CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

useful in problem determination. This is a lower level of
trace than the Gateway daemon trace. The logs are
named after the pid number of the Gateway daemon
process and so there is a unique log for each run of
the CICS TG.
Java client trace Turning on the Java client trace (in our case in the
application EciB1) allows you to see the calls made to
the CICS TG as well as the COMMAREA data.
Also helpful in problem diagnosis is the echo command. Including the echo
command in the ctgstart script can be useful to help display the contents of
variables. For example the following statement will display the setting of
AUTH_USERID_PASSWORD:
echo AUTH_USERID_PASSWORD=$AUTH_USERID_PASSWORD
User not defined to RACF
Figure 6-13 is taken from the CICS MSGUSR DD. This shows user CICSRSX
trying to access the system via IRP. CICSRSX is not defined to RACF.
Example 6-13 ACF access denied, user ID not defined
DFHSN1604 06/03/2002 22:55:33 SCSCPJA4 Attach header signon at terminal C31 by
user CICSRSX has failed. SAF codes are (X'00000004',X'00000000'). ESM codes are
(X'00000004',X'00000000').
DFHAC2047 06/03/2002 22:55:33 SCSCPJA4 While performing an attach for node
SCSCTG4 a security violation was detected.
In looking up DFHSH1604, we are informed SAF/ESM codes may be found in
External Security Interface (RACROUTE) Macro Reference for MVS,
GC23-3733. This manual tells us the error code for a SAF rc=4 and RACF rc=4 is
a user profile is not defined to RACF error. Of course, you could have
determined this by looking in the SYSLOG.
Chapter 6. CICS TG security scenarios 127