Re: More detail on authority failure

Le 23/02/2017 à 15:04, Justin Taylor a écrit :

Late yesterday it occurred to me to try and find an active job that had encountered one of these authority failures. Turns out the failure is on a SBMJOB. That's not a big surprise since the failure is on a user profile. I haven't figured out what the SBMJOB is trying to do, but I'm sure it's just calling a vendor program.

You could try to activate Command auditing for the user profile which is trying to run the failing SBMJOB cmd.
Normally you will find the exact command in the related CD journal entry.

However, if SBMJOB is invoked through a QCMDEXC call, I am not sure that it will get logged in QAUDJRN.

-----Original Message-----
From: Jack Callahan [mailto:jjcllhn@xxxxxxxxx]
Sent: Wednesday, February 22, 2017 4:21 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: More detail on authority failure

An audit journal should give you four details you can use:

1) Job ID (Job#/jobuser/jobname),

2) Object unsuccessfully accessed

3) User profile

4) Program where the failure occurred


1) Find the associated job log if it exists (job is still running, or is specified to leave a job log spool file after completion). Change the job logging level for the next run if you don't have sufficient messaging to determine what happened.

Without a job log, you may still be able to figure out the cause of the authority failure using the other pieces of data

2) Determine what authorities have been assigned to the object.

3) Determine what authorities the user profile has, including those inherited from groups the user may belong to.

4) Check the program to see if it is running as the program owner, or with adopted authorities