Global Security Forum

Security Global Forum

Our mission is to provide clients with an online user community of industry peers and IBM experts, to exchange tips and tricks, best practices, and product knowledge. We hope the information you find here helps you maximize the value of your IBM Security solutions.

 View Only
Expand all | Collapse all

CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

  • 1.  CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Mon May 15, 2023 07:21 AM
      |   view attached

    Hi, 

    I am receiving RC 16 error running CARLA report in zSecure 2.5 for RACF.

    CKR2225 16 Requested report requires CKFREEZE file for system SYSP .
    But CKFREEZE file exists in the SYSTEM as named SYS1.KYH.CKFREEZE.SYSP

    It is possible to check it from DASD as follows:
    DSLIST - Data Sets Matching SYS1.KYH.CKFREEZE.SYSP                  Row 1 of 1 
    Command ===>                                                  Scroll ===> CSR  
                                                                                   
    Command - Enter Ü/Ü to select action                  Message           Volume 
    -------------------------------------------------------------------------------
             SYS1.KYH.CKFREEZE.SYSP                                         DAD102 

    And also it is defined in zsecure setup input files as follows:

      Description . . . . CKFREEZE                                                    
      Complex . . . . . . SYSP       Version  . . . .                                 
                                                                                      
      Enter data set names and types.         Type END or press F3 when complete.     
      Enter dsname with .* to get a list      Type SAVE to save set, CANCEL to quit.  
      Valid line commands: E L I R D          Type REFRESH to submit unload  job.     
                                                                                      
         Data set name or DSNPREF=, or Unix file name            Type or ?   NJE node 
         'SYS1.KYH.CKFREEZE.SYSP'                                CKFREEZE             

    And the C2PXCOLL member contains:

    DASD=N,PATH=N,SCAN=N,CAT=MCAT,SMS=N,UNIX=Y,DB2CAT=N,       
    SERIALIZATION(WAIT,ENQ(CKRDSN,SYSDSN),MAXWAIT(10))  

    And also:

    CKF0182 00 Options for this run are:                                                                                                
               FOCUS=(ADMINRACF,AUDITRACF,VISUAL)                                                                                       
               IO=Y,TCPIP=Y,DASD=Y,TAPE=N,SWCH=N,PATH=N,VTOC=Y,VVDS=Y,PDS=Y,CAT=Y,MCD=Y,BCD=Y,DMS=Y,ABR=Y,TMC=Y,RMM=Y,VMF=Y,UNIX=Y,     
               UNIXCLIENT=N,RECALL=Y,AUTOMOUNT=Y,UNIXACL=Y,SHARED=Y,OFFLINE=N,SMS=Y,STATS=N,IDR=N,CHECK=N,SCAN=Y,PARALLEL=PATH,         
               REPORT,KEY0,BYPASS,SIO,XMEM,XMDSN,DIAG,UID0,ENQ=Y,DDLIMIT=1536,IOTIMEOUT=60,PDSEBUFSIZE=150,SIGVER=N,XTIOT=Y,MOD=Y,      
               NJE=Y,CICS=Y,IMS=Y,MQ=Y,DB2=Y,DB2CAT=Y,DB2ADM,CKDS=Y,PKDS=Y,TKDS=Y,SYMKEYTEST=N,CF=Y,SERIALIZATION(ENQ(CKRDSN),FAIL)           

    How can I solve this problem.
    Regards,
    Kayhan Tanrıverir





    ------------------------------
    iyi çalışmalar, saygılar / Regards
    ________________________
    Kayhan TANRIVERİR
    Sn. Systems Programmer & Consultant
    VBT Yazılım A.Ş
    www.vbt.com.tr
    ------------------------------

    Attachment(s)

    txt
    CKFREEZE Error RC 16.txt   21 KB 1 version


  • 2.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Tue May 16, 2023 01:59 AM

    Hi Kayhan,

    The CKR2225 is issued when a complex in your CARLa report run does not have a CKFREEZE file allocated and your CARLa run specifies at least one function that in principle needs information from a CKFREEZE file, and you did not say explicitly that it is OK to get a limited report by specifying SUPPRESS CKFREEZE.

    I am not sure from what you write what you are trying to achieve exactly, so it is hard to make a particular recommendation for tackling this.

    That the CKFREEZE (or at least a CKFREEZE) exists in the system is not material, this is about what is allocated to the CARLa run.

    The C2PXCOLL member is for creating a CKFREEZE, which is also not directly related.

    I would start by looking at the CKR0615 message in the SYSPRINT file, which shows you which complexes you have allocated and which files are in those complexes.
    Another angle is to look at what functions you are requesting in the CARLa that might necessitate having a CKFREEZE.

    If you'd rather not share some of the details here, you can of course open a Case (assuming you have formal support).

    I hope this begins to help.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 3.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Tue May 16, 2023 02:06 AM
    Edited by Jeroen Tiggelman Tue May 16, 2023 02:29 AM

    However, the CKR2225 might occur before the run gets to issuing CKR0615. In that case, it might be convenient to run a query that requests far less information[1] to see that message. Otherwise, you'd need to see in another way what you are allocating through SETUP files (or some other allocation method, depending on what you are doing) as a whole.


    [1] You could probably just add SUPPRESS CKFREEZE

    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 4.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Tue May 16, 2023 04:39 PM

    Hi Jeroen,

    Thank you for your reply,
    CKFREEZE is defined in SE.1 
    This problem is occur only when I coded newlist type=dsn  in CARLA program.  there is no problem with query in newlist type=racf 
    I already run a simple query that requests far less information. For example:
    //CARLGRU1 JOB (VBT),KAYHAN,MSGCLASS=X,NOTIFY=&SYSUID          
    //JCLLIB   JCLLIB ORDER=(CKR.CKRPARM,                          
    //         IBM.ZSECV25.SCKRPROC)                               
    //         SET CONFIG=C2RİPARM                                 
    //         INCLUDE MEMBER=&CONFIG.                             
    //LISTVSTU EXEC C2RC,CONFIG=C2RİVOID                           
    //SYSIN    DD *                                                
    newlist type=dsn title=ÜUnprotected data setsÜ                 
      select missing(profile)                                      
      sortlist dsname volume        
    And My zsecure setup files are (SE.1):

         Description                                               Complex          

         Active primary RACF data base                             SYSP     selected

         SYSP CKFREEZE                                             SYSP     selected

         Active backup RACF data base                                               

         Active backup RACF data base and live SMF data sets                        

         Setup - new Files 05.2023                                 SYSP             

      ******************************* Bottom of data ********************************

    And contents of the ckfreeze definition
    Command ===>                                                  Scroll ===> CSR 

                                                                                   

    Description . . . . SYSP CKFREEZE                                             

    Complex . . . . . . SYSP       Version  . . . .                               

                                                                                   

    Enter data set names and types.         Type END or press F3 when complete.   

    Enter dsname with .* to get a list      Type SAVE to save set, CANCEL to quit.

    Valid line commands: E L I R D          Type REFRESH to submit unload  job.   

                                                                                  

       Data set name or DSNPREF=, or Unix file name            Type or ?   NJE node

       'SYS1.KYH.SYSP.CKFREEZE'                                CKFREEZE            
    As if It seems definitions are ok with related to CKFREEZE in zsecure SE.
    But I could not understand that what is problem.
    Where else should CKFREEZE be defined apart from SETUP files?

    Regards,
    Kayhan Tanrıverir



    ------------------------------
    iyi çalışmalar, saygılar / Regards
    ________________________
    Kayhan TANRIVERİR
    Sn. Systems Programmer & Consultant
    VBT Yazılım A.Ş
    www.vbt.com.tr
    ------------------------------



  • 5.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 02:49 AM
    Edited by Rob van Hoboken Wed May 17, 2023 02:51 AM

    The selections you made in SE.1 are only used within the zSecure ISPF interface.  You can enter the CARLa commands using the CO.C menu option, and enter SUB in the command line to generate JCL.  This JCL will include ALLOC commands to reflect input data sets selected through SE.1.

    Alternatively, you can enter the ALLOC commands in your own JCL:

    //CARLGRU1 JOB (VBT),KAYHAN,MSGCLASS=X,NOTIFY=&SYSUID          
    //JCLLIB   JCLLIB ORDER=(CKR.CKRPARM,                          
    //         IBM.ZSECV25.SCKRPROC)                               
    //         SET CONFIG=C2R$PARM                                 
    //         INCLUDE MEMBER=&CONFIG.                             
    //LISTVSTU EXEC C2RC,CONFIG=C2R$VOID                           
    //SYSIN    DD *                                                
    alloc type=racf active
    alloc type=ckfreeze dsn=SYS1.KYH.SYSP.CKFREEZE
    newlist type=dsn title="Unprotected data sets"
      select missing(profile)                                      
      sortlist dsname volume        


    Of course, the CKFREEZE should contain information as needed by the CARLa commands.  You use TYPE=DSN, but the CKFCOLL commands had DASD=NO specificied, so no VTOC info was collected.  This makes the CKFREEZE smaller, but slightly useless for NEWLIST TYPE=DSN.

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 6.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 05:28 AM
    Hi Rob,
     
    I applied your solutions. 
    I used the alloc command in JCL and
    I used CO.C selection in zSecure CARLA 
    Both of them resulted successfully.
     
    Thank you very much.


    ------------------------------
    iyi çalışmalar, saygılar / Regards
    ________________________
    Kayhan TANRIVERİR
    Sn. Systems Programmer & Consultant
    VBT Yazılım A.Ş
    www.vbt.com.tr
    ------------------------------



  • 7.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 02:54 AM

    This community is for generic security issues.  There is another Z SECURITY community more specific to z/OS and zSecure.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 8.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 03:21 AM

    Indeed. I will only answer here if I see a title pointing to an obvious zSecure question in the digest for this community. I read the other community more fully.



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 9.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 05:34 AM
    OK, I will try to open issues with related z/OS and zsecure another time in the zSECURITY community. I believe that It will be more useful.
     
     
    Thank you very much again.


    ------------------------------
    iyi çalışmalar, saygılar / Regards
    ________________________
    Kayhan TANRIVERİR
    Sn. Systems Programmer & Consultant
    VBT Yazılım A.Ş
    www.vbt.com.tr
    ------------------------------



  • 10.  RE: CKR2225 Required CKFREEZE file even though the CKFREEZE file exists in the SYSTEM

    Posted Wed May 17, 2023 05:32 AM
    Hi Rob,
     
     
    OK, I will try to open issues with related z/OS and zsecure another time in the zSECURITY community. I believe that It will be more useful.
     
     
    Thank you very much again.


    ------------------------------
    iyi çalışmalar, saygılar / Regards
    ________________________
    Kayhan TANRIVERİR
    Sn. Systems Programmer & Consultant
    VBT Yazılım A.Ş
    www.vbt.com.tr
    ------------------------------