Re: Auditing suspended after maintenance

On 22 Jan 2013 05:46, Smith, Mike wrote:

Was the message CPI2284 issued during that IPL? Does that message
or CPI2283 show anywhere in the history?

Nope. Neither of these appeared in the log. I did notice that the
QAUDENDACN was set to *NOTIFY but I couldn't find any messages to
signal it was having a problem.

Bummer. I would have hoped that the OS having requested the LIC to terminate auditing due to an error condition would have enabled at least the latter periodic messaging.

The QAUDCTL stayed at *AUDLVL and *NOQTEMP, the system didn't change
it to *NONE .

That would be consistent with what I recall, IIRC, for a process exceeding the Automatic Storage limits. That is the failure can request the LIC to terminate auditing, but the attempt within that process to CHGSYSVAL QAUDCTL '*NONE' fails because the program(s) that implements that method requires too much PASA and so the change never transpires.

"There may even be a VLOG specifically for the LIC request to
stop auditing"

I have not done anything with these logs in the past but may take a
look. I'm not sure if I'm going to know what I'm looking at if I do
get the logs.

As I mentioned earlier, you'd think something as critical as that,
the system would be squawking to QSYSOPR's message queue.

The VLogs should be saved to media, not merely reviewed. The longer the delay in saving them, the more likely the relevant data will be gone. The maintenance [remaining or purging] depends upon log settings. Maybe increase the settings to ensure they are kept online for longer than normal, to allow an online review over a longer time.

There is some text with each VLog which could give some hint as to the type of issue... and the timing of the last audit entry in the QAUDJRN should give an idea of where to look chronologically. If the list of VLogs are posted in the code.midrange [several minutes before /last/ entry until after the pwrdwn\IPL] I could try to give an idea where to look.

The process\job name will be prominent in the VLog and review of that job's history and spools would help identify the errors that led to the condition. If a joblog could not be produced because of the problem, then perhaps one was created as part of the IPL. Having that joblog is ideal; much nicer than just a process dump in a VLog.