LOGON problem

[steve-myers]

I am getting LOGON PROCEEDING messages at about 1300 system time. Using another userid which was already on the system, I started examining SYSLOG. It appears this started early this morning.

I see this message in SYSLOG -

12053 04:13:12.24 00000090 *$HASP050 JES2 RESOURCE SHORTAGE OF BERT - 100% UTILIZATION REACHED

[prino]

Looking at the message, this is not good and may well require a cold start to solve the problem. I'm currently hung trying to log on.

[jhonga]

Hi,

I'm having logon problem with "reconnection rejected user in use".
I used the form "Disconnect Your TSO Session" and it shows "The userid GLLGMB7 has been disconnected successfully" but still I can't logging on.

Thank you for your support.

gllgmb7

[steve-myers]

Robert: I don't think this is a cold start issue, but I think any MARTY11A batch jobs in the execution queue should be cancelled before the initiators are started. I think - I'm not certain - that these MARTY11A jobs are just submitting another MARTY11A job that submits another ...

[steve-myers]

Maybe a cold start, thanks to MARTY11. More SYSLOG analysis showed -

12053 02:29:51.10 00000090 *$HASP050 JES2 RESOURCE SHORTAGE OF JOES - 100% UTILIZATION REACHED

repeated a couple of times before the BERT message.

I think MARTY11 deserves the treatment I sent to prino in a PM yesterday, probably including any MARTYxxx userids.

[steve-myers]

hjonga - your problem is not of your making, but you'll have to be patient for it to be resolved.

[mm160t]

Sir,

i agree with steve.those who are mis utilising the system must be punished.Unless a strict policy will be adhered seems like ppl don't bother about the system.
i don't think IBM has a shortage of mainframe Reserchers.expertise in any level (beginner,expert or scientist) does not matter if one cann't handle a system or follow the best practices and ethics of using mainframe.ones child play cann't be a punishment to all at every time.i think last couple of week system was vandalised enough.

And i am also damn sure if some one will do this kind of act to the systems for buisness purpose not only they will loose userids but also their jobs as well.some part of the fandezhi service should be a paid service.

We all in this are getting a great help of using mainframe with free. lets please don't play with the fandezhi system.Thanks to SYSPROG,Prino who are giving their precious time for maintaining this system.


Regards
MM160t

[drbob1]

As several others have reported, my TSO logon (drbob1) is hung in limbo.

• TSO tells me I'm already logged on;
• it refuses to honor a reconnect, because, um, I'm already logged on (duh?);
• and the "Disconnect Your TSO Session" page tells me the operation was successfully performed, but it is not.
• Repeat steps 1-3 ad infinitum.

Do we have here a cogent case for tertiary defenestration of a rogue user? Or am I just getting to be a crotchety old fart?

- Bob

[steve-myers]

You're part way logged on: if you had retained your first attempt to logon you would see a screen of LOGON PROCEEDING messages. A reconnect is always very chancy; even if it worked you'd just go back to LOGON PROCEEDING.

[sysprog]

The system is recovered. The JES2 issued message HASP9206 PCE WAITING FOR JOB LOCK and we had to cold start it.

[drbob1]

Thanks so much. Sorry it needed such a drastic action.

[steve-myers]

Thanks so much. Sorry it needed such a drastic action.

Sure.

What I do know is a wide variety of userids have been probing the system over the last couple of months looking for weaknesses. Userids MARTY and MARTYxxx among them.

Someone - I don't know who - found a way to to update the master catalog; this led to the outages last week. This same slug appears to be deleting catalog aliases, seemingly at random.

These kind of statistics -

Code: Select all

  DATE   PASSWORD VIOLATIONS  RESOURCE VIOLATIONS
11 FEB 12          62                 162
12 FEB 12         138                 114
13 FEB 12          41                 130

are simply unacceptable. A "password violation" is just an attempt to logon with an invalid password, a "resource violation" is an attempt to use a resource that is not allowed. We have traced attempts by some userids to access other people's datasets - usually just to read them but sometimes to update them. I have one example where one user made no less than 133 attempts over a period of about 3 days last year to update a single dataset!

Since November, there have been thousands of attempts to update the master catalog. Most of them have been inadvertent caused by a missing user alias, but not all, and there are too many to investigate them in detail. A recent post here talked about user FSS1010. Well, he lied: this has been going on since November! Since fandezhi does not collect SMF data it's not possible to perform detailed analysis, particularly successful updates of the master catalog, or successful dataset accesses.

I do think the admins should be more careful looking for probes and do something about it.

[E377878]

Log-On is good but nothing showed up for my ID as High Level Qualifier (HLQ) via ISPF 3.4?

And TSO ISRDDN leads to

ISPF system data set allocation error - press Enter to continue.
Log file allocation error - ISPF will operate without a log data set.
DAIR RC = 12 dec, DARC = 970C hex.
***

I believe my TSO profile set to NOWTPMSG that's why it did not show up the actual story. Do you have WTPMSG turned on?

I thought below might be the problem, but did not experiment further:

1. an SPFLOG dataset cataloged but not on DASD (dsn not found)
2. an SPFLOG dataset on DASD but not cataloged (dupe dsn)

Advise please.

[steve-myers]

And why do you think you have any right to look at other user's datasets?

M 00A0000 ADCD 12039 00:19:57.18 TSU77896 00000281 ICH408I USER(E377878 ) GROUP(USERG02 ) NAME(ANUJ DHAWAN ) 278
D 278 00000281 PRINO.OBJECT CL(DATASET ) VOL(FUSR35)
D 278 00000281 INSUFFICIENT ACCESS AUTHORITY
D 278 00000281 FROM PRINO.* (G)
E 278 00000281 ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

FWIW, there are more.

[prino]

And why do you think you have any right to look at other user's datasets?

M 00A0000 ADCD 12039 00:19:57.18 TSU77896 00000281 ICH408I USER(E377878 ) GROUP(USERG02 ) NAME(ANUJ DHAWAN ) 278
D 278 00000281 PRINO.OBJECT CL(DATASET ) VOL(FUSR35)
D 278 00000281 INSUFFICIENT ACCESS AUTHORITY
D 278 00000281 FROM PRINO.* (G)
E 278 00000281 ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )

FWIW, there are more.

Don't be too hard on him, he's one of the good guys:

1. he already apologized to me personally,
2. he has registered with a real name, and
3. he's one of the moderators on the IBM Mainframes Forum (DB2 section)

I wouldn't mind giving him RACF READ access to my datasets, he just has to ask.