Access Issue?

[Stevemo]

Hi, I was alerted that something occurred with my ID that may cause my login to be suspended/blocked.
I reviewed the Log and did find an entry that occurred when I first logged in this morning.
I don't get enough information from the Log to determine what specifically happened and am not
sure what took place to get the error. I was using a Rexx to build up skeletal JCL and checking a report that it generates.
It does not try to run.... there were some issues regarding my SPFtempx.CNTL, however, that I was trying
to figure out.

Not sure what this is.......happened only the one time......I just don't see it......
Let me know what you think of this as I am puzzled and upset about this as I had no intentions of doing this in
the first place. thanks.... Steve


M 00A0000 ADCD 12298 08:20:40.71 TSU82803
D 810
D 810
D 810
E 810
M 0020000 ADCD 12298 08:20:40.72 TSU82803
E 811


ICH408I USER(MORR ) GROUP(USERG02 ) NAME(STEVE MORRIS ) 810
CATALOG.USERS8.UCAT CL(DATASET ) VOL(FAN003)
INSUFFICIENT ACCESS AUTHORITY
FROM CATALOG.** (G)
ACCESS INTENT(ALTER ) ACCESS ALLOWED(UPDATE )
IEC161I 040(056,006,IGG0CLFT)-002,MORR,SYSUSER SYSUSER,NEWDD,,, 811
IEC161I CATALOG.USERS8.UCAT

[prino]

I've unblocked you. In 3.4 use MORR.* as "Dsname Level", rather than just MORR. The RACF message is (probably) caused by ISRSUPC (you did a SRCHFOR) trying to open your *ALIAS as a dataset.

I don't know how we could not have realized this earlier, but it may explain a lot more RACF violations on catalog datasets... Ouch!

[steve-myers]

The answer is right there ...

...
ICH408I USER(MORR ) GROUP(USERG02 ) NAME(STEVE MORRIS ) 810
CATALOG.USERS8.UCAT CL(DATASET ) VOL(FAN003)
INSUFFICIENT ACCESS AUTHORITY
FROM CATALOG.** (G)
ACCESS INTENT(ALTER ) ACCESS ALLOWED(UPDATE )
IEC161I 040(056,006,IGG0CLFT)-002,MORR,SYSUSER SYSUSER,NEWDD,,, 811
IEC161I CATALOG.USERS8.UCAT

Someone using your ID attempted to delete or damage a user catalog. Apparently an attempt was made to use DITTO. If you had bothered to read these posts: Rules for using z/OS - work in progress, return frequently! and Do not run DITTO on User Catalogs you would have known what to avoid.

[prino]

I sent a PM to the admins giving a more likely explanation for the RACF message, to explain that the cause is more than likely rather innocent. A quick experiment showed that I get the same 'IEC161I' message (but without the RACF violation) when I do a SRCHFOR an a 3.4 display that contains an *ALIAS entry. ISRSUPC is clearly unable to distinguish an *ALIAS from a normal data set and tries to open it.

[Stevemo]

Hi,
Thanks for looking into this and uncovering what was taking place. I normally do not run SRCHFOR within 3.4 as a complete
wildcard under my ID, but use it within PDS structures to find a particular command or something. I now see what took place
and will keep my SRCHFOR commands within my PDS's just as a safe practice. )

Thanks,

Steve

[rsilver]

Try Doug Nadel's SCANPDS at http://www.sillysot.com/mvs/...good utility for searching a PDS