RE: Private Authority

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
--
[ Picked text/plain from multipart/alternative ]
Chris,

>From the main menu, enter "GO SECTOOLS" which takes you to the Security
Tools menu.  Starting on the second page, there are reports available that
will list out private authorities for different object types:  25 - command,
28 - directory, 30 - document, 32 - file, 37 - library, 41 - program, and 43
- user profile.  Leave the default of *NO for "Changed report only" when
running the report option.

The reports will show object, owner, primary group, auth list (if any),
user, and the object authorities.  You will need to comb through these
reports to ascertain which private authorities you can remove and how your
overall authority scheme can be improved by replacing private (or direct)
authorities with group or authorization list authorities, which take less
time for the system to resolve.

Good luck!

Steven Martinson
Product Marketing Manager, iSeries and AS/400
PentaSafe Security Technologies, Inc.
http://www.pentasafe.com
Toll Free: 1.888.400.2834, x9585
Direct Dial: 1.713.860.9585


-----Original Message-----
From: Jnb ZI, Christophe Wenk [mailto:christophe.wenk@kuehne-nagel.com]
Sent: Thursday, September 06, 2001 8:12 AM
To: midrange-l@midrange.com
Subject: RE: Private Authority


Andy,

It says following:

 Cause . . . . . :   The guideline was first exceeded in the interval

 ending 06.09.01 13:54:03. The maximum rate was 216 checks per second
and
 occurred in the interval ending 06.09.01 13:54:03.  At the maximum
rate,
 these checks may have used as much as 6% of the processing unit. The

 guideline was exceeded in 1 out of 1 intervals.



 High authority check rates are usually due to private authority
lookups.
 A high rate is often found in systems that have migrated from a S/38.

 They may also occur when new applications have been integrated into a

 production system without the private authorities being removed.

 Recovery  . . . :   An authority count above the guideline is
acceptable
if your security scheme requires private authorities.  A change to your
security scheme may result in a change to the authority check rate.
Therefore, you should investigate unexpected increases in the cpu
utilization due to an increased authority check rate.
To avoid high authority check rates, eliminate private authorities
wherever possible.

==> we have an AS/400 720 and nevery migrated from a S/38.
I would like to eliminate the private authorities but where to start ??

Thanks
Chris


-----Original Message-----
From: midrange-l-admin@midrange.com
[mailto:midrange-l-admin@midrange.com] On Behalf Of Andy Nolen-Parkhouse
Sent: 06 September 2001 03:02
To: midrange-l@midrange.com
Subject: RE: Private Authority


Chris,

Is there any more indication of what the problem is?  Limits on private
authorities for an individual profile are in the hundreds of thousands,
does your report give any context?

The PRTPVTAUT command will allow you to list out the private authorities
for various objects if that would be helpful.

Regards,
Andy Nolen-Parkhouse

> Subject: Private Authority
>
> Hi there
>
> I did run the Performance Tools and checked afterwards the performance

> Adviser. There it tells me that I exceeded the limit of private
> Authorities with 216.
> Can anybody tell me what I can do (which command to run) in order to
> rectify
> the problem ?
>
> Thanks
> Chris

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@midrange.com To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.