ICH409I 282-010 ABEND DURING RACHECK PROCESSING

[dabills]

I am trying to implement the CZCHKCMD exit and am getting message:
ICH409I 282-010 ABEND DURING RACHECK PROCESSING

We have a racroute request=auth command in our command exit which I suspect is causing the issue. I suspect it's an APF authorization issue based on the message but I'm not sure what needs to be APF authorized. I tried authorizing the loadlib that CZCHKCMD is in, I tried linking CZCHKCMD with AC(1), I tried SETUID in the mountpoint we run COZ programs from, and I've even tried to extattr +a sftp-server to no avail. Any idea how to APF authorize whatever is causing the message or do you even think this is an APF authorization issue?

[dovetail]

This error would happen if your CZCHKCMD exit requires APF authorization. You might want to check your code (a RACHECK / RACROUTE macro?) to see if you *really* need the keywords that require APF authorization. I would discourage you from running APF authorized if at all possible. For example, if you are using RACOUTE REQUEST=AUTH, the manual documents which keywords require APF authorization. For example, LOG= anything but ASIS requires APF authorization. If this is the one causing you problems, you might want default logging controlled by the CLASS.

In order to run APF authorized, the Co:Z SFTP server (program <coz_inst>/bin/sftp-server) must be APF authorized and relinked with attribute AC=1.

We have had a couple of customers in the past that had FTP exits that required APF and they wanted to run them under Co:Z SFTP. For this purpose, we have a script that you can run that will relink and mark the Co:Z sftp-server executable as APF authorized. This script is in <coz_inst>/bin/relink-sftp-server.sh. You must run this under root or an id that has READ access to the BPX.FILEATTR.APF resource. To run it:

Code: Select all

cd /your/coz/instdir/bin
./relink-sftp-server.sh

see the comments in the script for more information. Also, if you install a new version of Co:Z, you will need to re-run this. (As you already have), the library containing your CZCHKCMD to be either APF authorized or in LINKLST.

A couple of things to consider when testing your CZCHKCMD exit:

- review the exits guide: https://docs.google.com/viewer?url=http ... _exits.pdf

- have some tracing in your exit, so that you can see *exactly* what it is being passed. This will help you with debugging.

[dabills]

We had to set relink sftp-server as APF authorized because the RACROUTE REQUEST=AUTH command we issue has parameters that require APF. Relinking fixed the issue. Thanks.