IBM InfoSphere Guardium S-TAP for DB2 on z/OS … InfoSphere Guardium S-TAP for DB2 collector agent...

IBM InfoSphere Guardium S-TAP for DB2on z/OS User's GuideVersion 9 Release 1

��

ii IBM InfoSphere Guardium S-TAP for DB2 on z/OS User's Guide

Contents

Chapter 1. InfoSphere Guardium S-TAPfor DB2 on z/OS overview . . . . . . . 1What's new in InfoSphere Guardium S-TAP for DB2V9.1? . . . . . . . . . . . . . . . . . 1The InfoSphere Guardium S-TAP for DB2 installationenvironment . . . . . . . . . . . . . . 1Installation and operation requirements . . . . . 3

Compatibility with IBM DB2 Query Monitor forz/OS . . . . . . . . . . . . . . . . 3Required user ID authorizations . . . . . . . 4

Globalization . . . . . . . . . . . . . . 5Accessibility features . . . . . . . . . . . 6

Chapter 2. Configuring InfoSphereGuardium S-TAP for DB2 on z/OS . . . 7Upgrading from previous versions of InfoSphereGuardium S-TAP for DB2 . . . . . . . . . . 7Configuring InfoSphere Guardium S-TAP for DB2 . . 8

APF authorizing the LOAD library data set . . . 8Enabling the dynamic LPA facility serviceCSVDYLPA. . . . . . . . . . . . . . 9Service class considerations . . . . . . . . 9Customizing JCL members . . . . . . . . 9Creating the InfoSphere Guardium S-TAP forDB2 control file . . . . . . . . . . . . 10Configuring the InfoSphere Guardium S-TAP forDB2 control file . . . . . . . . . . . . 10Configuring the collector agent . . . . . . . 11Configuring the collector agent for additionalDB2 subsystems . . . . . . . . . . . . 13Support Services Address Space overview . . . 14

Chapter 3. Data collection . . . . . . 17Filtering stages . . . . . . . . . . . . . 17

Data collection process . . . . . . . . . . 18Audit data source and collection types . . . . 19

Policy pushdown . . . . . . . . . . . . 20Streaming of IFI Event and collector agent data . . 20Starting and stopping the collector agent . . . . 20

Chapter 4. Reference information . . . 21Sample library members . . . . . . . . . . 21Collector agent parameters . . . . . . . . . 22Collector agent sample parameter file . . . . . 33ADHEMAC1 edit macro variables . . . . . . . 34

Chapter 5. Messages and codes forIBM InfoSphere Guardium S-TAP forDB2 on z/OS . . . . . . . . . . . . 37Error messages . . . . . . . . . . . . . 37Error messages and codes: ADHAxxx . . . . . 37Error messages and codes: ADHGxxx . . . . . 47Error messages and codes: ADHIxxxx . . . . . 50Error messages and codes: ADHKxxxx . . . . . 52Error messages and codes: ADHMxxxx . . . . . 53Error messages and codes: ADHPxxxx . . . . . 54Error messages and codes: ADHQxxxx . . . . . 56Error messages and codes: ADHSxxxx . . . . . 73Error messages and codes: ADHTxxxx . . . . . 77Error messages and codes: ADHXxxxx . . . . . 79Error messages and codes: ADHZxxxx . . . . . 86

Index . . . . . . . . . . . . . . . 91

iii

iv IBM InfoSphere Guardium S-TAP for DB2 on z/OS User's Guide

Chapter 1. InfoSphere Guardium S-TAP for DB2 on z/OSoverview

IBM® InfoSphere® Guardium® S-TAP® for DB2® on z/OS® (also referred to asInfoSphere Guardium S-TAP for DB2, and S-TAP) collects and correlates dataaccess information from a variety of DB2 resources to produce a comprehensiveview of business activity for auditors. InfoSphere Guardium S-TAP enables you todetermine which users updated or read a particular table, on a specific z/OS DB2system, within a specific time period.

Use InfoSphere Guardium S-TAP for DB2 to collect and correlate the followingtypes of data to the Guardium system:v Modifications to an object (SQL UPDATE, INSERT, DELETE)v Reads of an object (SQL SELECT)v Explicit GRANT and REVOKE operations to capture events where users might

be attempting to modify authorization levelsv Assignment or modification of an authorization IDv Authorization attempts that are denied because of inadequate authorizationv CREATE, ALTER, and DROP operations against an object (such as a table)v Utility access to an object (IBM utilities only)v DB2 commands entered (including which users are issuing specific commands)

IBM InfoSphere Guardium S-TAP for DB2 uses DB2 data sharing to obtain auditinformation from all members of the data sharing group.

What's new in InfoSphere Guardium S-TAP for DB2 V9.1?Speed and monitoring enhancements are now provided in V9.1.

Thread termination supportV9.1 enables you to cancel an active DB2 thread that is running prohibitedSQL activity. The policy you create with the Guardium appliance is used todetermine what SQL activities are prohibited.

Reduced use of DB2 Trace for auditingV9.1 uses collector technology to capture GRANT and REVOKE events,eliminating the need to start the DB2 Class 2 trace.

Expanded audit data for DB2 utilitiesV9.1 enables you to collect and configure information on tables that areaccessed by DB2 utilities.

Capture of DB2 START/STOP eventsV9.1 unconditionally collects information about DB2 START and STOPevents.

The InfoSphere Guardium S-TAP for DB2 installation environmentInfoSphere Guardium S-TAP for DB2 collects SQL and IFI collector data from anaudited DB2 subsystem, in accordance with the filtering policies you set with theGuardium system.

1

The InfoSphere Guardium S-TAP for DB2 collector agent is responsible for thecollection of audit data in an InfoSphere Guardium S-TAP for DB2 environment.As shown in the following diagram, SQL and IFI collector data is filtered and sentto the Guardium system, enabling you to view reports on your workstation.

Guardium system and S-TAP agent communication

The Guardium system and the InfoSphere Guardium S-TAP for DB2 agentcommunicate by using a TCP/IP connection. The filtering policies you create tellthe agent what data to collect. The policy specifies filter information, such as whichjobs and data sets to be monitored for data accesses.

Guardium system

The Guardium system can gather, and report on, information from multiple agentsrunning on multiple z/OS systems. The Guardium system:v Provides the user interface, which processes requests and displays the resulting

information.v Enables you to create filtering policies, which specify the types of data to be

collected by the agent.v Stores the collected data.

Figure 1. An overview of the InfoSphere Guardium S-TAP for DB2 environment

2 IBM InfoSphere Guardium S-TAP for DB2 on z/OS User's Guide

Installation and operation requirementsVerify that you have the hardware and software that is required to install andoperate InfoSphere Guardium S-TAP for DB2.

FEC common code FMID H25F132 is required, and must be present on the systemfor the successful installation of this product.

IBM DB2 Data Access Common Collector for z/OS V1.1 (CQC) common codeFMID HCQC110 is required, and must be present on the system for the successfulinstallation of this product.

Hardware requirements

Any hardware that is capable of running DB2 for z/OS (V8, V9, V10, or V11).

Collector agent requirementsv DB2 version 8 or later.v z/OS Version 1 Release 11 or later.v The InfoSphere Guardium S-TAP for DB2 collector agent must be run on an

operating system version that is equivalent to the operating system version onwhich the product SMP/E installation was performed.

v Resource Recovery Services (RRS) must be configured and enabled forInfoSphere Guardium S-TAP for DB2 to use the RRSAF attachment facility toconnect to DB2.

Compatibility with IBM DB2 Query Monitor for z/OSInfoSphere Guardium S-TAP for DB2 does not require DB2 Query Monitor to beinstalled or activated on a DB2 subsystem that InfoSphere Guardium S-TAP forDB2 audits. If you are running DB2 Query Monitor on your system, be aware thatInfoSphere Guardium S-TAP for DB2 can only audit a DB2 subsystem that isrunning DB2 Query Monitor Version 3.1 or later. Certain InfoSphere GuardiumS-TAP for DB2 PTFs require Query Monitor PTFs through SMP/E IFREQ.

To implement DB2 Query Monitor, your site must have the appropriate operatingsystem and environment, hardware and software, and network requirements. Forinformation about installing and operating Query Monitor, refer to the IBM DB2Query Monitor for z/OS User's Guide (SC18-9202).

Note: If you encounter problems when running InfoSphere Guardium S-TAP forDB2 and other query monitoring products against the same DB2 subsystem,contact IBM Software Support.

Compatible releases and maintenance levels

The following product abbreviations are used:v InfoSphere Guardium S-TAP for DB2: STPv DB2 Query Monitor: CQMv DB2 Audit Management Expert: ADHv InfoSphere Optim™ Query Capture and Replay: CQR 1.1v InfoSphere Optim Query Workload Replay: CQR 2.1

Chapter 1. InfoSphere Guardium S-TAP for DB2 on z/OS overview 3

Table 1. Compatible releases and maintenance levels

CQM 2.3 CQM 3.1 CQM 3.2 ADH 2.1 STP 8.1 STP 9.0 STP 9.1 CQR 1.1 CQR 2.1

CQM 2.3 --- LPAR(1) N DB2 DB2(2) N N N N

CQM 3.1 LPAR(1) --- LPAR LPAR(3) DB2 DB2 DB2 DB2 DB2

CQM 3.2 N LPAR --- N DB2 DB2 DB2 DB2 DB2

ADH 2.1 DB2 LPAR(3) N --- LPAR(4) N N N N

STP 8.1 DB2(2) DB2 DB2 LPAR(4) --- N LPAR DB2 N

STP 9.0 N DB2 DB2 N LPAR --- LPAR DB2 DB2

STP 9.1 N DB2 DB2 N LPAR LPAR --- DB2 DB2

CQR 1.1 N DB2 DB2 N DB2 DB2 DB2 --- LPAR

CQR 2.1 N DB2 DB2 N N DB2 DB2 LPAR ---

where:

N The two product releases are not compatible.

LPAR The two products releases can coexist on the same LPAR (provided theyuse a different MASTER name), but cannot be active on the same DB2subsystem.

DB2 The two products releases can coexist on the same LPAR and can both beactive on the same DB2 subsystem – i.e. shared collector.

(1) CQM 2.3 and CQM 3.1 are compatible on the same LPAR until APARPM85050 or later is applied to CQM 3.1. After that, CQM 2.3 and CQM 3.1cannot operate on the same LPAR.

(2) STP 8.1 and CQM 2.3 are compatible on the same DB2 until APARPM85117 or later is applied to STP 8.1. After that, CQM 2.3 and STP 8.1cannot operate on the same DB2 or LPAR.

(3) ADH 2.1 and CQM 3.1 are compatible on the same LPAR until APARPM85050 or later is applied to CQM 3.1. After that, ADH 2.1 and CQM 3.1cannot operate on the same LPAR.

(4) ADH 2.1 and STP 8.1 are compatible on the same LPAR until APARPM85117 or later is applied to STP 8.1. After that, ADH 2.1 and STP 8.1cannot operate on the same LPAR.

Compatible minimum maintenance levels

In the list that follows, "compatible with" means that the two products can runtogether on the same LPAR.

STP 9.1 with PM98906 is compatible with:

v CQM 3.1 with PM95540v CQM 3.2 with PM95549v CQR 1.1 with PM95769v CQR 2.1 with PM98901

Required user ID authorizationsTo operate InfoSphere Guardium S-TAP for DB2, the S-TAP collector agent startedtask must run under the authority of a Time Sharing Option (TSO) user ID withthese authorizations:


v The collector agent user ID requires DB2 privileges. Grant the collector agentuser ID one of the following authorities:– TRACE, MONITOR1, and MONITOR2 authority

or– SYSCTRL authority

v The collector agent user ID must have the authority to issue the SELECTstatements on these tables:– SYSIBM.SYSTABLES– SYSIBM.SYSTABLESPACE– SYSIBM.SYSCOLUMNS– SYSIBM.SYSKEYS– SYSIBM.SYSINDEXES– SYSIBM.SYSTABLEPART– SYSIBM.SYSFIELDS– SYSIBM.SYSCOPY– SYSIBM.SYSPACKSTMT– SYSIBM.SYSSTMT

OMVS segment

The collector agent uses UNIX System Services (USS) callable services as thenetwork interface to the appliance. The USS callable services require that an OMVSsegment is defined in the RACF profile for the user ID under which the collectoragent job runs. The OMVS segment that is defined for the user ID must contain thefollowing minimum requirements:v A numeric user ID that is assigned to the userv A valid path to an existing home directoryv A program name, for example: /bin/sh or /bin/echo for non-shellv A numeric group ID that is assigned to the user's DEFAULT group

To verify that the ID has an OMVS segment in its RACF profile, use the followingcommand:LU user ID OMVS

To add an OMVS segment to the RACF profile of an ID, refer to this samplecommand:ALTUSER user IDOMVS(UID(nnn)HOME(’/u/ user ID)PROGRAM(’/bin/sh’))

GlobalizationTo ensure the correct display of SQL Text for IFI-based events(CREATE/ALTER/DROP IFCID 142) that contain embedded DBCS charactersrequires that the DB2 ZPARM PARM UIFCIDS set to YES.

InfoSphere Guardium S-TAP for DB2 supports double-byte characters.

DB2 Universal Database™ for z/OS is increasingly being used as a part of largeclient-server systems. In these environments, character representations vary onclients and servers across many different platforms and across differentgeographies. InfoSphere Guardium S-TAP for DB2 for DB2 Universal Database for

Chapter 1. InfoSphere Guardium S-TAP for DB2 on z/OS overview 5

z/OS supports these environments by enabling the use of the Unicode encodingscheme for internally processing of metadata and audit data.

Accessibility featuresAccessibility features help a user who has a physical disability, such as restrictedmobility or limited vision, to use a software product successfully.

The major accessibility features in InfoSphere Guardium S-TAP for DB2 enableusers to:v Use assistive technologies such as screen readers and screen magnifier software.

Consult the assistive technology documentation for specific information whenusing it to access z/OS interfaces.

v Customize display attributes such as color, contrast, and font size.v Operate specific or equivalent features by using only the keyboard. Refer to the

following publications for information about accessing ISPF interfaces:– z/OS ISPF User's Guide, Volume 1

– z/OS TSO/E Primer

– z/OS TSO/E User's Guide

These guides describe how to use ISPF, including the use of keyboard shortcuts orfunction keys (PF keys), include the default settings for the PF keys, and explainhow to modify their functions.


Chapter 2. Configuring InfoSphere Guardium S-TAP for DB2on z/OS

After you install InfoSphere Guardium S-TAP for DB2, you must customize somefiles for your system. All configuration steps are required in both stand-alone anddata sharing environments.

Before you begin

Review the collector agent security and system requirements before proceedingwith the following steps. A complete list of sample library members is provided inthis User's Guide.

About this task

The following table describes the configuration steps and the correspondingSADHSAMP sample library member that is required for customization.

Table 2. Configuration steps

Step Description of configuration step SADHSAMP sample library member to use

1 APF authorizing the LOAD librarydata set

(Not applicable)

2 Customizing JCL members using theADHEMAC1 macro

ADHEMAC1

3 Binding DBRMs using the JCL bindjob

ADHBIND

4 Creating the InfoSphere GuardiumS-TAP for DB2 control file

ADHSJ000

5 Configuring the InfoSphereGuardium S-TAP for DB2 control file

ADHSJ001

6 Configuring the collector agent ADHCFGP and ADHCSSID

Upgrading from previous versions of InfoSphere Guardium S-TAP forDB2

InfoSphere Guardium S-TAP for DB2 V8.1 and V9.0 users can upgrade to V9.1 bycompleting these steps.

Procedure1. Complete the SMP/E installation of InfoSphere Guardium S-TAP for DB2 V9.1.2. APF-authorize the V9.1 SADHLOAD data set.3. Customize and run the DB2 bind job in SADHSAMP(ADHBIND).4. Export and save your collection profiles. (V8.1 collection profiles, or policies,

were administered either with the InfoSphere Guardium S-TAP for DB2administration client, or the Guardium system.)

5. Stop the previous version's collector agent and server address spaces.6. Update the collector started task JCLs (ADHCssid) to:v Remove the previous version of the product SADHLOAD data sets.

7

v Include the new V9.1 product SADHLOAD data sets in the STEPLIB DDconcatenation members.

Note: ADHSssid and ADHAssid started tasks are not used in InfoSphereGuardium S-TAP for DB2 V9.1.

7. Update the V9.1 collector configuration member (typicallySADHSAMP(ADHCFGP).

8. Install a collection policy on the Guardium system.v If policy pushdown was used for V8.1 collection administration, follow the

Guardium Policy Builder instructions for migrating policies for V8.1 to V9.1.v If the InfoSphere Guardium S-TAP for DB2 administration client was used

for V8.1 collection administration, use the XML exported in Step 4 as areference for the Guardium Policy Builder to define collection policies forV9.1.

9. Start the collector address space by typing /S ADHCssid at the z/OS commandprompt.

What to do next

Now you can install policies on the z/OS host by using the InfoSphere Guardiuminterface. No additional configuration steps are required.

Configuring InfoSphere Guardium S-TAP for DB2After installation, configure InfoSphere Guardium S-TAP for DB2 by completingthe steps that are described in this section. All configuration steps are required inboth stand-alone and data sharing environments.

APF authorizing the LOAD library data setThe system programmer must APF authorize the product LOAD library for datacollection to work correctly. The system programmer must modify the IEAAPFxxor PROGxx PARMLIB members to define the InfoSphere Guardium S-TAP for DB2data set, as specified by ADHEMAC1 macro value #SADHLOAD, as an APFauthorized library.

About this task

The InfoSphere Guardium S-TAP for DB2 agent requires that all data sets accessedin the STEPLIB of the collector job be APF authorized, including:v the LOAD library data setv adhhlq.SADHLOADv the FEC data set fechlq.SFECLOAD (where adhhlq and fechlq are the data set

high level qualifier where S-TAP and FEC products are installed)v the CQC data set cqchlq.SCQCLOAD (where adhhlq and cqchlq are the data set

high level qualifier where S-TAP and CQC products are installed)

Other data sets that require APF authorization are:v CEE.SCEERUNv CEE.SCEERUN2v DB2 EXIT data set (i.e. DSN.V9R1.SDNEXIT)v DB2 LOAD library data set (i.e. DSN.V9R1.SDSNLOAD)v SYS1.LINKLIB


Refer to the z/OS Information Center for more information about how to APFauthorize libraries.

Enabling the dynamic LPA facility service CSVDYLPAThe user ID that was used to start the Collector Agent PROC must be enabled touse the dynamic LPA facility CSVDYLPA to enable the collector agent to collectdata.

About this task

Determine whether the dynamic LPA facility CSVDYLPA is SAF protected. If thedynamic LPA facility CSVDYLPA is not SAF protected, this step is not required.

Procedure

Provide the user ID with ADD/UPDATE/DELETE authority. For more informationabout how to enable the CSVDYLPA resource, see section 5.6.3 of the z/OS V1R7.0MVS Planning: Operations Guide (SA22-7601-06), section Controlling/Adding A Moduleto LPA after IPL.

Service class considerationsThe collector agent started task must be set at a dispatching priority that is thesame as, or higher than, that of DB2.Related tasks:“Configuring the collector agent” on page 11To configure the collector agent, complete the steps provided in each of thesubsequent sections. The address space dispatching priority for InfoSphereGuardium S-TAP for DB2 must be the same as, or higher than, that of DB2.

Customizing JCL membersUse the edit macro ADHEMAC1 to customize the variables in the JCL to be run.

About this task

Procedure1. Copy member ADHEMAC1 from the adhhilvl.SADHSAMP to your site's CLIST

library, and then edit the ADHEMAC1 macro with the appropriate variables.2. After you copy the edit macro to your CLIST library, use it to edit each sample

library member individually. You might need to update the macro betweenedits depending on the member being edited and the context of the variable tobe modified in the sample library.

3. To run the macro, type the ADHEMAC1 command to automatically update theappropriate variables in the member that you are editing. Running ADHEMAC1allows you to modify members without requiring you to remember plannames, creators, and other variables from one edit session to the next editsession.

Related reference:“ADHEMAC1 edit macro variables” on page 34This table shows the ADHEMAC1 edit macro variables, including their defaultvalue and instructions for use. An example is also provided.

Chapter 2. Configuring InfoSphere Guardium S-TAP for DB2 on z/OS 9

Creating the InfoSphere Guardium S-TAP for DB2 control fileInfoSphere Guardium S-TAP for DB2 configuration information is stored in aVSAM data set, which is the product control file.

About this task

Using the sample JCL that is included with the product, complete these steps tocreate the InfoSphere Guardium S-TAP for DB2 control file:

Procedure1. Edit SADHSAMP member ADHSJ000.2. Add the appropriate job card to ADHSJ000.3. In the DELETE instruction, change the data set name.4. In the DEFINE CLUSTER instruction, change the following text within

parentheses:v Data set NAMEv VOLUMESv DATA NAMEv INDEX NAME

5. In the REPRO instruction, change the name of the OUTDATASET.6. Run ADHSJ000 to create the control file. The job steps must end with a return

code of zero.

Configuring the InfoSphere Guardium S-TAP for DB2 controlfile

InfoSphere Guardium S-TAP for DB2 requires information that identifies targetDB2 subsystems, product options, and data set attributes. The productconfiguration is saved in the VSAM product control file data set that you createdpreviously.

About this task

Update the product control file by using the sample JCL that is included withInfoSphere Guardium S-TAP for DB2. Sample library member ADHSJ001 containsthe JCL to update the control file. The following steps list the tasks required toconfigure the product control file data set.

Important: The DB2 plan names that are specified in the product configurationoptions must match the product plan names assigned to the product's DB2 plansbind plan job.

Procedure1. Edit SADHSAMP member ADHSJ001.2. Add the appropriate job card to ADHSJ001.3. Change ADH.V0110.CONTROL to the name of the VSAM control data set that

you created using member ADHSJ000.4. Change #SADHLOAD to the name of the product LOADLIB used for

InfoSphere Guardium S-TAP for DB2.5. Modify the SYSIN DD statements as instructed in the sample member. For

more information, see Required statements for each subsystem.


Important: In a data-sharing environment, specify subsystem names (not groupnames) in ADHSJ001.

6. Run ADHSJ001. Ensure that the update job steps of the product control file endwith a return code of zero. If a non-zero return code occurs, review the joboutput for errors, correct the problem, and resubmit the JCL.

Required statements for each subsystemThe following statements are required for each DB2 subsystem that is added to thecontrol file.

Table 3. Required statements for each subsystem

Statement Setting

SET DB2 SSID #SSID

UPDATE DB2 ZPARMS #SZPARM

UPDATE DB2 BOOTSTRAP 1 #SBSDS01

UPDATE DB2 LOADLIB 1 #SDSNEXIT

UPDATE DB2 LOADLIB 2 #SDSNLOAD

SET PRODUCT CFG NULL

SET PRODUCT VER NULL

UPDATE ADH PLAN 1 ADHPLAN1

UPDATE ADH CORR ID 1 ADH ID 1

UPDATE ADH CORR ID 2 ADH ID 2

Configuring the collector agentTo configure the collector agent, complete the steps provided in each of thesubsequent sections. The address space dispatching priority for InfoSphereGuardium S-TAP for DB2 must be the same as, or higher than, that of DB2.Related reference:“Service class considerations” on page 9The collector agent started task must be set at a dispatching priority that is thesame as, or higher than, that of DB2.

Configuring the JCL for ADHBINDSADHSAMP(ADHBIND) is a job that binds the packages and plan used by thecollector agent.

Procedure1. Customize and submit the JCL according to the instructions in the member.2. Submit the ADHBIND JCL to bind the collector agent packages and plan on

each DB2 subsystem on which you want to use InfoSphere Guardium S-TAPfor DB2.

Configuring the ADHCFGP data setThe ADH#MAIN program uses parameters to define the IBM InfoSphereGuardium S-TAP for DB2 subsystem name, the monitored DB2 subsystem, theGuardium system host name or network address TCP/IP port, and otherparameters that control how the InfoSphere Guardium S-TAP for DB2 collectoragent is implemented.


About this task

These parameters are defined in an 80-byte sequential or partitioned data set thatyou must allocate to the ADHPARMS DD. A sample is available in theSADHSAMP library member ADHCFGP.

Note: The AUDIT parameter is required. It instructs the collector agent to audit aspecific DB2 subsystem. It supports only one DB2 subsystem.

To use the sample ADHCFGP member:

Procedure1. Copy ADHCFGP to the appropriate location on your system.2. Verify that the parameters are valid for your environment. If necessary, edit the

parameter file for your InfoSphere Guardium S-TAP for DB2 objects.3. Edit the ADHPARMS DD in the started task JCL to point to the ADHCFGP

data set that you have customized.

Example

An example of the ADHCFGP member contents is as follows:BROWSE ADH.STP9DROP.D120612.SAMPLIB(ADHCFGP) - 01 LCommand ===>SUBSYS(#SSID) -AUDIT(#SSID) -MASTER_PROCNAME(ADHMST31) -APPLIANCE_SERVER(#APPSRVR)

Defining the collector agent started task JCLThe collector agent runs as a started task. The sample library member ADHCSSIDcontains the sample JCL to set up the InfoSphere Guardium S-TAP for DB2collector agent started task.

Before you begin

To run the collector agent as a started task, the JCL must be in a catalogedprocedure library. Modify the sample started task JCL in SADHSAMP librarymember ADHCSSID for your site, according to the instructions in the member.

The collector agent started task requires:v A user ID with the authorizations that are described in “Required user ID

authorizations” on page 4v READ access to the ADHCFGP data set in the RACF® DATASET classv UPDATE access to the DB2PARMS data set in the RACF DATASET classv The ability to connect to the DB2 subsystem that is monitored by the collector

agent (access to the DSNR resource class in DB2)

Procedure1. Using the sample library member ADHCSSID as a template, customize the

member according to the directions contained in the sample JCL. Any validmember name can be used for the started task name, but the suggested startedtask name is ADHCSSID, where SSID is the identifier of the DB2 subsystemthat is to be monitored.


2. Copy the customized JCL to an appropriate SYSPROC data set. The JCL mustinclude definitions for the following data descriptions:

ADHPARMSADHPARMS must name the InfoSphere Guardium S-TAP for DB2collector agent configuration file.

DB2PARMSDB2PARMS must name the InfoSphere Guardium S-TAP for DB2product control file (example: ADH.V0900.CONTROL).

ADHPLCYADHPLCY enables policy persistence. If ADHPLCY is defined, it mustpoint to a data set that is allocated with a record format of fixedblocked (RECFM=FB) and a record length (LRECL) greater than orequal to 256.

The ADHPLCY data set should be allocated with a minimum of 50primary tracks and 10 secondary tracks. The ADHPLCY data set can besequential, PDS, or PDS/E. If you use PDS or PDS/E, the spacerequirements might need to be increased in relation to the number ofmembers that are contained within the data set.

ADHLOGADHLOG is the SYSOUT data set to which InfoSphere GuardiumS-TAP for DB2 collector agent log messages will be written.

STEPLIBSTEPLIB must include the InfoSphere Guardium S-TAP for DB2SADHLOAD data set.

Note: Every data set allocated to STEPLIB must be APF-authorized.

SYSPRINTSYSPRINT is the SYSOUT data set to which log messages will bewritten.

Related reference:“Sample library members” on page 21Use the following sample library members that are included with InfoSphereGuardium S-TAP for DB2 for installation and configuration.

Configuring the collector agent for additional DB2 subsystemsThe collector agent must be configured for each DB2 subsystem that is to beaudited.

Before you begin

The collector agent started task requires:v A user ID with the authorizations that are described in “Required user ID

authorizations” on page 4v READ access to the ADHCFGP data set in the RACF DATASET classv UPDATE access to the DB2PARMS data set in the RACF DATASET classv The ability to connect to the DB2 subsystem that is monitored by the collector

agent (access to the DSNR resource class in DB2)


Procedure1. For additional stand-alone DB2 subsystem, use the SADHSAMP member

ADHBIND to bind InfoSphere Guardium S-TAP for DB2 plans on each DB2subsystem that is to be audited. For data sharing group members, useADHBIND to bind one member of the data sharing group. The bind will applyto all additional group members.

2. For each data sharing group or additional stand-alone DB2 subsystem, grantEXECUTE permission for the agent started task ID to the ADH PLAN 1, asspecified in the PCF file for the DB2 subsystem.

3. Update the control file with the new SSID, or create a new S-TAP control filefor each SSID by using the SADHSAMP member ADHSJ001.

4. If a new subsystem is a member of a data sharing group, and the S-TAPcollector agents are to be configured and defined for each member of thegroup, modify the audit trace command to use SCOPE(LOCAL) instead ofSCOPE(GLOBAL) by setting the STAP_DB2TRACE_LOCAL parameter to Y. InstallAPAR PI14825 to use the STAP_DB2TRACE_LOCAL parameter. This preventsduplicate IFI audit events from being sent to the Guardium system.

5. Configure a new S-TAP agent configuration file.6. Add the agent started task name to the z/OS started task table.7. Start the new S-TAP agent.

Note:

v Dispatching priority must be the same as, or higher than, DB2.

After you start the agent, review the agent log and MVS log for error messages.When an active collection policy is received, the agent starts collecting auditdata.

Support Services Address Space overviewInfoSphere Guardium S-TAP for DB2 uses a Support Services Address Space, alsoreferred to as a Master Address Space. Learn about how the Master Address Spaceworks, as well as the implications for using and stopping it.

A Support Services Address Space, also referred to as a Master Address Space,starts for each z/OS image after the first instance of InfoSphere Guardium S-TAPfor DB2, InfoSphere Optim Query Workload Replay for DB2, or DB2 QueryMonitor starts with a MASTER_PROCNAME value that is not yet in use on thatz/OS image.

The Master Address Space is a Service Address Space for all instances ofInfoSphere Guardium S-TAP for DB2, InfoSphere Optim Query Workload Replayfor DB2, or DB2 Query Monitor that specify the same MASTER_PROCNAME parametervalue that is running on the z/OS image. The Master Address Space acts as aplaceholder for shared collector resources, and is similar to other Master AddressSpaces that are used throughout MVS™. For sample, MVS and DB2 both haveMaster Address Spaces.

The Master Address Space:v Never shuts downv Does not run any code except for its initialization routinesv Owns resources that are needed by the shared collectorv Does not require a formal shutdown and should not be canceled or forced to

shut down during the operation of InfoSphere Guardium S-TAP for DB2,


InfoSphere Optim Query Workload Replay for DB2, or DB2 Query Monitor.Forcing the Master Address Space to stop causes the abnormal termination of allInfoSphere Guardium S-TAP for DB2, InfoSphere Optim Query Workload Replayfor DB2, and DB2 Query Monitor subsystems on the LPAR.

Important: During installation, do not stop or start the Master Address Spaceunless required by product maintenance or instructed to do so by IBM SoftwareSupport.

Usage considerations for the Master Address SpaceThe following considerations apply to the use of the Support Services AddressSpace when you are using InfoSphere Guardium S-TAP for DB2 to monitor thesame DB2 subsystem, or multiple DB2 subsystems, on the same LPAR.

Monitoring the same DB2 subsystemIf you use multiple collector products (such as InfoSphere GuardiumS-TAP for DB2, InfoSphere Optim Query Workload Replay for DB2, or DB2Query Monitor) to monitor the same DB2 subsystem, each product mustspecify the same value for the MASTER_PROCNAME parameter.

Monitoring multiple DB2 subsystems that reside on the same LPARIf you use multiple collector products (such as InfoSphere GuardiumS-TAP for DB2, InfoSphere Optim Query Workload Replay for DB2, or DB2Query Monitor) or multiple instances of the same product to monitordifferent DB2 subsystems that reside on the same LPAR, each product canhave a different value for the MASTER_PROCNAME parameter.

Note: This rule applies to instances when you are running differentmaintenance levels of the same product on the same LPAR (for example, ifyou are testing new maintenance levels prior to upgrading yourproduction system).

Stopping the Master Address SpaceDo not stop the Master Address Space unless you are directed to do so by IBMSoftware Support or by a ++HOLD(ACTION) in a PTF.

To ensure product stability, the Master Address Space should only be stopped byusing the sample job that is provided in SCQMSAMP, member CQMMSTR. Thisjob verifies that no InfoSphere Guardium S-TAP for DB2, InfoSphere Optim QueryWorkload Replay for DB2, or DB2 Query Monitor subsystems are using the MasterAddress Space before it is stopped.


Chapter 3. Data collection

The collection process involves gathering SQL events captured at run time. Use acollection policy to specify filtering criteria to capture relevant data, and filter outirrelevant data.

Filter wildcard supportFilter values can include the percent sign (%) as a wildcard character.

Important: The use of wildcards in filters can potentially result in the collection ofsignificant amounts of captured data.

Filtering stagesYou can control filtering performance through the fields that you include in therules for the active policy. Two levels of filtering are available for SQL eventcollection: Stage 1, which generally results in more efficient CPU usage, and Stage2, which can result in higher CPU usage. Filtering occurs in one or both of thesestages, depending on the fields that are included in your filter.

The filtering of SQL events against rules in an active policy occurs as follows:v Stage 1 filtering occurs at the point of collection.v Stage 2 filtering occurs during post-collection processing of the event.

Stage 1 filteringStage 1 filtering occurs when you create a filter that uses the followingfilter fields:v Planv Primary AUTHID (AuthID)v Connection typev Transaction name (WSTran)v Original operator ID (OriginalOpId)v Program name (Program)v Workstation user (WSUser)v Workstation name (WSName)

These fields can be fully qualified, or partially qualified by using thepercent sign wildcard character. You must specify at least one filteringterm, other than the wildcard character, for Stage 1 filtering to occur.

In both Stage 1 and Stage 2 filtering, the most efficient CPU usage isachieved when you create a filter that eliminates the greatest number ofevents.

Stage 2 filteringStage 2 filtering occurs if the filter specifies at least one object, such as atable. Stage 2 filtering is automatically performed when your policyincludes a filter based on schema.target.

Stage 2 filtering occurs when at least one rule in the active policy specifiesan object other than the wildcard percent sign.

Stage 2 filtering results in higher CPU usage for the collection and filteringprocess. To increase efficiency within Stage 2 filtering, refine your filtering

17

criteria by indicating the specific filtering types associated with the datayou want to collect. Better CPU efficiency can be achieved in Stage 2filtering if you specify the plan, primary AuthID, Connection type, SQLID,OriginalOpId, Program, WSUser, or WSName associated with the actionperformed on an object, as shown in the following example:

To capture access to a table called MY.TABLE, you could create the following filter:

Filter 1Schema.Table equal to MY.TABLE

This filter causes InfoSphere Guardium S-TAP for DB2 to parse all SQL statementsfor target tables, which can result in high CPU usage.

To increase efficiency in this example, specify a Stage 1 filter field, such as plan,even if you are sure that that plan is the only plan that accesses this table. Tocapture access to the table MY.TABLE for an application that runs under a specificplan, such as MYPLAN, the following is an example of a more efficient filter:

Filter 2Plan equal to MYPLAN

Schema.Table equal to MY.TABLE

Specifying the plan eliminates the need for InfoSphere Guardium S-TAP for DB2 toparse all SQL statements for target tables. Parsing is limited to MYPLAN, whichresults in better CPU efficiency.

Combined FiltersWhen the filtering specifications exceed the scope of Stage 1 filtering, bothStage 1 and Stage 2 filtering can occur.

For example, if you create a filter with plan equal to DSNTEP2, andTARGET equal to SYSIBM.SYSTABLES, then Stage 1 filtering occurs. Theactivity that is run under the plan DSNTEP2 will be sent to the collectorfor Stage 2 filtering. All other activity is discarded.

Data collection processDuring the collection process, InfoSphere Guardium S-TAP for DB2 collects auditevent data and verifies the data against the collection criteria defined in thecollection policy.

Note: Set the DB2 ZPARM PARM UIFCIDS to YES to ensure the correct display ofSQL text for IFI based events that contain embedded DBCS characters.Specify filtering criteria by defining a collection policy so that all relevant eventsare captured, and the amount of unnecessary data collected and stored byInfoSphere Guardium S-TAP for DB2 is limited.

Data collected from the DB2 audit facility is filtered by the product during thecollection process, and non-relevant events are discarded. Data filtering continuesas follows:1. Collection of all reads and all changes (with collector agent based collection).2. Collection of host variables, up to a maximum of 256 bytes per variable.3. Collection of dynamic SQL text up to 32768 bytes per statement.4. Collection of static SQL text up to 4000 bytes.


Audit data source and collection typesThe following table shows the correlation between the audit data source, and thetype of audit data collected. Filtering criteria is defined and managed through theGuardium audit policy interface.

Table 4. Audit data source and corresponding audit data collection types

Collected audit data type Data source collector type

All reads SQL

All changes SQL

Grant/Revoke SQL

Authorization IFI

Access attempts IFI

DB2 Commands IFI

DB2 Utilities IFI

Audit data for DB2 Utilities IFI

Create, Alter, Drop Table SQL

Create, Alter, Drop <all other object types> SQL

Static SQL host variables SQL

Static SQL text SQL

Dynamic SQL host variables SQL

Dynamic SQL text SQL

Audit data for DB2 UtilitiesYou can collect table information for DB2 utility operations that are run againsttable spaces. The InfoSphere Guardium S-TAP for DB2 V9.1 collector agent reportsthe name of the table that is associated with the table space, involved in the DB2Utility operation. Configure audit data for DB2 utilities according to the followingrules:

Set the STAP_UTILITY_TS_TO_TABLE parameter to Y to collect audit data for DB2utilities. See “Collector agent parameters” on page 22 for more information.

Note: Setting this parameter to Y enables the DB2 catalog to be accessed. Thefrequency of catalog access is determined by the number of audited DB2 utilityaccesses that occur. A large number of DB2 utility accesses, or catalog contentionissues, can result in longer processing times.

Audit data for DB2 utilities is collected according to the following rules:v When a single table is contained in the tablespace, the table information is

reported.v When more than one table is contained in the table space, the product can be

configured to report either:

No tablesThe table space is reported, but no tables are reported, as in previousproduct versions.

All tables in the table spaceUtility executions are reported against the accessed table.

Chapter 3. InfoSphere Guardium S-TAP for DB2 - Data collection 19

This option can result in false-positives being reported against tables inthe table space that were not affected by the running of the utility.

Policy pushdownThe policy pushdown process maps policies to the S-TAP collection.

At startup, the collector agent waits for a policy to be streamed (or pushed down)from the Guardium system before activating a collection. When the collector agentreceives a policy, it inactivates the active collection (if a collection is active),updates the collection profile with the new policy, and then activates the collectionpolicy.

The following processing occurs in the collector agent when a policy is received:1. The new policy is compared to the currently active policy if the new policy

contains one or more rules.a. If the policies are identical, no further processing is required.b. If the policies are not identical, the policy is written to DD:ADHPLCY (if

defined) and it becomes the collection active policy.2. If the new policy does not apply to this subsystem, processing continues

without any changes. In this case, if there is an active policy, the collectioncontinues using it. If no policy is active, none is started.

3. If the new policy is inactive (contains no general audit settings, table or targetdefinitions), the active policy is inactivated.

For more information about creative, activating, and inactivating policies from theGuardium system interface, see the how-to topics in the InfoSphere Guardium V9.1documentation on the IBM information center.

Streaming of IFI Event and collector agent dataInfoSphere Guardium S-TAP for DB2 collects and sends (streams) IFI Event andcollector agent data directly to the Guardium system.

IFI Events and collector agent audit data are collected according to the activepolicies. If the active policy does not contain rules that require data to be collectedfor IFI events, then IFI collection is not enabled. IFI Events and collector agentaudit data is streamed to the Guardium system as it is collected.

Starting and stopping the collector agentAfter you configure the product and review the data collection information, youcan start the collector agent. Use the commands provided to start and stop thecollector agent started task from a cataloged procedure library.

Procedure1. To start the collector agent, use the START command. Example: /S ADHCSSID

2. To stop the collector agent, use the STOP command, or the MODIFY commandwith the STOP parameter. Example:/P ADHCSSID

or/F ADHCSSID,STOP


Chapter 4. Reference information

These reference topics are designed to provide you with quick access toinformation about InfoSphere Guardium S-TAP for DB2 sample library members,parameters, and variables.

Topics:v “Sample library members”v “Collector agent parameters” on page 22v “Collector agent sample parameter file” on page 33v “ADHEMAC1 edit macro variables” on page 34

Other resources

The following IBM documentation provides more information about configuringand operating this product.v IBM Ported Tools for z/OS: Open SSH User's Guidev z/OS V1Rxx.x UNIX System Services Planningv z/OS V1Rxx.x MVS JCL User's Guidev DB2 Administration Guidev Monitoring and Tuning DB2 Performance

Sample library membersUse the following sample library members that are included with InfoSphereGuardium S-TAP for DB2 for installation and configuration.

Table 5. Installation and configuration sample library members

Member Type Description

ADHBIND JCL Bind job used to bind DBRMs.

ADHCFGP 80-byte sequentialor partitioneddata set

A listing of required parameters that control how thecollector is implemented.

ADHCFGPE 80-byte sequentialor partitioneddata set

A listing of optional parameters that control how thecollector is implemented.

ADHCSSID Procedure InfoSphere Guardium S-TAP for DB2 collectorstarted task procedure. Runs an instance of theInfoSphere Guardium S-TAP for DB2 collectorstarted task.

ADHEMAC1 (edit macro) Customizes the variables that appear in the DDL andJCL to be run.

ADHMSTR JCL Stops the InfoSphere Guardium S-TAP for DB2master address space.

ADHSJ000 JCL Allocates VSAM product control file.

ADHSJ001 JCL Sets product configuration options.

ADHSJ003 JCL Generates the product control file content report.

21

http://www-03.ibm.com/systems/z/os/zos/features/unix/ported/openssh/

http://pic.dhe.ibm.com/infocenter/zos/v1r13/index.jsp?topic=%2Fcom.ibm.zos.r13.bpxb200%2Fabstract.htm

http://publib.boulder.ibm.com/infocenter/zos/v1r11/index.jsp?topic=/com.ibm.zos.r11.ieab500/abstract.htm

http://pic.dhe.ibm.com/infocenter/dzichelp/v2r2/index.jsp?topic=%2Fcom.ibm.db2z10.doc.admin%2Fsrc%2Fadmin%2Fdb2z_admin.htm

http://www.redbooks.ibm.com/abstracts/sg247073.html

Table 5. Installation and configuration sample library members (continued)

Member Type Description

ADHSTAPD JCL Produces an InfoSphere Guardium S-TAP for DB2diagnostic report.

ADHTCPD JCL Produces a TCP/IP diagnostic report to use fortroubleshooting network connectivity andthroughput issues.

Related tasks:“Defining the collector agent started task JCL” on page 12The collector agent runs as a started task. The sample library member ADHCSSIDcontains the sample JCL to set up the InfoSphere Guardium S-TAP for DB2collector agent started task.

Collector agent parametersThe collector agent parameters are described in this section.

APPLIANCE_CONNECT_RETRY_COUNT

Required: No

Default: 0

Description: The number of consecutive failed connection attempts beforeterminating. The value of 0 indicates to never stop attempting connections. Avalue of 1 indicates a stop immediately after connection attempt fails. Range: 0- 99999.

Syntax:APPLIANCE_CONNECT_RETRY_COUNT(retry_count)

Example:APPLIANCE_CONNECT_RETRY_COUNT(1000)

APPLIANCE_NETWORK_REQUEST_TIMEOUT

Default: 0

Range: 0 or 500 - 12000

Description: The value in milliseconds of the period of time to wait fornetwork communication request send or receive to complete. A value of 0results in no timeout period.

Syntax:APPLIANCE_NETWORK_REQUEST_TIMEOUT(timeout)

Example:APPLIANCE_NETWORK_REQUEST_TIMEOUT(0)

APPLIANCE_PING_RATE

Required: No

Default: 5

Description: Specifies the time interval between accesses to the Guardiumsystem to prevent timeouts (disconnects) during idle periods. The value is innumber of seconds.

Syntax:


APPLIANCE_PING_RATE(ping_interval)

Example:APPLIANCE_PING_RATE(5)

APPLIANCE_PORT

Required: No

Default: 16022

Valid ports: 16022 or 16023

Description: The IP port number of the Guardium system to which theInfoSphere Guardium S-TAP for DB2 audit data collector should connect. Thisparameter must be properly configured to enable collection of audit data and aconnection to the Guardium system. If port 16023 is used, encryption supportis required for the connection to the appliance.

Note: Specifying this keyword and parameter designates the port on which theInfoSphere Guardium appliance is listening to the S-TAP. The port is dedicatedto the IP address of the appliance. Port 16022 or 16023 can also be in use onz/OS by another application.

Syntax:APPLIANCE_PORT(port_number)

Example:APPLIANCE_PORT(16022)

APPLIANCE_RETRY_INTERVAL

Required: No

Default: 3

Description: Specifies the time interval between attempts to establish aconnection to the Guardium system. The value is in number of seconds.

Syntax:APPLIANCE_RETRY_INTERVAL(retry_interval)

Example:APPLIANCE_RETRY_INTERVAL(3)

APPLIANCE_SERVER

Required: Yes

Default: None

Description: The host name or IP address (in dotted-decimal notation, forexample: 1.2.3.4) of the Guardium system to which the InfoSphere GuardiumS-TAP for DB2 audit data collector should connect.

Note: This parameter must be properly configured to enable collection of auditdata, and a connection to the Guardium system. The value can contain up to128 characters.

Syntax:APPLIANCE_SERVER(hostname|ip_address)

Example:APPLIANCE_SERVER(192.168.2.205)

Chapter 4. Reference information 23

APPLIANCE_SERVER_FAILOVER_[1-5]

Required: No

Default: None

Description: The host name or IP address (in dotted-decimal notation, forexample: 1.2.3.4) of the Guardium system to which the InfoSphere GuardiumS-TAP for DB2 audit data collector should fail over to if APPLIANCE_SERVERis not available.

Note:

1. This parameter must be properly configured to enable collection of auditdata and a connection to the Guardium system. The value can contain upto 128 characters.

2. The collector agent attempts to connect to the fail over systems beginningwith APPLIANCE_SERVER_FAILOVER_1, and ending withAPPLIANCE_SERVER_FAILOVER_5.

Syntax:APPLIANCE_SERVER_FAILOVER_1(hostname|ip_address)

Example:APPLIANCE_SERVER_FAILOVER_1(192.168.2.205)

AUDIT

Required: Yes

Default: None

Description: The DB2 subsystem ID for the DB2 subsystem on which the IBMz/OS S-TAP for DB2 Collector Agent should capture query data.

Note: This parameter must be properly configured to enable collection ofcapture data. The value can contain up to 4 characters.

Syntax:AUDIT(ssid))

Example:AUDIT(DSN1)

AUTHID

Required: No

Default: Defaults to the user ID under which the started task will run.

Description: The AUTHID parameter defines the DB2 AUTHID thatInfoSphere Guardium S-TAP for DB2 uses when establishing a connection toDB2. If you are using RACF on your DB2 system, this ID must be defined toRACF. The AUTHID specified needs to be authorized through the residentsecurity package, such as RACF, to perform the functions needed for allprocesses done by the started task and the Collector Agent monitoringsubsystem. Such processes include connecting to each of the monitored DB2SSIDs and performing file update activities against the IBM InfoSphereGuardium S-TAP for DB2 VSAM control file.

Notes:

1. The ID specified in the startup parameter AUTHID must be a valid TSOuser ID and not a RACF group name.


2. If the AUTHID parameter is defined in the RACF Started Procedures Table(ICHRIN03), it should not be used as a startup parameter. The StartedProcedures Table (ICHRIN03) associates the names of started procedureswith specific RACF user IDs and group names. It can also contain a genericentry that assigns a user ID or group name to any started task that doesnot have a matching entry in the table. However, it is recommended thatyou use the STARTED class for most cases rather than the startedprocedures table.

Syntax:AUTHID(db2authid)

Where db2authid is the DB2 AUTHID that InfoSphere Guardium S-TAP for DB2uses when establishing a connection to DB2.

Example:AUTHID(DB2USER)

DEBUG

Required: No

Default: N

Description: The DEBUG parameter turns on debug mode and producesdiagnostic messages for use by IBM Software Support.

Syntax:DEBUG(YES|NO)

Example:DEBUG(Y)

FORCE

Required: No

Default: N

Description: The FORCE parameter forces installation of a monitoring agent. Ifyou use this parameter, any return codes from any failure reported in messageADHQ2002E are overridden.

Note: This parameter should not be specified without instruction by IBMSoftware Support.

Syntax:FORCE(YES|NO)

Example:FORCE(Y)

HOSTVAR_LIMIT

Required: No

Default: 1500

Description: The HOSTVAR_LIMIT parameter designates the amount ofstorage to be allocated for host variable collection per event. The valid range is1 - 9999. If this parameter is not customized, the default value of 1500 is set.


If error message ADHQ1203I is encountered, with RC=0008, RSN=003F,increase the HOSTVAR_LIMIT setting to accommodate the collection of hostvariables for the monitored workload.

If InfoSphere Guardium S-TAP for DB2 and DB2 Query Monitor aresimultaneously monitoring the same DB2 subsystem, both products must havematching HOSTVAR_LIMIT settings to avoid receiving a mismatch error.

Syntax:HOSTVAR_LIMIT(n)

where n is an integer between 1 - 1500.

Example:HOSTVAR_LIMIT(1500)

ISM_CONSTRAINT_AGE

Required: No

Default: 300

Description: This parameter controls how much time must have passed sincethe last storage constraint occurrence for a given ISM storage space before theconstraint event is considered to have been relieved.

Syntax:ISM_CONSTRAINT_AGE(n)

where n is an integer between 1 - 60000 specified in .01 seconds. The defaultvalue is 300.

Example:ISM_CONSTRAINT_AGE(16)

ISM_ERROR_DETAIL

Required: No

Default: Y

Description: This parameter controls whether messages ADHQ1203I andADHQ1204I are issued to provide detailed information for ISM StorageConstraint situations. Recommendation is to leave this set to Y. This settingcan be overridden at run time with the /f cqmstc,ISMERROR_DETAIL command.

Syntax:ISM_ERROR_DETAIL(Y|N)

Example:ISM_ERROR_DETAIL(N)

ISM_ERROR_BLOCKS

Required: No

Default: 256

Description: This parameter determines the number of ISM Error Blocks thatare allocated when InfoSphere Guardium S-TAP for DB2 initializes.

If this value is too low, message ADHQ1219W might be issued. ISM ErrorBlocks communicate a storage constraint event from somewhere in the productto the task that issues storage constraint messages. If you run out of ISM ErrorBlocks, the storage constraint message will not be issued. However, an abend


table entry will be created to document this event. This is most likely atemporary situation and it does not impact the overall performance ofInfoSphere Guardium S-TAP for DB2.

Syntax:ISM_ERROR_BLOCKS(n)

where n is an integer, 16 - 8192. The default value is 256.

Example:ISM_ERROR_BLOCKS(256)

ISM_ERROR_MSG_BLOCKS

Required: No

Default: 256

Description: This parameter determines the number of ISM Error MessageBlocks that are allocated when InfoSphere Guardium S-TAP for DB2 initializes.If this value is too low, duplicate ISM error message can be issued for the samespace and reason instead of incrementing the occurrence count.

ISM Error Message Blocks are used by the task that issues storage constraintmessages to do two things:1. To consolidate similar storage constraint events to eliminate duplicate

messaging for the same condition, and2. To keep track of storage constraint events so that the Storage Constraint

Relieved situation can be detected and messaged.

If you run out of ISM Error Message Blocks, this consolidation will not alwaysoccur. This would result in additional, duplicate messages in the log for thesimilar storage constraint events.

Syntax:ISM_ERROR_MSG_BLOCKS(n)

where n is an integer between 16 - 8192. The default value is 256.

Example:ISM_ERROR_MSG_BLOCKS(16)

MASTER_PROCNAME

Required: Yes

Default: None.

Description: The MASTER_PROCNAME parameter enables users to specifythe PROCNAME to be used for the Master Address Space. Specifying thisparameter causes InfoSphere Guardium S-TAP for DB2 to use the 9.1 MasterAddress Space with the same name.v The MASTER_PROCNAME for InfoSphere Guardium S-TAP for DB2 and

Query Monitor must be the same when each is started at the same time forthe same DB2 Subsystem.

v If this InfoSphere Guardium S-TAP for DB2 9.1 Query Monitor MasterAddress Space is already started, it is shared with other InfoSphereGuardium S-TAP 9.1 subsystems that are already using it.

v If this Master Address Space has not already been started, it will startautomatically.

Syntax:


MASTER_PROCNAME(procname)

where procname is the specified Master Address Space PROCNAME (character,8 bytes).)

Example:MASTER_PROCNAME(CQMMASTR)

MAXIMUM_ALLOCATIONS

Required: No

Default: 2048

Description: This parameter determines the maximum amount of globalshared memory to be allocated by InfoSphere Guardium S-TAP for DB2 forinternal Integrated Storage Manager spaces.

Syntax:MAXIMUM_ALLOCATIONS(n)

where n is an integer between 512 - 32768 specified in megabytes; must besmaller than SMEM_SIZE.

Example:MAXIMUM_ALLOCATIONS(2048)

MESSAGE_LOG_LEVEL

Required: No

Default: I

Description: Controls the amount of output log information that is generatedby the agent:

I Includes all log messages with an "informational" severity or higher

W Includes all log messages with a "warning" severity or higher

E Includes all log messages with an "error" severity or higher

S Includes all log messages with a "severe" severity or higher

The ADHPARMS file is read when the agent is started. Modifying the log-levelsetting in the ADHPARMS file does not implement the new setting until yourestart the collector agent.

Note: During installation, it is recommended that you set theMESSAGE_LOG_LEVEL to I.

Syntax:MESSAGE_LOG_LEVEL(I|W|E|S)

Example:MESSAGE_LOG_LEVEL(I)

OUTAGE_SPILLAREA_SIZE

Required: No

Default: 0

Description: This parameter determines the maximum amount of memory tobe allocated to support the retention of audit data in the event of a Guardiumsystem connection outage.


Note: A value of 0 disables spillfile support. When enabled,OUTAGE_SPILLAREA_SIZE supersedes SEND_FAIL_EVENT_COUNT fortemporary data retention.

Syntax:OUTAGE_SPILLAREA_SIZE(n)

where n is an integer between 0 - 1024 specified in megabytes.

Example:OUTAGE_SPILLAREA_SIZE(2)

SEND_FAIL_EVENT_COUNT

Required: No

Default: 100

Description: Specifies the maximum number of events buffered duringcommunication outage with the Guardium system.

Note: SEND_FAIL_EVENT_COUNT and OUTAGE_SPILLAREA_SIZE aremutually exclusive. When OUTAGE_SPILLAREA_SIZE is specified, spillfilesupport is enabled, which supersedes SEND_FAIL_EVENT_COUNT fortemporary data retention.

Syntax:SEND_FAIL_EVENT_COUNT (event_count)where n is an integer between 0 - 1024 specified in megabytes.

Example:SEND_FAIL_EVENT_COUNT(1000)

SMEM_SIZE(5|n)

Required: No

Default: 5

Description: This parameter determines the maximum amount global sharedmemory to be allocated by InfoSphere Guardium S-TAP for DB2 for allpurposes.

Syntax:SMEM_SIZE(n)

where n is an integer between 3 - 32 specified in gigabytes; must be larger thanMAXIMUM_ALLOCATIONS.

Example:SMEM_SIZE(5)

STAGE1_FILTER

Required: No

Default: N

Description: The STAGE1_FILTER parameter enables the SQL Collector processto perform Stage 1 filtering. If you specify STAGE1_FILTER(Y), and the activeaudit collection profile is eligible for Stage 1 filtering, Stage 1 filtering isenabled. If STAGE1_FILTER is set to Y, message ADHQ1069I indicates whetherStage 1 filtering status is active or ignored, depending on the active collectionpolicy.


The default is STAGE1_FILTER(N).

Syntax:STAGE1_FILTER(Y|N)

Example:STAGE1_FILTER(N)

STAP_DB2TRACE_LOCAL

Required: No

Default: N

Description: The STAP_DB2TRACE_LOCAL parameter controls the SCOPE ofthe started IFI DB2 Trace in a data sharing group. IfSTAP_DB2TRACE_LOCAL is set to Y, the SCOPE of the trace is LOCAL, andthe DB2 IFI Trace is only started on the audited DB2 Subsystem. IfSTAP_DB2TRACE_LOCAL is set to N, the SCOPE of the trace is GLOBAL, andthe trace is started on all members of the data sharing group.

The default is STAP_DB2TRACE_LOCAL(N).

In non-data sharing group environments, the use of this parameter has noeffect.

Syntax:STAP_DB2TRACE_LOCAL (Y|N)

Example:STAP_DB2TRACE_LOCAL (N)

STAP_MEGABUFFER

Required: No

Default: Y

Description: When multiple InfoSphere Guardium S-TAP for DB2 audit eventsare accumulated in a buffer, it is referred to as a megabuffer. A megabufferreduces the CPU usage that is related to TCP/IP activity. To optimizeInfoSphere Guardium S-TAP for DB2 performance, STAP_MEGABUFFER mustremain set to Y. However, STAP_MEGABUFFER can be set to N when buffering isnot desired.

Setting the STAP_MEGABUFFER parameter to N eliminates buffering, and providesnear real-time event streaming to the Guardium appliance. It also increasesCPU usage, due to additional TCP/IP calls.

Syntax:STAP_MEGABUFFER(Y|N)

Example:STAP_MEGABUFFER(Y)

STAP_TERMINATE_OPTIMIZE

Required: No

Default: N

Description: This parameter can be used to improve the response time forprocessing STAP_TERMINATE requests from the Guardium appliance. Roundtriptime for STAP_TERMINATE activity is impacted by the STAP_MEGABUFFERparameter. STAP_TERMINATE policies require near real-time event recording to


the Guardium appliance, in order to analyze events against the policy, andissue the termination requests to InfoSphere Guardium S-TAP for DB2. Toenable near real-time event recording to the Guardium appliance, set theSTAP_MEGABUFFER parameter to N.

Syntax:STAP_TERMINATE_OPTIMIZE(Y|N)

Example:STAP_TERMINATE_OPTIMIZE(N)

STAP_UTILITY_MULTITABLE

Required: No

Default: N

Description: The STAP_UTILITY_MULTITABLE parameter works inconjunction with the STAP_UTILITY_TS_TO_TABLE parameter. Theseparameters control how table information is reported for DB2 Utility accessevents that involve tablespaces. The STAP_UTILITY_MULTITABLE parametercontrols the behavior of the collector when multiple tables are contained in thetablespace. When STAP_UTILITY_MULTITABLE is set to Y:v The collector will report all tables in the tablespace that are impacted by the

utility. This guarantees that tablespace access by a utility execution willresult in an audit event against the table name.

v Tables within a tablespace, which were not accessed by the utility, might bereported.

When STAP_UTILITY_MULTITABLE is set to N, no attempt is made to reporttable information for multi-table tablespaces accessed by a utility. Only thetablespace name is reported.

Syntax:STAP_UTILITY_MULTITABLE(Y|N)

Example:STAP_UTILITY_MULTITABLE(N)

No table names are reported (default).STAP_UTILITY_MULTITABLE(Y)

All table names are reported.

STAP_UTILITY_TS_TO_TABLE

Required: No

Default: Y

Description: The STAP_UTILITY_TS_TO_TABLE parameter controls how tableinformation is reported for DB2 Utility accesses to tablespaces. When theparameter is set to Y, the collector queries the DB2 catalog. The collector thendetermines and reports on which table exists within the tablespace that hasbeen accessed by the utility execution. If multiple tables are contained in thetablespace, the STAP_UTILITY_MULTITABLE parameter controls whether thecollector reports either:

All tablesAll table names in the accessed tablespace


No tablesOnly the tablespace is reported.

This action is controlled by STAP_UTILITY_MULTITABLE parameter setting.

Syntax:STAP_UTILITY_TS_TO_TABLE(Y|N)

Example:STAP_UTILITY_TS_TO_TABLE(Y)

SUBSYS

Required: No

Default: The default value is the DB2 subsystem name.

Description: The SUBSYS parameter defines the SQL Collector subsystemname. The subsystem name does not need to correspond to a DB2 subsystemnor an MVS operating system name. The name must be 1-4 characters inlength.

Syntax:SUBSYS(ssid)

Where ssid is the 1-4 character SQL Collector subsystem name.

Note: The SQL Collector subsystem ID must be unique across the SYSPLEX. ASQL Collector component subsystem must be running on each LPAR that has aDB2 subsystem to be captured. When choosing a collector agent subsystem IDname, be sure it will not conflict with another on the SYSPLEX. If the specifiedSUBSYS is not unique across the SYSPLEX, message ADHQ1003E will beissued.

Example:SUBSYS(ADH1)

ZIIP_FILTER(Y|N)

Required: No

Default: ZIIP_FILTER(N)

Description:

v ZIIP_FILTER(Y) indicates that the z/OS image running the collector agentstarted task has an IBM System z® Integrated Information Processor (zIIP).In this case, allow collector agent to perform offload profile filtering to azIIP.

v If ZIIP_FILTER(Y) is specified and the collector agent started task is runningon a z/OS that has no zIIP, message ADHQ1060I is issued, indicating theWLM related service has failed. In this case, collector agent continues to runas if ZIIP_FILTER(N) were set.

Syntax:ZIIP_FILTER(Y)

Example:ZIIP_FILTER(Y)

ZIIP_TCP(Y|N)

Required: No

Default:ZIIP_TCP(N)

Description:


v ZIIP_TCP(Y) indicates that the z/OS image running the collector agentstarted task has an IBM System z Integrated Information Processor (zIIP). Inthis case, allow collector agent to offload TCP/IP message processing to azIIP.

v If ZIIP_TCP(Y) is specified and the collector agent started task is running ona z/OS that has no zIIP, message ADHQ1060I is issued, indicating the WLMrelated service has failed. In this case, collector agent continues to run as ifZIIP_TCP(N) were set.

Note: ZIIP_TCP(Y) requires that zIIP filter support be enabled:ZIIP_FILTER(Y). If ZIIP_FILTER(N) and ZIIP_TCP(Y) are specified together,ZIIP_FILTER will be automatically set to Y.

Syntax:ZIIP_TCP(Y)

Example:ZIIP_TCP(Y)

/f cqmstc,ISMERROR_DETAIL(Y|N)

Description: This parameter controls whether ISM constraint message detail ison or off. When the parameter is specified, messages ADHQ1203I andADHQ1204I are issued for ISM storage constraint situations.

Collector agent sample parameter fileThe following sample parameter file is the minimum set of parameters required ina collector agent parameter file (ADHCFGP). If you want to use this sample file,verify that the values on each parameter are appropriate for your environment.- 5655-STP- (C) COPYRIGHT ROCKET SOFTWARE, INC. 1999 - 2012 ALL RIGHTS RESERVED.-- MEMBER: ADHCFGP-- DESCRIPTION: THIS IS A SAMPLE MINIMUM ADHCFGP MEMBER- USED FOR IBM INFOSPHERE GUARDIUM S-TAP for DB2 on z/OS- COLLECTOR AGENT STARTUP.- VERIFY THAT THE VALUES ON EACH PARM ARE APPROPRIATE- FOR YOUR ENVIRONMENT.-- NOTE: AFTER USING THE EDIT MACRO, VERIFY THAT NONE OF THE- STATEMENTS EXCEED COLUMN 72 IN LENGTH.--SUBSYS(#SSID) -AUDIT(#SSID) -MASTER_PROCNAME(ADHMST31) -APPLIANCE_SERVER(#APPSRVR)


ADHEMAC1 edit macro variablesThis table shows the ADHEMAC1 edit macro variables, including their defaultvalue and instructions for use. An example is also provided.

Table 6. ADHEMAC1 Edit macro variables

Variable Default Instructions

#SSID MYSSID Change the default to a valid DB2 subsystemID.Note: The ADHEMAC1 macro sets theSUBSYS parameter using the #SSID variable.Running the macro sets SUBSYS to the DB2subsystem ID used by the collector agenttask. Do not change the #SSID variable in theADHEMAC1 macro to be anything otherthan the DB2 subsystem ID used by thecollector agent task.

#ADHOWNER &ZUSER Change &ZUSER to the value of#ADHQUALIFIER. #ADHOWNER is used toconfigure the owner of the plans andpackages. It is used as the owner value ofobjects created by statements containedwithin the package or plan.

#ADHUSERID &ZUSER Use as the authorization ID for the collectoragent task.

#SADHLOAD ADH.IBMTAPE.SADHLOAD

Change the default to the data set containingthe InfoSphere Guardium S-TAP for DB2load modules.

#SADHDBRM ADH.IBMTAPE.SADHDBRM

Change the default to the data set containingthe InfoSphere Guardium S-TAP for DB2DBRMs.

#SDSNLOAD DSN.Vxxx.SDSNLOAD Change the default to the data set containingthe DB2 load modules.

#SDSNRUNL DSN.Vxxx.RUNLIB.LOAD Change the default to the data set containingthe DB2 DSNTEP2 module.

#DSNTEP2 DSNTEP2 Change the default to the DSNTEP2 planname.

ADHPLAN1 ADHPLAN1 Change the default to a valid plan name.This plan used to collect information aboutthe DB2 System catalog during audit datacollection.

#SZPARM MYSSIDPARM Change the default to the DB2 ZPARMmember that is associated with the DB2subsystem.

#SBSDS01 MYSSID.BSDS01 Change the default to the DSN of thebootstrap data set 01.

#SBSDS02 MYSSID.BSDS02 Change the default to the DSN of thebootstrap data set 02.

#SDSNEXIT DSN.Vxxx.SDSNEXIT Change the default to the data set containingthe DB2 ZPARMs.

#SFECLOAD None Data set name of the required FEC loadlibrary.

#SCQCLOAD None Data set name of the required CQC loadlibrary.

#ADHCNTRLFILE None Name of the control file that is allocated byusing the ADHSJ000 job.

#APPSRVR None System name or IP address of the Guardiumsystem server.


The following example shows the contents of the ADHEMAC1 member:ISREDIT MACRO (NP)ISPEXEC VGET (ZUSER)ISREDIT CHANGE ALL ’#SSID’ MYSSIDISREDIT CHANGE ALL ’#ADHOWNER’ &ZUSERISREDIT CHANGE ALL ’#ADHUSERID’ &ZUSERISREDIT CHANGE ALL ’#SADHLOAD’ ADH.IBMTAPE.SADHLOADISREDIT CHANGE ALL ’#SADHDBRM’ ADH.IBMTAPE.SADHDBRMISREDIT CHANGE ALL ’#SDSNLOAD’ DSN.Vxxx.SDSNLOADISREDIT CHANGE ALL ’#SDSNRUNL’ DSNxxx.RUNLIB.LOADISREDIT CHANGE ALL ’#DSNTEP2’ DSNTEP2ISREDIT CHANGE ALL ’ADHPLAN1’ ADHPLAN1ISREDIT CHANGE ALL ’#SZPARM’ MYSSIDPARMISREDIT CHANGE ALL ’#SBSDS01’ MYSSID.BSDS01ISREDIT CHANGE ALL ’#SBSDS02’ MYSSID.BSDS02ISREDIT CHANGE ALL ’#SDSNEXIT’ DSN.Vxxx.SDSNEXITISREDIT CHANGE ALL ’#SFECLOAD’ FEC.IBMTAPE.SFECLOADISREDIT CHANGE ALL ’#SCQCLOAD’ CQC.IBMTAPE.SCQCLOADISREDIT CHANGE ALL ’#ADHCNTRLFILE’ ADH.V0901.CONTROLISREDIT CHANGE ALL ’#APPSRVR’ appliance.company.com

Related tasks:“Customizing JCL members” on page 9Use the edit macro ADHEMAC1 to customize the variables in the JCL to be run.


Chapter 5. Messages and codes for IBM InfoSphere GuardiumS-TAP for DB2 on z/OS

These topics document the messages and error codes issued by InfoSphereGuardium S-TAP for DB2. Messages are presented in ascending alphabetical andnumerical order.

Error messages

InfoSphere Guardium S-TAP for DB2 error messages adhere to the followingformat: ADHnnnx

Where:

ADH Indicates that the messages was issued by InfoSphere Guardium S-TAP forDB2.

nnn Indicates the message identification number.

x Indicates the severity of the message:

Table 7. Error message severity codes

Severity Code Description

A Indicates that operator intervention is required beforeprocessing can continue.

E Indicates that an error occurred, which might or might notrequire operator intervention.

I Indicates that the message is informational only.

W Indicates that the message is a warning to alert you to apossible error condition.

Error messages and codes: ADHAxxxThe following information is about error messages and codes that begin withADHA.

ADHA002E Unsuccessful OPEN of ISPSLIB memberADHIN1

Explanation: An OPEN request failed for the specifiedmember.

User response: Verify that the member exists.

ADHA003E Unsuccessful OPEN of temp file filename

Explanation: The temporary JCL file could not beopened.

User response: Verify the validity of the data set namefor your site.

ADHA005E ISPSLIB member ADHIN1 bad recordstarting recid

Explanation: A bad record was found in the specifiedmember.

User response: Use the record identifier to locate thebad record and correct the entry.

ADHA006E Bad date format or value

Explanation: A date format or value incorrect.

User response: Use the specified formats and/orverify the correctness of YYYYMMDD values.

ADHA007E Bad time format or value

37

Explanation: A time format or value is incorrect.

User response: Use the specified formats and/orverify the correctness of HHMMSS values.

ADHA011E No RBAs found in BSDS for therequested log range

Explanation: The log range specified was outside therange of the contents of the bootstrap data set (BSDS).

User response: Verify the specified log ranges. If thelog ranges look correct, the possible reasons for thiserror are:

1. The ranges specified were greater than the highestranges for the currently active log.

2. Date gaps might exist in the BSDS for the DB2 logs.

If step 1 occurs, archive the log and retry. Otherwise,check the BSDS log ranges. The DB2 supplied utilityDSNJU004 may be run against the BSDS to determinethe log ranges and logs known to DB2.

ADHA012E The BSDS start date for logs was > therequested end date

Explanation: The BSDS contains no information forthe DB2 logs in the date range specified. The BSDSkeeps only a certain amount of data for the logs basedon installation settings. Once the BSDS reaches itslogging maximum, the most recent archive data wrapsaround, thereby overlaying older log data.

User response: The DB2 supplied utility DSNJU004may be run against the BSDS to determine the datesand logs known to DB2.

ADHA016E Filter input bad record: recid.

Explanation: The filter input (DD DATAIN) containeda bad record. It is most likely that this would onlyoccur if you edited the input records. The first 20characters of the offending record is shown.

User response: Correct the filter input and retry.

ADHA018E OPEN failure on DATAIN input data set

Explanation: An OPEN request failed for the specifiedddname.

User response: Verify that the DD name exists in theJCL.

ADHA019E DATAIN input file has bad recordstarting with: recid

Explanation: A bad record was encountered whileprocessing the specified data set.

User response: Use the record identifier to locate andcorrect the record.

ADHA021E Error occurred during error processing:Ret: code

Explanation: An error occurred while error processingwas in effect. The return code values are:

v 14 - missing a quote in the ISPMLIB membermessage.

v 16/28 - OPEN failed/abended.

For 28, a bad message ID may have been entered.

v 20 - dynamic allocation failure for ISPMLIB.

v 24 - dynamic deallocation failure for ISPMLIB.

User response: Contact IBM Software Support.

ADHA022E OPEN failure for GENRPT output file

Explanation: An OPEN request for the specified dataset failed.

User response: Verify the existence of the DD name inthe JCL.

ADHA023E BSDS VSAM OPEN error: Ret: code, Res:code

Explanation: An OPEN failure occurred whileattempting to access the bootstrap data set.

User response: The return and reason codes can befound in the IBM document DFSMS Macro InstructionsFor Data Sets. Correct and retry.

ADHA024E BSDS VSAM GET error: Ret: code, Res:code

Explanation: A GET failure occurred while attemptingto access the bootstrap data set.

User response: The return and reason codes can befound in the IBM document DFSMS Macro InstructionsFor Data Sets. Correct and retry.

ADHA026E Table owner: userid, Table: tablename; notfound in DB2

Explanation: The specified table owner and name wasnot found in DB2. Either the table has been dropped, orit never existed.

User response: Change the table owner and name andretry.

ADHA027E DBname: name, TSname: name; notfound in DB2

Explanation: The specified database/table space wasnot found in DB2. Either the table space has beendropped, or it never existed.

User response: Change the database or table spacename and retry.

ADHA011E • ADHA027E


ADHA028E Any set of log range values requiresboth start and end values.

Explanation: To request either an RBA or LRSN logrange, both the start and end values must both bepresent.

User response: Correct and retry.

ADHA029E Start log range not less than end logrange value.

Explanation: To request either an RBA or LRSN logrange, the start value must be less than the end value.

User response: Correct and retry.

ADHA032E No point-in-time conversion was found.

Explanation: An interface request was made toconvert between a date/time, LRSN, or RBA values.However, no conversion was possible. This is mostlikely due to bad input values. For example, if therequested input value was a date/time value that isbeyond the current date/time, this error would occur.

User response: Validate your input and retry.

ADHA033E No SSID found for details report

Explanation: No SSID was found which may meanthat no database activity report (general) was run priorto running the detail report.

User response: Verify that the general report was run.

ADHA034E The job job-name / job-id was abandoned.

Explanation: The specified job did not end in a timelyfashion after it was cancelled.

User response: The specified job did not end in atimely fashion after it was cancelled. Use native JESfacilities to check the status of the job, and take furtheractions if necessary.

ADHA037E Process halted, memory exhausted forname.

Explanation: An internal storage area was filledbeyond capacity and the processing was halted at thatpoint.

User response: Narrow your filter ranges and retry. Ifthis occurs frequently, contact your productadministrator to alert vendor.

ADHA038E Unsuccessful OPEN of the REFILE.

Explanation: The REFILE could not be opened.

User response: Verify the existence of the DD namedREFILE in your JCL. Also, verify the correctness of theassociated data set name.

ADHA039E Unsuccessful OPEN for DD ROWDATA,reason code: code.

Explanation: The VSAM file associated with theROWDATA DD statement could not be opened. Thereason code is a standard OS/390 VSAM error code.

User response: Verify the existence of the ROWDATADD statement in your JCL and the associated data setname.

ADHA040E Unsuccessful PUT for ROWDATA DD,reason code: code.

Explanation: The VSAM file associated with theROWDATA DD statement could not be written to.

User response: Check the reason code included withthe message in the IBM document DFSMS MacroInstructions For Data Sets.

ADHA042E An unknown type of log record wasfound. It is dumped below. <Messagedump.>

Explanation: A log record was read, but the programcould not decipher its type, based on known log recordmappings. The first 70 bytes of the offending log recordare dumped with this message.

User response: Notify your product administrator.

ADHA043E GENCB for ACB failed in ADHPGR:return code: code.

Explanation: The GENCB statement failed in thespecified program.

User response: Check the IBM document DFSMSMacro Instructions For Data Sets" for return codeexplanations.

ADHA044E GENCB for RPL failed in ADHPGR:return code: code.

Explanation: The GENCB statement failed in thespecified program.

User response: Check the IBM document DFSMSMacro Instructions For Data Sets for return codeexplanations.

ADHA045E OPEN err DSN: name, res cde: code.

Explanation: The OPEN request failed for the nameddata set.

User response: Verify validity of the data set name.Check the IBM document DFSMS Macro Instructions ForData Sets for reason code explanations.


Chapter 5. Messages and codes for IBM InfoSphere Guardium S-TAP for DB2 on z/OS 39

ADHA046E GET err DSN: name, res cde: code.

Explanation: The GET request failed for the nameddata set.

User response: Check the IBM document DFSMSMacro Instructions For Data Sets" for reason codeexplanations.

ADHA047E CAF error: Unable to CONNECT toSSID: ssid.

Explanation: The Call Attach Facility was unable toCONNECT to the named subsystem.

User response: Verify that the subsystem name iscorrect and that is up and running.

ADHA048E CAF error: Unable to OPEN plan: name.

Explanation: The Call Attach Facility was unable toOPEN the named PLAN.

User response: Verify that the PLAN name is correctand that it has been bound.

ADHA049E OPEN failed for PLOGD DD data set.

Explanation: The OPEN request for the PLOGD DDfailed.


ADHA050E OPEN err for ROWDATA, res cde: code.

Explanation: The VSAM file associated with theROWDATA DD statement could not be opened.

User response: Check the reason code included withthe message in the IBM document DFSMS MacroInstructions For Data Sets for descriptions of VSAMOPEN errors.

ADHA051E GET err for ROWDATA, res cde: code.


User response: Check the reason code included withthe message in the IBM document DFSMS MacroInstructions For Data Sets for descriptions of VSAM GETerrors.

ADHA052E PUT err for ROWDATA, res cde: code.


User response: Check the reason code included withthe message in the IBM document DFSMS MacroInstructions For Data Sets for descriptions of VSAM PUTerrors.

ADHA053E OPEN error for DD FRMTFILE.

Explanation: An OPEN attempt failed for this DDstatement.

User response: This should not occur; contact IBMCustomer Support.

ADHA054E OPEN error for DD CATFILE.

Explanation: An OPEN attempt failed for this DDstatement.

User response: This should not occur; contact IBMCustomer Support.

ADHA061W Log RID mismatch with page RID;variable1 - variable5

Explanation: When reading the data page associatedwith a log record modification, it was determined thatthe data page row ID did not match the log page rowID. This causes processing to shutdown for thisparticular table space. The table is identified by thevariables in the message, listed as such: page number,row ID, DBID, PSID, and OBID. These values are allfrom the log record. This can occur for many reasons,such as if a table was REORGed, was recreated, or thelog record data is still in the DB2 buffer pool.

User response: If this latter case is likely, retry after aQUIESCE on the database. Otherwise, use alog-forward mode process.

ADHA064E Dyn alloc err: DDname: name, Ret: code,Res: code

Explanation: An internal dynamic allocation attemptfailed for the specified DD name. The return code andreason codes are SVC 99 standard codes and can befound in the IBM manual, Authorized Assembler ServicesGuide, in the chapter, Requesting Dynamic AllocationFunctions. The most common codes likely to beencountered are:

v 0210/0410 - ddname unavailable or in use byanother user.

v 0420 - ddname associated with an already openeddata set.

v 1708 - data set associated with ddname not found.


ADHA065E Unsuccessful OPEN of name

Explanation: An unsuccessful OPEN was issued forthe specified ddname. The data set may not beallocated or already open.

User response: Logging off TSO may resolve thisproblem.



ADHA066E DB2PARMS file bad for ssid, missingconfiguration information.

Explanation: For the SSID specified on the message,there is missing common configuration information.

User response: Verify with your product administratorthat all the necessary configuration information hasbeen supplied for the SSID.

ADHA067E DB2PARMS file does not haverequested SSID: ssid

Explanation: The configuration file has no entry forthe specified subsystem.

User response: Edit the configuration file to add thespecified subsystem.

ADHA068E DYN:DSName: name, code, code

Explanation: An internal dynamic allocation attemptfailed for the specified dsname. The reason code andinfo codes follow after the DSName field. These codesare SVC 99 standard codes and can be found in theIBM manual, Authorized Assembler Services Guide, in thesection, Requesting Dynamic Allocation Functions. Themost common codes likely to be encountered are:

v 0210/0410 - ddname unavailable or in use byanother user

v 0420 - ddname associated with an already openeddata set

v 1708 - dsname not found


ADHA107E No useable image copy found fortablespace name.

Explanation: A full image copy was not found for thespecified table space. An image copy must exist priorto the time of your earliest log records. If none can befound earlier than that time, no useable image copyexists. For example, if you INSERT many records andsubsequently take an image copy of the table space,that image copy is not useable for the INSERTs becauseit occurred after them.

User response: Verify that a full image copy isavailable prior to the time of your earliest log recordactions for the table space.

ADHA200I (ACM) Collection Manager started.

Explanation: The Collection Manager has started.

User response: No action is required.

ADHA201I (ACM) Collection Manager stopped.

Explanation: The Collection Manager has stopped.


ADHA202I (AEC) Started collecting events.{collection-name: collection-name,agent-id: agent-id }.

Explanation: InfoSphere Guardium S-TAP for DB2 hasbegun collecting events for the specified collection andagent.


ADHA203I (AEC) Stopped collecting events.{collection-name: collection-name,agent-id: agent-id }.

Explanation: InfoSphere Guardium S-TAP for DB2 hasstopped collecting events for the specified collectionand agent.


ADHA204I (AFM) Filters Monitor started.

Explanation: The Filters Monitor has started.


ADHA205I (AFM) Filters Monitor stopped.

Explanation: The Filters Monitor has stopped.


ADHA206F (AEC) Collecting events.

Explanation: InfoSphere Guardium S-TAP for DB2 iscurrently collecting events.


ADHA207F (AEC) Scheduled next collect to occurafter seconds seconds.

Explanation: The next collection is schedule to occurafter the specified number of seconds.


ADHA208I (ADM) Started monitoring events.

Explanation: InfoSphere Guardium S-TAP for DB2 hasstarted monitoring events.


ADHA066E • ADHA208I


ADHA209I (ADM) Stopped monitoring events.

Explanation: InfoSphere Guardium S-TAP for DB2 hasstopped monitoring events.


ADHA210I (ADM) Processed xxx event(s).

Explanation: InfoSphere Guardium S-TAP for DB2 hasprocessed the specified number of events.


ADHA211I (ACM) Loading fresh filters.

Explanation: InfoSphere Guardium S-TAP for DB2 isloading fresh filters.


ADHA212F (ADM) No new events collected.


ADHA219I Interval processing started.

Explanation: InfoSphere Guardium S-TAP for DB2Thread has started agent interval processing. All eventsin memory will be written to Offload data sets. Offloaddata sets will be closed for the current interval.


ADHA220I Interval processing ended.

Explanation: InfoSphere Guardium S-TAP for DB2Thread has completed agent interval processing.


ADHA310E (ADM) Invalid storage mode:mode-number. Terminating the agent.

Explanation: The storage mode setting is set to anunrecognized value.

User response: Verify that the agent data storagemode is set correctly in the Administration client. If theproblem persists, collect the diagnostic information (joblog output) and provide to IBM Software Support.

ADHA501E A callable services abend abend-code hasoccurred.

Explanation: A callable services abend has occurred.

User response: Contact IBM Customer Support.

ADHA502E GPRS register-register: value value valuevalue

Explanation: An abend has occurred.

User response: No action is required. Preceding orfollowing messages provide more information aboutthe abend that occurred.

ADHA503E Active module not found.

Explanation: The active module was not found.

User response: None required. Preceding or followingmessages provide more information about the abendthat occurred.

ADHA504E Active module = module-name, load point= address, offset = offset.



ADHA505E PSW = psw-contents.



ADHA507E Callable service invocation failed withreturn code = rc and reason code = rs

Explanation: A callable service invocation failed witha return code and reason code that are identified in themessage.

User response: Issue the DB2 command -DISPLAYTRACE to view info about any audit traces that mightstill be running. If audit traces are running, stop themusing the DB2 command -STOP TRACE and then restartthe agent. If this does not resolve the problem, checkfor the existence of additional messages. If the problemis not resolved after attempting all user responses forexisting additional messages, contact IBM CustomerSupport.

ADHA508E ADHCSI SQL code = sql-code, reasoncode = reason-code.

Explanation: An SQL error has occurred.

User response: See the IBM manual, DB2 Messages andCodes for more information about the specified SQLcode and SQL state values. Ensure that the productpackages have been bound at the connected location.

ADHA209I • ADHA508E


ADHA509E The data set data-set-name does not existon volume volume.

Explanation: The specified image copy or log data setis recorded as being cataloged on the specified volume,but it does not exist on that volume.

User response: Regenerate recovery plans. You mayneed to take a new image copy with the COPY utilityto replace the missing data set.

ADHA513E An error occurred while submitting thejob: RC rc.

Explanation: An error occurred while submitting thejob.

User response: Use Native JES facilities to check thestatus and review the output of the job to diagnose theerror. If unable to resolve the error(s), contact IBMSoftware Support.

ADHA514I Job jobname was submitted.

Explanation: The job was submitted successfully.

User response: The specified image copy data set isrecorded as being cataloged, but in fact, it is notcataloged. Regenerate recovery plans. You may need totake a new image copy with the COPY utility to replacethe missing data set.

ADHA527E Job job-number (beginning with \"jcl-text...\") has invalid job cards.

Explanation: The job that is identified in the messagehas invalid job cards.

User response: Specify valid job cards in the job. Thejob cards must not exceed 72 characters in length, andmust include a job name on the JOB statement.

ADHA530I Invoking callable service service-name.

Explanation: Invoking a callable service that isidentified in the message.


ADHA531I Returned from callable serviceservice-name

Explanation: Returned from a callable service that isidentified in the message.


ADHA034E The job job-name / job-id was abandoned.

Explanation: The specified job did not end in a timelyfashion after it was cancelled.

User response: The specified job did not end in atimely fashion after it was cancelled. Use native JES

facilities to check the status of the job, and take furtheractions if necessary.

ADHA535E The job job-name / job-id abendedabend-code.

Explanation: The job that is identified in the messageabended.

User response: Use native JES facilities to check thestatus and review the output of the job to diagnose theerror.

ADHA536E The job job-name / job-id was cancelled.

Explanation: The job was cancelled due to a userrequest.

User response: None required. The job was cancelleddue to a user request.

ADHA537E The job job-name / job-id did not run.

Explanation: The job that is identified in the messagedid not run.


ADHA538E The job job-name / job-id ended with aJCL error.

Explanation: The job that is identified in the messageended with a JCL error.


ADHA539E The job job-name / job-id ended withMAXCC = max-cc

Explanation: The job that is identified in the messageended with an error.


ADHA540W The job job-name / job-id ended withMAXCC =max-cc.

Explanation: The job that is identified in the messageended with a warning.


ADHA509E • ADHA540W


ADHA541I The job job-name / job-id ended withMAXCC =max-cc.

Explanation: The job that is identified in the messageended successfully.


ADHA542E The job job-name / job-id is running.

Explanation: The job that is identified in the messageshould have ended, but is still running.


ADHA543E A severe error occurred while runningjob job-name / job-id.

Explanation: A severe error occurred while runningjob that is identified in the message.


ADHA544E Validation of job_card_type failed. Jobjob_name/job-id Reason: reason..

Explanation: Validation of the job card specified byjob_card_type failed. The job is identified (if available)along with the reason for the failure.

User response: Correct and retry validating the jobcard depending on the output in the job outputspecified by the job-name and job-id and the reasoncode. If unable to resolve the error(s), contact IBMSoftware Support.

ADHA548E Validation of DB2 Load job card failed.Job: xxxx Reason: NOT FOUND

Explanation: Validation of the job card specified byjob_card_type failed. The job is identified (if available)along with the reason for the failure.

User response: Correct and retry validating the jobcard depending on the output in the job outputspecified by the job-name and job-id and the reasoncode. If you are unable to resolve the error(s), contactIBM Software Support.

ADHA650I Contents of DB2 LOAD Job SYSPRINTDD, file filename.

Explanation: This is an informational message statingthe name of the DB2 Load Job's SYSPRINT DD.


ADHA651I Processing DB2 LOAD Job SYSPRINTDD PDS name for Job (job name/jobID).

Explanation: This is an informational message statingthe DB2 Load Job SYSPRINT DD with the specified jobname and job ID is being processed.


ADHA652I SYSPRINT DD Contents for Job Name:job name, Job ID: job ID.

Explanation: This is an informational message statingthe job name and job ID for the SYSPRINT DD of thecurrent DB2 Load Job.


ADHA653I Unrecognized Output Start Message ForLoad Utility: (message).

Explanation: The specified message warns of apossible unrecognized error message by the DB2 LoadJob.

User response: The error may have been caused byany number of reasons. Follow up on the specifiederror message provided diagnose the problem. If theproblem persists, collect the diagnostic information (joblog output) and provide to IBM Software Support.

ADHA655I Number of records loaded: number.

Explanation: This is an informational messageindicating the total number of records loaded by theDB2 Load Job utility.


ADHA656I Succeeded with RC=return code.

Explanation: The DB2 Load Job utility has returnedsuccessfully. A return code of RC=0 specifies successfulloading and processing of the DB2 Load Job.

User response: A return code higher than zero mayindicate a problem with the loading and processing ofthe job and thus requires further investigation.

ADHA663E Job is not executing and cannot belocated. Terminating.

Explanation: A status query of an agent-submitted jobfailed because the job could not be located in JES.

User response:

1. Determine the cause of the status query failure byreviewing the job card for the specified job.

2. Verify that the job is routed to a HELD outputqueue by reviewing the system log to determine thedisposition of the specified job. For example, this

ADHA541I • ADHA663E


error could be encountered if an outsideuser/process purged the job from the output queue.

3. Correct the error and restart the agent.

ADHA701E AAPI invocation failed with return code= nnnnnnnn (ssss).

Explanation: The AAPI invocation failed with thereturn code and string indicated in the message.

Note: AAPI is the abbreviation for the collector agentApplication Programming Interface.

User response: Diagnose the problem using the returncode in the message. Attempt to stop and restart theInfoSphere Guardium S-TAP for DB2 Agent to clear theerror. Return codes and the corresponding string willbe one of the following:

AAPI_INVALID_SUBSYSTEM - 0x000004This error usually occurs during the startup ofthe collector agent address space. It indicatesan issue with the start up of the collectoragent PROC. Consult the collector agentPROC's log to check the errors and correctthem.

AAPI_API_INITIALIZED - 0x00000CContact IBM Software Support.

AAPI_API_NOT_INITIALIZED - 0x000010Contact IBM Software Support.

AAPI_VSAM_INIT_ERROR - 0x000014This error might occur while attempting toselect or read from a collector agent intervaldata set. The data set might have been deletedoutside of the control of collector agent or theagent. Contact IBM Software Support if thisoccurs again.

AAPI_VSAM_LOGIC_ERROR - 0x000018This error might occur while attempting toselect or read from a collector agent intervaldata set. The data set might have been deletedoutside of the control of collector agent or theagent. Contact IBM Software Support if theerror continues to occur for the same intervaldata set.

AAPI_OPEN_ERROR - 0x00001CThis error might occur while attempting toselect or read from a collector agent intervaldata set. The data set might have been deletedoutside of the control of collector agent or theagent. Contact IBM Software Support if theerror continues to occur for the same intervaldata set.

AAPI_IVSM_ERROR - 0x000054This error might occur while attempting toselect or read from a collector agent intervaldata set. The data set might have been deletedoutside of the control of collector agent or the

agent. Contact IBM Software Support if theerror continues to occur for the same intervaldata set.

AAPI_DYNALLOC_ERROR - 0x00006CThis error might occur while attempting toselect or read from a collector agent intervaldata set. The data set might have been deletedoutside of the control of collector agent or theagent. Contact IBM Software Support if theerror continues to occur for the same intervaldata set.

AAPI_SUBSYSTEM_INACTIVE - 0x000020Contact IBM Software Support.

AAPI_collector agentRE_FAILED - 0x00002CContact IBM Software Support.

AAPI_START_IN_PROGRESS - 0x000030Contact IBM Software Support.

AAPI_POST_ERROR - 0x000034Contact IBM Software Support.

AAPI_DB2_AGENT_INACTIVE - 0x00003CContact IBM Software Support.

AAPI_DB2_SUBSYSTEM_NOT_AUDITED - 0x000040Contact IBM Software Support.

AAPI_DB2_SUBSYSTEM_INACTIVE - 0x000044Contact IBM Software Support.

AAPI_RULE_LIST_MISMATCH - 0x000048Contact IBM Software Support.

AAPI_ABEND_OCCURRED - 0x00004CContact IBM Software Support.

AAPI_INTERVAL_DATASETS_EXIST - 0x000050No action is required.

AAPI_COMMUNICATIONS_NOT_SETUP - 0x000058Contact IBM Software Support.

AAPI_PARAMETER_ERROR - 0x000060The collector agent PROC encountered anerror while reading the parameters. Consultthe collector agent PROC log for more details.

AAPI_PARAMETER_MEMBER_NOT_FOUND -0x000068

The collector agent PROC encountered anerror while reading the parameters. Consultthe collector agent PROC log for more details.

AAPI_TIMEOUT - 0x000064This might occur during termination and canindicate the collector agent PROC is takinglonger than usual while terminating. Checkthe collector agent PROC and verify that itterminates. If it does not terminate, or thiserror occurs during the normal course ofoperation, contact IBM Software Support.

AAPI_AGENT_INSTALL_FAILURE - 0x000074Check the PROC log of the collector agent to

ADHA701E


see if there were any errors. Contact IBMSoftware Support if needed.

ADHA702E VSAM nnnnnnnn nnnnnnnn nnnnnnnn

Explanation: This message is issued in conjunctionwith other message and displays VSAM information.


ADHA703E DYNALLOC 00000000 00000000

Explanation: This message is issued in conjunctionwith other message and displays dynamic allocationinformation.


ADHA704E DSNAME

Explanation: This message is issued in conjunctionwith other messages and displays the data set name.


ADHA705E OPEN 00000000 00000000

Explanation: This message is issued in conjunctionwith other messages and displays (need info).


ADHA850I (Collector Agent) Processing data frominterval nn (timestamp = ssss).

Explanation: The interval data sets are being read andparsed in preparation for normalization.

User response: None required.

ADHA851I (Collector Agent) Retrieved nn record(s).

Explanation: This message indicates the number ofrecords that were retrieved for the interval.


ADHA852I (Collector Agent) Normalizing nnrecord(s).

Explanation: Indicates the records are being processedby the normalization engine.


ADHA853E (ASC) Found nn unprocessed records atthe end of processing.

Explanation: This message is accompanied with atrace of the unprocessed records and indicates thatsome records retrieved from the interval data set didnot have enough information to be processedsuccessfully.

User response: Contact IBM Software Support andprovide the trace produced with the message.

ADHA854I (ASC) Completed processing interval nn(timestamp = ssss).

Explanation: Interval processing has completed for theinterval number indicated in the message.


ADHA855I (ASC) Started auditing for ssid usingaddress space address-space-name.

Explanation: Auditing has been initiated for thesubsystem indicated in the message using the indicatedaddress space.


ADHA856I (ASC) Stopped auditing for ssid.

Explanation: Auditing of the subsystem indicated inthe message has been stopped.


ADHA857I (ASC) Address space address-space-namestopped successfully.

Explanation: The address space indicated in themessage has been stopped successfully.


ADHA858I (ASC) Starting address spaceaddress-space-name.

Explanation: The address space indicated in themessage is starting.


ADHA859I (ASC) Timed out waiting for the startedtask address-space-name to terminate.

Explanation: The agent timed out waiting for thestarted task to terminate.


ADHA860I (ASC) Stopping address spaceaddress-space-name.

Explanation: The address space indicated in themessage is stopping.


ADHA702E • ADHA860I


ADHA861I (ASC) Address space address-space-namestarted successfully.

Explanation: The address space indicated in themessage has been successfully started.


ADHA862E (ASC) Address space address-space-namefailed to start.

Explanation: A problem occurred when attempting tostart the address space indicated in the message.

User response: Check the ASC proc's log for errors.The errors will also be relayed in the agent log.

ADHA900E Failed to connect to Guardium appliance

Explanation: InfoSphere Guardium S-TAP for DB2 onz/OS could not connect to the Guardium system.

User response: Check the server log for additionalinformation. Contact your administrator or IBMSoftware Support if needed.

Error messages and codes: ADHGxxxThe following information is about error messages and codes that begin withADHG.

ADHG000I Attempting connection to serverserver-address port=server-port

Explanation: The S-TAP collector will attempt toestablish a TCP/IP connection to a Guardium system atthe specified server address and port.


ADHG001I Establishing connection

Explanation: The S-TAP collector is preparing toestablish the TCP/IP connection to the specifiedGuardium system.


ADHG002I Connection established

Explanation: The S-TAP collector was successful inestablishing a TCP/IP connection to the Guardiumsystem.


ADHG003I Connection re-established

Explanation: The S-TAP collector was successful inre-establishing a TCP/IP connection to the Guardiumsystem following a disconnect.


ADHG004W Connection was lost

Explanation: The TCP/IP connection between theS-TAP collector and the Guardium system was lost. TheS-TAP collector will automatically attempt tore-establish the connection, however a potential fordata loss does exist if the connection is notre-established. A data loss condition is indicated bymessage ADHG006E.

User response: Determine the cause of the networkinterruption and correct the problem so that the

connection can be re-established.

ADHG005S Unable to establish a connection

Explanation: The S-TAP collector was unable toestablish a TCP/IP connection to the Guardium system.

User response:

v Ensure that the Guardium system is listening for aconnection at the server and port specified inmessage ADHG001I.

v Ensure that no firewalls are blocking connectionsbetween the collector and Guardium system.

ADHG006E Data loss has occurred as the result of anetwork send failure

Explanation: During a disconnected state, the S-TAPcollector exceeded the number of events to retain inmemory while waiting for the network connection tothe Guardium system to be reestablished.

User response:

v Determine the cause of the network interruption andcorrect the problem so that the connection can bereestablished.

v If deemed necessary, increase theSEND_FAIL_EVENT_COUNT value in the ASCADHPARMS parameter file to increase the numberof events that can be retained in memory duringshort outages.

ADHG007E Unable to create a communicationsinterface

Explanation: An attempt to create an internalcommunications interface failed.


ADHG008S Required parameter was not supplied.Parameter=parameter-name

ADHA861I • ADHG008S


Explanation: A required parameter was not supplied.

User response: Supply a parameter and value for thespecified parameter.

ADHG009I TCP/IP streaming disabled due to usersetting.

Explanation: A debug setting was specified that hasdisabled TCP/IP streaming between the S-TAP collectorand the Guardium appliance.


ADHG010I Disconnecting from server server-name

Explanation: The S-TAP collector is disconnectingfrom the Guardium system.


ADHG011E Unable to create an output stream

Explanation: An attempt to create an internal outputstream failed.


ADHG012E Unable to set socket timeout value.rc=return-code reason=reason-code

Explanation: An attempt to set the timeout thresholdin the socket interface failed.


ADHG013I Connection attempt timed out.Reattempting connectionreattempt-number of total-reattempts

Explanation: The S-TAP collector agent was unable toestablish a TCP/IP connection to the Guardium systemwithin the timeout period. The connection will bereattempted until the reattempt-number specified meetsthe total-reattempts number specified.

User response:

v Ensure that the Guardium system is listening for aconnection at the server and port specified inmessage ADHG001I.

v Ensure that there no firewalls are blockingconnections between the collector and Guardiumsystem.

ADHG014I Spillfile support enabled. Spill areasize: [size] MB

Explanation: A spillfile area was successfully allocatedat the specified size.


ADHG015W Primary server is unavailable

Explanation: A connection to the primary Guardiumsystem is not available. Failover systems will beattempted for connection.

User response: Determine the cause of the connectioninterruption to the primary Guardium system andattempt to restore the connection.

ADHG017W Data is being temporarily stored in aspillfile until a connection isre-established

Explanation: A Guardium system connection isunavailable. Collected data is written to the spillfilearea until a system connection can be established.

User response: Determine the cause of the systemconnection outage and attempt to restore theconnection.

ADHG018I Spillfile contents have been successfullybe sent to server [server]

Explanation: The Guardium system connection hasbeen restored. The spillfile data that was collectedduring a connection outage has been sent to thespecified system.


ADHG019S Spillfile storage has been exhausted.Data loss will occur.

Explanation: A Guardium system connection isunavailable and the spillfile is out of space. Datacollected after this time will be lost.

User response: Determine the cause of the connectionoutage to the system and attempt to restore theconnection. Notify others of the outage as necessary.

ADHG020I Registering server [server] as eligible forfailover.

Explanation: The specified server will be added to thelist of failover servers to register for the connection.Registration is attempted after all failover servers havebeen added. A successful failover registration isindicated by message ADHG012I.


ADHG021E Spillfile is approaching [50% | 85% |95% |100$] capacity.

Explanation: A Guardium system connection isunavailable and the spillfile area is at the specifiedcapacity.

User response: Determine the cause of the connection

ADHG009I • ADHG021E


outage to the system and attempt to restore theconnection.

ADHG022I A connection has been established tofailover server [server].

Explanation: A connection to the primary Guardiumsystem is not available. A connection has successfullybeen established to one of the specified failover server.

User response: Determine the cause of the connectioninterruption to the primary system and attempt torestore the connection.

ADHG026W Invalid port specified forAPPLIANCE_PORT. Port 16022 will beused instead.

Explanation: The APPLIANCE_PORT parametercurrently supports a setting of 16022, but the parameterhas been retained for future support. IfAPPLIANCE_PORT is specified with a value other than16022, message ADHG026W is issued, and port 16022will be used instead.

User response: Change APPLIANCE_PORT parametersetting to 16022 or remove the parameter entirely.

ADHG030I InfoSphere Guardium S-TAP for DB2Collector Agent is terminating

Explanation: The collector is terminating.


ADHG031I IBM InfoSphere Guardium S-TAP forDB2 on z/OS V9.1 [component]connection established

Explanation: The specified component successfullyestablished a TCP/IP connection to the Guardiumsystem.


ADHG097E Unexpected error: [error_description].Return code:[return_code].

Explanation: An unexpected error was encountered.


ADHG098I This event will be logged due to anunexpected data condition.

Explanation: A collected event contained unexpectedor invalid data fields. The event fields are written toDD:ADHLOG for use in diagnosing the problem.

User response: Contact IBM Software Support withthe error log.

ADHG099E Unexpected error: error-condition



ADHG210I A thread termination request wasreceived for thread [thread-token]

Explanation: A –CANCEL THREAD command was issuedby InfoSphere Guardium S-TAP for DB2 as a result of arequest received by the Guardium system. Thecommand ended successfully. Thread-token representsthe cancelled thread token, as would be reported by a–DISPLAY THREAD DB2 command.


ADHG501E pbSend: Bad host name. code=error-code

Explanation: While sending a message, the socketinterface encountered a bad host name condition.

User response:

v Verify that the host name value provided forAPPLIANCE_SERVER in the ASC ADHPARMSparameter file is valid.

v Contact IBM Software Support.

ADHG502E pbSend: Interface not open. code=error-code

Explanation: While sending a message, a problem wasencountered with an internal interface.


ADHG503E pbSend: Socket I/O problem. code=error-code

Explanation: While sending a message, the socketinterface encountered a socket I/O problem.


ADHG550E Unable to send message. Connection toserver is unavailable.

Explanation: An attempt to send a status (non-audit)message to the Guardium system failed because aconnection was unavailable.

User response: Determine the cause of the connectionoutage to the system and attempt to restore theconnection.

ADHG510E pbWrite: No such message. code=error-code

Explanation: While building a message, a problemwas encountered with an internal interface


ADHG022I • ADHG510E


ADHG511E pbWrite: Nested too deep. code=error-code

Explanation: While building a message, a problemwas encountered with an internal interface.


ADHG512E pbWrite: Stack underflow. code=error-code



ADHG513E pbWrite: Not in message. code=error-code



ADHG514E pbWrite: No such field in message.code= error-code



ADHG515E pbWrite: Not a 32-bit integer field.code= error-code



ADHG516E pbWrite: Not implemented. code=error-code



ADHG517E pbWrite: Not a message type. code=error-code



ADHG520W Encoding exception: Event exceedsprotocol message size limit.code=error-code

Explanation: The network protocol used tocommunicate to the Guardium system is limited to 64KB in payload size. If an audited event results in apayload that exceeds this limit, this message is issued,and a truncated message is built and sent to thesystem. This message is only issued once per collectorinstance. At termination, message ADHG521W reportsthe total number of events impacted by this exception.The specified error-code value is for use by technicalsupport.

User response: No action is required. If an excessivenumber of exceptions are observed, or if you areconcerned that the exceptions are impacting audit dataintegrity, use APPLIANCE_PORT(16022), which uses acommunications protocol capable of delivering eventswith larger payloads.

ADHG521W Total encoding exceptions encountereddue to exceeded message size:exception-count

Explanation: The network protocol used tocommunicate to the Guardium system is limited to 64KB in payload size. If an audited event results in apayload that exceeds this limit, message ADHG520W isissued. At termination, this message reports the totalnumber of events that have been impacted by thisexception, displayed as exception-count.

User response: No action is required. If an excessivenumber of exceptions are observed, or if you areconcerned that the exceptions are impacting audit dataintegrity, use APPLIANCE_PORT(16022), which uses acommunications protocol capable of delivering eventswith larger payloads.

Error messages and codes: ADHIxxxxThe following information is about error messages and codes that begin withADHI.

ADHI026W Invalid port specified forAPPLIANCE_PORT. Port 16022 will beused instead.

Explanation: The APPLIANCE_PORT parametercurrently supports a setting of 16022, but the parameterhas been retained for future support. If

APPLIANCE_PORT is specified with a value other than16022, message ADHG026W is issued, and port 16022will be used instead.


ADHG511E • ADHI026W


ADHI031I IBM InfoSphere Guardium S-TAP forDB2 on z/OS V9.1 [component]connection established

Explanation: The specified component successfullyestablished a TCP/IP connection to the Guardiumsystem.

User response: None action is required.

ADHI530E DB2 connection failed [function]SQLCODE=[sqlcode] RSN=[reason-code]

Explanation: A DB2 attachment facility error occurred.

User response: An error occurred while performing aDB2 attachment function. See the IBM DB2 for z/OSMessages and Codes manual for more information aboutthe return and reason codes.

ADHI531W OptionSTAP_UTILITY_TS_TO_TABLE(Y) isignored due to a previous error

Explanation: The optionSTAP_UTILITY_TS_TO_TABLE was set to enablecollection of expanded utility information. However, anerror occurred when attempting to establish the DB2connection, which is required for this feature. Theoption is disabled.

User response: Review ADHLOG for occurrences ofmessage ADHG503E to determine the cause of the DB2connection failure.

ADHI600I Starting IFI Collection Manager

Explanation: The IFI collection manager task receiveda start request.


ADHI602I IFI Collection Manager started

Explanation: The IFI collection manager task wassuccessfully started.


ADHI607I IFI Collection Manager restart requested

Explanation: The IFI collection manager task isstopping because it received a restart request.


ADHI608I IFI Collection Manager stop requested

Explanation: The IFI collection manager task receiveda stop request.


ADHI609I IFI Collection Manager stopped

Explanation: The IFI collection manager task wassuccessfully stopped.


ADHI611E START TRACE command failure.RC=[return_code] RSN=[reason_code].

Explanation: The DB2 START TRACE command issuedby the IFI collection manager failed with the specifiedreturn and reason codes. This error results in theshutdown of the collector agent.

User response: If possible, attempt to resolve the errorbased on the DB2 reason code specified in RSN. If youare unable to resolve the error, contact IBM SoftwareSupport.

ADHI612E Termination requested as the result of aprevious error

Explanation: An unrecoverable error condition wasencountered. A shutdown request will sent to thecollector agent.

User response: Check the ADHLOG for prior errorsand attempt to resolve any previous errors.

ADHI613E SQLCODE -805 encountered for planname [plan_name]

Explanation: A DB2 bind error -805 was encounteredfor the specified plan name.

User response: Run the ADHBIND job located in theSADHSAMP library.

ADHI697E Unexpected error: [error_description].Return code:[return_code]


User response: Contact IBM Support.

ADHI699E Unexpected error: [error-condition]



ADHI031I • ADHI699E


Error messages and codes: ADHKxxxxThe following information is about error messages and codes that begin withADHK.

ADHK001I Scope expression received, len = lengthof expression text

Explanation: The filter compiler has received a filterexpression of length length and expression text ofexpression Text. Only the first line of the expression textis output with this message. Only issued whentrace-filter is true.


ADHK002I Starting Compilation...

Explanation: The expression compiler is starting tocompile the filter expression. Only issued whentrace-filter is true.


ADHK004I Constant Pool for routine: (atmemoryLocation).

Explanation: This is a debugging message that showsthe memory location of an important data structure forthe compiled filter. This line is followed by ahexadecimal printout of the contents of that memory.Only issued when trace-filter is true.


ADHK005W Level level ‘compilerMessage'.

Explanation: These are messages generated by thefilter compiler if there is anything wrong with thegenerated filter expression. The compiled filter will notbe used. The agent and/or collector will shut down.

User response: Contact IBM Software Support.Provide the agent and/or collector logs along with thexml file for the active profile at the time the messagewas generated.

ADHK101I Compiling filter. Flags1 Flags; CompileTrace True/False; Runtime TraceRuntimeTraceFlag; RuntimeTraceRuntimeTraceValue; Stage 1 RequestedTrue/False.

Explanation: An informational message is issuedwhenever a new profile is about to be compiled into acompiled filter.


ADHK102I Rule Expression.

Explanation: The following lines show the filterexpression that was generated from the profile.

User response: No response required.

ADHK103I Profile contained no filter informationfor this agent.

Explanation: The currently active filter had nothingspecified to be collected in the current context. Forexample, in the ASC started task, if the filter has notargets, or if none of the targets had any events“checked”, then there is nothing for the ASC startedtask to collect. For the IFI agent, this message couldappear if, in addition to the above-mentioned lack oftargets or events, there were no items checked in the“General” tab for all the rules in the active profile.

User response: No response is required, in general.However, if you had intended data to be collected, youmay wish to review the active profile. If you believethe message is issued in error, contact IBM SoftwareSupport.

ADHK104I Filter Compile Failed.

Explanation: The expression that was generated fromthe currently active profile could not be compiled into afilter.


ADHK105I Variable text

Explanation: This message has been issued from thefilter compiler


ADHK106I Compiled filter requires bytes bytes ofdynamic save area.

Explanation: The compiled filter needs a certainamount of filter working memory to be able to dofiltering, and this message only appears if the amountof filter working memory allocated (8192 bytes) isinsufficient. This is unusual, and indicates a very largeand complicated profile.

User response: You can consider reducing the size ofthe profile through the use of wildcards. If that is notpossible, contact IBM Software Support.

ADHK110I Rule expression:

Explanation: his message will be followed by a full,multi-line, display of the filter expression generatedfrom the profile. This message is only printed iftrace-filter is true.


ADHK001I • ADHK110I


ADHK111I Compiling filter. flags1 flags1 trace=traceruntimeTraceFlag runtimeTraceFlagruntimeTrace runtimeTrace

Explanation: An informational message issuedwhenever a new profile is about to be compiled into acompiled filter.


ADHK203I Stage one filtering was not enabled.

Explanation: Stage 1 filtering must be enabled.

User response: To enable stage 1 filtering, enterSTAGE1_FILTER(Y) in the ADHCPARMS DD.

ADHK204I Error while creating stage one filter.

Explanation: A bug in the filtering code prevented thecorrect creation of a filter for stage 1. If the stage 2 filtercompiled correctly, filtering proceeds successfully at ahigher overhead.

User response: Contact IBM Software Support withXML export of the profile, and the JES output thatcontained this message.

ADHK205I No valid stage one filter criteria found.

Explanation: Stage 1 filtering is based on a subset ofthe profile fields. If one or more rules in the profiles donot include at least one of the profile fields, then stage1 filtering might not apply.

User response: Review the filtering stages section ofthe User's Guide and adjust the profile accordingly.

Error messages and codes: ADHMxxxxThe following information is about error messages and codes that begin withADHM.

ADHM2354E The connection to the remote db2location location failed for user ID ID.

Explanation: The connection to the specified remoteDB2 location failed for the specified user ID.

User response: Check for additional messages thatmay provide more information about the error.

ADHM2355E The length of the remote password isnot valid.

Explanation: The length of the remote password is notvalid.

User response: Check the length of the password andcorrect it if needed.

ADHM2356E The length of the remote user ID ID isnot valid.

Explanation: The length of the specified remote userID is not valid.

User response: Check the length of the remote user IDand correct it if needed.

ADHM2357E The length of the remote LOCATIONlocation is not valid.

Explanation: The length of the remote location is notvalid.

User response: Check the length of the remote userlocation and correct it if needed.

ADHM2358E Fatal SQL Error encountered. Statement: statement

Explanation: A fatal SQL error was encountered in thespecified statement.


ADHM2359S DBRM or PACKAGE dbrm package nameaccess error for PLAN plan name.

Explanation: The specified DBRM or package hasencountered an access error for the specified plan.

User response: Verify that the installation bind stepshave been completed.

ADHM2404E Database not found

Explanation: The database was not found.

User response: Check the server log for additionalinformation. Contact your administrator or IBMSoftware Support, if needed.

ADHM2408E Insertion of database record failed

Explanation: The attempt to insert the selecteddatabase record has failed.

User response: Check the server log for additionalinformation. Contact your administrator or IBMSoftware Support, if needed.

ADHK111I • ADHM2408E


Error messages and codes: ADHPxxxxThe following information is about error messages and codes that begin withADHP.

ADHP000I Attempting connection to serverserver-address port=server-port

Explanation: The S-TAP policy component willattempt to establish a TCP/IP connection to aGuardium system at the specified server address andport.


ADHP001I Establishing Policy connection

Explanation: The InfoSphere Guardium S-TAP for DB2policy component is preparing to establish the TCP/IPconnection to the specified Guardium system.


ADHP002I Connection established

Explanation: The S-TAP policy component wassuccessful in establishing a TCP/IP connection to theGuardium system.


ADHP003I Connection was re-established to [servername]

Explanation: The S-TAP policy component wassuccessful in establishing a TCP/IP connection to theGuardium system following a disconnect.


ADHP004W Connection was lost

Explanation: The TCP/IP connection between theS-TAP policy component and the Guardium systemwas lost. The S-TAP policy component willautomatically attempt to reestablish the connection,however a potential for data loss exists if theconnection is not established. A data loss condition isindicated by message ADHP006E.

User response: Determine the cause of the networkinterruption and correct the problem so that theconnection can be established.

ADHP005S Unable to establish a connection

Explanation: The S-TAP Policy component was unableto establish a TCP/IP connection to the Guardiumsystem.

User response:

v Ensure that the Guardium system is listening for aconnection at the server and port specified inmessage ADHP001I. .

v Ensure that there are no firewalls blockingconnections between the collector and the Guardiumsystem.

ADHP006E Data loss has occurred as the result of anetwork send failure

Explanation: During a disconnection, the S-TAP policycomponent exceeded the number of events that can beretained in memory while waiting for the networkconnection to the Guardium system to be reestablished.

User response:

v Determine the cause of the network interruption andcorrect the problem so that the connection can beestablished.

v If necessary, increase theSEND_FAIL_EVENT_COUNT value in the ASCADHPARMS parameter file to increase the numberof events that can be retained in memory duringshort outages.

ADHP007E Unable to create a communicationsinterface

Explanation: An attempt to create an internalcommunications interface failed.


ADHP008S Required parameter was not supplied.Parameter=parameter-name

Explanation: A required parameter was not supplied.

User response: Supply a parameter and value for thespecified parameter.

ADHP009I TCP/IP streaming disabled due to usersetting.

Explanation: A debug setting was specified that hasdisabled TCP/IP streaming between the S-TAP policycomponent and the Guardium system.


ADHP010I Disconnecting from server server-name

Explanation: The S-TAP policy component isdisconnecting from the Guardium system.


ADHP000I • ADHP010I


ADHP012I Failover support enabled

Explanation: One or more failover servers weresuccessfully registered with the communicationsinterface, enabling failover support.


ADHP013I Connection attempt timed out.Reattempting connectionreattempt-number of total-reattempts.

Explanation: The S-TAP policy component was unableto establish a TCP/IP connection to the Guardiumsystem within the timeout period. An attempt to bemade to reestablish the connection until thereattempt-number reaches the total-reattempts number.

User response:

v Ensure that the Guardium system is listening for aconnection at the server and port specified inmessage ADHP001I.

v Ensure that no firewalls are blocking connectionsbetween the collector and Guardium system.

ADHP015W Primary server is unavailable

Explanation: A connection to the primary Guardiumsystem is not available. Failover appliances will beattempted for connection.


ADHP017W Data is being temporarily stored in aspillfile until a connection isre-established

Explanation: A Guardium system connection isunavailable and collected data is being written to thespillfile area until an system connection can be restored.


ADHP018I Spillfile contents have been successfullybe sent to server [server]

Explanation: The spillfile data that was collectedduring a connection outage has been sent to thespecified Guardium system upon reconnection.


ADHP019S Spillfile storage has been exhausted.Dataloss will occur

Explanation: A Guardium system connection isunavailable and the spillfile is out of space. Datacollected after this time will be lost.

User response: Determine the cause of the connectionoutage to the system and attempt to restore theconnection. Notify others of the outage as necessary.

ADHP020I Registering server [server] as eligible forfailover

Explanation: The specified server will be added to thelist of failover servers to register for the connection.Registration is attempted after all failover servers havebeen added. A successful failover registration isindicated by message ADHP012I.


ADHP021E Spillfile is approaching [50% | 85% |95% |100%] capacity

Explanation: A Guardium system connection isunavailable and the spillfile area has reached thespecified percentage of capacity.


ADHP022I A connection has been established tofailover server [server]

Explanation: A connection to the primary Guardiumsystem is not available. A connection has successfullybeen established to one of the specified failover server.


ADHP023I A persisted policy from DD:ADHPLCYis being used.

Explanation: The S-TAP policy component was unableto establish a connection to the Guardium system. Apersisted policy from DD:ADHPLCY is being used.


ADHP026W Invalid port specified forAPPLIANCE_PORT. Port 16022 will beused instead.

Explanation: The APPLIANCE_PORT parametercurrently supports a setting of 16022, but the parameterhas been retained for future support. IfAPPLIANCE_PORT is specified with a value other than16022, message ADHG026W is issued, and port 16022will be used instead.


ADHP012I • ADHP026W


ADHP030I InfoSphere Guardium S-TAP for DB2Policy component is terminating


ADHP031I IBM InfoSphere Guardium S-TAP forDB2 on z/OS V9.1 component connectionestablished

Explanation: The S-TAP Policy componentsuccessfully established a TCP/IP connection to theGuardium system.


ADHP093E Policy discarded because all DB2 rulescontain errors

Explanation: All of the DB2 collection profileinterception policies that were pushed down from theGuardium appliance contain errors. As a result,InfoSphere Guardium S-TAP for DB2 collection isdeactivated.

User response: Review the ADHLOG for messagesthat were issued prior to this message that indicatewhy the DB2 rules were discarded. Examples ofrelevant messages include ADHP096E and ADHP101W.Use the reason and value that is reported in themessage to correct the incorrect value or error in thecollection policy.

ADHP094E Policy discarded due to error

Explanation: One or more errors were detected whileprocessing an interception policy that was pusheddown from the Guardium appliance. As a result, theentire policy, as well as any rules that are containedwithin the policy, are ignored.

User response: Review the ADHLOG for messagesthat were issued prior to this message (for example,ADHP101W) that indicate why the policy wasdiscarded. Use the reason and value that is reported inthe message to correct the incorrect value or error inthe collection policy.

ADHP095E error: rule discarded due to error

Explanation: One or more errors were detected whileprocessing an interception policy rule that was pusheddown from the Guardium appliance. As a result, therule containing these errors is ignored.

User response: Review the ADHLOG for messagesthat were issued prior to this message that indicatewhy the rule was discarded. Examples of relevantmessages include ADHP096E and ADHP101W. Use thereason and value that is reported in the message tocorrect the incorrect value or error in the collectionpolicy.

ADHP096E rule error: [error]

Explanation: An error was detected while processingan interception policy rule that was pushed down fromthe Guardium appliance.

User response: Use the error text that is provided inthis message to correct the value or error in thecollection policy.

ADHP097E Unexpected error: [error_description].Return code:[return_code]



ADHP099E Unexpected error: error-condition



ADHP101W Invalid value for filter. Reason: [reason].Value: [value]

Explanation: An invalid value was detected whileprocessing the collection policy received from theGuardium system.

User response: Attempt to correct the invalid value orerror in the collection policy by referencing the reasonand value reported in the message.

ADHP550E Unable to send message. Connection toserver is unavailable

Explanation: An attempt to send a non-audit statusmessage to the Guardium system failed because noconnection to the appliance is available.


Error messages and codes: ADHQxxxxIBM InfoSphere Guardium S-TAP for DB2 on z/OS V9.1 - Error messages andcodes: ADHQxxxx

The following information is about error messages and codes that begin withADHQ. These messages are generated from the collector agent.

ADHP030I • ADHP550E


ADHQ1000E NOT APF AUTHORIZED

Explanation: The collector agent started task or job isnot APF authorized.

User response: The collector agent requires that thetarget load libraries be APF-authorized.

ADHQ1001I DB2 QUERY COMMON COLLECTORINITIALIZATION IN PROGRESS FORSUBSYSTEM

Explanation: This message appears during the normalinitialization process of the collector agent.


ADHQ1002I DB2 AUDIT SQL COLLECTORINITIALIZATION COMPLETE FORSUBSYSTEM

Explanation: This message appears during the normalinitialization process of the collector agent and confirmsthe initialization process has completed.


ADHQ1003E SUBSYSTEM ssid ALREADY ACTIVE

Explanation: The collector agent indicated in themessage is already active and can therefore cannotprocess another activate command.

User response: Verify that you are activating thecorrect system. If you are attempting to activate asubsystem that is already active, do not attemptactivation.

ADHQ1004I QUERY COMMOON COLLECTORTERMINATION IN PROGRESS FORSUBSYSTEM subsystem

Explanation: This message appears during normalshutdown of the Collector Agent and indicates thecollector is undergoing shutdown.


ADHQ1005I QUERY COMMON COLLECTORTERMINATION COMPLETE FORSUBSYSTEM ssid

Explanation: The collector agent subsystem has beenterminated. This message could appear as part ofnormal shutdown or as a failure to connect to asubsystem.

User response: Investigate other write-to-operator(WTO) messages preceding this one to determine thereason for the termination.

ADHQ1006E statement DD STATEMENT MISSING

Explanation: The parameter DD statement (forexample, ADHCFGP DD statement) is missing from theJCL for the collector agent started task.

User response: Create the necessary DD statementand code the appropriate parameters in the data set.

ADHQ1007E INVALID USERID SPECIFIED FORAUTHID

Explanation: The user ID entered in the AUTHIDparm in the ADHCFGP data set has not been definedto RACF or an equivalent security system.

User response: Correct the user ID, or ensure the ID isdefined to your security system.

ADHQ1008E Mutually exclusive parameters coded onOPTKEYS parameter specification

Explanation: Two or more mutually exclusiveparameters were coded on the OPTKEYS startupparameter.

User response: Specify only one of the mutuallyexclusive OPTKEYS settings.

ADHQ1010I DEBUG MODE ON

Explanation: Debugging mode has been turned on.


ADHQ1011I DEBUG MODE OFF

Explanation: Debugging mode has been turned off.


ADHQ1016E INVALID COMMAND SYNTAX

Explanation: The command syntax is invalid.

User response: Correct the command.

ADHQ1017E INVALID COMMAND

Explanation: An invalid MVS Modify command wasissued.

User response: Correct the command and execute itagain.

ADHQ1018I INTERVAL EXTERNALIZATIONMODE ON

Explanation: The Query CommonCollector subsystemwas started with externalization mode set to on.


ADHQ1000E • ADHQ1018I


ADHQ1019I INTERVAL EXTERNALIZATIONMODE OFF

Explanation: The collector agent subsystem wasstarted with externalization mode set to off.


ADHQ1020E DB2 SUBSYSTEM ssid IS NOTDEFINED

Explanation: The DB2 subsystem indicated in themessage is not defined.

User response: Verify that you have specified thecorrect DB2 subsystem.

ADHQ1021I OPTKEYS(AUTHIDS,TEXT) IN EFFECTFOR NEXT INTERVAL

Explanation: The AUTHIDS and TEXT optional keyswill take effect for the next interval.


ADHQ1022I OPTKEYS(AUTHIDS) IN EFFECT FORNEXT INTERVAL

Explanation: The AUTHIDS optional key will takeeffect for the next interval.


ADHQ1023I OPTKEYS(TEXT) IN EFFECT FORNEXT INTERVAL

Explanation: The TEXT optional key will take effectfor the next interval.


ADHQ1024E dsn SPECIFICATION INVALID

Explanation: The data set name listed in this messageis not valid.

User response: Verify that you specified the correctdata set name in ADHCFGP.

ADHQ1026E SHARED MEMORY FAILURE FOROBJECT object request RC =rc RS=rs

Explanation: A shared memory failure has occurredfor the indicated object.


ADHQ1027I CPU=CPU Type-CPU Model-CPUManufacturer. OS Name OS Version.OSRelease.OS Modification.

Explanation: This message displays information aboutthe CPU and the operating system.


ADHQ1028E Component requires a 64 bit processorand z/OS 1.5 or higher.

Explanation: Your system does not meet the minimumsystem requirements.

User response: Upgrade to the minimumrequirements.

ADHQ1031E Serious error in master address spaceaddress space.

Explanation: A serious error has occurred in themaster address space specified.

User response: Verify that the master address space isavailable.

ADHQ1032I Recreating master address space.


ADHQ1033E Unable to create master address spaceaddress space.

Explanation: DB2 Query Monitor is not able to createthe master address space specified.

User response: Many issues that cause this error relateto security setup. If you encounter this message, sendyour console log to IBM Software Support.

ADHQ1034I Master address space has started.


ADHQ1035E Unable to restart master (RS=rc).

Explanation: The master address space could not berestarted.

User response: verify the master address space isavailable and restart.

ADHQ1055E CQM1055E DB2 ssid ISEXPERIENCING STORAGECONSTRAINTS, DATA LOSS MAYOCCUR, REASON=code

Explanation: The DB2 subsystem indicated in themessage is experiencing storage constraints.

User response: Verify that your DB2 subsystem hasthe needed storage allocations.

ADHQ1060I ZIIP SUPPORT IS NOT ACTIVE.nnnnnnnn RC=yy RSN=zzzzzzzznnnnnnnn is the name of the service thatfailed with a nonzero return code (RC).

Explanation:

ADHQ1019I • ADHQ1060I


Table 8. Return code explanations

Service Description

IWM4ECRE(WLM EnclaveCreate)

The return codes and reason codesare documented in z/OS V1R10.0MVS Programming WorkloadManagement Services.

IWM4EoCT(WLM CPUOffload TimeService)

The return codes and reason codesare not documented in anyexisting WLM manual. However,RC=4 typically means no ZIIP isconfigured on the instance ofz/OS. If you have a ZIIP processorand it is properly configured,report the RC to the vendor.

MAXWFLOAD(Enclave SRB loadservice)

An error occurred trying to LOADADHMAXWF (the enclave SRBroutine that runs on the ZIIP).Make sure you have the rightSTEPLIB configured.

IEAVAPE (Z/OSAllocate PauseElement)

These return codes are describedin z/OS V1R10.0 MVS ProgrammingAssembler Services References V2. Ifthe ADHQ1060I has IEAVAPE hasthe failing service, contact thevendor for resolution.

ADHQ1061E MISSING PARAMETER:AUDIT_STATEMENT_DSN

Explanation: The AUDIT_STATEMENT_DSNparameter has not been defined in ADHCFGP.

User response: Verify that you specified the correctdata set name in ADHCFGP.

ADHQ1062E COMMUNICATION INTERFACEDISABLED BY CROSS MEMORYFAILURE

Explanation: A cross memory failure has occurred andas a result the communication interface has beendisabled.

User response: Troubleshoot the memory failure andrestart the ASC.

ADHQ1062I ZIIP SUPPORT IS INSTALLED

Explanation: The collector agent has detected thatWLM is configured for zIIP support. This does notnecessarily indicate that zIIP processors are installed orare available for zIIP offload of collector agentprocessing.


ADHQ1065E REQUIRED DATA ACCESS COMMONCOLLECTOR MODULE NOT FOUND

Explanation: The started task did not find the DataAccess Common Collector (CQC) initialization module,which prevented successful startup.

User response: Verify that the Data Access CommonCollector (CQC) has been installed and that the loadlibrary is included in the started task STEPLIBconcatenation

ADHQ1066E Subsystem terminating due to abendwhile compiling the collection profile.SVCDUMP collected.

Explanation: An abend was detected when compilingthe collection profile. A memory dump was collected togather the diagnostic information.

User response: If you are unable to take correctivemeasures to resolve the abend, then the SVCDUMP, thecollector joblog, and the details of the collection profilein use should be reported to IBM Software Support forresolution of this error.

ADHQ1070E Terminating due to XML profileprocessing error RC (xxxxxxxx)

Explanation: A policy is sent from the Guardiumsystem to the InfoSphere Guardium S-TAP for DB2collector agent during their initial communication. Ifthe policy received by the collector agent is notcomposed of valid XML syntax, the collectorterminates.

User response: Verify that the Guardium system isproperly configured, using the APPLIANCE_SERVERparameter. The system should be set up to acceptconnections from collectors. If the problem persists,contact IBM Software Support with the return codespecified in this message.

ADHQ1071E Terminating due to missing XML profileat start up

Explanation: A policy is sent from the Guardiumsystem to the InfoSphere Guardium S-TAP for DB2collector agent during their initial communication. Ifthe policy is not received by the collector agent duringthe initial communication set up, then the collectorterminates.

User response: Verify that the Guardium system isproperly configured, using the APPLIANCE_SERVERparameter. The appliance should be set up to acceptconnections from collectors. If the problem persists,contact IBM Software Support.

ADHQ1061E • ADHQ1071E


ADHQ1086E ADHQ1086E statement DD STATEMENTMISSING

Explanation: The parameter DD statement (forexample, ADHPARMS DD statement) is missing fromthe JCL for the collector agent started task.

User response: Create the necessary DD statementand code the appropriate parameters in the data set.

ADHQ1153E RETURN CODE return_code REASONCODE reason_code WASENCOUNTERED DURINGTRANSLATION SOURCE CCSID ccsidTARGET CCSID ccsid

Explanation: An error was encountered during thetranslation of the indicated CCSIDs. This may be theresult of not having defined conversion paths betweenthe CCSID of the collected SQL text and CCSID 1208when performing a DB2 offload.

User response: To offload SQL text, verify that allnecessary CCSID paths to 1208 are installed. You mustdefine conversion paths between the CCSID of thecollected SQL text and CCSID 1208.

ADHQ1202I STORAGE CONSTRAINT RELIEVEDFOR SPACE – space – OCCURRENCES:count

Explanation: An InfoSphere Integrated StorageManager error had previously occurred due to astorage constraint for the space named in the message.The storage constraint has now been relieved. Thenumber of storage constraint occurrences for thisincident is displayed in the message.

User response: None.

ADHQ1203I ASID=asid,TCB=tcb,CPID=cpid,MODULE=module,ADDR=addr,RC=rc,RSN=rsn

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager error has occurred. Thismessage provides details that can be used by IBMSoftware Support to diagnose the situation.

User response: Provide the text of this message toIBM Software Support.

ADHQ1204I FUNC=func,SP=subpool,FLG2=flag,FLG3=flag

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager error has occurred. Thismessage provides details that can be used by IBMSoftware Support to diagnose the situation.

User response: Provide the text of this message toIBM Software Support.

ADHQ1205E ISM ERROR OCCURRED, DETAILFOLLOWS: note

Explanation: An InfoSphere Guardium S-TAPIntegrated Storage Manager error has occurred. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM SoftwareSupport to diagnose the situation.

User response: Provide the text of this message andmessages ADHQ1203I and ADHQ1204I along with anymemory dumps that have been produced to IBMSoftware Support.

ADHQ1209I ISM ERROR RC=rc,RSN=rsn,SPACE –space

Explanation: An InfoSphere Guardium S-TAPIntegrated Storage Manager error has occurred. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM SoftwareSupport to diagnose the situation.


ADHQ1210E ISM SPACE IS DISABLED – space

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager error has occurred. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM SoftwareSupport to diagnose the situation.


ADHQ1211I AN ABEND OCCURRED DURING ISMPROCESSING FOR SPACE – space

Explanation: A Query Monitor Integrated StorageManager error has occurred. This message andmessages ADHQ1203I and ADHQ1204I provide detailsthat can be used by IBM Software Support to diagnosethe situation.

User response: Provide the text of this message andmessages ADHQ1203I and ADHQ1204I along with anydumps that may have been produced to IBM SoftwareSupport.

ADHQ1212E AN ERROR OCCURRED IN THEEXTENT EXIT ROUTINE FOR SPACE –space

Explanation: An InfoSphere Guardium S-TAPIntegrated Storage Manager error has occurred. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM Software



Support to diagnose the situation.

User response: Provide the text of this message andmessages ADHQ1203I and ADHQ1204I along with anymemory dumps that might been produced to IBMSoftware Support.

ADHQ1213W SPACE IS FULL AND NO MOREEXTENTS CAN BE OBTAINED FORSPACE – space

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager operation has failedbecause no more extents can be obtained for the spacenamed in the message. This message and messagesADHQ1203I and ADHQ1204I provide details that canbe used by IBM Software Support to diagnose thesituation.

User response: This may be a temporary situation dueto the level of DB2 activity currently monitored byInfoSphere Guardium S-TAP for DB2. If messageADHQ1202I is also issued to indicate that the StorageConstraint has ended, then processing resumes. If thissituation occurs frequently, adjust the amount of datacollected by InfoSphere Guardium S-TAP for DB2within an interval by reducing the number of OPTKEYsthat are specified for the workload, reducing the lengthof the INTERVAL, or increasing the amount of memoryavailable to InfoSphere Guardium S-TAP for DB2(using MAXIMUM_ALLOCATIONS and SMEM_SIZE).

If you need assistance with modifying theseparameters, provide the text of this message andmessages ADHQ1203I and ADHQ1204I to IBMSoftware Support.

ADHQ1214W OWNER LIMIT EXCEEDED FORSPACE – space

Explanation: An InfoSphere Guardium S-TAP for DB2Monitor Integrated Storage Manager error hasoccurred. This message and messages ADHQ1203I andADHQ1204I provide details that can be used by IBMSoftware Support to diagnose the situation.

User response: Provide the text of this message andmessages ADHQ1203I and ADHQ1204I along with anymemory dumps that might have been produced to IBMSoftware Support.

ADHQ1215W SPACE IS FULL AND NO MORELARGE EXTENTS CAN BE OBTAINEDFOR SPACE – space

Explanation: An InfoSphere Guardium S-TAP for DB2Monitor Integrated Storage Manager operation hasfailed because no more large extents can be obtainedfor the space named in the message. This message andmessages ADHQ1203I and ADHQ1204I provide detailsthat can be used by IBM Support to diagnose theproblem.

User response: This may be a temporary situation dueto the level of DB2 activity currently being monitoredby InfoSphere Guardium S-TAP for DB2. If messageADHQ1202I is also issued to indicate that the StorageConstraint has ended, then processing resumes. If thissituation occurs frequently, adjust the amount of datacollected by InfoSphere Guardium S-TAP for DB2within an interval by reducing the number of OPTKEYsthat are specified for the workload, reducing the lengthof the INTERVAL, or increasing the amount of memoryavailable to InfoSphere Guardium S-TAP for DB2(MAXIMUM_ALLOCATIONS and SMEM_SIZE).

If you need assistance with modifying theseparameters, provide the text of this message andmessages ADHQ1203I and ADHQ1204I to IBMSoftware Support.

ADHQ1216E EXTENT PROCESSING FAILED(ABEND) FOR SPACE – space

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager error has occurred. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM SoftwareSupport to diagnose the situation.

User response: Provide the text of this message andmessages ADHQ1203I and ADHQ1204I along with anydumps that might have been produced to IBM SoftwareSupport.

ADHQ1217W SPACE IS FULL AND NO MORELARGE EXTENTS CAN BE OBTAINEDFOR SPACE – space

Explanation: An InfoSphere Guardium S-TAP for DB2Integrated Storage Manager operation has failedbecause the request would have exceeded themaximum storage allocation specified in theMAXIMUM_ALLOCATIONS parm in ADHPARMS. Atthe time of the error, InfoSphere Guardium S-TAP forDB2 was attempting to allocate additional storage forthe space named in the message. This message andmessages ADHQ1203I and ADHQ1204I provide detailsthat can be used by IBM Software Support to diagnosethe situation.

User response: This may be a temporary situation dueto the level of DB2 activity currently being monitoredby InfoSphere Guardium S-TAP for DB2. If messageADHQ1202I is also issued to indicate that the StorageConstraint has ended, then processing resumes. If thissituation occurs frequently, adjust the amount of datacollected by InfoSphere Guardium S-TAP for DB2within an interval by reducing the number of OPTKEYsthat are specified for the workload, reducing the lengthof the INTERVAL, or increasing the amount of memoryavailable to InfoSphere (MAXIMUM_ALLOCATIONSand SMEM_SIZE).

If you need assistance with modifying theseparameters, provide the text of this message and

ADHQ1213W • ADHQ1217W


messages ADHQ1203I and ADHQ1204I to IBMSoftware Support.

ADHQ1218W MAXIMUM EXTENTS HAS BEENREACHED FOR SPACE – space

Explanation: An InfoSphere Integrated StorageManager operation has failed because the requestwould have exceeded the maximum number of extentsallowed for the space named in the message. Thismessage and messages ADHQ1203I and ADHQ1204Iprovide details that can be used by IBM SoftwareSupport to diagnose the situation.

User response: This might be a temporary situationdue to the level of DB2 activity currently beingmonitored by InfoSphere. If message ADHQ1202I isissued later to indicate that the Storage Constraint hasended, then processing resumes normally. If thissituation rarely occurs, it may not be a problem. If thissituation frequently occurs, it may be possible toprevent it by adjusting the amount of data collected byInfoSphere within an interval. This could beaccomplished by reducing the number of OPTKEYsthat are specified for the workload, reducing the lengthof the INTERVAL, or increasing the amount of memoryavailable to InfoSphere (MAXIMUM_ALLOCATIONSand SMEM_SIZE).

If you need assistance with tuning these parameters,provide the text of this message and messagesADHQ1203I and ADHQ1204I to IBM Software Support.

ADHQ1219W ALL ISMERROR MESSAGE BLOCKSARE IN USE

Explanation: An InfoSphere Integrated StorageManager error has occurred. However there were nofree ISMERROR message blocks available.

User response: Increase the value of theISM_ERROR_BLOCKS parameter in the ADHPARMSfile. If this parameter is already set to the maximumvalue and the problem persists, contact IBM SoftwareSupport.

ADHQ1500E ABNORMAL EOT FOR subtaskSUBTASK

Explanation: An abnormal end of task occurred forthe subtask indicated in the message.

User response: Verify conditions surrounding theabnormal end of task and reissue the subtask.

ADHQ2001E DB2 SUBSYSTEM ssid ALREADYMONITORED BY SUBSYSTEM ssid

Explanation: The indicated DB2 subsystem is alreadybeing monitored by the collector agent shown in themessage.

User response: A DB2 subsystem can only be

monitored by a single collector agent. To monitor theDB2 subsystem with another collector agent, first stopthe monitoring of the DB2 subsystem by the collectoragent (shown in the message).

ADHQ2002E MONITORING AGENTINSTALLATION FAILED FORSUBSYSTEM ssid

Explanation: A monitoring agent was unable to start.Another SQL-type monitoring product might be activewithin the specified DB2 subsystem.

User response: Check to see if another SQL-typemonitoring product is active. If so, shut down the otherproduct and restart the S-TAP collector. If this does notresolve the problem, contact IBM Software Support.

If you encounter message ADHQ2002E and receive amemory dump, contact IBM Software Support andprovide the memory dump for diagnostic purposes.

ADHQ2003I FORCING MONITORING AGENTINSTALLATION FOR ssid

Explanation: The collector agent has detected that amonitoring agent is already active, but is forcinginstallation because FORCE (Y) was included.


ADHQ2005I MULTIPLE MONITORING AGENTINSTALLATION FOR SUBSYSTEM ssid

Explanation: The collector agent has installed multiplemonitoring agents for the subsystem shown in themessage.


ADHQ2008E DB2 SYSTEM ssid IS BEINGMONITORED BY A 2.2 OR BELOWVERSION CQM SUBSYSTEM ANDCANNOT BE AUDITED

Explanation: This message indicates anincompatibility between DB2 Query Monitor andS-TAP. InfoSphere Guardium S-TAP for DB2 Version 9.1will not start auditing a DB2 subsystem that is runningQuery Monitor at Version 3.1 or below.

User response: Ensure that you are runningcompatible versions of S-TAP and Query Monitor, orrun only one product at a time.

ADHQ2009E DB2 SYSTEM ssid WAS PREVIOUSLYMONITORED BY A 2.2 OR BELOWCQM SUBSYSTEM qmid WHICH HASNOT APPLIED APAR PK55535.

Explanation: You must apply Query Monitory V2R2APAR PK55535.

ADHQ1218W • ADHQ2009E


User response: Apply the required maintenance.

ADHQ2010I CURRENTLY ACTIVE POLICYRESULTS IN DISABLED COLLECTION

Explanation: The currently installed collection policy,as received from the Guardium system, results in noASC collection. This can be the result of:

v No policies are installed on the system.

v No DB2 Collection Profile policies are installed onthe system.

v No DB2 Collection Profile policies matching the Svc.Name of the collector agent SSID are installed on thesystem.

v No DB2 Collection Profile policies contain Objectentries that would result in ASC collection.

User response: If ASC collection is expected when thismessage is issued, review installed policy definitions inthe Guardium system administration interface for theconditions listed above. If no ASC collection is expectedwhen this message is issued, no action is required.

ADHQ2011I CURRENTLY ACTIVE POLICYRESULTS IN NOIFI COLLECTION

Explanation: The currently installed collection policy,as received from the Guardium system, results in no IFIcollection. This can be the result of:

v No policies are installed on the system.

v No DB2 Collection Profile policies are installed onthe system.

v No DB2 Collection Profile policies that match theSvc. Name of the collector agent SSID are installedon the system.

v No DB2 Collection Profile policies contain Commandentries that would result in IFI collection.

User response: If IFI collection is expected when thismessage is issued, review the installed policydefinitions in the Guardium system administrationinterface for the conditions listed above. If no IFIcollection is expected when this message is issued, noaction is required.

ADHQ2013I CURRENTLY ACTIVE POLICYRESULTS IN GRANT/REVOKECOLLECTION

Explanation: The activated policy enables thecollection of GRANT and REVOKE SQL statements.GRANT and REVOKE SQL statements are collected ifthey match the policy filter criteria.


ADHQ2100E UNRECOGNIZED PARAMETER

Explanation: The collector agent has encountered anunrecognized parameter.

User response: Check the startup parameters toensure that the parameters specified are all valid.

ADHQ2101E PARAMETER ERROR DETECTED FORparameter

Explanation: The collector agent has encountered anerror in one of the startup parameters.

Note: Message ADHQ2101E can be issued when thecollector agent is started if the ADHCFGP file specifiesprimary space allocations for back store data sets thatare lower than the default.

User response: Check the startup parameters toensure that all are specified properly. Check thatprimary space allocations for back store data sets arenot set lower than their default values.

ADHQ2103E DUPLICATE PARAMETER DETECTEDFOR parameter

Explanation: Duplicate parameters were specified inthe Query Common Collector startup parameters.

User response: Check the startup parameters toensure that all are specified properly. Remove anyduplicate parameters.

ADHQ2110E TERMINATING DUE TO ERRORS INPARAMETER FILE

Explanation: An error in the collector agent parameterfile caused the termination of processing.

User response: Verify that the input you specified foryour collector agent parameters in ADHCFGP is validand correct for your objectives.

ADHQ2111E ERROR READING PARAMETERDATASET - MEMBER NOT FOUND

Explanation: The collector agent encountered an errorwhile attempting to read the ADHCFGP data set. TheADHPARMS DD statement specified a PDS data setand the member name specified did not exist.

User response: Correct the JCL specification for theADHPARMS DD statement and specify a valid membername.

ADHQ2400I INTERVAL PROCESSING STARTEDFOR procstart

Explanation: This message signifies the beginning ofthe Query Common Collector interval processing.




ADHQ2401I INTERVAL PROCESSING ENDED FORprocend

Explanation: This message signifies the end of theQuery Common Collector interval processing.


ADHQ2402I DATASPACE MANAGEMENT INPROGRESS FOR dsmgmt

Explanation: Indicates dataspace management is inprogress for the subsystem shown in the message.


ADHQ2403I n DATASPACE PAGES RELEASED FORssid

Explanation: Displays the number of dataspace pagesthat have been released for the subsystem shown in themessage.


ADHQ2405E INTERVAL PROCESSING NOTSUSPENDED

Explanation: Interval processing for the subsystem hasnot been suspended.


ADHQ2406I RESUMING INTERVAL PROCESSING

Explanation: Interval processing is being resumed.


ADHQ2407I INTERVAL DATASET CONTAINSPRE-RELEASE RECORDS. REPLY U TOACCEPT OR R TO REJECT

Explanation: Backstore data sets, created by a priorlevel of the collector agent, are referenced in theinterval file.

User response: If you reply U, to accept, thisinformational message appears. You will then be able todisplay these backstore data sets until all of the priorlevel backstore data sets roll-off.

To prevent this message, you can create a new intervalfile. Note that this will prevent you from seeing any ofthe old back store data sets.

ADHQ2408E INVALID REPLY. REPLY "U" TOACCEPT OR "R" TO REJECT

Explanation: The replay you entered is not valid.

User response: Enter U to accept or R to reject.

ADHQ2409I TERMINATING DUE TO INTERVALSDATASET VERSION

Explanation: The collector agent processing isterminating due to interval data set version.


ADHQ2451E INVALID PARAMETER. VALIDVALUES ARE "COPY" OR "DELETE"

Explanation: The parameter you entered is not valid.

User response: Valid values are COPY and DELETE.

ADHQ2601E ALLOCATION FAILED FOR VSAMDATASET dsn RETCD=rc REAS=rs

Explanation: This message is issued by the startedtask if there is a problem during the dynamic allocationof a data set. When this message occurs, the collectoragent stops and the startup process and terminates.

User response: To further diagnose and resolve theproblem using the return code and reason code listedin the message, refer to the MVS ProgrammingAuthorized Assembler Services Guide (SA22-7608-07).

ADHQ2603E DEALLOCATION FAILED FORDATASET data_set RETCD=return_codeREAS=reason_code

Explanation: This message reports errors encounteredduring the execution of a CLOSE macro instruction.

User response: To further diagnose and resolve theproblem using the return code and reason code listedin the message, refer to the z/OS V1R1.0 DFSMS/DFPDiagnosis Reference (GY27-7618-01) or the following Webpage:

http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/dgt2r101/20.8.1.2

ADHQ2605E OUT OF SPACE CONDITIONDETECTED ON DATASET data set

Explanation: Your request produced an out of spacecondition for the data set indicated in the message.

User response: Allocate additional space for the dataset.

ADHQ2606E TERMINATING DUE TODATASET_FULL(AB0RT)

Explanation: The data set was full, causing atermination.

User response: Allocate additional space for the dataset or specify a different data set.

ADHQ2401I • ADHQ2606E




ADHQ2607E NO FURTHER EXCEPTIONS WILL BERECORDED UNTIL NEXT INTERVAL

Explanation: The number of exceptions to be recordedhas exceeded the exception threshold specified inADHCFGP.

User response: No additional exceptions will berecorded.

ADHQ2608E NO FURTHER DB2 COMMAND DATAWILL BE RECORDED UNTIL NEXTINTERVAL

Explanation: No additional DB2 command data is tobe recorded until the next interval starts.


ADHQ2609E NO FURTHER -SQLCODE DATA WILLBE RECORDED UNTIL THE NEXTINTERVAL

Explanation: No additional information aboutnegative SQLCODES is to be recorded until the nextinterval starts.


ADHQ2610E NO FURTHER SUMMARY DATA WILLBE RECORDED UNTIL THE NEXTINTERVAL

Explanation: No additional summary data is to begathered until the next interval starts.


ADHQ2611E NO FURTHER SUMMARY TEXT WILLBE RECORDED UNTIL THE NEXTINTERVAL

Explanation: No additional summary text informationis to be gathered until the next interval starts.


ADHQ2612E S99ERSN=code

Explanation: This message indicates an S99ERSNcode.

User response: Refer to related messages generatedwith this code for more information.

ADHQ2620E CISIZE Incorrect for AUDIT_DATAbackstore data set

Explanation: The CISIZE specification for the dataclassused by the AUDIT_DATA backstore data set isincorrect. The CISIZE must be 32756.

User response: Ensure the CISIZE for theAUDIT_DATA backstore data set is 32K.

ADHQ2621E CISIZE Incorrect for AUDIT_HOSTVbackstore data set

Explanation: The CISIZE is not correct for theAUDIT_HOSTV backstore data set.

User response: Ensure the CISIZE for theAUDIT_HOSTV backstore data set is 32K.

ADHQ2622E CISIZE Incorrect for AUDIT_OBJECTSbackstore data set

Explanation: The CISIZE is not correct for theAUDIT_OBJECTS backstore data set.

User response: Ensure the CISIZE for theAUDIT_OBJECTS backstore data set is 32K.

ADHQ2623E CISIZE Incorrect for AUDIT_TEXTbackstore data set

Explanation: The CISIZE is not correct for theAUDIT_TEXT backstore data set.

User response: Ensure the CISIZE for theAUDIT_TEXT backstore data set is 32K.

ADHQ2624I Terminating due to backstore datasetdefinition errors

Explanation: Backstore data set definitions containerrors and the ASC is terminating.

User response: Verify that backstore data setdefinitions are correct.

ADHQ3001I DB2 STARTUP DETECTED FORSUBSYSTEM ssid

Explanation: The collector agent determined that aDB2 subsystem in its monitor list has started.


ADHQ3002I MONITORING AGENT STARTED FORSUBSYSTEM ssid

Explanation: This message informs you thatInfoSphere Guardium S-TAP for DB2 has initiatedmonitoring for the named subsystem.


ADHQ3003I DB2 SHUTDOWN DETECTED FORSUBSYSTEM ssid

Explanation: The collector agent determined that aDB2 subsystem in its monitor list has shut down.


ADHQ2607E • ADHQ3003I


ADHQ3005I MONITORING AGENTDEACTIVATED FOR ssid

Explanation: The monitoring agent has beendeactivated for the indicated Collector Agent.


ADHQ3006I AUDITING AGENT ACTIVATED FORssid

Explanation: The collector agent has been instructedto start the monitoring agent for a given DB2subsystem when it becomes active. Monitoring of SQLfor the DB2 subsystem will start when the monitoringagent is started indicated by message ADHQ3002I.Monitoring will continue after message ADHQ3002I isissued until one of the following events occur:

1. The DB2 subsystem is stopped.

2. A deactivate for the monitoring agent is performed.

3. The collector agent subsystem that is monitoring theDB2 subsystem is stopped.


ADHQ3192I LEVEL STATUS DB2(ssid) message

Explanation: This message will only display if amismatch in code level exists between InfoSphereGuardium S-TAP for DB2 and DB2 Query Monitor. Onemessage per mismatched code level will occur.

User response: Verify that all the programs listed havethe Query Monitor and corresponding S-TAP for DB2maintenance applied.

ADHQ3200I DISPLAY AGENTS

Explanation: This message is used in conjunction withother messages to indicate display agents.


ADHQ3201I DB2 SUBYSYSTEM ssid AGENTADDRESS address

Explanation: Indicates the DB2 subsystem and agentaddress.


ADHQ3202I ssid AGENT ADDRESS address

Explanation: Indicates the monitoring agent address.


ADHQ3203I ASC DIAGNOSTIC DISPLAY:

Explanation: Indicates ASC diagnostic display is ineffect.


ADHQ3204I SDA ADDRESS address

Explanation: Indicates the SDA address.


ADHQ3205I ssid ADDRESS address

Explanation: This message is used in conjunction withother messages to indicate the address.


ADHQ3206I DIAGNOSTIC DATA FOR ABEND ATPSW psw

Explanation: The message displays diagnostic data forthe abend.


ADHQ3207I SYSTEM COMPLETION CODE code

Explanation: The message indicates the systemcompletion code.


ADHQ3208I OCCURRENCES n DATE date TIMEtime

Explanation: Indicates the number of occurrences andthe date and time at which the took place.


ADHQ3209I GPR 0-3 info

Explanation: This message displays diagnosticinformation about the current contents of the register.













ADHQ3213I AR 0-3 info












ADHQ3240I DB2 QM DATASPACE USAGEDISPLAY:

Explanation: This message appears in conjunctionwith other messages as a result of the MVS Modifycommand DISPLAY DATASPACES.


ADHQ3241I dataspace DATASPACE

Explanation: This message appears in conjunctionwith ADHQ3240I as a result of the MVS Modifycommand DISPLAY DATASPACES.


ADHQ3242I NODE SIZE size

Explanation: This message appears in conjunctionwith ADHQ3240I as a result of the MVS Modifycommand DISPLAY DATASPACES. This message lists thenode size for the named data space.


ADHQ3243I TOTAL NODES n

Explanation: This message appears in conjunctionwith ADHQ3240I as a result of the MVS Modifycommand DISPLAY DATASPACES. This message lists thetotal number of nodes allowed for the named dataspace.


ADHQ3244I AVAILABLE NODES n

Explanation: This message appears in conjunctionwith ADHQ3240I as a result of the MVS Modifycommand DISPLAY DATASPACES. This message lists thetotal number of nodes available for use by the nameddata space.


ADHQ3245I PERCENT UTILIZED n

Explanation: This message appears in conjunctionwith ADHQ3240I as a result of the MVS Modifycommand DISPLAY DATASPACES. This message lists thepercentage of nodes used for the named data space.


ADHQ3250I POSTING INTERVAL PROCESSOR

Explanation: This message appears to inform you thatthe interval processor has been started through an MVSModify INTERVAL command.


ADHQ3251I INTERVAL PROCESSOR NOT POSTED- DB2 UNAVAILABLE

Explanation: The interval processor was not startedbecause a DB2 subsystem is not available.

User response: Verify the status of all monitored DB2subsystems.

ADHQ3252I INTERVAL PROCESSING ALREADYIN PROGRESS

Explanation: This message appears to inform you thatthe interval processor was already started through anMVS Modify INTERVAL command.


ADHQ3253I DATASPACE THRESHOLD EXCEEDEDFOR dataspace DATASPACE. POSTINGINTERVAL PROCESSOR

Explanation: The dataspace threshold has beenexceeded for the dataspace indicated in the message.


ADHQ3301E LOAD FAILED FOR PROFILE profileON location

Explanation: The monitoring profile cannot be loadedinto memory.

User response: Specify a valid monitoring profile.



ADHQ3302I **WARNING** MONITORING AGENTFOR info WILL NOT COLLECTEXCEPTION DATA OR CURRENTACTIVITY

Explanation: The collector agent issues this messagewhen a monitoring profile is not in effect after a profileload has been attempted either at monitoring agentstartup or after a change profile operation. Thismessage indicates that current activity and exceptiondata will not be collected because these collector agentfunctions require a monitoring profile.

User response: If you want to collect current activityand exception data, specify a valid monitoring profilefor use with the monitoring agent.

ADHQ3303I PROFILE CHANGE COMPLETE FORssid

Explanation: The monitoring profile change yourequested has now completed for the indicatedsubsystem.


ADHQ3304E PROFILE CHANGE FAILED FOR ssid

Explanation: The requested profile change failed forthe indicated subsystem.

User response: Verify that the profile exists and thesubsystem is active.

ADHQ3305I PROFILE REFRESH COMPLETE FORssid

Explanation: The monitoring profile refresh action hascompleted for the indicated ASC subsystem.


ADHQ3306E PROFILE REFRESH FAILED FOR ssid

Explanation: The profile refresh action failed for thespecified ASC subsystem.

User response: Verify that the profile still exists. Ifnecessary, create a new profile or change to anotherprofile.

ADHQ3308E DB2 SYSTEM ssid IS MONITORED BYDB2 QUERY MONITOR ssid WHICHHAS MISMATCHED OBJ AGENT

Explanation: This message indicates that themaintenance levels of one or more object modules donot match between the InfoSphere Guardium S-TAP forDB2 and Query Monitor installations. The maintenancecode levels for IBM InfoSphere and Query Monitorinstallations must match.

User response: Ensure that the maintenance levels

match between the InfoSphere Guardium S-TAP forDB2 and Query Monitor installations. Applymaintenance as required to one or both environmentsto ensure that the maintenance levels match.

ADHQ3315E MASTER SUBSYSTEM DOES NOTMATCH

Explanation: For monitoring and auditing to be activeon the DB2 subsystem, a DB2 subsystem that ismonitored by DB2 Query Monitor or Workload Replayfor DB2 for z/OS or audited by InfoSphere GuardiumS-TAP for DB2 must have a matchingMASTER_PROCNAME parameter between the QueryMonitor subsystem and the Workload Replay DB2subsystem, or the InfoSphere Guardium S-TAP ASCstarted task.

User response: Update the MASTER_PROCNAMEparameter for DB2 Query Monitor, InfoSphereGuardium S-TAP for DB2, or Workload Replay so thatthe same MASTER_PROCNAME is in use by allproducts for the monitored DB2 subsystem. Afterupdating the MASTER_PROCNAME, restart the startedtask for the task that is affected by the parameterchange.

ADHQ3402I ISSUING COMMAND cmd

Explanation: Indicates command execution.


ADHQ3551E VSAM LOGIC ERRORENCOUNTERED WHILE ACCESSINGCONTROL FILE FOR DB2 ssid.VSAMRC='rc' VSAMRS=X'rs'

Explanation: A VSAM logic error was encounteredwhen accessing the control file for the DB2 subsystemindicated in the message.

User response: Verify that the DB2 control file for theDB2 subsystem listed in the message has been properlyallocated and that the appropriate DB2 subsystem andplan names information have been specified correctly.

ADHQ3552E SETUP INFORMATION MISSINGFROM CONTROL FILE FOR DB2 ssid

Explanation: There is insufficient information in thecontrol file for the DB2 subsystem indicated in themessage.

User response: Modify the control file to include thenecessary information.

ADHQ3553E message ERROR message

Explanation: An error has occurred. This message iscustomized to display various messages such asinitialization errors.




ADHQ3192E LEVEL STATUS DB2(ssid) message

Explanation: This message will only display if amismatch in code level exists between InfoSphereGuardium S-TAP for DB2 and Query Monitor. Onemessage per mismatched code level will occur.

User response: Ensure that all the programs listedhave the Query Monitor and corresponding InfoSphereGuardium S-TAP for DB2 maintenance applied.

ADHQ4001E CONNECT TO DB2 ssid FAILED FORPLAN plan RETURN CODE rc REASONCODE rs

Explanation: InfoSphere Guardium S-TAP for DB2was not able to connect to the DB2 subsystem using theplan shown in the message.

User response: Refer to DB2 Universal Database forz/OS V8 Messages (GC18-9602-01) and DB2 UniversalDatabase for z/OS V8 Codes (GC18-9603-01) to furtherdiagnose and resolve the problem.

ADHQ4003E CONNECT FAILED - DB2 NOTOPERATIONAL

Explanation: The collector agent was not able toconnect to the DB2 subsystem because DB2 is notcurrently operational.

User response: Verify that DB2 is functioningcorrectly.

ADHQ5010I MONITORING AGENTDEINSTALLATION IN PROGRESSFOR SUBSYSTEM ssid

Explanation: The monitoring agent deinstallation is inprogress for the DB2 subsystem indicated in themessage.


ADHQ5011I MONITORING AGENTDEINSTALLATION COMPLETE FORSUBSYSTEM ssid

Explanation: The monitoring agent deinstallationcompleted for the DB2 subsystem indicated in themessage.


ADHQ5012I REQURESTING MONITORINGAGENT ACTIVATION FOR DB2SUBSYSTEM ssid

Explanation: The monitoring agent for the indicatedDB2 subsystem is being requested for activation.


ADHQ5013I REQUESTING MONITORING AGENTDEACTIVATION FOR DB2SUBSYSTEM ssid

Explanation: The monitoring agent for the indicatedDB2 subsystem is being requested for deactivation.


ADHQ6002I OUT OF SPACE CONDITIONDETECTED ON DATASET dataset

Explanation: An out of space condition wasencountered for the data set indicated in the message.

User response: Verify that adequate space has beenallocated for the data set.

ADHQ6003I POSTING INTERVAL PROCESSORDUE TO OUT OF SPACE CONDITION

Explanation: Interval processing is being posted dueto the out of space condition encountered for the dataset.

User response: Verify that adequate space has beenallocated for the interval data set.

ADHQ6004E CATALOG LOAD FAILED. VERIFYTHAT THE CORRECT ZPARMMEMBER WAS SPECIFIED IN SETUP

Explanation: Indicates the catalog load did notcomplete successfully.

User response: Verify that the correct ZPARM memberwas specified in set up.

ADHQ6101E LOCATE FAILED FOR dataset R0=codeRC=rc

Explanation: A catalog located failed during intervaldata set expiration processing. r0 contains the contentsof the register zero and rc is the LOCATE return code.

User response: See z/OS DFSMSdfp Advanced Services(SC26-7400-02) for a description of the return codesissued by LOCATE.

ADHQ6102E SCRATCH FAILED FOR file SCRATCHSTATUS CODE=code RO=ro

Explanation: The scratch failed for the indicated file.

User response: See z/OS DFSMSdfp Advanced Services(SC26-7400-02) for a description of the return codesissued by LOCATE.



ADHQ7001E table TABLE NOT LOCATED IN DB2CATALOG

Explanation: The table indicated in the messagecannot be found in the DB2 catalog.

User response: Verify that the table you specifiedexists.

ADHQ7002I STARTING INTERVAL NOT LOCATEDIN ADHINTER DATASET OR ALLINTERVALS ARE EMPTY - NO DATATO OFFLOAD

Explanation: The starting interval you specifiedcannot be found in ADHINTER data set.

User response: Verify that you specified the correctstarting interval.

Note: You cannot specify a current interval as astarting or ending interval.

ADHQ7003E COLUMN column MISSING FORTABLE table

Explanation: The indicated column is missing for thetable shown in the message.

User response: Verify that the table contains thenecessary columns.

ADHQ7004E UNIDENTIFIED COLUMN column INTABLE table

Explanation: There is an unidentified column in thetable indicated in the message.

User response: Verify that the table contains thecorrect columns.

ADHQ7005E TYPE MISMATCH FOR COLUMNcolumn IN TABLE table

Explanation: The column type is not matched for thetable shown in the message.

User response: Ensure that the data type is correct forthe column.

ADHQ7006E LENGTH ERROR FOR COLUMNcolumn IN TABLE table

Explanation: The length of data for the columnindicated in the message is not valid.

User response: Ensure that the data length is correctfor the column.

ADHQ7007E SEQUENCE ERROR FOR COLUMNcolumn IN TABLE table

Explanation: The column indicated in the messagewas in the wrong sequence for the indicated table.

User response: Update your ASC table definition to beconsistent with the correct column sequence.

ADHQ7008E QUERY COMMON COLLECTOR ssidNOT VALID OR HAS NOT BEENSTARTED SINCE IPL

Explanation: The collector agent shown in themessage is not a valid collector agent.

User response: Verify that you specified the correctQuery Common Collector subsystem ID, and that thecollector agent is available.

ADHQ7009E OUT OF SPACE CONDITIONDETECTED WHILE WRITING TO THEdsn DATASET

Explanation: An out-of-space condition wasencountered when attempting to write to the data setindicated in the message.

User response: Verify that adequate space has beenallocated to the data set.

ADHQ7010E MISSING "ADD" PARAMETER FORparameter AT LINE line COLUMN column

Explanation: The ADD parameter is missing for theindicated line and column.

User response: Specify an ADD parameter.

ADHQ7011E INTERNAL ERROR - UNABLE TORESOLVE ALTERNATE COLUMNcolumn

Explanation: There has been an internal error.


ADHQ7012E ALTERNATE COLUMN columnDUPLICATES column COLUMN INTABLE table

Explanation: There are duplicates in the column andtable.

User response: Remove the duplicates.

ADHQ7013E SCALE ERROR FOR COLUMN columnIN TABLE table

Explanation: There has been a scale error in theindicated column and table.




ADHQ7014I RECORDS OFFLOADED FOR record:INTV# record-record

Explanation: This message is only issued if theSTATISTICS option is specified on the LOAD parameterwhen offloading Query Common Collector data to DB2.It provides a count of the number of records off-loadedby the interval table.


ADHQ7015E NUMBER OF BSDS SPECIFICATIONSINVALID OR MISSING

Explanation: An invalid number of BSDS parametershas been sent as input to the ADH#CTLF utility.

User response: Verify that the two boot strap data setsused for your DB2 subsystem are properly specified.

ADHQ7016E DUPLICATE RECORD STOREATTEMPTED FOR DB2 SUBSYSTEMssid

Explanation: This message describes an errorcondition when attempting to load records into thecontrol file that already exist without specifyingREPLACE(Y) for the DB2 subsystem indicated in themessage.

User response: Edit your ADH#CTLF job to includeREPLACE(Y). Refer to the instructions in SADHSAMPlibrary member ADH#CTLF for details.

ADHQ8001E ERRORS DETECTED IN parametersPARAMETERS:

Explanation: Errors have been detected in ADHCFGP.

User response: Verify that the parameters youspecified in ADHCFGP are correct and modify anysyntax errors before proceeding.

ADHQ8002E UNIDENTIFIED KEYWORDDETECTED AT LINE line COLUMNcolumn

Explanation: An unknown keyword has been found.

User response: Verify the correct syntax and modifythe keyword as needed.

ADHQ8003E INVALID SYNTAX SPECIFIED FORparameter NEAR LINE line COLUMNcolumn

Explanation: The syntax specified for the parameterindicated in the message is not valid.

User response: Correct the syntax and resubmit thejob.

ADHQ8004E PARAMETER LENGTH EXCEEDEDFOR parameter NEAR LINE lineCOLUMN column

Explanation: The length of the value specified for theparameter indicated in the message exceeded the validlength for that parameter.


ADHQ8005E PARAMETER MISSING FOR parameterNEAR LINE line COLUMN column

Explanation: A required parameter is missing fromADHLOADP.


ADHQ8006E NON NUMERIC DATA SPECIFIEDFOR parameter NEAR LINE lineCOLUMN column

Explanation: Non-numeric data was specified inADHLOADP for the parameter listed in the message.

User response: Specify numeric data for theparameter.

ADHQ8007E INVALID VALUE SPECIFIED FORparameter NEAR LINE line COLUMNcolumn

Explanation: An invalid value was specified inADHLOADP.

User response: Correct the value and resubmit the job.

ADHQ8008E value MUST BE value THAN value

Explanation: The value of the parameter shown in themessage must be within the specified range.

User response: Correct the value of the parameter soit falls within the range indicated in the message text.

ADHQ8009E DUPLICATE PARAMETER parameter ATLINE line COLUMN column

Explanation: A parameter you specified is a duplicate.

User response: Correct the syntax to eliminate theduplicate parameter.

ADHQ8010E DUPLICATE SUBPARAMETERDETECTED FOR PARAMETERparameter AT LINE line COLUMN column

Explanation: A sub-parameter you specified is aduplicate.

User response: Correct the syntax to eliminate theduplicate sub-parameter.



ADHQ8011E DB2 VERSION NOT SUPPORTED

Explanation: The version of DB2 with which you areattempting to use is not supported by unloadfunctionality of the collector agent.

User response: The collector agent unloads data toDB2 Version 8, DB2 Version 9, or DB2 Version 10.

ADHQ8012E ERROR OPENING DDNAME ddname

Explanation: The collector agent encountered an errorattempting to open the TEXTDATA data set.

User response: Verify that the TEXTDATA data set isconfigured properly and has adequate space available.

ADHQ8013E INVALID PARAMETER LENGTH FORparameter

Explanation: The value you specified for theTBCREATOR parameter is too long and is thereforeinvalid.

User response: Specify a valid value for TBCREATOR.Valid values are up to eight characters in length.

ADHQ8014E LOGIC ERROR: error

Explanation: The collector agent has encountered alogic error.


ADHQ8015E LOAD (REPLACE,RESUME) ARECONFLICTING OPTIONS

Explanation: The options specified for LOAD areconflicting options.

User response: Specify only REPLACE or RESUME onthe LOAD.

ADHQ8016E ONLY 10 OPTIONS CAN BESPECIFIED PER LINE - LINE lineEXCEEDED MAX

Explanation: You have exceeded the maximumnumber of options that can be specified per line.

User response: Correct the number of optionsspecified on the line indicated in the message so that itis ten or less.

ADHQ8017E ADH@ITXT IS NOT BOUNDUNICODE.

Explanation: ADH@ITXT is not bound in UNICODEencoding.

User response: Rebound and ensure the encoding isset to UNICODE.

ADHQ8018E UNABLE TO RESTART LOAD FORddname: reason

Explanation: This message indicates that the loadcannot be restarted. The message displays the filewhere the error was encountered and the reason (whichcan be either PREMATURE END OF FILE or SQLERROR FINDING RESTART POINT).

User response: Ensure that the ADH@ITXT LOADkeyword is set to RESUME. For a restart, the LOADkeyword must be set to RESUME.

ADH8022I adh parameter value

Explanation: This message is used to display thecontents of the ADHPARMS file that was processedwhen InfoSphere Guardium S-TAP for DB2 was started.


ADH9899I adh modify command

Explanation: This message is used to display the textof a modify command that was issued to InfoSphereGuardium S-TAP for DB2.


ADHQ8011E • ADH9899I


Error messages and codes: ADHSxxxxThe following information is about error messages and codes that begin withADHS.

ADHS002I Received command acknowledgement.

Explanation: Received command acknowledgement.


ADHS003I Received command response.

Explanation: Received command response.


ADHS005E Location location-name does not exist onmachine-name.

Explanation: The location that is identified in themessage does not exist.

User response: Verify that the subsystem or datasharing group location-name exists on machine-name.

ADHS008E The configuration file file-name isinvalid; the root element element is notserver-config.

Explanation: The contents of the specifiedconfiguration file are invalid.

User response: Correct the file contents to specifyagent-config as the root XML element.

ADHS009E An error occurred while opening theconfiguration file file-name. message-text

Explanation: An error occurred while opening theconfiguration file that is identified in the message.

User response: Review the message text for moreinformation about the error that occurred. Specify avalid configuration file which is not in use by any otherprocess.

ADHS010E Message with ID = id does not exist.

Explanation: The message with the ID that isidentified in the message does not exist.


ADHS011E A task is in progress for specification.

Explanation: The specification could not be deleted orrenamed because it has an active related job to beviewed by the user.

User response: Either wait for the job to end, or openthe specification and cancel the job before deleting thespecification.

ADHS012I Received an acknowledgement withsequence = sequence-id and ID =request-id from an agent session with ID= session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received an acknowledgement that is identified in themessage from an agent session.


ADHS013I Received a data message from an agentsession with ID = session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received a data message from an agent session with theID that is identified in the message.


ADHS014I Received a negative acknowledgementwith sequence = sequence-id from anagent session with ID = session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received a negative acknowledgement from an agentsession that is identified in the message.


ADHS015I Received a report with type = type froman agent session with ID = session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received a report from an agent that is identified in themessage.


ADHS016I Received request with sequence =sequence-id and type = type from clientsession session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received a request from the client session that isidentified in the message.


ADHS017I Received a response with ID = id, type =type, and final indicator = indicator froman agent session with ID = session-id.

Explanation: InfoSphere Guardium S-TAP for DB2received a response from an agent session that isidentified in the message.


ADHS002I • ADHS017I


ADHS022I IBM InfoSphere Guardium S-TAP forDB2 server started.

Explanation: The InfoSphere Guardium S-TAP for DB2server has started.


ADHS023I (CT request-id) Task started.

Explanation: (CT request-id) Task started.


ADHS024E (CT request-id) Error: message-text

Explanation: Message text identifies the error and therequest ID.

User response: Use the specified message text todiagnose the error.

ADHS025I (CT request-id) Task ended.

Explanation: (CT request-id) Task ended.


ADHS026I (CT request-id) Started processing requestwith sequence = sequence-id and type =type.

Explanation: InfoSphere Guardium S-TAP for DB2started processing the request that is identified in themessage.


ADHS027I (CT request-id) Completed processingrequest with sequence = sequence-id andtype = type.

Explanation: InfoSphere Guardium S-TAP for DB2completed processing the request that is identified inthe message.


ADHS028E (CT request-id) Task does not exist.

Explanation: (CT request-id) Task does not exist.


ADHS029I IBM InfoSphere Guardium S-TAP forDB2server is terminating normally.

Explanation: The InfoSphere Guardium S-TAP for DB2server is terminating normally.


ADHS030E IBM InfoSphere server is terminatingdue to prior errors.

Explanation: The InfoSphere Guardium S-TAP for DB2server is terminating due to prior errors.

User response: See preceding messages to determinewhy the server is terminating.

ADHS031E An invalid request type \"request-id\"was received.

Explanation: An invalid request type that is identifiedin the message was received.


ADHS032E Invalid data was received from an agent:data

Explanation: Invalid data that is identified in themessage was received from an agent.


ADHS033I IBM InfoSphere Guardium S-TAP forDB2 is terminating. Please end yoursession.

Explanation: InfoSphere Guardium S-TAP for DB2 isterminating.

User response: End your session.

ADHS034E An invalid report type \"report-id\" wasreceived.

Explanation: An invalid report type that is identifiedin the message was received.


ADHS035I (AT request-id) Task started.

Explanation: Task started.


ADHS036E (AT request-id) Error: message-text.

Explanation: Message text identifies the error and therequest ID.


ADHS037I (AT request-id) Task ended.

Explanation: Task ended.




ADHS038I (AT request-id) Sent request. agent-info{id= agent-id} ; request-info{type=request-type,sequence=sequence-id}

Explanation: Request sent.


ADHS039I (AT request-id) Received ack. agent-info{id=agent-id}; nack-info{sequence=sequence-id ,id=request-id}

Explanation: Acknowledgement received.


ADHS040I (AT request-id) Received nack. agent-info{id=agent-id}; nack-info{sequence=sequence-id}

Explanation: Negative acknowledgement received.


ADHS041I (AT request-id) Received response.agent-info {id=agent-id} ; response-info{id=request-id, final =indicator}

Explanation: Response received.


ADHS042I (AT request-id) Agent disconnectedunexpectedly. agent-info {id=agent-id}

Explanation: Agent disconnected unexpectedly.

User response: Review the agent job output todetermine why it disconnected unexpectedly.

ADHS043I Task was cancelled.

Explanation: Task was cancelled.


ADHS044S The agent for location location-name hasunexpectedly disconnected.

Explanation: The agent for the location that isidentified in the message has unexpectedlydisconnected.

User response: Review the agent job output todetermine why it disconnected unexpectedly.

ADHS045E Specification already exists.

Explanation: Specification already exists.

User response: Specify a different specification owneror name.

ADHS046E The length of the \"parameter\"configuration parameter exceeds number.

Explanation: The length of the configurationparameter that is identified in the message exceeds themaximum allowable length.

User response: Specify a value for the configurationparameter which does not exceed the maximumallowable length.

ADHS048I ACP) Received command command.

Explanation: InfoSphere Guardium S-TAP for DB2received the command that is identified in the message.


ADHS049I (ACP) command -- Begin output.

Explanation: This is the beginning of the output fromthe command that is identified in the message.


ADHS050I ACP) command -- End output.

Explanation: This is the end of the output from thecommand that is identified in the message.


ADHS051E ACP) command not recognized.

Explanation: The command that is identified in themessage is not recognized.

User response: Specify a command that is supportedby the server. See InfoSphere Guardium S-TAP for DB2Administration for supported administrative commands.

ADHS052E (ACP) command -- Unique specificationID not specified.

Explanation: The command is not correctly formatted.

User response: See InfoSphere Guardium S-TAP for DB2Administration for supported administrative commands.

ADHS053E (ACP) command -- Session ID required.

Explanation: The command is not properly formatted.

User response: See InfoSphere Guardium S-TAP for DB2Administration for supported administrative commands.

ADHS054I The administrator has requested thatthis session be ended. Please end yoursession.

Explanation: The administrator has requested that thissession be ended.

User response: End your session.



ADHS055I Sending report with type = type to clientwith session id = session-id.

Explanation: InfoSphere Guardium S-TAP for DB2 issending the report that is identified in the message.


ADHS19E An XML schema violation was detected;required element element child child isnot present.

Explanation: The InfoSphere Guardium S-TAP for DB2server encountered an XML schema violation whenreading a message from the client that displayed themessage.


ADHS201I Summarizer ended.

Explanation: Summary thread has ended.


ADHS204E (SUM) error: MessageText

Explanation: An error occurred during summary tableprocessing. The message text identifies the error.

User response: Use the specified message text todiagnose the error. If unable to resolve the error,contact IBM Software Support.

ADHS205I (SUM) Summary tables refreshprocessing complete.

Explanation: Summary tables refresh processing hascompleted.


ADHS206W SQL Error Encountered. Summarizationwill be attempted at next interval.

Explanation: A SQL Error was encountered duringsummary table refresh processing. Summarization oftables will occur at next interval.

User response: It is reasonable to encounterADHS206W messages on an infrequent basis. Insituations where ADHS206W messages are issuedfrequently, review the generated SQL Code andmessages appearing in the log and take appropriateaction. If unable to resolve the generation of theADHS206W messages, contact IBM Software Support.

ADHS200I Summarizer started.

Explanation: Summary thread has started.


ADHS2000E Caught Exception processingrequest:request

Explanation: InfoSphere Guardium S-TAP for DB2encountered the specified exception processing request.


ADHS2009E id1 Spec ID id2 unlocked successfully.

Explanation: The specified spec ID was unlockedsuccessfully.


ADHS2010E id1 Spec ID id2 is not locked. Commandfailed.

Explanation: The specified spec ID is not locked.


ADHS2012E id1 Requested Session ID id2 toshutdown successfully.

Explanation: The specified session ID has beenrequested to shutdown successfully.


ADHS2013E id1 Session ID id2 not found or is notactive. Command failed.

Explanation: The specified session ID was not foundor is not active.


ADHS2014E id1 Shutdown of Session ID id2initiated.

Explanation: The specified session ID shutdown hasbeen initiated.


ADHS2015E id1 Session ID id2 not found or is notactive. Command failed.



ADHS055I • ADHS2015E


ADHS202I Refreshing summary tables.

Explanation: Summary tables refresh processing inprogress.


ADHS2022E id1 Session ID id2 not found or is not anagent session ID. Command failed.


User response: Check the server log for additionalinformation. Contact your administrator or IBMSupport if needed.

ADHS2030E id1 Client Session ID id2 not found.Command failed.

Explanation: The specified client session ID was notfound or is not active.


ADHS2031E Administrator issued a cancel request.

Explanation: Administrator issued a cancel request.

User response: No action is required. Contact youradministrator for details, if needed.

ADHS2032E id1 Issued a cancel request to Task IDid2 successfully.

Explanation: The specified ID issued a cancel requestfor the specified task ID.

User response: None required. Contact youradministrator for details, if needed.

Error messages and codes: ADHTxxxxThe following information is about error messages and codes that begin withADHT.

ADHT012I Performing discovery of availablelocations.

Explanation: The InfoSphere Guardium S-TAP for DB2agent is looking for available locations.


ADHT013I IBM InfoSphere Guardium S-TAP forDB2 agent is terminating.

Explanation: The InfoSphere Guardium S-TAP for DB2agent is terminating.


ADHT014I Connected to server hostname on portport number.

Explanation: The InfoSphere Guardium S-TAP for DB2agent has connected to the identified server and portnumber.


ADHT015I Attempting connection to serverhostname on port port number.

Explanation: The InfoSphere Guardium S-TAP for DB2agent is attempting to connect to the identified serverand port number.


ADHT016I Discovered data sharing group groupname.

Explanation: The InfoSphere Guardium S-TAP for DB2agent has discovered the identified data sharing group.


ADHT017I Discovered subsystem subsystem-id.

Explanation: The InfoSphere Guardium S-TAP for DB2agent has discovered the identified subsystem.


ADHT018I The agent is ready to process requests.

Explanation: The agent is ready to process requests.


ADHT019I IBM InfoSphere Guardium S-TAP forDB2 agent started.

Explanation: The InfoSphere Guardium S-TAP for DB2agent started.


ADHT020I Starting the socket selector thread(thread thread id).

Explanation: The InfoSphere Guardium S-TAP for DB2agent is starting the identified socket selector thread.


ADHS202I • ADHT020I


ADHT021I Processing request with ID id and typetype.

Explanation: The InfoSphere Guardium S-TAP for DB2agent is processing a request with the identified ID andtype.


ADHT022I Reading request with ID id and typetype.

Explanation: The InfoSphere Guardium S-TAP for DB2agent is reading a request with the identified ID andtype.


ADHT023I Received shutdown request.

Explanation: The InfoSphere Guardium S-TAP for DB2agent has received a shutdown request.


ADHT024I Request thread timed out waiting forwork.

Explanation: The InfoSphere Guardium S-TAP for DB2agent request thread has timed out waiting for work.


ADHT025I The socket selector thread isterminating.

Explanation: The InfoSphere Guardium S-TAP for DB2agent socket selector thread is terminating.


ADHT026E Location location name is not known tothe agent.

Explanation: The location name specified on areceived request does not match any DB2 subsystem IDor data sharing group attachment name known to theagent.

User response: Ensure that a valid location is specifiedin the client. If a valid location is specified, ensure thatthe DB2 subsystem is operational.

ADHT027S An invalid request type \"request-id\"was received.

Explanation: The InfoSphere Guardium S-TAP for DB2agent received an invalid request type.


ADHT028E An error occurred while authenticatinguser user-id.

Explanation: An unexpected return code was returnedby the pthread_security_np() callable service.

User response: Ensure that the configuration requiredto use this service has been completed. See Configuringthe agent for more information about the requiredconfiguration. Check the agent job log for additionalmessages which might be generated.

ADHT029E Location location name has not beenconfigured for use with InfoSphereGuardium S-TAP for DB2.

Explanation: The specified location name isrecognized by the agent, but an error occurred whileaccessing the product control file for the location'sconfiguration information.

User response: Use sample job ADHSJ001 to establishthe required configuration parameters.

ADHT031I Starting the command listener thread(thread thread-id).

Explanation: The InfoSphere Guardium S-TAP for DB2agent is starting the command listener thread.


ADHT032I Received \"stop\" command:command-text.

Explanation: The InfoSphere Guardium S-TAP for DB2agent received a STOP command.


ADHT033I Received \"modify\" command:command-text.

Explanation: The InfoSphere Guardium S-TAP for DB2agent received a MODIFY command.


ADHT034S IBM InfoSphere Guardium S-TAP forDB2 agent is terminating due to hardstop request.

Explanation: InfoSphere Guardium S-TAP for DB2agent is terminating due to a user /MODIFY FORCEcommand.


ADHT021I • ADHT034S


ADHT040E An I/O abend Sabend-code-reason-codeoccurred on filename.

Explanation: An abend occurred while trying to writeto the identified file.

User response: Review the abend and reason codes todetermine the error that occurred while writing the file.

ADHT045E Subsystem ssid is not known to theagent

Explanation: The specified subsystem is not known tothe agent.

User response: Verify that the ssid represents a validsubsystem.

ADHT047E An error occurred while renamingold-file-name to new-file-name:*message-text*

Explanation: An error occurred while renaming thespecified file and there is also error information in themessage.

User response: Use the specified message text todiagnose why the specified file could not be renamed.

Error messages and codes: ADHXxxxxThe following information is about error messages and codes that begin withADHX.

ADHX028E The command line option \"option\" isinvalid.

Explanation: The command line option \"option\" isinvalid.

User response: Correct the command line option andretry the operation. See The InfoSphere GuardiumS-TAP for DB2 on z/OS client/server environment forvalid options.

ADHX029E The command line option \"option\"value \"value\" is invalid.

Explanation: The command line option\"option\"value \"value\" is invalid.

User response: Correct the command line option andretry the operation. See the InfoSphere GuardiumS-TAP for DB2 Guardium S-TAP for DB2 on z/OSclient/server environment for valid options.

ADHX030E The required command line option\"option\" was not specified.

Explanation: The required command line option\"option\" was not specified.

User response: Specify the required command lineoption and retry the operation. See The InfoSphereGuardium S-TAP for DB2 on z/OS client/serverenvironment for valid options.

ADHX031E A value is required for the commandline option \"option\".

Explanation: A value is required for the command lineoption \"option\".

User response: Specify a value for the command lineoption and retry the operation. See the InfoSphereGuardium S-TAP for DB2 Guardium S-TAP for DB2 onz/OS client/server environment for valid options.

ADHX032E Too many values were specified for thecommand line option \" option\".

Explanation: Too many values were specified for thecommand line option \"option\".

User response: Specify only one value for thecommand line option and retry the operation. See theInfoSphere Guardium S-TAP for DB2 Guardium S-TAPfor DB2 on z/OS client/server environment for validoptions.

ADHX033E The command line option \"option\"does not accept any values.

Explanation: The command line option \"option\"does not accept any values.

User response: Correct the command line option andretry the operation. See the InfoSphere GuardiumS-TAP for DB2 Guardium S-TAP for DB2 on z/OSclient/server environment for valid options.

ADHX034S A severe error occurred duringcommand line processing; an unknownexception occurred.

Explanation: A severe error occurred duringcommand line processing; an unknown exceptionoccurred.


ADHX035E The operation completed successfully.

Explanation: The operation completed successfully.


ADHX036E he address family is not supported bythe protocol family ( socket-return-code).

Explanation: The address family is not supported by

ADHT040E • ADHX036E


the protocol family ( socket-return-code).


ADHX037E The operation is still in progress(socket-return-code).

User response: Contact your system administrator toresolve the socket communication problem on yoursystem.

ADHX038E Permission is denied (socket-return-code).


ADHX039E The network is down (socket-return-code).


ADHX040E No buffer space is available(socket-return-code).


ADHX041E Too many sockets have been opened(socket-return-code).

Explanation: Too many sockets have been opened(socket-return-code).


ADHX042E The protocol is not supported(socket-return-code).

Explanation: The protocol is not supported(socket-return-code).


ADHX043E The WSAStartup routine was not called(socket-return-code).

Explanation: The WSAStartup routine was not called(socket-return-code).


ADHX044E The protocol is the wrong type for thesocket (socket-return-code).

Explanation: The protocol is the wrong type for thesocket (socket-return-code).


ADHX045E The socket type is not supported(socket-return-code).

Explanation: The socket type is not supported(socket-return-code).


ADHX046E The destination network is unreachable(socket-return-code).

Explanation: The destination network is unreachable(socket-return-code).

User response: Ensure that the correct host name or IPaddress was specified.

ADHX047E The socket handle is invalid(socket-return-code).

Explanation: The socket handle is invalid(socket-return-code).


ADHX048E The address is already in use(socket-return-code).

Explanation: The address is already in use(socket-return-code).


ADHX049E The function call was interrupted(socket-return-code

Explanation: The function call was interrupted(socket-return-code).


ADHX050E The requested address is not available(socket-return-code).


ADHX051E The connection was aborted(socket-return-code).


ADHX052E The connection was refused by thepartner (socket-return-code).

Explanation: The connection was refused by thepartner (socket-return-code).

User response: Ensure that the correct port number

ADHX037E • ADHX052E


was specified, and that the partner application has beenstarted and is available.

ADHX053E The connection was reset by the partner(socket-return-code).

Explanation: The connection was reset by the partner(socket-return-code).

User response: The partner application ended thenetwork connection. If this is unexpected, diagnose theother application's failure. Otherwise, no action isrequired.

ADHX054E The network message is too long(socket-return-code).

Explanation: The network message is too long(socket-return-code).


ADHX055E The network dropped the connectionwhen reset (socket-return-code).


ADHX056E An invalid parameter was specified(socket-return-code).

Explanation: An invalid parameter was specified(socket-return-code).


ADHX057E The socket is not connected(socket-return-code).

Explanation: The socket is not connected(socket-return-code).


ADHX058E The operation is not supported(socket-return-code).

Explanation: The operation is not supported(socket-return-code).


ADHX059E The socket has been closed(socket-return-code).

Explanation: The socket has been closed(socket-return-code).


ADHX060E The socket is already connected(socket-return-code).

Explanation: The socket is already connected(socket-return-code).


ADHX061S An unknown error occurred(socket-return-code).

Explanation: An unknown error occurred(socket-return-code).


ADHX062E A socket error occurred on\"socket-operation\": message-text.

Explanation: A socket error occurred.


ADHX063E A socket select error occurred:message-text.

Explanation: A socket select error occurred.


ADHX064E An XML schema violation was detected;expected root element\"element-expected\", but found\"element-found\" instead.

Explanation: An XML schema violation was detected;expected root element \" element-expected\", but found\"element-found\" instead.

User response: If the error occurred while reading theagent or server configuration file, correct the filecontents. Otherwise, contact IBM Software Support.

ADHX066E An XML schema violation was detected;element \"element\" value \"value\" isinvalid.

Explanation: An XML schema violation was detected;element \"element\" value \"value\" is invalid.


ADHX067E An XML schema violation was detected;element name \"element\" is invalid.

Explanation: An XML schema violation was detected;element name \" element\" is invalid.

User response: If the error occurred while reading theagent or server configuration file, correct the file



contents. Otherwise, contact IBM Software Support.

ADHX068E An XML schema violation was detected;element name \"element-found\" isinvalid (expected \"element-expected\").

Explanation: An XML schema violation was detected;element name \" element-found\" is invalid (expected\"element-expected\").


ADHX071E An error occurred while invoking thesubsystem interface (RC = return-code).

Explanation: The specified return code was returnedby the z/OS subsystem interface when trying to queryjob status or results.

User response: See MVS Using the Subsystem Interfacefor more information about the return code.

ADHX072E An error occurred while invoking theSYSOUT API (SSOBRETN = return-code,SSS2REAS = reason-code).

Explanation: The specified return code was returnedby the z/OS subsystem interface when trying to queryjob status or results.

User response: See MVS Using the Subsystem Interfacefor more information about the return code.

ADHX076E An XML schema violation was detected;element \"element\" attribute\"attribute\" value \"value\" isinvalid.

Explanation: An XML schema violation was detected;element \"element\" attribute \"attribute\"value\"value\" is invalid.


ADHX077E A DB2 attachment facility erroroccurred: function = function-code, RC =return-code, reason = reason-code.

Explanation: A DB2 attachment facility error occurred:function = function-code, RC = return-code, reason =reason-code.

User response: An error occurred while performing aDB2 attachment function. See DB2 Messages and Codesfor more information about the return and reasoncodes.

ADHX078E An error occurred while opening theDB2 load libraries: RC = return-code.

Explanation: An error occurred while opening theDB2 load libraries: RC = return-code.

User response: Ensure that the correct list of loadlibraries for the DB2 subsystem is configured in theproduct control file, using sample job ADHSJ001. SeeDFSMS Macro Instructions for Data Sets for moreinformation about the return code.

ADHX079E An error occurred while attaching theDB2 attachment facility subtask: RC =return-code.

Explanation: An error occurred while attaching theDB2 attachment facility subtask: RC = return-code.

User response: Contact IBM customer service.

ADHX080S The DB2 attachment facility subtaskended unexpectedly: RC = return-code.

User response: Contact your system administrator orDB2 administrator to resolve the DB2 issue.

ADHX081E An SQL error occurred: SQL code =sql-code, SQL state = sql-state.

Explanation: An SQL error occurred: SQL code =sql-code, SQL state = sql-state.

User response: See DB2 Messages and Codes for moreinformation about the SQL code and SQL state values.

ADHX082E The input DB2 command is too long.

Explanation: The input DB2 command is too long.


ADHX083E An error occurred while making an IFIfunction-code call: IFCARC1 = return-code,IFACRC2 = reason-code.

Explanation: An error occurred while making an IFIfunction-code call: IFCARC1 = return-code, IFACRC2 =reason-code.


ADHX084E Insufficient data was returned from anIFI call.

Explanation: Insufficient data was returned from anIFI call.




ADHX085E A dynamic allocation error occurred:info code = info-code, error code =error-code.

Explanation: A dynamic allocation error occurred: infocode = info-code, error code = error-code.

User response: See MVS Programming: AuthorizedAssembler Services Guide for more information about thespecified information and error codes.

ADHX086E A dynamic concatenation error occurred:info code = info-code, error code =error-code.

Explanation: A dynamic concatenation error occurred:info code = info-code, error code = error-code.


ADHX087E A dynamic free error occurred: info code= info-code, error code = error-code.

Explanation: A dynamic free error occurred: info code= info-code, error code = error-code.


ADHX088E An invalid dynamic allocationparameter was specified: code =parm-code.

Explanation: An invalid dynamic allocation parameterwas specified: code = parm-code.


ADHX089E The specified user ID user-id andpassword are invalid.

Explanation: The specified user ID user-id andpassword are invalid.

User response: Correct the user ID and password andretry the operation.

ADHX090E The specified password for user IDuser-id has expired.

Explanation: The specified password for user IDuser-id has expired.

User response: Use native facilities to change yourpassword, then retry the operation.

ADHX091E Access for the specified user ID user-idhas been revoked.

Explanation: Access for the specified user ID user-idhas been revoked.

User response: See your security administrator to getyour user ID reinstated.

ADHX092E An error occurred while performingauthentication: SAF RC = saf-return-code,RC = return-code, RSN = reason-code.

Explanation: An error occurred while performingauthentication: SAF RC = saf-return-code, RC =return-code, RSN = reason-code.


ADHX093S An unexpected error occurred (file-name,line-number).

Explanation: An unexpected error occurred (file-name,line-number).


ADHX094S An unexpected error occurred withtoken \"token, \" (file-name, line-number).

Explanation: An unexpected error occurred with token\"token,\" (file-name, line-number).


ADHX095S An unexpected error occurred withtokens \"token\" and \"token\"(file-name, line-number).

Explanation: An unexpected error occurred withtokens \"token\" and \"token\" (file-name, line-number).


ADHX096S An unexpected error occurred withtokens \"token, token \" and \"token\"( file-name, line-number).

Explanation: An unexpected error occurred withtokens \"token, token \" and \"token\" ( file-name,line-number).


ADHX097S An unexpected error occurred withtokens \"token, token, token, \" and\" token\" (file-name, line-number.

Explanation: An unexpected error occurred withtokens \"token, token, token\", and \" token\" (file-name,line-number.


ADHX085E • ADHX097S


ADHX098E A thread error occurred on\"thread-operation\": message-text.

Explanation: A thread error occurred on\"thread-operation\": message-text.


ADHX101E An event error occurred on\"event-operation\": message-text.

Explanation: An event error occurred on\"event-operation\": message-text.


ADHX104E A mutex error occurred on\"mutex-operation\": message-text.

Explanation: A mutex error occurred on\"mutex-operation\": message-text.


ADHX109E A semaphore error occurred on\"semaphore-operation\": message-text.

Explanation: A semaphore error occurred on\"semaphore-operation\": message-text.


ADHX110I The network connection has beendisconnected.

Explanation: The network connection has beendisconnected.


ADHX111E An SQL error occurred with SQL code =sql-code and SQL state = sql-state. SQLmessage text follows: message-text.

Explanation: An SQL error occurred with SQL code =sql-code and SQL state = sql-state. SQL message textfollows: message-text.


ADHX112E An SQL error occurred with SQL code =sql-code and SQL state = sql-state.

Explanation: An SQL error occurred with SQL code =sql-code and SQL state = sql-state.


ADHX113E An SQL error occurred with SQL code =sql-code and SQL state = sql-state.

Explanation: An SQL error occurred with SQL code =sql-code and SQL state = sql-state.


ADHX114E A dynamic allocation query erroroccurred: info code = info-code, errorcode = error-code.

Explanation: A dynamic allocation query erroroccurred: info code = info-code, error code = error-code.

User response: See MVS Programming: AuthorizedAssembler Services Guide for more information about thespecified info and error codes.

ADHX115E An input command error occurred on\"command-operation\": message-text.

Explanation: An input command error occurred on\"command-operation\": message-text.


ADHX116I Received input command: command-text.

Explanation: Received input command: command-text.


ADHX117E Excessive data was encountered in theASN.1 data stream.

Explanation: Excessive data was encountered in theASN.1 data stream.


ADHX118E Insufficient data was encountered in theASN.1 data stream.

Explanation: Insufficient data was encountered in theASN.1 data stream.


ADHX119E An unsupported ASN.1 feature wasencountered.

Explanation: An unsupported ASN.1 feature wasencountered.


ADHX120E Invalid DES-encrypted data wasencountered.

Explanation: Invalid DES-encrypted data wasencountered.




ADHX121E Invalid DES-encrypted data wasencountered (pad = pad-value).

Explanation: Invalid DES-encrypted data wasencountered (pad = pad-value).


ADHX122I Build date component = date.

Explanation: Build date component = date.


ADHX123W The action was cancelled.

Explanation: The action was cancelled.

User response: No action is required. The operationwas cancelled due to user or administrator request.

ADHX124S The task is not running APF-authorized.

Explanation: The task is not running APF-authorized.

User response: The InfoSphere Guardium S-TAP forDB2 load library, and the load libraries for all of theDB2 subsystems accessed, must be APF-authorized. SeeAPF authorizing the LOAD library agent for moreinformation about the required configuration steps.

ADHX125E An error occurred while retrievingproduct configuration data: RC =return-code.

Explanation: An error occurred while retrievingproduct configuration data: RC = return-code.

User response: Ensure that a product control file hasbeen created and loaded using sample jobs ADHSJ000and ADHSJ001, and that it is allocated to theDB2PARMS DD.

ADHX127S An error occurred while opening log file\" file-name\".

Explanation: An error occurred while opening log file\"file-name\".


ADHX128E An error occurred while submitting thejob: RC = return-code.

Explanation: An error occurred while submitting thejob: RC = return-code.


ADHX129I Job job-id was submitted.

Explanation: The specified job was submitted.


ADHX121E • ADHX129I


Error messages and codes: ADHZxxxxThe following information is about error messages and codes that begin withADHZ.

ADHZ100S Identify failure using IFI.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, theDB2 return code, followed by the DB2 reason codeexplaining the problem.

User response: Areas to investigate to solve theproblem after looking up the return code and reasoncodes in the DB2 Messages and Codes manual includethe following:

v Verify that the specified DB2 subsystem ID is valid.

v Verify the DB2 subsystem is active on the processor.

v Verify the started address space can connect to DB2.

Correct the problem and rerun.

ADHZ101S Sign on failure using IFI.


User response: Look up the return code and reasoncodes in the DB2 Messages and Codes manual toisolate the problem. Correct the problem and rerun.

ADHZ102S Create thread failure using IFI.


User response: After looking up the return code andreason codes in the DB2 Messages and Codes manual,verify the program has authorization to run theInfoSphere Guardium S-TAP for DB2 plan specified inthe message. Correct the problem and rerun.

ADHZ103S Command failure using IFI.


User response: After looking up the return code and

reason codes in the DB2 Messages and Codes manual,verify that the program has authorization to issue DB2commands. Correct the problem and rerun.

ADHZ104S READA failure using IFI.


User response: Verify that the user ID that is runningthe agent has SYSCTRL or SYSADM authority. If so,then contact IBM Software Support. Otherwise, look upthe return code and reason codes in the DB2 Messagesand Codes manual, and then correct the problem andrerun.

ADHZ106S DB2 terminated.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, theDB2 return code, followed by reason code of 16.

User response: Restart DB2 and then restartInfoSphere Guardium S-TAP for DB2.

ADHZ107S A permanent problem occurred usingthe IBM UNICODE conversion routineconversion and the collection processterminates.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, the UNICODE conversion return code, followedby the reason code explaining the problem. A snapdump is issued if ADHZSNAP DDNAME is specifiedin the JCL.

User response: Notify the systems programmer of theUNICODE conversion problem. After the problem hasbeen corrected, restart InfoSphere Guardium S-TAP forDB2.

ADHZ108S A permanent problem occurredattempting to read the product datasetand the collection process terminates.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, the InfoSphere Guardium S-TAP for DB2 data setreturn code, followed by the reason code indicating anumber associated with the failure. This error occurs

ADHZ100S • ADHZ108S


when the DB2 SSID is not defined in the product dataset.

User response: Define the DB2 SSID in the productdata set and then restart InfoSphere Guardium S-TAPfor DB2.

ADHZ200S Identify failure using SQL.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, the UNICODE conversion return code, followedby the reason code explaining the problem.






ADHZ201S Sign on failure using SQL.

Explanation: The SQL requests fails, but IFI collectioncontinues. The message contains the DB2 subsystem ID,the InfoSphere Guardium S-TAP for DB2 plan name,the DB2 return code, followed by the DB2 reason codeexplaining the problem.






ADHZ202S Create thread failure using SQL.

Explanation: The SQL requests fails, but IFI collectioncontinues. The message contains the DB2 subsystem ID,the InfoSphere Guardium S-TAP for DB2 plan name,the DB2 return code, followed by the DB2 reason codeexplaining the problem.

User response: Look up the return code and reasoncodes in the DB2 Messages and Codes manual. Verifythe program has authorization to run the InfoSphereGuardium S-TAP for DB2 plan specified in themessage. Correct the problem and rerun.

ADHZ210S Dynamic allocation failure. The datasetidentified in the product file could notbe allocated.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, theSVC 99 return code, the SVC 99 reason code, and thedataset name.

User response: Verify the data set is valid. The dataset is defined in the product dataset. Notify the systemsprogrammer of the problem.

ADHZ211S Load failure. The datasets identified inthe product file did not contain aneeded load module.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, theload return code, the load reason code, and the loadmodule name.

User response: Check the load module resides in thelibraries specified in the product dataset. Correct theproblem and rerun.

ADHZ212S Dynamic deallocation failure. Thedataset identified in the product filecould not be deallocated.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, theSVC 99 return code, the SVC 99 reason code, and theDD name.

User response: Notify the system programmer.Correct the problem and rerun.

ADHZ213S The product dataset did not contain therequired DB2 Load libraries needed.

Explanation: The collection of auditinginstrumentation records stops and the collection processends. The message contains the DB2 subsystem ID, theInfoSphere Guardium S-TAP for DB2 plan name, areturn code, and a reason code.

User response: Verify the data sets in the productdataset are correct. Correct the problem and rerun.

ADHZ214S A temporary problem occurred using theIBM UNICODE conversion routineconversion and the collection processwill eliminate the record involved.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 plan

ADHZ200S • ADHZ214S


name, the UNICODE conversion return code, followedby the reason code explaining the problem. A snapdump is issued if ADHZSNAP DDNAME is specifiedin the JCL.

User response: Notify the system programmer of theproblem. One possible cause is an MVS commandmade an UNICODE table unavailable.

ADHZ215S A temporary problem occurredattempting to obtain a buffer to use foran IFI call. The collection process waitsfor a buffer to become available.Records may be lost.

Explanation: From a performance problem make sureInfoSphere Guardium S-TAP for DB2 is at a highdispatching priority. Also verify DB2 contention on theInfoSphere Guardium S-TAP for DB2 databases andDB2 catalog is not causing the problem. The messagecontains the DB2 subsystem ID, and the InfoSphereGuardium S-TAP for DB2 plan name.

User response: Notify the systems programmer. Makesure IBM InfoSphere Guardium S-TAP for DB2 is at ahigh dispatching priority. Verify DB2 contention on theInfoSphere Guardium S-TAP for DB2 databases andDB2 catalog is not causing the problem. InfoSphereGuardium S-TAP for DB2 uses a data space forauxiliary buffering. Verify the installation parametersallow InfoSphere Guardium S-TAP for DB2 to obtain adata space specified by InfoSphere Guardium S-TAP forDB2 installation.

ADHZ216S A temporary problem occurredattempting to obtain an auxiliary bufferto use for an IFI call. The collectionprocess will wait for a buffer to becomeavailable. Records may be lost.

Explanation: From a performance problem make sureInfoSphere Guardium S-TAP for DB2 is at a highdispatching priority. Also verify DB2 contention on theInfoSphere Guardium S-TAP for DB2 databases andDB2 catalog is not causing the problem. The messagecontains the DB2 subsystem ID, and the InfoSphereGuardium S-TAP for DB2 plan name.

User response: Notify the systems programmer. Verifythe installation parameters allow InfoSphere GuardiumS-TAP for DB2 to obtain a data space specified byInfoSphere Guardium S-TAP for DB2 installation.

ADHZ217S A problem occurred trying to createauxiliary storage. The DSPSERV callfailed.

Explanation: The collection of auditinginstrumentation records continues using only realmemory buffers. The message contains the DB2subsystem ID, the InfoSphere Guardium S-TAP for DB2

plan name, the DSPSERV return code, and theDSPSERV reason code.

User response: Notify the systems programmer.

ADHZ218S A problem occurred trying to createauxiliary storage. The ALESERV callfailed.

Explanation: The collection of auditinginstrumentation records continues using only realmemory buffers. The message contains the DB2subsystem ID, the InfoSphere Guardium S-TAP for DB2plan name, the ALESERV return code, and theALESERV reason code.

User response: Notify the systems programmer.

ADHZ219S The expected sequence number of theIFC record was not received.

Explanation: The message indicates the actual IFCmessage sequence number and the expected sequencenumber. If the expected sequence number is less thanthe IFC message number, then records are potentiallylost. The collection of auditing instrumentation recordscontinues. The message contains the DB2 subsystem ID,the InfoSphere Guardium S-TAP for DB2 plan name,the IFC record sequence number, and the expectedsequence number.

User response: InfoSphere Guardium S-TAP for DB2is not keeping up with audit activity either because ofCPU limitation or shortage of buffers. Verify thatInfoSphere Guardium S-TAP for DB2 is receivingadequate CPU resources. InfoSphere Guardium S-TAPfor DB2 uses a data space for a spill file. If InfoSphereGuardium S-TAP for DB2 cannot obtain a data spacebecause of installation rules, then it is possible to runshort on buffers. It is recommended the installationallow IBM InfoSphere Guardium S-TAP for DB2 toobtain the data space size as specified in theinstallation documentation.

ADHZ220A A SQL problem occurred duringinitialization. A select request wasissued using the SQLID defined to theADH product and the views for the DB2catalog. The view names areADHVTABS and ADHVTBLS.

Explanation: The normal cause of the problem is anauthorization failure. Auditing instrumentation recordscontinue to be collected, but the object names will notbe translated and yield object numbers for thedatabase, tablespace and table. The message containsthe DB2 subsystem ID, the DB2 InfoSphere GuardiumS-TAP for DB2 plan name, the return code, and theSQL code.

User response: Look up the return code and reasoncodes in the DB2 Messages and Codes manual; isolateand correct the problem.

ADHZ215S • ADHZ220A


ADHZ220S A SQL problem occurred duringinitialization. A select request wasissued using the SQLID defined toInfoSphere Guardium S-TAP for DB2and the views for the DB2 catalog.

Explanation: The view names are ADHVTABS andADHVTBLS. The normal cause of the problem is anauthorization failure. The collection of auditinginstrumentation records continues. The messagecontains the DB2 database ID, the IBM InfoSphereGuardium S-TAP for DB2 plan name, the return code,and the SQL code.

User response: Verify that the SAMPLIB memberADHDDLS has been modified and run on thesubsystem that is being monitored.

Verify that the userid of the S-TAP agent has access(permission) to the ADHVTABS and ADHVTBLS views.See SAMPLIB member ADHGRTA, ADHGRTB, andADHGRTC for more information.

ADHZ221S A SQL problem occurred duringinitialization. A SET CURRENT SQLIDrequest was issued using the SQLIDdefined to the product.

Explanation: The normal cause of the problem is anauthorization failure. The collection of auditinginstrumentation records continues. The messagecontains the DB2 subsystem ID, the InfoSphereGuardium S-TAP for DB2 plan name, the return code,and the SQL code.

User response: Correct the problem.

ADHZ300A Identify failure using DB2 Connect. Theuse of DB2 Connect Identify failed andstatic SQL information cannot becollected.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, and the DB2 return code, followed by the DB2reason code explaining the problem.

User response: After looking up the return code andreason codes in the DB2 Messages and Codes manual,investigate the following to solve the problem: Verifythe specified DB2 subsystem ID is valid; verify the DB2subsystem is active on the processor; verify the startedaddress space can connect to DB2; correct the problemand rerun.

ADHZ301A Sign on failure using DB2 Connect Theuse of DB2 Connect sign on failed andstatic SQL information cannot becollected.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, and the DB2 return code, followed by the DB2

reason code explaining the problem.

User response: Look up the return code and reasoncodes in the DB2 Messages and Codes manual toisolate the problem. Correct the problem and rerun.

ADHZ302A Create Thread failure using DB2Connect. The use of DB2 ConnectCreate Thread failed and static SQLinformation cannot be collected.

Explanation: The message contains the DB2 subsystemID, the InfoSphere Guardium S-TAP for DB2 planname, and the DB2 return code, followed by the DB2reason code explaining the problem.

User response: After looking up the return code andreason codes in the DB2 Messages and Codes manual,verify the program has authorization to execute theDB2 InfoSphere Guardium S-TAP for DB2 planspecified in the message. Correct the problem andrerun.

ADHZ320A A SQL problem occurred. A selectrequest was issued using the SQLIDdefined to the ADH product and theviews for the DB2 catalog. The viewnames are ADHVSTMT andADHVPSTM.

Explanation: The normal cause of the problem is anauthorization failure. Static SQL statements cannot becollected from the DB2 catalog. The message containsthe DB2 subsystem ID, the DB2 InfoSphere GuardiumS-TAP for DB2 plan name, the return code, and theSQL code.

User response: Look up the return code and reasoncodes in the DB2 Messages and Codes manual; isolateand correct the problem.

ADHZ220S • ADHZ320A


Index

Aaccessibility

overview 6additional documentation 21ADHEMAC1 edit macro variables 34audit data source

collection types 19

Ccollector agent 3, 22

configuration 11collector agent started task 12compatibility with other products 3compatibility with Query Monitor 3compatible releases and maintenance

levels 3components

Guardium system 2configuration 7

ADHCFGP data set 12collector agent started task 12

configuringadditional DB2 collections 13

control filecreating 10required statements 11

customizingJCL members 9

Ddata collection 17, 18dynamic LPA facility service

CSVDYLPA 9

Eerror messages 37

codes 37collector agent messages 56

Ffeatures and functions overview 1filtering

controlling 17

Gglobalization 5Guardium system

connection 22

IIFI event audit data

streaming 20InfoSphere Guardium S-TAP for DB2 2installation environment

architecture diagram 2

JJCL

ADHBIND 11

LLOAD library

APF authorizing 8

MMaster Address Space

considerations for stopping 15overview 14

usage considerations 15

Pparameters 22policy pushdown 20

QQuery Monitor

compatibility with collector agent 3

Rreference information 21

Ssample library members 21sample parameter file 33screen readers and magnifiers 6SQL event filtering

Stage 1 filtering 17Stage 2 filtering 17

Uupgrading from previous versions 7user IDs

required user ID authorizations 5

VV9.1 enhancements 1

91

IBM InfoSphere Guardium S-TAP for DB2 on z/OS … InfoSphere Guardium S-TAP for DB2 collector agent...

Documents

Transcript of IBM InfoSphere Guardium S-TAP for DB2 on z/OS … InfoSphere Guardium S-TAP for DB2 collector agent...