so the RAC command cannot be processed.

8 The command issuer is not authorized to issue RACF commands usingRAC.

32 The RAC command could not be processed. Either the command wasissued from a RACF service machine or the command request timed out inCP while waiting for a response from the RACF service machine.

40 The ICHSFSDF EXEC or RCMDRFMT EXEC did not return any data.44 The RACF command timed out because of the value of the user's

$RAC_TIM global variable. For more information, see RACF CommandLanguage Reference.

100 RACROUTE REQUEST=VERIFY for the command issuer failed.104 RAC command exceeds the maximum length allowed.108 Bad command name.

RACF Command Session Return CodesThis section lists and explains the RACF command session return codes. Somereturn code values may be different if a password or password phrase is requiredon the RACF command session.

Return CodeDescription

4 The highest return code from a RACF command issued during thecommand session was 4, the command issuer is not RACF-defined, orRACF is not active.

8 The highest return code from a RACF command issued during thecommand session was 8, or the password or password phrase is notauthorized.


12 The highest return code from a RACF command issued during thecommand session was 12, or an error occurred while creating the user'ssecurity environment for the RACF command session.

24 RACROUTE REQUEST=VERIFY for the command issuer was failed by aninstallation exit.

28 The command issuer has been revoked.32 The RACF service machine is not operational. RACF commands cannot be

issued.36 The command issuer's access to the default group has been revoked.56 RACROUTE REQUEST=VERIFY for the command issuer failed due to

SECLABEL authorizations.72 The system is in a tranquil state.204 The IUCV path between CP and the RACF service machine was broken

after the RACF command session was established.254 The command issuer is not authorized to issue RACF commands using the

RACF command session.

RACF-Manager Return Codes

Programming interface information

This section lists and explains the RACF-manager return codes. The RACFmanager returns the codes to the caller (a RACF SVC, a command processor, or auser-written program) in hexadecimal in Register 15. However, the RACF managerissues messages that contain decimal return codes.

Return Code - Hex (Decimal)Description

0 (0) The requested operation was successful.4 (4) A recovery environment could not be established.8 (8) An attempt was made to add an entry (a profile) to the RACF database but

an identical entry already exists.

Note: Identical entries have the same name, type, and (if specified)volume.

C (12) For requests other than NEXT or NEXTC, the specified entry (RACFprofile) did not exist.

For NEXT or NEXTC requests, no subsequent entries (RACF profiles)satisfied the request.

10 (16) Reserved.14 (20) The RACF database did not contain enough space to satisfy the request.18 (24) An I/O error occurred while accessing the RACF database. The RACF

manager uses the EXCP macro to access the RACF database. This errorcould be caused by a problem with the DASD on which the RACFdatabase is stored.

1C (28)RACF was not active at the time of the request; or, in an environment withmultiple RACF data sets, the RACF data set containing the requestedprofile is inactive.

19 (25) The number of actual tests for the ICHEINTY request for the CONNECTtype profile is more than 254.

20 (32) 1. The request type requires a user work area but the area was notprovided (the address in the parameter list was 0). 2. For a RENAME,neither NEWNAME nor NEWNAMEX was supplied.

24 (36) The input parameter list or the associated ACTION and TEST blocks

Appendix. Return Codes 265

contain an error. For abend 482, 483, or 485, this RACF-manager returncode usually indicates that down-level templates are being used for theRACF database. Template conversion is done with ICHMIN00. Do thefollowing:1. Check the output of ICHMIN00 to be sure higher-level templates were

used.2. Check that the higher level of ICHMIN00 was run.3. Check that ICHMIN00 was run against the correct RACF data base.

RACF uses the templates from the first primary RACF databaseactivated.

4. Check that an unconverted database was not copied over the one thathad ICHMIN00 run against it.

When this code is returned, register 0 contains one of the following reasoncodes:

Reason Code - Hex (Decimal)Description

1 (1) Invalid entry name (profile name).2 (2) Action(s) specified with DELETE or DELETEA.3 (3) An action specified for an undefined field.4 (4) Test(s) specified with RENAME.5 (5) Reserved.6 (6) Reserved.7 (7) Incorrect entry type (profile type).8 (8) DATAMAP(OLD) was coded on the ICHEINTY macro, and

GROUP=YES was coded on the ICHEACTN macro, but the givendata length was too long for the repeat group.

9 (9) DATAMAP(OLD) was coded on the ICHEINTY macro, andGROUP=YES was coded on the ICHEACTN macro, but the givendata length was too short for the repeat group.

A (10) Consistency error between multiple input parameter lists. Thiserror occurs if chaining is being used and all input parameter listsare not using the same options or the same values for: TYPE, RBA,CLASS, VOLID, ENTRY, SMC, GENERIC or INDEX.

B (11) Input parameter list chaining/request type combination error. Thiserror occurs when the rules for types of input parameter listrequests that may be chained are violated. For example, the firstinput parameter list can only be a NEXT or NEXTC, LOCATE,ALTER or ALTERI, DELETE with SEGMENT or ADD. Thefollowing input parameter lists can only be LOCATE (afterLOCATE), NEXT/NEXTC (after NEXT/NEXTC), ALTERI (afterALTERI), ALTER (after ALTER, DELETE or ADD), and DELETEwith SEGMENT (after ALTER or DELETE).

C (12) All input parameter lists specify RUN=NO.D (13) Request type/segmentation combination error. This error occurs if

a segment name is specified with ADD, DELETEA, or RENAME.E (14) Invalid field for GROUP=YES. This error occurs if GROUP=YES

was coded but the field is not a repeat group.F (15) Input parameter list limit exceeded. More than 1000 input

parameter lists were chained.10(16) Segment not allowed. Specified SEGMENT name not allowed for

the specified profile TYPE.11(17) Inconsistency between ACTION data length and repeat group

FIELDS, GROUP=YES. This is similar to return code 8, butDATAMAP(NEW) was coded on the ICHEINTY macro.


12 (18) Data length specified on ICHEACTN macro exceeded the length ofthe specified fixed-length field.

17 (23) The generic entity name exceeds the maximum length after it hasbeen encoded.

28 (40) The maximum profile size (65,535 bytes) has been reached; the profilecannot be expanded.

2C (44)The user-supplied work area was not large enough to hold all the datareturned. The work area is filled with data up to, but not including, thefirst field that did not fit.

30 (48) The user-supplied work area was smaller than the minimum amountrequired (30 bytes).

34 (52) A test condition specified in the TESTS keyword of the ICHEINTY macrowas not met; RACF stopped processing.

38 (56) You requested an operation on an entry (profile) in class DATASET thathas multiple RACF definitions, but you did not specify a VOLUME tosingle out a specific entry.

3C (60)For DATASET class entries, you specified a VOLUME that did not exist inthe volume list of any entry with the specified name. For TAPEVOL classentries, a request tried to add a new TAPEVOL to a nonexistent tapevolume set.

40 (64) You attempted to delete one of the IBM-defined entries (such as SYS1 orIBMUSER) from the RACF database.

44 (68) An ALTERI request attempted to increase the size of the profile beingupdated.

48 (72) A request to add an entry to the RACF database would have caused theRACF index to increase to a depth that RACF does not support (themaximum depth is 10 levels).

4C (76)ICHEINTY encountered an invalid index block or read a nonindex blockwhen it expected an index block.

50 (80) You made an attempt to update (by a request other than ALTERI) a RACFdatabase that has been extended (the extended bit in the ICB was on).

54 (84) Reserved (used internal to RACF).58 (88) Some field-level access checks failed for data retrieval.5C (92)

All field-level access checks failed for data retrieval.60 (96) Field-level access checks failed for data update.64 (100)

Reserved for use by the ICHEINTY macro for RELEASE=(xx,CHECK).68 (104)

Invalid data in a RACF profile. Detail code is in the reason code:

Reason Code - Hex (Decimal)Description

1 (1) Profile too short6C (108)

The RACF manager has been invoked recursively, and an exclusivereserve/enqueue is required. However a shared reserve/enqueue isalready held.

70 (112)The RACF manager received an unexpected return code from areserve/enqueue. The reserve/enqueue return code is passed back inregister 0.


End programming interface information

RACF-Utilities Return CodesWith RACF 1.9, new utilities were created to handle a converted RACF database.When a new utility replaced an old utility, the prefix was changed from ICH toIRR. For example, new utility IRRUT100 replaced utility ICHUT100.

In general, the return codes for a new utility are the same as the return codes foran old utility.

This appendix describes the return codes for the RACF utilities. This information isalso described in RACF System Programmer's Guide for the programmer creatingjobs that use the utility.

Table 1. Return Codes for the ICHUT100 and IRRUT100 Utilities

Hex (Decimal) Description

0 (0) Function successful. Report printed.4 (4) Insufficient authority. See your RACF security administrator.8 (8) Error. Report not printed.10 (16) Open of SYSPRINT DCB failed.



0 (0) Function successful. Report printed.4 (4) A noncritical error was detected. Report printed.8 (8) A critical error was detected. Utility processing may not have

completed. Any report printed may not be complete.C (12) Utility terminated because:

v A request for storage failed.

v The ICB (inventory control block) or top-level index block couldnot be read (or was invalid).

v The utility was unable to open a required data set.



0 (0) Successful completion without error.4 (4) Duplicate IBM-defined names caused one or more warning

conditions.8 (8) One or more error conditions occurred because of one of the

following reasons:

v Duplicate non-IBM-defined names

v A defective tape volume set.C (12) One or more severe error conditions resulted from an error on an

output database.


Table 3. Return Codes for the ICHUT400 and IRRUT400 Utilities (continued)


10 (16) A terminating error condition occurred because of one of thefollowing reasons:

v A recovery environment could not be established.

v The SYSPRINT file could not be opened.

v An error was found in a parameter specification.

v A range table was requested but could not be loaded.

v An error was detected in the specified range table.

v An error occurred on an input database.

Table 4. Return Codes for the IRRDSC00 Utility


0 (0) Successful completion without error.4 (4) Error locking or unlocking a data set.8 (8) Failed profile. Conversion is incomplete.10 (16) Terminating error. Conversion incomplete or not started.14 (20) Open of SYSPRINT DCB failed.


Notices

This information was developed for products and services offered in the US. Thismaterial might be available from IBM in other languages. However, you may berequired to own a copy of the product or product version in that language in orderto access it.

IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not grant youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

For license inquiries regarding double-byte character set (DBCS) information,contact the IBM Intellectual Property Department in your country or sendinquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer ofexpress or implied warranties in certain transactions, therefore, this statement maynot apply to you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM websites are provided forconvenience only and do not in any manner serve as an endorsement of those


websites. The materials at those websites are not part of the materials for this IBMproduct and use of those websites is at your own risk.

IBM may use or distribute any of the information you provide in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

Such information may be available, subject to appropriate terms and conditions,including in some cases, payment of a fee.

The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.

The performance data and client examples cited are presented for illustrativepurposes only. Actual performance results may vary depending on specificconfigurations and operating conditions.

Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.

Statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

This information may contain examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to actual people or business enterprises is entirelycoincidental.

COPYRIGHT LICENSE:

This information may contain sample application programs in source language,which illustrate programming techniques on various operating platforms. You maycopy, modify, and distribute these sample programs in any form without paymentto IBM, for the purposes of developing, using, marketing or distributingapplication programs conforming to the application programming interface for theoperating platform for which the sample programs are written. These exampleshave not been thoroughly tested under all conditions. IBM, therefore, cannotguarantee or imply reliability, serviceability, or function of these programs. The


sample programs are provided “AS IS”, without warranty of any kind. IBM shallnot be liable for any damages arising out of your use of the sample programs.

IBM Online Privacy StatementIBM Software products, including software as a service solutions, (“SoftwareOfferings”) may use cookies or other technologies to collect product usageinformation, to help improve the end user experience, to tailor interactions withthe end user, or for other purposes. In many cases no personally identifiableinformation is collected by the Software Offerings. Some of our Software Offeringscan help enable you to collect personally identifiable information. If this SoftwareOffering uses cookies to collect personally identifiable information, specificinformation about this offering’s use of cookies is set forth below.

This Software Offering does not use cookies or other technologies to collectpersonally identifiable information.

If the configurations deployed for this Software Offering provide you as customerthe ability to collect personally identifiable information from end users via cookiesand other technologies, you should seek your own legal advice about any lawsapplicable to such data collection, including any requirements for notice andconsent.

For more information about the use of various technologies, including cookies, forthese purposes, see IBM Online Privacy Statement Highlights athttp://www.ibm.com/privacy and the IBM Online Privacy Statement athttp://www.ibm.com/privacy/details in the section entitled “Cookies, WebBeacons and Other Technologies”, and the IBM Software Products andSoftware-as-a-Service Privacy Statement at http://www.ibm.com/software/info/product-privacy.

Programming Interface InformationThis publication primarily documents information that is NOT intended to be usedas programming interfaces.

This publication also documents intended programming interfaces that allow thecustomer to obtain the services of an external security manager. This information isidentified where it occurs by an introductory statement or by the followingmarking:

Programming interface information

Programming interface information.

End programming interface information

TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks ofInternational Business Machines Corp., registered in many jurisdictions worldwide.Other product and service names might be trademarks of IBM or other companies.A current list of IBM trademarks is available on the web at IBM copyright andtrademark information - United States (www.ibm.com/legal/us/en/copytrade.shtml).

Notices 273

http://www.ibm.com/privacy

http://www.ibm.com/privacy/details

http://www.ibm.com/software/info/product-privacy

http://www.ibm.com/software/info/product-privacy

http://www.ibm.com/legal/us/en/copytrade.shtml

http://www.ibm.com/legal/us/en/copytrade.shtml

Linux is a trademark of Linus Torvalds in the United States, other countries, orboth.


Glossary

For a list of z/VM terms and their definitions, see z/VM: Glossary.

The z/VM glossary is also available through the online z/VM HELP Facility, ifHELP files are installed on your z/VM system. For example, to display thedefinition of the term “dedicated device”, issue the following HELP command:help glossary dedicated device

While you are in the glossary help file, you can do additional searches:v To display the definition of a new term, type a new HELP command on the

command line:help glossary newterm

This command opens a new help file inside the previous help file. You canrepeat this process many times. The status area in the lower right corner of thescreen shows how many help files you have open. To close the current file, pressthe Quit key (PF3/F3). To exit from the HELP Facility, press the Return key(PF4/F4).

v To search for a word, phrase, or character string, type it on the command lineand press the Clocate key (PF5/F5). To find other occurrences, press the keymultiple times.The Clocate function searches from the current location to the end of the file. Itdoes not wrap. To search the whole file, press the Top key (PF2/F2) to go to thetop of the file before using Clocate.


Bibliography

See the following publications for additionalinformation about z/VM. For abstracts of thez/VM publications, see z/VM: General Information,GC24-6193.

Where to Get z/VM Informationz/VM product documentation and other z/VMinformation is available in IBM Knowledge Center- z/VM (www.ibm.com/support/knowledgecenter/SSB27U).

You can also obtain z/VM product publicationsfrom IBM Publications Center(www.ibm.com/e-business/linkweb/publications/servlet/pbi.wss).

z/VM Base LibraryOverviewv z/VM: License Information, GC24-6200v z/VM: General Information, GC24-6193v z/VM: Glossary, GC24-6195

Installation, Migration, and Servicev z/VM: Installation Guide, GC24-6246v z/VM: Migration Guide, GC24-6201v z/VM: Service Guide, GC24-6247v z/VM: VMSES/E Introduction and Reference,

GC24-6243

Planning and Administrationv z/VM: CMS File Pool Planning, Administration,

and Operation, SC24-6167v z/VM: CMS Planning and Administration,

SC24-6171v z/VM: Connectivity, SC24-6174v z/VM: CP Planning and Administration,

SC24-6178v z/VM: Enabling z/VM for OpenStack (Support for

OpenStack Liberty Release), SC24-6251v z/VM: Getting Started with Linux on z Systems,

SC24-6194v z/VM: Group Control System, SC24-6196v z/VM: I/O Configuration, SC24-6198v z/VM: Running Guest Operating Systems,

SC24-6228

v z/VM: Saved Segments Planning andAdministration, SC24-6229

v z/VM: Secure Configuration Guide, SC24-6230v z/VM: TCP/IP LDAP Administration Guide,

SC24-6236v z/VM: TCP/IP Planning and Customization,

SC24-6238v z/OS and z/VM: Hardware Configuration Manager

User's Guide, SC34-2670

Customization and Tuningv z/VM: CP Exit Customization, SC24-6176v z/VM: Performance, SC24-6208

Operation and Usev z/VM: CMS Commands and Utilities Reference,

SC24-6166v z/VM: CMS Primer, SC24-6172v z/VM: CMS User's Guide, SC24-6173v z/VM: CP Commands and Utilities Reference,

SC24-6175v z/VM: System Operation, SC24-6233v z/VM: TCP/IP User's Guide, SC24-6240v z/VM: Virtual Machine Operation, SC24-6241v z/VM: XEDIT Commands and Macros Reference,

SC24-6244v z/VM: XEDIT User's Guide, SC24-6245

Application Programmingv z/VM: CMS Application Development Guide,

SC24-6162v z/VM: CMS Application Development Guide for

Assembler, SC24-6163v z/VM: CMS Application Multitasking, SC24-6164v z/VM: CMS Callable Services Reference, SC24-6165v z/VM: CMS Macros and Functions Reference,

SC24-6168v z/VM: CMS Pipelines User's Guide and Reference,

SC24-6252v z/VM: CP Programming Services, SC24-6179v z/VM: CPI Communications User's Guide,

SC24-6180v z/VM: Enterprise Systems Architecture/Extended

Configuration Principles of Operation, SC24-6192


http://www.ibm.com/support/knowledgecenter/SSB27U

http://www.ibm.com/support/knowledgecenter/SSB27U

http://www.ibm.com/e-business/linkweb/publications/servlet/pbi.wss

v z/VM: Language Environment User's Guide,SC24-6199

v z/VM: OpenExtensions Advanced ApplicationProgramming Tools, SC24-6202

v z/VM: OpenExtensions Callable Services Reference,SC24-6203

v z/VM: OpenExtensions Commands Reference,SC24-6204

v z/VM: OpenExtensions POSIX ConformanceDocument, GC24-6205

v z/VM: OpenExtensions User's Guide, SC24-6206v z/VM: Program Management Binder for CMS,

SC24-6211v z/VM: Reusable Server Kernel Programmer's Guide

and Reference, SC24-6220v z/VM: REXX/VM Reference, SC24-6221v z/VM: REXX/VM User's Guide, SC24-6222v z/VM: Systems Management Application

Programming, SC24-6234v z/VM: TCP/IP Programmer's Reference, SC24-6239v Common Programming Interface Communications

Reference, SC26-4399v Common Programming Interface Resource Recovery

Reference, SC31-6821v z/OS: IBM Tivoli Directory Server Plug-in

Reference for z/OS, SA76-0169v z/OS: Language Environment Concepts Guide,

SA22-7567v z/OS: Language Environment Debugging Guide,

GA22-7560v z/OS: Language Environment Programming Guide,

SA22-7561v z/OS: Language Environment Programming

Reference, SA22-7562v z/OS: Language Environment Run-Time Messages,

SA22-7566v z/OS: Language Environment Writing

Interlanguage Communication Applications,SA22-7563

v z/OS MVS Program Management: AdvancedFacilities, SA23-1392

v z/OS MVS Program Management: User's Guideand Reference, SA23-1393

Diagnosisv z/VM: CMS and REXX/VM Messages and Codes,

GC24-6161v z/VM: CP Messages and Codes, GC24-6177v z/VM: Diagnosis Guide, GC24-6187

v z/VM: Dump Viewing Facility, GC24-6191v z/VM: Other Components Messages and Codes,

GC24-6207v z/VM: TCP/IP Diagnosis Guide, GC24-6235v z/VM: TCP/IP Messages and Codes, GC24-6237v z/VM: VM Dump Tool, GC24-6242v z/OS and z/VM: Hardware Configuration

Definition Messages, SC34-2668

z/VM Facilities and FeaturesData Facility Storage ManagementSubsystem for VMv z/VM: DFSMS/VM Customization, SC24-6181v z/VM: DFSMS/VM Diagnosis Guide, GC24-6182v z/VM: DFSMS/VM Messages and Codes,

GC24-6183v z/VM: DFSMS/VM Planning Guide, SC24-6184v z/VM: DFSMS/VM Removable Media Services,

SC24-6185v z/VM: DFSMS/VM Storage Administration,

SC24-6186

Directory Maintenance Facility for z/VMv z/VM: Directory Maintenance Facility Commands

Reference, SC24-6188v z/VM: Directory Maintenance Facility Messages,

GC24-6189v z/VM: Directory Maintenance Facility Tailoring

and Administration Guide, SC24-6190

Open Systems Adapter/Support Facilityv Open Systems Adapter-Express Customer's Guide

and Reference, SA22-7935v Open Systems Adapter-Express Integrated Console

Controller User's Guide, SA22-7990v Open Systems Adapter-Express Integrated Console

Controller 3215 Support, SA23-2247v Open Systems Adapter-Express3 Integrated Console

Controller Dual-Port User's Guide, SA23-2266

Performance Toolkit for VMv z/VM: Performance Toolkit Guide, SC24-6209v z/VM: Performance Toolkit Reference, SC24-6210

RACF Security Server for z/VMv z/VM: RACF Security Server Auditor's Guide,

SC24-6212v z/VM: RACF Security Server Command Language

Reference, SC24-6213


v z/VM: RACF Security Server Diagnosis Guide,GC24-6214

v z/VM: RACF Security Server General User'sGuide, SC24-6215

v z/VM: RACF Security Server Macros andInterfaces, SC24-6216

v z/VM: RACF Security Server Messages and Codes,GC24-6217

v z/VM: RACF Security Server SecurityAdministrator's Guide, SC24-6218

v z/VM: RACF Security Server System Programmer'sGuide, SC24-6219

v z/VM: Security Server RACROUTE MacroReference, SC24-6231

Remote Spooling CommunicationsSubsystem Networking for z/VMv z/VM: RSCS Networking Diagnosis, GC24-6223v z/VM: RSCS Networking Exit Customization,

SC24-6224v z/VM: RSCS Networking Messages and Codes,

GC24-6225v z/VM: RSCS Networking Operation and Use,

SC24-6226v z/VM: RSCS Networking Planning and

Configuration, SC24-6227

Prerequisite ProductsDevice Support Facilitiesv Device Support Facilities: User's Guide and

Reference, GC35-0033

Environmental Record Editing andPrinting Programv Environmental Record Editing and Printing

Program (EREP): Reference, GC35-0152v Environmental Record Editing and Printing

Program (EREP): User's Guide, GC35-0151

Bibliography 279

Index

Numerics182 251183 251185 251282 251283 252285 253382 254383 254385 2553C7 255482 255483 256485 2564C7 256582 256585 257683 257684 257685 2579C7 258

Aabend codes 251ADDGROUP command

messages 36ADDSD command

messages 48ADDUSER command

messages 38ALTDSD command

messages 79ALTGROUP command

messages 72ALTUSER command

messages 74

BBLKUPD command

messages 91

CCMSIUCV return codes (VM only) 263codes

abend 251CMSIUCV return codes (VM only) 263completion 251descriptor codes 1, 105RAC command return codes 264RACF command session return codes 264RACF manager return codes 265RACF utility return codes 268routing codes 2, 106VSIUCV return codes (VM only) 263

completion codes 251

CONNECT commandmessages 40

CSTABE001T 173CSTDDD00E 173CSTDET001I 173CSTERP001W 173CSTHSV001E 173CSTIGC001E 174CSTINT001I 174CSTINT002I 174CSTINT003I 174CSTINT004I 174CSTINT005I 174CSTINT006I 174CSTINT007I 174CSTIOS001T 174CSTIOS002T 174CSTIOS003W 174CSTIOS004W 175CSTPGM001T 175CSTPGM002T 175CSTPGM003T 175CSTPGM004T 175CSTSET001I 175CSTSET002W 175CSTSET003T 175CSTSET004I 175CSTTER001I 175CSTUCB001I 175CSTWTO001E 175CSTWTO002E 176CSTWTO003E 176CSTWTO004E 176CSTWTO005E 176CSTWTO006E 176

DD82 258D83 258D84 259D85 259data security monitor (DSMON)

messages 99DELDSD command

messages 48DELGROUP command

messages 43DELUSER command

messages 43descriptor codes 1, 105DMSFLD22E 176DSMON (data security monitor)

messages 99dynamic parse

messages 119


EE82 260E83 260E84 260E85 260

FFACILITY class

activating 200, 229

HHCPRPD001I 176HCPRPD002I 176HCPRPD003I 176HCPRPD004I 176HCPRPD005I 176HCPRPD006I 177HCPRPD007I 177HCPRPI035I 177HCPRPI036E 177HCPRPI037I 177HCPRPI038I 177HCPRPW001E 178HCPRPW002E 178HCPRPW003E 178HCPRPW004I 178HCPRPW005I 178HCPRPW006I 178HCPRPW007I 178

IICH operator messages 1ICH000 series of messages 3ICH00000 series of messages 36ICH00002I 36ICH00003I 36ICH00004I 36ICH00005I 36ICH00006I 37ICH00007I 37ICH00008I 37ICH00009I 37ICH00010I 37ICH00011I 37ICH001E 3ICH002I 3ICH003I 3ICH004I 3ICH005I 3ICH006D 3ICH007E 4ICH01000 series of messages 38ICH01001I 38ICH01002I 38ICH01003I 38ICH01004A 38ICH01005I 38ICH01006I 38ICH01007I 38ICH01008I 38ICH01009I 38ICH01010I 38

ICH01011I 39ICH01012I 39ICH01013I 39ICH01015I 39ICH01016I 39ICH01017I 39ICH01020I 39ICH01021I 39ICH01022I 40ICH01023I 40ICH02000 series of messages 40ICH02001I 40ICH02002I 40ICH02003I 40ICH02004I 40ICH02005I 40ICH02006I 40ICH02007I 41ICH02008I 41ICH02009I 41ICH02010I 41ICH02011I 41ICH02012I 41ICH02013I 41ICH03000 series of messages 42ICH03002I 42ICH03003I 42ICH03004I 42ICH03005I 42ICH03006I 42ICH03007I 42ICH03008I 42ICH03014I 42ICH03021I 42ICH03025I 42ICH03026I 42ICH04000 series of messages 43ICH04001I 43ICH04002I 43ICH04004I 43ICH04006I 43ICH04007I 43ICH04009I 43ICH04010I 43ICH04011I 43ICH05000 series of messages 43ICH05001I 43ICH05002I 43ICH05004I 44ICH05005I 44ICH05006I 44ICH05007I 44ICH06000 series of messages 44ICH06001I 44ICH06002I 44ICH06003I 44ICH06004I 44ICH06005I 45ICH06006I 45ICH06007I 45ICH06008I 45ICH06009I 45ICH06010I 45ICH06011I 45ICH06013I 45ICH06014I 45ICH06015I 45


ICH06016I 46ICH06017I 46ICH06018I 46ICH06019I 46ICH06020I 46ICH08000 series of messages 47ICH08001I 47ICH08002I 47ICH08003I 47ICH08004I 47ICH08005I 47ICH08006I 47ICH08007I 47ICH08010I 47ICH08011I 47ICH08012I 47ICH08013I 47ICH08014I 47ICH08017I 48ICH08019I 48ICH08020I 48ICH08021I 48ICH08022I 48ICH08024I 48ICH08025I 48ICH08026I 48ICH09000 series of messages 48ICH09000I 48ICH09001I 49ICH09002I 49ICH09004I 49ICH09005I 49ICH09006I 49ICH09007I 49ICH09008I 49ICH09009I 49ICH09010I 49ICH09011I 50ICH09012I 50ICH09013I 50ICH09014I 50ICH09015I 50ICH09016I 50ICH09017I 50ICH09018I 50ICH09019I 50ICH09020I 50ICH09021I 51ICH09022I 51ICH09023I 51ICH09024I 51ICH09025I 51ICH09026I 51ICH09027I 51ICH09028I 51ICH09029I 51ICH09030I 51ICH09031I 52ICH09032I 52ICH09033I 52ICH09034I 52ICH09035I 52ICH09036I 52ICH09037I 52ICH09038I 52ICH09039I 52ICH09041I 53

ICH09042I 53ICH09043I 53ICH09044I 53ICH09045I 53ICH09046I 53ICH09047I 53ICH09048I 53ICH09049I 54ICH09050I 54ICH09051I 54ICH09052I 54ICH09053I 54ICH09054I 54ICH10000 series of messages 55ICH10004I 55ICH10005I 55ICH10006I 55ICH10102I 55ICH10103I 55ICH10104I 55ICH10105I 55ICH10201I 55ICH10202I 55ICH10203I 55ICH10204I 55ICH10207I 56ICH10301I 56ICH10302I 56ICH10303I 56ICH10304I 56ICH10305I 56ICH10306I 56ICH10307I 57ICH10308I 57ICH10309I 57ICH10310I 57ICH10311I 57ICH10312I 57ICH10313I 58ICH10315I 58ICH10316I 58ICH10317I 58ICH11000 series of messages 58ICH11001I 58ICH11002I 58ICH11003I 58ICH11004I 58ICH11005I 58ICH11006I 58ICH11007I 58ICH11008I 59ICH11009I 59ICH11102I 59ICH11103I 59ICH11104I 59ICH11105I 59ICH11106I 59ICH11107I 59ICH11108I 59ICH11111I 59ICH11112I 59ICH11113I 60ICH11114I 60ICH11115I 60ICH11118I 60ICH11201I 60ICH11301I 60

Index 283

ICH11302I 60ICH11303I 60ICH11304I 60ICH11306I 60ICH11307I 61ICH11308I 61ICH11309I 61ICH11311I 61ICH12000 series of messages 61ICH12001I 61ICH12002I 61ICH12102I 61ICH12103I 61ICH12201I 61ICH12202I 61ICH12301I 62ICH12302I 62ICH12303I 62ICH13000 series of messages 62ICH13001I 62ICH13002I 62ICH13003I 62ICH13004I 62ICH13005I 62ICH13006I 62ICH14000 series of messages 62ICH14001I 62ICH14002I 63ICH14003I 63ICH14004I 63ICH14006I 63ICH14009I 63ICH14010I 63ICH14011I 64ICH14013I 64ICH14014I 64ICH14015I 64ICH14016I 64ICH14017I 64ICH14018I 64ICH14019I 64ICH14020I 64ICH14021I 64ICH14022I 64ICH14023I 65ICH14024I 65ICH14025I 65ICH14026I 65ICH14027I 65ICH14028I 65ICH14029I 65ICH14030I 65ICH14031I 65ICH14032I 65ICH14033I 66ICH14034I 66ICH14035I 66ICH14036I 66ICH14037I 66ICH14038I 66ICH14040I 67ICH14041I 67ICH14042I 67ICH14043I 67ICH14044I 67ICH14045I 67ICH14046I 67

ICH14047I 67ICH14048I 68ICH14049I 68ICH14050I 68ICH14051I 68ICH14052I 68ICH14053I 68ICH14054I 69ICH14055I 69ICH14056I 69ICH14057I 69ICH14058I 69ICH14059I 70ICH14060I 70ICH14083I 70ICH15000 series of messages 70ICH15001I 70ICH15002I 70ICH15003I 70ICH15004I 70ICH15005I 71ICH15006I 71ICH15007I 71ICH15008I 71ICH15009I 71ICH15010I 71ICH15011I 71ICH15012I 71ICH15013I 72ICH15014I 72ICH15015I 72ICH15016I 72ICH15043A 72ICH20000 series of messages 72ICH20002I 72ICH20003I 72ICH20004I 72ICH20005I 72ICH20006I 73ICH20007I 73ICH20008I 73ICH20009I 73ICH20010I 73ICH20011I 73ICH20012I 73ICH20013I 73ICH20014I 73ICH20015I 74ICH20016I 74ICH20017I 74ICH20018I 74ICH20019I 74ICH20020I 74ICH20021I 74ICH20022I 74ICH21000 series of messages 74ICH21001I 74ICH21002I 74ICH21003I 75ICH21004I 75ICH21005I 75ICH21006I 75ICH21007I 75ICH21008I 75ICH21009I 75ICH21010I 75ICH21011I 75


ICH21012I 76ICH21013A 76ICH21014I 76ICH21015I 76ICH21016I 76ICH21017I 76ICH21018I 76ICH21019I 76ICH21020I 76ICH21021I 76ICH21022I 76ICH21023I 77ICH21026I 77ICH21027I 77ICH21028I 77ICH21029I 77ICH21030I 77ICH21031I 77ICH21032I 77ICH21033I 77ICH21034I 77ICH21036I 78ICH21038I 78ICH21039I 78ICH21042I 78ICH21043I 78ICH21044I 78ICH22000 series of messages 79ICH22001I 79ICH22002I 79ICH22003I 79ICH22004I 79ICH22005I 79ICH22006I 79ICH22007I 79ICH22008I 79ICH22009I 79ICH22010I 79ICH22011I 80ICH22012I 80ICH22013I 80ICH22014I 80ICH22015I 80ICH22016I 80ICH22017I 80ICH22018I 80ICH22020I 80ICH22021I 80ICH22022I 80ICH22023I 81ICH22024I 81ICH22025I 81ICH22026I 81ICH22027I 81ICH22028I 81ICH22029I 81ICH22030I 81ICH22031I 82ICH22032I 82ICH22033I 82ICH22034I 82ICH22035I 82ICH22036I 82ICH22037I 82ICH300 series of messages 4ICH30000 series of messages 83ICH30001I 83

ICH30002I 83ICH30003I 83ICH30010I 83ICH30011I 83ICH30012I 83ICH30013I 83ICH30014I 83ICH30015I 83ICH301I 4ICH302D 4ICH303I 4ICH304D 4ICH31000 series of messages 84ICH31001I 84ICH31002I 84ICH31003I 84ICH31004I 84ICH31005I 84ICH31006I 84ICH31007I 84ICH31008I 84ICH31009I 84ICH31010I 84ICH31011I 84ICH31012I 84ICH31013I 85ICH31014I 85ICH31015I 85ICH31016I 85ICH31017I 85ICH31018I 85ICH31021I 85ICH31022I 85ICH31023I 85ICH31024I 85ICH31025I 85ICH31026I 85ICH31027I 85ICH32000 series of messages 86ICH32002I 86ICH32004I 86ICH32005I 86ICH32006I 86ICH32007I 86ICH35000 series of messages 86ICH35001I 86ICH35002I 86ICH35003I 86ICH35004I 86ICH35005I 86ICH35006I 87ICH35007I 87ICH35008I 87ICH35009I 87ICH35010I 87ICH35011I 87ICH36000 series of messages 87ICH36001I 87ICH400 series of messages 5ICH401I 5ICH402I 5ICH403I 6ICH404I 6ICH405I 6ICH406I 7ICH407I 7ICH408I 7, 9, 10, 11, 12, 13, 14, 15

Index 285

ICH409I 16ICH410I 16ICH411I 16ICH412I 16ICH413I 16ICH414I 17ICH415I 17ICH416I 17ICH500 series of messages 18ICH500I 18ICH501I 18ICH502A 18ICH503I 19ICH504I 19ICH505A 19ICH506I 20ICH507I 20ICH508I 20ICH509I 21ICH51000 series of messages 88ICH51001I 88ICH51002I 88ICH51003I 88ICH51004I 88ICH51005I 88ICH51006I 88ICH51007I 89ICH51008I 89ICH51009I 89ICH51010I 89ICH51011I 89ICH51012I 89ICH510I 21ICH511I 21ICH512I 22ICH513I 22ICH515I 22ICH516I 22ICH517I 23ICH518I 23ICH519I 23ICH520I 23ICH521I 24ICH522I 24ICH523I 24ICH524I 24ICH525I 24ICH526I 24ICH527I 25ICH528I 25ICH529I 25ICH530I 25ICH531I 26ICH532I 26ICH533I 26ICH534I 26ICH535I 26ICH536I 26ICH537I 27ICH538I 27ICH539I 27ICH540I 27ICH541I 27ICH542I 28ICH543I 28ICH544I 28ICH546I 28

ICH547I 29ICH548I 29ICH563I 29ICH600A 29ICH61000 series of messages 89ICH61000I 89ICH61001I 89ICH61002I 89ICH61003I 90ICH61004I 90ICH61006I 90ICH61007I 90ICH62000 series of messages 90ICH62001I 90ICH62002I 90ICH62003I 90ICH62004I 90ICH62007I 90ICH62008I 90ICH62009I 90ICH62010I 91ICH62012I 91ICH62014I 91ICH62015I 91ICH62017I 91ICH62018I 91ICH62019I 91ICH62021I 91ICH62022I 91ICH63000 series of messages 91ICH63001I 91ICH63002I 92ICH63003I 92ICH63004I 92ICH63005I 92ICH63006I 92ICH63007I 92ICH63008I 92ICH63009I 92ICH63010I 92ICH63011I 92ICH63012I 92ICH63013I 93ICH63014I 93ICH63015I 93ICH63016I 93ICH63017I 93ICH63018I 93ICH63019I 93ICH63020I 94ICH63021I 94ICH63022I 94ICH63023I 94ICH63024I 94ICH63025I 94ICH63026I 94ICH63027A 94ICH64000 series of messages 95ICH64001I 95ICH64002I 95ICH64003I 95ICH64004I 95ICH64005I 95ICH64006I 95ICH64007I 95ICH64008I 96ICH64009I 96


ICH64301I 96ICH64302I 96ICH64303I 96ICH64304I 96ICH64305I 97ICH65000 series of messages 97ICH65001I 97ICH65002I 97ICH65003I 97ICH65004I 97ICH65005I 97ICH65006I 97ICH65007I 97ICH65008I 97ICH65009I 97ICH65010I 97ICH65011I 98ICH65012I 98ICH65013I 98ICH65014I 98ICH65015I 98ICH65016I 98ICH65017I 98ICH65018I 98ICH65019I 98ICH65020I 98ICH65021I 98ICH65022I 98ICH65023I 99ICH65024I 99ICH65025I 99ICH65026I 99ICH66000 series of messages 99ICH66001I 99ICH66002I 99ICH66003I 99ICH66004I 99ICH66005I 99ICH66006I 99ICH66009I 99ICH66010I 99ICH66011I 100ICH66012I 100ICH66013I 100ICH66014I 100ICH66015I 100ICH66016I 100ICH66017I 100ICH66018I 100ICH66019I 100ICH66020I 100ICH66021I 100ICH66101I 100ICH66102I 100ICH66103I 101ICH66104I 101ICH66105I 101ICH66106I 101ICH66107I 101ICH66108I 102ICH66109I 102ICH66110I 102ICH66111I 102ICH66134I 102ICH66135I 102ICH66136I 102ICH66137I 102

ICH66138I 102ICH66139I 103ICH66140I 103ICH700 series of messages 29ICH70000 series of messages 103ICH70001I 103ICH70002I 103ICH70003I 103ICH70004I 103ICH70005I 104ICH70006I 104ICH70007I 104ICH701A 29ICH702A 29ICH703A 30ICH800 series of messages 30ICH8000 33ICH8000 series of messages 33ICH8001 33ICH8002 33ICH8003 33ICH8004 33ICH8005 34ICH8006 34ICH8007 34ICH8008 34ICH8009 34ICH8010 34ICH8011 34ICH8012 35ICH8013 35ICH8014 35ICH8015 35ICH8016 35ICH801I 30ICH802D 30ICH900 series of messages 30ICH901I 30ICHDIR001I 179ICHDIR002I 179ICHDIR003I 179ICHDIR004I 179ICHDIR005I 179ICHDIR006I 179ICHDIR007I 179ICHDIR008I 180ICHDIR009I 180ICHDIR010I 180ICHDIR011I 180ICHDIR012I 180ICHDIR013I 180ICHDIR014I 180ICHDIR015I 181ICHDIR016I 181ICHDIR017I 181ICHDIR018I 181ICHDIR019I 181ICHDIR020I 181ICHDIR021I 181ICHDIR022I 181ICHDIR023I 182ICHDIR024I 182ICHDIR999I 182ICHSFS002A 182ICHSFS003A 182ICHSFS004I 182ICHSFS005I 182

Index 287

ICHSFS006A 183ICHSFS007I 183ICHSFS008A 183ICHSFS009I 183ICHSFS010I 183ICHSFS011I 183ICHSFS012A 183ICHSFS013I 184ICHSFS014I 184ICHSFS015I 184ICHSFS016I 184ICHSFS017A 184ICHSFS018I 184ICHSFS019I 185ICHSFS020A 185ICHSFS021A 185ICHSFS022A 185ICHSFS023I 185ICHSFS024I 185ICHSFS025I 185ICHSFS026A 185ICHSFS027I 185ICHSFS028I 185ICHSFS029I 186ICHSFS030I 186ICHSFS031I 186ICHSFS999A 186ICHUT100 utility

messages 89return codes 268

ICHUT200 utilitymessages 90return codes 268

ICHUT300 utilitymessages 91

ICHUT400 utilitymessages 97return codes 268

IKJ56000 series of messages 186IKJ56700A 186IKJ56701I 186IKJ56702A 186IKJ56702I 186IKJ56703A 187IKJ56706I 187IKJ56707I 187IKJ56709I 187IKJ56712I 187IKJ56713I 187IKJ56715I 187IKJ56716I 187IKJ56717I 187IKJ56718A 187IKJ56760I 187IKJ56801I 187IKJ56802I 187IKJ56806I 187initialization messages

in z/VM environment 171RACF initialization 18

IRR operator messages 105IRR000 series of messages 106IRR008I 106IRR009I 106IRR010I 106IRR011I 107IRR012I 107

IRR013I 107IRR014I 107IRR015I 107IRR016I 107IRR017I 107IRR018I 107IRR16000 series of messages 118IRR16001I 118IRR16002I 118IRR16003I 118IRR400 series of messages 108IRR401I 108IRR402I 108IRR403I 109IRR404I 109IRR405I 109IRR406I 110IRR407I 110IRR410I 110IRR411I 110IRR413I 111IRR416I 111IRR420I 112IRR52000 series of messages 119IRR52001I 119IRR52002I 119IRR52003I 119IRR52004I 119IRR52005I 119IRR52006I 120IRR52007I 120IRR52008I 120IRR52009I 120IRR52010I 120IRR52011I 120IRR52012I 120IRR52013I 121IRR52014I 121IRR52015I 121IRR52016I 121IRR52017I 121IRR52018I 121IRR52019I 121IRR52020I 122IRR52021I 122IRR52022I 122IRR52023I 122IRR52024I 122IRR52025I 122IRR52026I 122IRR52027I 122IRR52028I 123IRR52029I 123IRR52030I 123IRR52031I 123IRR52100I 123IRR52101I 123IRR52102I 123IRR52103I 124IRR52104I 124IRR52105I 124IRR52106I 124IRR52107I 124IRR52108I 124IRR52109I 124IRR52110I 125IRR52112I 125


IRR52113I 125IRR52114I 125IRR52115I 125IRR52116I 125IRR52117I 125IRR52118I 125IRR52119I 126IRR52120I 126IRR52121I 126IRR52122I 126IRR52123I 126IRR52124I 126IRR52125I 126IRR52126I 126IRR52127I 126IRR52128I 127IRR52129I 127IRR52130I 127IRR52131I 127IRR52132I 127IRR52133I 127IRR52134I 128IRR52135I 128IRR52136I 128IRR52139I 128IRR52140I 128IRR52141I 129IRR52142I 129IRR52153I 129IRR52154I 129IRR545I 112IRR546I 112IRR62000 series of messages 129IRR62001I 129IRR62002I 130IRR62003I 130IRR62004I 130IRR62007I 130IRR62008I 130IRR62009I 130IRR62010I 130IRR62012I 131IRR62014I 131IRR62015I 131IRR62017I 131IRR62018I 131IRR62019I 131IRR62021I 132IRR62022I 132IRR62023I 132IRR62024I 132IRR62025I 132IRR62026I 132IRR62027I 132IRR62028I 133IRR62029I 133IRR62030I 133IRR62031I 133IRR62032I 133IRR62033I 133IRR62034I 133IRR62035I 133IRR62036I 134IRR62037I 134IRR62038I 134IRR62039I 134IRR62040I 134

IRR62041I 134IRR62042I 134IRR62043I 134IRR62044I 135IRR62045I 135IRR62046I 135IRR62048I 135IRR62050I 135IRR62051I 135IRR62053I 135IRR62055I 135IRR62056I 135IRR62057I 136IRR62058I 136IRR62059I 136IRR62060I 136IRR62061I 136IRR62062I 136IRR62063I 136IRR62064I 136IRR63000 series of messages 137IRR63001I 137IRR63002I 137IRR63003I 137IRR63004I 137IRR63005I 137IRR63006I 137IRR63007I 137IRR63008I 137IRR63009I 137IRR63010I 138IRR63011I 138IRR63012I 138IRR63013I 138IRR63014I 138IRR63015I 138IRR63016I 138IRR63017I 139IRR63018I 139IRR63019I 139IRR63020I 139IRR63021I 139IRR63022I 139IRR63023I 140IRR63024I 140IRR63025I 140IRR63032I 140IRR63033I 140IRR63034I 140IRR63035I 140IRR63036I 140IRR63037I 140IRR63038I 141IRR63039I 141IRR63040I 141IRR63041I 141IRR63042I 141IRR63043I 141IRR65000 series of messages 142IRR65000I 142IRR65001I 142IRR65002I 142IRR65003I 142IRR65004I 142IRR65005I 142IRR65006I 142IRR65007I 142

Index 289

IRR65008I 143IRR65009I 143IRR65010I 143IRR65011I 143IRR65012I 143IRR65013I 143IRR65014I 143IRR65015I 143IRR65016I 143IRR65017I 144IRR65018I 144IRR65019I 144IRR65020I 144IRR65021I 144IRR65022I 144IRR65023I 144IRR65024I 144IRR65025I 144IRR65026I 145IRR65027I 145IRR65028I 145IRR65029I 145IRR65030I 145IRR65031I 145IRR65032I 145IRR65033I 145IRR65034I 145IRR67000 series of messages 146IRR67000I 146IRR67001I 146IRR67002I 146IRR67003I 146IRR67004I 146IRR67005I 146IRR67006I 146IRR67007I 146IRR67008I 146IRR67010I 147IRR67011I 147IRR67012I 147IRR67013I 147IRR67014I 147IRR67015I 147IRR67016I 147IRR67017I 147IRR67020I 147IRR67021I 148IRR67030I 148IRR67031I 148IRR67032I 148IRR67033I 148IRR67034I 148IRR67035I 148IRR67060I 149IRR67090I 149IRR67091I 149IRR67092I 149IRR67093I 149IRR67094I 149IRR67095I 149IRR67096I 149IRR67097I 149IRR67098I 150IRR67120I 150IRR67121I 150IRR67122I 150IRR67123I 150

IRR67124I 150IRR67125I 150IRR67150I 150IRR67151I 150IRR67152I 151IRR67153I 151IRR67154I 151IRR67155I 151IRR67156I 151IRR67157I 151IRR67158I 151IRR67159I 151IRR67160I 152IRR67161I 152IRR67162I 152IRR67163I 152IRR67164I 152IRR67165I 152IRR67166I 152IRR67167I 152IRR67168I 152IRR67180I 153IRR67181I 153IRR67182I 153IRR67183I 153IRR67240I 153IRR67241I 153IRR67242I 153IRR67243I 154IRR67270I 154IRR67330I 154IRR67331I 154IRR67332I 154IRR67333I 154IRR67335I 155IRR67336I 155IRR67402I 155IRR67403I 155IRR67417I 155IRR67422I 155IRR67423I 155IRR67460I 155IRR67494I 156IRR67495I 156IRR67500I 156IRR67520I 156IRR67522I 156IRR67524I 156IRR67534I 156IRR67540I 156IRR67541I 156IRR67550I 156IRR67551I 156IRR67552I 157IRR67580I 157IRR67581I 157IRR67582I 157IRR71000 series of messages 157IRR71001E 157IRR71002E 157IRR71003E 157IRR71004E 158IRR800 series of messages 112, 113IRR8000 115IRR8000 series of messages 115IRR8001 115IRR8002 115


IRR8003 115IRR8004 115IRR8005 115IRR8006 115IRR8007 116IRR8008 116IRR8009 116IRR8010 116IRR8011 116IRR8012 116IRR8013 116IRR8014 116IRR8015 117IRR8016 117IRR8017 117IRR8018 117IRR8019 117IRR8020 117IRR8025I 117IRR803I 112IRR804I 113IRR805I 113IRR806I 113IRR807I 113IRR808I 113IRRA0000 series of messages 158IRRA001I 158IRRA002I 158IRRA003I 158IRRA004I 158IRRA080I 158IRRADU00 utility

messages 146IRRB0000 series of messages 158IRRB000I 158IRRB001I 159IRRB002I 159IRRB003I 159IRRB004I 159IRRB005I 159IRRB006I 159IRRB007I 159IRRB008I 159IRRB009I 160IRRB010I 160IRRB011I 160IRRB012I 160IRRB013I 160IRRB014I 160IRRB015I 160IRRB016I 161IRRB017I 161IRRB031I 161IRRB032I 161IRRB033I 161IRRB034I 161IRRB036I 162IRRB037E 162IRRB038I 162IRRB039E 162IRRB040I 162IRRB041I 162IRRC0000 series of messages 162IRRC001I 162IRRC002I 162IRRC003I 163IRRC004I 163

IRRC005I 163IRRC006I 163IRRC080I 163IRRC130I 163IRRC133I 164IRRC135I 164IRRC136I 164IRRC138I 164IRRC139I 165IRRC142I 165IRRD0000 series of messages 165IRRD000I 165IRRD001I 165IRRD002I 165IRRD003I 165IRRD004I 166IRRD005I 166IRRD006I 166IRRD007I 166IRRD008I 167IRRD009I 167IRRD010I 167IRRD080I 167IRRDPI00 command

messages 119IRRDSC00 utility

return codes 269IRRE0000 series of messages 168IRRE000I 168IRRE001I 168IRRE002I 168IRRE003I 168IRRE004I 168IRRE005I 169IRRE006I 169IRRE007I 169IRRE008I 169IRRE009I 169IRRE010I 170IRRE011I 170IRRE012I 170IRRE080I 170IRRMIN00 utility

messages 115IRRUT100 utility

return codes 268IRRUT200 utility

messages 129return codes 268

IRRUT300 utilitymessages 137

IRRUT400 utilitymessages 142return codes 268

LLISTDSD command

messages 86LISTGRP command

messages 86LISTUSER command

messages 83

Index 291

Mmessages 95messages unique to RACF in the z/VM environment 171miscellaneous messages 103

Ooperator messages on z/VM

using the SMSG command to reply 2other RACF messages 87

PPASSWORD command

messages 47password messages on z/VM 178PERMIT command

messages 44

Qquerying messages sent to RACF service machine 2

RRAC command

return codes 264RACDEF operator messages 30RACF block update (BLKUPD) command messages 137RACF command session

return codes 264RACF commands

messages 35, 118RACF database initialization messages 33, 115RACF database initialization utility messages 115RACF database split/merge utility (IRRUT400) messages 142RACF database split/merge/extend utility (ICHUT400)

messages 97RACF initialization messages 18, 171RACF manager

error messages 88return codes 265

RACF processing (ICH400) 5RACF processing (IRR400) 108RACF processing messages 5, 108RACF report writer 95RACF SMF data unload utility messages 146RACF status messages 29RACFRW (RACF report writer) 95RACHECK operator messages 30RACHECK VLF operator messages 112RACINIT messages 4RACINIT NJE operator messages 113RACSEC001A 188RACSEC002I 188RACSEC003A 188RACSEC004I 188RACUTL001E 188RACUTL002E 188RACUTL003E 188RALTER command

messages 58RDEFINE command

messages 55

RDELETE commandmessages 61

REMOVE commandmessages 42

responding to messages sent to RACF service machine 3return codes

CMSIUCV (VM only) 263RAC command 264RACF command session 264RACF manager 265RACF utility 268VSIUCV (VM only) 263

RLIST commandmessages 62

routing codes 2, 106RPG001 261RPI001 261RPI002 261RPI003 261RPIADU001A 189RPIADU002A 189RPIADU003A 189RPIADU004A 189RPIADU006A 189RPIADU009A 189RPIADU010A 189RPIADU011A 189RPIADU014A 190RPIADU016A 190RPIADU017A 190RPIADU018A 190RPIADU019A 190RPIADU020A 190RPIADU021I 190RPIADU022I 190RPIADU025I 190RPIADU026A 190RPIADU027A 191RPIADU029A 191RPIADU033I 191RPIADU034A 191RPIADU036A 191RPIADU039A 191RPIADU998A 191RPIADU999A 191RPIALC001E 191RPIALC002E 192RPIALC003E 192RPIALC004E 192RPIALC005E 192RPICLM001E 192RPICLM002E 192RPICLM003E 192RPICLM004E 192RPICLM006E 192RPICLM007E 193RPICLS101E 193RPICLS102E 193RPICLS103E 193RPICLS104W 193RPICLS105E 194RPICLS106E 194RPICLS107E 194RPICLS108E 195RPICLS109E 195RPICLS110E 195RPICLS111E 195


RPICLS112W 195RPICLS113W 195RPICLS114W 196RPICLS115E 196RPICLS116E 196RPICLS117I 196RPICLS118I 196RPICLS119E 197RPICLS120E 197RPICLS121E 197RPICLS122E 197RPICLS123I 198RPICMD001T 198RPICMD002E 198RPICMD003I 198RPICMD004E 198RPICMD005E 198RPICMD006I 198RPICMD009E 198RPICMD009W 198RPICMD010E 199RPICMD012E 199RPICMS001E 199RPICMS002E 199RPICMS003E 199RPICMS004E 199RPICMS005E 199RPICMS006E 199RPICMS007E 200RPICMS008E 200RPICMS009W 200RPICMS010E 200RPICMS011E 200RPICMS012E 200RPICMS013E 200RPICMS014E 200RPICMS015E 201RPICMS016I 201RPICMS017I 201RPICMS018I 201RPICMS019I 201RPICMS020I 201RPICMS021E 201RPIDBU001A 201RPIDBU002A 201RPIDBU003A 202RPIDBU004A 202RPIDBU005A 202RPIDBU006A 202RPIDBU007I 202RPIDBU008I 202RPIDBU009A 202RPIDBU010A 202RPIDBU011A 202RPIDBU012A 203RPIDBU013A 203RPIDBU014A 203RPIDBU015A 203RPIDBU016A 203RPIDBU017A 203RPIDBU018A 203RPIDBU019A 203RPIDBU020A 203RPIDBU021I 204RPIDBU022I 204RPIDBU023A 204RPIDBU024A 204

RPIDBU025I 204RPIDBU026A 204RPIDBU027A 204RPIDBU028A 204RPIDBU029A 204RPIDBU030A 204RPIDBU031A 205RPIDBU032A 205RPIDBU033I 205RPIDBU034A 205RPIDBU036A 205RPIDBU037I 205RPIDBU038A 205RPIDBU039A 205RPIDBU040A 206RPIDBU041A 206RPIDBU042A 206RPIDBU044A 206RPIDBU045A 206RPIDBU046A 206RPIDBU047A 206RPIDBU998A 206RPIDBU999A 206RPIDEV001E 207RPIDSF001A 207RPIDSF002A 207RPIDSF003A 207RPIDSF004I 207RPIDSF005A 207RPIDSF006A 207RPIDSF007A 207RPIDSF008A 207RPIDYNAL001E 208RPIGCS001E 208RPIGCS002E 208RPIGCS003E 208RPIGCS004E 208RPIGCS005E 208RPIGCS006W 208RPIGCS007E 208RPIGCS008E 208RPIGCS009E 208RPIGCS010E 209RPIGCS011E 209RPIGCS012I 209RPIGCS013I 209RPIGCS014E 209RPIGCS015E 209RPIINIT001E 209RPIINIT002E 209RPIINS001I 209RPIINS002I 209RPIINS003I 209RPIINS004I 210RPIINS005I 210RPIINS006I 210RPIINS007I 210RPIINS008I 210RPIINS009I 210RPIINS010I 210RPIINS011I 211RPIINS012I 211RPIINS013I 211RPIINS014I 211RPIINS015I 211RPIINS016A 211RPIINS017A 211

Index 293

RPIINS018I 211RPIINS019I 212RPIINS020I 212RPIINS021A 212RPIINS022A 212RPIINS023A 212RPIINS024I 213RPIINS025A 213RPIINS026A 213RPIINS027A 213RPIINS028A 213RPIINS029I 214RPIINS030A 214RPIINS031A 214RPIINS032I 214RPIINS033I 214RPIINS034A 215RPIINS035A 215RPIINS036I 215RPIINS037A 215RPIINS038A 215RPIINS039A 215RPIINS040I 216RPIINS041I 216RPIINS042A 216RPIINS043A 216RPIINS044I 216RPIINS045A 216RPIINS046A 216RPIINS047A 216RPIINS048I 217RPIINS049A 217RPIINS050A 217RPIINS051A 217RPIINS052A 217RPIINS053W 217RPIINS054A 217RPIINS055I 218RPIINS056A 218RPIINS057A 218RPILOG001E 218RPIMAC001A 218RPIMAC002A 218RPIMGR001E 219RPIMGR002T 219RPIMGR003I 219RPIMGR004E 219RPIMGR005I 219RPIMGR006I 219RPIMGR007I 219RPIMGR008I 219RPIMGR009E 220RPIMGR009W 220RPIMGR010T 220RPIMGR011T 220RPIMGR012E 220RPIMGR013E 220RPIMGR014E 220RPIMGR015T 220RPIMGR030I 220RPIMGR031E 220RPIMGR032E 221RPIMGR033E 221RPIMGR035E 221RPIMGR038E 221RPIMGR039E 221RPIMGR040T 221

RPIMGR041T 221RPIMGR042I 221RPIMGR043E 221RPIMGR044T 221RPIMGR045T 222RPIMGR046T 222RPIMGR047T 222RPIMGR048T 222RPIMGR049T 222RPIMGR051T 222RPIMGR052T 222RPIMGR053E 222RPIMGR054E 222RPIMGR055E 222RPIMGR056E 223RPIMGR057T 223RPIMGR058A 223RPIMGR059A 223RPIMGR060I 223RPIMGR061A 223RPIMGR062A 224RPIMGR063A 224RPIMGR064A 224RPIMGR065A 224RPIMGR066A 224RPIMGR067E 225RPIMGR068E 225RPIMSG001E 225RPIMSG002E 225RPIMSG003E 225RPIOPN001E 225RPIOPN002E 225RPIOPN003E 225RPIOPN004E 225RPIOPN005E 225RPIOPN006E 226RPIRAC001E 226RPIRAC002E 226RPIRAC003E 226RPIRAC004E 226RPIRAC005E 226RPIRAC006E 226RPIRAC007E 226RPIRAC008I 227RPIRAC009W 227RPIRAC010W 227RPIRND001E 227RPIRND002E 228RPIRND003E 228RPIRND004E 228RPIRPG001A 228RPIRTE001E 228RPIRTE002E 228RPIRTE003E 228RPIRTE004E 228RPIRTE005E 229RPIRTE006E 229RPIRTE007E 229RPIRWI001E 229RPIRWI002E 229RPIRWI003E 230RPIRWI004E 230RPIRWI005E 230RPIRWI006E 230RPIRWI007E 230RPISEL001E 230RPISEL002E 230


RPISEL003E 230RPISEL004E 231RPISEL005W 231RPISEL006W 231RPISEL007W 231RPISEL008W 231RPISEL009I 231RPISEL010E 231RPISEL100 series of messages 231RPISEL101E 231RPISEL102E 232RPISEL103E 232RPISEL104E 232RPISEL105W 232RPISEL106W 232RPISEL107W 232RPISEL108I 232RPISEL109E 232RPISEL110E 233RPISEL111E 233RPISEQ001E 233RPISEQ002E 233RPISET041E 233, 239RPISET100 series of messages 233RPISET101E 233RPISET102E 233RPISET103I 233RPISET104E 233RPISET105E 234RPISET106E 234RPISET107W 234RPISET108E 234RPISET109E 234RPISET110E 235RPISET111W 235RPISET112W 235RPISET113W 235RPISET114W 235RPISET115E 236RPISET116W 236RPISET117W 236RPISET118W 236RPISET119E 236RPISET120E 236RPISET121E 236RPISET122E 236RPISET123I 237RPISET124I 237RPISET125I 237RPISET126I 237RPISET127I 237RPISET128E 237RPISET129E 238RPISET130E 238RPISET131E 238RPISET132E 238RPISET133E 238RPISET134E 238RPISET135I 238RPISET136E 239RPISET137E 239RPISET138E 239RPISMF001E 239RPISMF050E 239RPISMF051E 239RPISMF052E 239RPISMF053E 239

RPISMF054I 239RPISMF055I 240RPISMF056I 240RPISMF057I 240RPISMF058I 240RPISMF059E 240RPISMF060E 240RPISMF061E 240RPISMF062E 240RPISMF063E 240RPISMF064E 240RPISMF065I 241RPISMF066I 241RPISMF067I 241RPISMF068E 241RPISMF069E 241RPISMF070E 241RPISMF071I 241RPISMF072I 241RPISMF073I 241RPISMF074E 241RPISTR001I 241RPISTR002I 241RPISTR003I 242RPISTR004E 242RPISVR001A 242RPISVR002A 242RPISVR003A 242RPISVR004A 242RPISVR005A 242RPISVR006A 242RPISVR007A 243RPISVR008A 243RPISVR009A 243RPISVR010W 244RPISVR011W 244RPISVR012A 244RPISVR013A 244RPISVR014I 244RPISVR015I 245RPISVR016A 245RPISVR017A 245RPISVR018A 245RPITMP001I 245RPITMP002I 245RPITMP003E 245RPITMP004E 245RPITMP005I 245RPITMP006I 245RPITMP007I 245RPITMP008E 246RPITMP008I 246RPITMP009E 246RPITMP010T 246RPITMP011T 246RPITMP012E 246RPITMP013E 246RPITMP014E 246RPITMP015E 246RPITMP016T 246RPITMP017E 247RPITMP018E 247RPITMP019T 247RPITMP020T 247RPITMP021E 247RPITRNQL001E 247RPITRNQL002E 247

Index 295

RPITRNQL003E 247RPIUTL000 series of messages 247RPIUTL001E 247RPIVAL001E 248RPIVPHSD001E 248RPIVPHSD002E 248RPIVPHSD003E 248RPIVPHSD004E 248RPIVPHSD005E 248RPIVPHSD006E 248RPIVPHSD007E 248RPIVPHSD008E 249RPIVPHSD009E 249RPIVPHSD010E 249RPIVPHSD011E 249RPIVPHSD012E 249RPIVRT001E 248RPIVRT002E 248RPIVSC001E 249RPIVSC002E 249RPIVSC003E 249RPIVSC004E 249RPIVSC005E 250RPIVSC006E 250RPIVSC007E 250RPIVSC008E 250RPIVSC009E 250RVARY command

messages 70

SSAF initialization operator messages 3SEARCH command

messages 84secondary user

responding to messages sent to RACF service machine 3SEND command

responding to messages sent to RACF service machine 3SETEVENT command messages for VM 233SETROPTS command

messages 62SMSG command

querying messages sent to RACF service machine 2responding to messages sent to RACF service machine 3using to reply to operator messages on z/VM 2

status messages 29system operator messages 1, 5, 105, 108

RACDEF (ICH900) 30RACF initialization (ICH500) 18RACF status (ICH700) 29RACHECK (ICH800) 30RACHECK VLF (IRR800) 112RACINIT (ICH300) 4RACINIT NJE (IRR800) 113SAF initialization (ICH000) 3VERIFY and VERIFYX (IRR000) 106

Uunnumbered messages

password messages on z/VM 178RACF initialization on z/VM 171

VVERIFY and VERIFYX operator messages 106VSIUCV return codes (VM only) 263

Zz/VM environment, messages unique to RACF in 171


IBM®

Product Number: 5741-A07

Printed in USA

GC24-6217-04