Troubleshooting
Problem
This document explains that client/server applications that use ODBC can generate several AF (Authorization Failure) entries in the QAUDJRN.
Resolving The Problem
An application that uses ODBC generates several AF (Authorization Failure) entries in the audit journal, QAUDJRN; however, no authority errors are logged in the QZDASOINIT job log.
The AF journal entries are produced when the database host server receives the Query timeout limit parameter. Starting in V6R1, *JOBCTL (job control) special authority is required for this parameter to be processed. This happens because this function is changing the query attributes for the job and, by definition, that is something that requires job control authority.
To stop the AF journal entries from being generated, you must perform one of the following three options:
The AF journal entries are produced when the database host server receives the Query timeout limit parameter. Starting in V6R1, *JOBCTL (job control) special authority is required for this parameter to be processed. This happens because this function is changing the query attributes for the job and, by definition, that is something that requires job control authority.
To stop the AF journal entries from being generated, you must perform one of the following three options:
| 1. | Give *JOBCTL special authority to the user profile making the ODBC connection by using the CHGUSRPRF command. |
| 2. | Change the ODBC data source (DSN) to disable the query timeout feature. Open the data source in the ODBC Administrator application. Click the Performance tab and click the Advanced button. Clear the option Allow query timeout as shown in Figure 1. |
| 3. | You could set the query timeout by using a mechanism that will not require the user to have job control authority: a. You can set the query time limit globally by creating a QAQQINI file in the QUSRSYS library and setting the query time limit in that file. This will override all other QAQQINI files on the system though and that can have unintended consequences. To create the file, first copy the file from QSYS: CRTDUPOBJ OBJ(QAQQINI) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(QUSRSYS) Next, insert the record to set the query time limit. This is done through an SQL insert that can be done through interactive SQL (STRSQL) or Run SQL Scripts function in Access Client Solutions, or any other available SQL interface. The SQL command is as follows: INSERT INTO QUSRSYS.QAQQINI VALUES ('QUERY_TIME_LIMIT', '60', 'Specifies a time limit for database queries allowed to be started based on the estimated number of elapsed seconds that the query requires to process. QQVAL: *DEFAULT--The default value is set to *SYSVAL. *NOMAX--There is no maximum number of estimated elapsed seconds. *SYSVAL--The query time limit for this job is obtained from the system value QQRYTIMLMT. Integer Value--Specifies the maximum value that is checked against the estimated number of elapsed seconds required to run a query. If the estimated elapsed seconds is greater than this value, the query is not started. Valid values range from 0 through 2147352578.') b. An exit program on the database host server could be used to change the query attributes based on logic in the exit program. This program has to be compiled with the USRPRF(*OWNER) parameter set, and the owner of the program must have *JOBCTL special authority. The following is an example of a simple program to change the query time limit for a specific user, in this case, DUMMY. Example /********************************************************************/ |
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"Component":"Data Access","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]
Historical Number
536538849
Was this topic helpful?
Document Information
Modified date:
27 December 2019
UID
nas8N1012740