Previous Topic: Processing INCLUDE and EXCLUDE StatementsNext Topic: Creating GRANT and REVOKE Statements

Using the Catalog Synchronization Utility › Overview › Importance of Order

Importance of Order

Because CA ACF2 Option for DB2 processes the statements sequentially, the order of the INCLUDE and EXCLUDE statements is very important. An INCLUDE statement placed before an EXCLUDE statement generates very different results from the same INCLUDE placed after the EXCLUDE. In the list of logonids and resource names generated because of an INCLUDE statement, the utility marks as excluded the entries that are specified in any of the following EXCLUDE statements. The utility uses the remaining entries to perform resource validation calls.

To illustrate the importance of statement order, consider the following example:

EXCLUDE USER(WALBE02)
INCLUDE USER(WAL‑)
EXCLUDE USER(WALRA‑)
INCLUDE USER(WALRA03)

The first EXCLUDE statement does not work as intended: WALBE02 is not included yet, so it cannot be excluded. The first INCLUDE statement generates an internal table that lists all logonids that begin with WAL. The subsequent EXCLUDE statement marks all logonids in this table that begin with WALRA. The marked logonids are excluded from the batch to be synchronized. However, the second INCLUDE statement returns the utility to the table and removes the mark that excludes WALRA03 from the synchronization. Therefore, the Catalog Synchronization Utility performs resource validation calls on the following:

  1. All users whose logonids begin with WAL except those that begin with WALRA, and
  2. User WALRA03.

To perform resource validation calls, the utility correlates each logonid with a DB2 resource name. The call determines whether the logonid has access to that resource and which DB2 privileges are assigned to that logonid for that resource. This information is used to create GRANT and REVOKE statements, as described in the next section.

Each batch of INCLUDE and EXCLUDE statements is processed independently. The logonids and resource names that are validated for one batch do not affect the processing of a subsequent batch.

The CADB2SCP trace reports list the logonids or resources that are included or excluded for a particular synchronization batch. For more information about these reports, see Using the Catalog Synchronization Utility Reports.