Restrict users to create implicit databases like DSN00001 ...

Problem Definition: Application developer can create their own tables taking away controls from DBA.

Explanation: Recently while analyzing the Catalog table space we found many tables and databases created by application developers for their testing purpose. They are sitting on the space pool that the DB2 catalog is using. This is a wired situation from a DBA point of View.

We will discuss how to prevent application users to create a table/database in DB2 environment.

How it is possible: In DB2 V9, IBM introduced a new feature of implicit Database creation. It means if you try to create a table in DB2 without mentioning table space and database, DB2 will take care of that by implicitly creating them.

On a CREATE TABLE statement, if you do not specify a database name, DB2 will use an existing implicitly created database. If an implicitly created database does not exist, DB2 creates one using the naming convention of DSNxxxxx. The DSNxxxxx values can range from DSN00001 to DSNnnnnn, where nnnnn is the maximum value of the sequence SYSIBM.DSNSEQ_IMPLICITDB, with a default of 10000.

To remind you that in Pre-V9, the database is default to DSNDB04 while creating the new table.

Just imagine one Database of each table. It's really difficult task for DBA to relate the objects logically and maintain them. More over they will take the space from the storage group where DB2 catalog resides.

IBM has taken this steps for future to simplify the object creation without providing table space and database name which are not familiar to users other than DBAs. it may be beneficial for certain tools or SAP environment where lots tables to be created while setting up the environment.

Resolutions:
How to prevent the users to create the implicit databases:

Revoke the Create object privilege on database DSNDB04 from PUBLIC. You can't restrict SYSADM users in this case.
or
Restrict the cataloging of high level qualifier containing DSNxxxxx to register the dataset in VTOC
or
Alter the default maximum value of the sequence SYSIBM.DSNSEQ_IMPLICITDB to 1


Cheers,
Prakash Singh
IBM Certified DB2 DBA

DSNTEP2 stops after MAXERRORS limit reached

Hi,

Problem description:
This happened when I was using multiple insert script through program DSNTEP2. Idea was to insert the record if that is not present in table.


The execution gave me MAX CC 0008. I knew that some inserts are going to fail due to duplicate record.

Observation: The number of insert statement executed was 10 out of 100. All were failed due to duplicate records.

Question: Why the utility did not process rest of the statement.

Here is why:

There is a parameter which controls the maximum error the DSNTEP2 will encounter before exit. This Parameter is MAXERRORS.

The default value for this parameter is 10.

Solution:

We can override the default value for MAXERRORS as shown below or to a specific definite number.

--#SET MAXERRORS -1

You can embed this command at the begin of the control card statement like

//SYSIN DD *
-#SET MAXERRORS -1

INSERT INTO tablex VALUES('a',1,'x');
COMMIT;

So on...


Cheers,
Prakash C. Singh
IBM Certified DBA

UNAVAILABLE RESOURCE REASON 00E70081

Hi,

Here I come again!!!

Problem:

You want to drop or alter a Table. But you are getting "DSNT408I SQLCODE = -904, ERROR: UNSUCCESSFUL EXECUTION CAUSED BY AN UNAVAILABLE RESOURCE. REASON 00E70081, TYPE OF RESOURCE 00000A00, AND RESOURCE NAME

Let's see what is reason code: 00E70081

Explanation: A DROP or ALTER statement was issued but the object cannot be dropped or altered. The object is referenced by a prepared dynamic SQL statement that is currently stored in the prepared statement cache and is in use by an application.

System action: The requested operation is not performed.

Programmer response: The requested operation cannot be performed until there are no applications that reference the object using dynamic SQL. Ensure that other applications have quiesced or performed a commit operation. Then try the request again.

Problem determination: An SQLCODE -904 is issued. The message tokens for that message report the name and type of the object that was being referenced by another application.

Solution:

On quering the resource type:

TYPE Code            Type of Resource       Name, Content,Format

00000A00             Table                  RD.CR.TB

where
RD is a DB2 Release dependency mark


CR the object creator and

TB the Table name
 
 
Runstat utility will be handy to resolve this problem. Runstat with option "update none report none" will clear the dynamic statement cache so that the resource is released to be used by the other application.

Here is the control statement you need to use:

//DSNUPROC.SYSIN DD *

RUNSTATS TABLESPACE . TABLE ALL INDEX ALL

UPDATE NONE REPORT NO



Regards,
Prakash C Singh
IBM Certified DBA.

Termination of REORG TABLESPACE

Hello my blog readers...

It is truely a concern when the REORG of the table terminated. Here is one of the most important facts regarding Reorg failure and termination which I have collected from IBM manual and shared with you for your benefit.



You can terminate the REORG TABLESPACE utility.

If you terminate REORG TABLESPACE with the TERM UTILITY command during the UNLOAD phase, objects have not yet been changed, and you can rerun the job.

If you terminate REORG TABLESPACE with the TERM UTILITY command during the RELOAD phase, the behavior depends on the SHRLEVEL option:

•For SHRLEVEL NONE, the data records are not erased. The table space and indexes remain in RECOVER-pending status. After you recover the table space, rerun the REORG job.

•For SHRLEVEL REFERENCE or CHANGE, the data records are reloaded into shadow objects, so the original objects have not been affected by REORG. You can rerun the job.

If you terminate REORG with the TERM UTILITY command during the SORT, BUILD, or LOG phases, the behavior depends on the SHRLEVEL option:

•For SHRLEVEL NONE, the indexes that are not yet built remain in RECOVER-pending status. You can run REORG with the SORTDATA option, or you can run REBUILD INDEX to rebuild those indexes.

•For SHRLEVEL REFERENCE or CHANGE, the records are reloaded into shadow objects, so the original objects have not been affected by REORG. You can rerun the job.

If you terminate a stopped REORG utility with the TERM UTILITY command during the SWITCH phase, the following conditions apply:

•All data sets that were renamed to their shadow counterparts are renamed to their original names, so that the objects remain in their original state, and you can rerun the job.

•If a problem occurs in renaming the data sets to the original names, the objects remain in RECOVER-pending status, and you cannot rerun the job.

If the SWITCH phase does not complete, the image copy that REORG created is not available for use by the RECOVER utility. If you terminate an active REORG utility during the SWITCH phase with the TERM UTILITY command, during the rename process, the renaming occurs, and the SWITCH phase completes. The image copy that REORG created is available for use by the RECOVER utility.

The REORG-pending status is not reset until the UTILTERM execution phase. If the REORG utility abnormally terminates or is terminated, the objects remain in REORG-pending status and RECOVER-pending status, depending on the phase in which the failure occurred.

The following table lists the restrictive states that REORG TABLESPACE sets according to the phase in which the utility terminated.

Table 1. Restrictive states that REORG TABLESPACE sets. Phase Effect on restrictive status

UNLOAD No effect.

RELOAD SHRLEVEL NONE:

•Places table space in RECOVER-pending status at the beginning of the phase and resets the status at the end of the phase.

•Places indexes in RECOVER-pending status.

•Places the table space in COPY-pending status. If COPYDDN is specified and SORTKEYS is ignored, the COPY-pending status is reset at the end of the phase. SORTKEYS is ignored for several catalog and directory table spaces

SHRLEVEL REFERENCE or CHANGE has no effect.

SORT No effect.

BUILD SHRLEVEL NONE resets RECOVER-pending status for indexes and, if the utility job includes both COPYDDN and SORTKEYS, resets COPY-pending status for table spaces at the end of the phase. SHRLEVEL REFERENCE or CHANGE has no effect.

SORTBLD No effect during the sort portion of the SORTBLD phase. During the build portion of the SORTBLD phase, the effect is the same as for the BUILD phase.

LOG No effect.

SWITCH No effect. Under certain conditions, if TERM UTILITY is issued, it must complete successfully; otherwise, objects might be placed in RECOVER-pending status.

Recovering a failed REORG job

If you terminate REORG SHRLEVEL NONE in the RELOAD phase, all SYSLGRNX records associated with the reorganization are deleted. Use the RECOVER TABLESPACE utility to recover to the current point in time. This action recovers the table space to its state before the failed reorganization.

Example 1: Recovering a table space. The following control statement specifies that the RECOVER utility is to recover table space DSN8D81A.DSN8S81D to the current point in time.

RECOVER TABLESPACE DSN8D81A.DSN8S81D


Cheers.. and Merry Christmas!!!


Regards,
Prakash C. Singh
IBM Certified DB2 DBA.

DB2 EXIT Routines

Hi,

Here is one topic for you in controlling access to DB2 Subsystems:

There are two very important IBM supplied default Exit routines.

DB2 provides 2 exit points for authorization routines:

1) Connection Processing - DSN3@ATH

2) Sign-on Processing - DSN3@SGN

DB2 also provides a third exit point - DSNX@XAC which gives you the flexibility to furnish your own access control routines or use RACF (or equivalent) to perform system authorization checking.

DB2 passes 3 possible functions while invoking authorization routine

a) Initialization - DB2 Startup
b) Authorization check
c) Termination - DB2 Shutdown

There are certain situations where Exit routines may not be called

1) If the user is a Install SYSADM or Install SYSOPR
2) Grant statement is executed
3) If previous invocation indicated the routine should not be called again
4) DB2 security has been disabled (AUTH (DSNZPARM) - Use Protection is set to NO  or in DSNTIPP panel)


Cheers...
Prakash C. Singh
IBM Certified DB2 DBA

Backup Failed with REASON 00C200E1

Hello All,

Here is another classic example of backup failure with REASON 00C200E1.

You will get below message:

DSNUGUTC - OUTPUT START FOR UTILITY, UTILID = DSQDBCTL
DSNUGUTC -  COPY TABLESPACE DSQDBCTL.DSQTSCT1 COPYDDN DSQTSCT1
DSNUGBAC - RESOURCE UNAVAILABLE
          REASON 00C200E1
          TYPE 00000220
          NAME QMF220.DSNDBC.DSQDBCTL.DSQTSCT1.I0001.A001
DSNUGBAC - UTILITY DATA BASE SERVICES MEMORY EXECUTION ABENDED, REASON=X'00E4010A'

If you do a QW for the above reason code, then you see

00C200E1
  Explanation:  The buffer manager (BM) subcomponent of DB2 is unable to
  open a data set that is required to be accessed by the requesting
  function. An error was returned by the media manager CONNECT function,
  which was invoked to open a VSAM data set. DB2 message DSNB204I was issued
  to inform the operator of the error condition. This reason code and the
  data set name are recorded in the cursor table (CT) and made available to
  the user in the SQLCA or in messages.

  This abend reason code is issued by the following CSECT: DSNB1OST

  System Action:  A 'resource not available' code is returned to the user.
  Abend status is recorded in SYS1.LOGREC.

  Operator Response:  Notify the system programmer.

  System Programmer Response:  Refer to system message IEC161I and DB2
  message DSNB204I for assistance in determining the cause of the error.
  Correct the situation, and notify the user to invoke the application

As you see, you need to search for IEC161I.
2 places you can able to see this, one is System LOG another place is DSN1DBM1.

It is logical to see in DBM1 as it manages buffer and the error says "he buffer manager (BM) subcomponent of DB2 is unable to open a data set"

After you look into the DBM1 started task, you may find following error messages:


ICH408I USER(SYS00   ) GROUP(SYS1    ) NAME(STC                 )  093
  QMF220.DSNDBC.DSQDBCTL.DSQTSCT1.I0001.A001 CL(DATASET ) VOL(DSN101)
  RESOURCE NOT PROTECTED
  ACCESS INTENT(UPDATE )  ACCESS ALLOWED(NONE   )
IEC161I 040(056,006,IGG0CLFT)-002,DSN1DBM1,DSN1DBM1,SYS30435,,,  094
IEC161I QMF220.DSNDBC.DSQDBCTL.DSQTSCT1.I0001.A001

Now it is confirmed that it is not a DB2 issue at all rather than RACF issue.

As you get the clue, you can contact the mainframe System admin/RACF admin to resolve the issue and rerun the job.

Cheers...
Prakash C. Singh
IBM Certified DB2 DBA

Know the power of REPAIR utility in DB2

Hello my blog readers...

In this blog, I am going to explain how you can utilize REPAIR utility the most.

Everybody know REPAIR utility is popularly used for resetting the pending states of Index and Tablespaces.



Example 1: 
Everybody know REPAIR utility is popularly used for resetting the pending states of Index and Tablespaces.

//STEP3    EXEC DSNUPROC,UID='SSTRR',                            
//            UTPROC='',SYSTEM='DSN2'                                      
//SYSIN    DD *                                                            
  REPAIR OBJECT                                                            
  SET INDEX (ALL) TABLESPACE DTSG10.SSTRR NORBDPEND                  
  SET TABLESPACE DBTEST1.STEST PART 1 NOAUXCHKP                        
  SET TABLESPACE DBTEST1.STEST PART 4 NOCHECKPEND
/*

Example 2:
Suppose you want to delete a row corresponding to a ROWID mentioned in the referential violation constraint.


REPAIR
  LOCATE TABLESPACE DTSG10.TS1 RID (X'0000000503')
    DELETE




Example 3:
Replacing damaged data and verifying replacement.

* Repair the specified page of table space DTSG10.STEST1, as indicated by the LOCATE clause.
* Verify that, at the specified offset (50), the damaged data (0A00) is found, as indicated by the VERIFY clause.
* Replace the damaged data with the desired data (0D11), as indicated by the REPLACE clause.
* Initiate a dump beginning at offset 50, for 4 bytes, as indicated by the DUMP clause. You can use the generated dump to verify the replacement.

//STEP1    EXEC  DSNUPROC,UID='IUIQU1UH',UTPROC='',SYSTEM='DSN'

//SYSIN DD *

REPAIR OBJECT

  LOCATE TABLESPACE DSN8D81A.DSN8S81D PAGE X'02'

    VERIFY OFFSET 50 DATA X'0A00'

    REPLACE OFFSET 50 DATA X'0D11'

    DUMP OFFSET 50 LENGTH 4

Example 4:

Reporting whether catalog and directory DBDs differ. The following control statement specifies that REPAIR is to compare the DBD for DTSG10 in the catalog with the DBD for DTSG10 in the directory.

REPAIR DBD TEST DATABASE DTSG10

Example 5:

Reporting differences between catalog and directory DBDs. The following control statement specifies that the REPAIR utility is to report information about the inconsistencies between the catalog and directory DBDs for DTSG10. Run this job after you run a REPAIR job with the TEST option (as shown in example 4), and the condition code is not 0. In this example, SYSREC is the output data set, as indicated by the OUTDDN option.

REPAIR DBD DIAGNOSE DATABASE DSN8D2AP OUTDDN SYSREC

Example 6:

Repairing a table space with an orphan row. After running DSN1CHKR on table space SYSDBASE, assume that you receive the following message:

DSN1812I ORPHAN ID = 20 ID ENTRY = 0190 FOUND IN

         PAGE = 0000000024

From a DSN1PRNT of page X'0000000024' and X'0000002541', you identify that RID X'0000002420' has a forward pointer of X'0000002521'.

Repair the table space by taking the following actions:

1. Submit the following control statement, which specifies that REPAIR is to set the orphan's backward pointer to zeros:

      REPAIR OBJECT LOG YES

       LOCATE TABLESPACE DSNDB06.SYSDBASE RID X'0000002420'

        VERIFY OFFSET X'0A' DATA X'0000002422'

        REPLACE OFFSET X'0A' DATA X'0000000000'

Setting the pointer to zeros prevents the next step from updating link pointers while deleting the orphan. Updating the link pointers can cause DB2 to abnormally terminate if the orphan's pointers are incorrect.

2. Submit the following control statement, which deletes the orphan:

      REPAIR OBJECT LOG YES

       LOCATE TABLESPACE DSNDB06.SYSDBASE RID X'00002420'

        VERIFY OFFSET X'06' DATA X'00002521'

        DELETE

Example 7:

Updating version information. The control statement specifies that REPAIR is to update the version information in the catalog and directory for table spaces STEST1, STEST2, and STEST3.

REPAIR VERSIONS example control statement

//STEP1    EXEC DSNUPROC,UID='JUKQU3AS.REPAIR',TIME=1440,        

//         UTPROC='',                                            

//         SYSTEM='SSTR',DB2LEV=DB2A                             

//SYSIN    DD *                                                       

 REPAIR VERSIONS TABLESPACE DTSG10.STEST1                   

  REPAIR VERSIONS TABLESPACE DTSG10.STEST1 2                   

  REPAIR VERSIONS TABLESPACE DTSG10.STEST1 3  

So arm the knowledge of REPAIR Utility and set for the adventure.

Cheers..

Prakash C Singh.

IBM Certified DB2 DBA