Previous Topic: Using the TSDB2SY1 ReportsNext Topic: Using the TSDB2SY3 Reports


Using the TSDB2SY2 Reports

CADB2SSV-Synchronization Control Statement Report

The CADB2SSV report lists the synchronization control statements and reports any syntax errors it finds. The following is a sample synchronization control statement report with errors.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.03 CADB2SSV DB2 SYNCHRONIZATION UTILITY ‑ SYNCHRONIZATION CONTROL STATEMENT REPORT PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ SYNCHRONIZATION CONTROL STATEMENT ================================================================================ SYNC SYSTEM(PROD) OPTIONS(TRACE,NOPRIVCHECK) /* SELECT USERS TO BE PROCESSED */ INCLUDE USER(ARDUV03) INCLUDE USER(USER*) EXCLUDE USER(USER2) EXCLUDE USER(USER3) INCLUDE DEPT(RESEARCH) EXCLUDE PROF(RSCHCLK) INCLUDE USER(TEST*) INCLUDE USER(WGGAB01) /* SELECT DB2 RESOURCES TO BE PROCESSED */ INCLUDE BPL(BP*) CAD2018E *Error* INCLUDE DATABASE(PAY****) CAD2019E Keyword: * CAD2021E CADB2SSV Input control statement parse error RC=08 (INVALID KEYWORD) CAD2031E Errors detected in synchronization control statement scan, execution terminated

After you correct the errors, the corrected synchronization control statements will synchronize the CA Top Secret Option for DB2 authorizations with the DB2 catalog of the PROD DB2 subsystem. Users who match the INCLUDE and EXCLUDE criteria are correlated with the PAY* DB2 databases and the SYSADM resource.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SSV DB2 SYNCHRONIZATION UTILITY ‑ SYNCHRONIZATION CONTROL STATEMENT REPORT PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ SYNCHRONIZATION CONTROL STATEMENT ================================================================================ SYNC SYSTEM(PROD) OPTIONS(TRACE,NOPRIVCHECK) /* SELECT USERS TO BE PROCESSED */ INCLUDE USER(ARDUV03) INCLUDE USER(USER*) EXCLUDE USER(USER2) EXCLUDE USER(USER3) INCLUDE DEPT(RESEARCH) EXCLUDE PROF(RSCHCLK) INCLUDE USER(TEST*) INCLUDE USER(WGGAB01) /* SELECT DB2 RESOURCES TO BE PROCESSED */ INCLUDE BPL(BP*) INCLUDE DBS(PAY????) INCLUDE DBS(EMP*) INCLUDE PLN(DSN*) INCLUDE SYS(SYSADM) INCLUDE TBL(ACCTPAY.XREF) INCLUDE TBL(ORDER.DV*) GO CAD2022I Input control statement scan successful CAD2024I Synchronization in progress for CA Security system CA‑Top Secret CAD2025I Synchronization in progress for DB2 subsystem PROD

The GRANT and REVOKE statements that these statements generate are shown in the CADB2SGS report.

CADB2SEU-User ID Exception Report

The CADB2SEU report is produced only if you have ACIDs in your Security File that are invalid names for DB2. Invalid names include all ACIDs that include a non‑national character or that start with a numeric value. The ACIDs listed in this report are ignored by the Catalog Synchronization Utility because they cannot exist as a DB2 authorization ID.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SEU DB2 SYNCHRONIZATION UTILITY ‑ USERID EXCEPTION REPORT PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ USERID WITH ERROR ================================================================================ CAD2051I Userid *ID04 contains invalid DB2 characters, excluding userid from processing CAD2051I Userid SPID** contains invalid DB2 characters, excluding userid from processing CAD2051I Userid 1487DP contains invalid DB2 characters, excluding userid from processing

CADB2SGP-Input GRANT TO PUBLIC Report

The CADB2SGP report lists the input GRANT TO PUBLIC control statements and displays any syntax errors contained in the statements. Syntax errors include:

Except for values defined by the SYS keyword, the utility does not validate resource names. Such validation is not possible because the GRANT TO PUBLIC file can be a common file shared for all DB2 subsystems and all synchronization runs.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SGP DB2 SYNCHRONIZATION UTILITY ‑ INPUT GRANT TO PUBLIC REPORT PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ GRANT TO PUBLIC STATEMENT ================================================================================ /* DEFAULT BUFFER POOL */ BPL(BP0) /* DB2 CATALOG TABLES */ TBL(SYSIBM*) PRIV(SELECT) /* SAMPLE DYNAMIC SQL PLAN */ PLN(DSNTIA*) PRIV(EXECUTE) /* DEVELOPMENT TEST DATABASE */ DBS(SYN1DBS) PRIV(STATS,STARTDB,STOPDB)

CADB2SCP-Extract Exception Trace

The CADB2SCP report provides exception information for each batch of synchronization control statements. The batch number is shown in the report header. Exceptions occur when the Catalog Synchronization Utility cannot find users or resources requested by synchronization control statements. The exception information included in this report lists

The following is a sample extract exception trace report.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SCP DB2 SYNCHRONIZATION UTILITY ‑ EXTRACT EXCEPTION TRACE BATCH 1 PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ KEYWORD KEYWORD EXCEPTION TYPE VALUE REASON ============ ================================ ======================================================= USER ARDUV03 USER NOT IN SECURITY FILE USER WGGAB01 USER NOT IN SECURITY FILE TBL ACCTPAY.XREF TABLE NOT IN DB2 CATALOG TBL ORDER.DV* NO TABLE IN DB2 CATALOG MATCHING THIS MASK

Field Descriptions

Keyword Type

Specifies the type of keyword that was specified on the synchronization control statement.

Keyword Value

Specifies the value that the CA Top Secret Option for DB2 Catalog Synchronization Utility used to select users or resources.

Keyword Reason

Specifies the reason the utility found no matches for the selection criteria.

CADB2SCP-User ID Extract Trace

The CADB2SCP report provides the reason for including or excluding each ACID in a synchronization batch. TSDB2SY2 extracts all ACIDs requested in the synchronization control statements from the Security File. The result can be a series of specifically‑defined ACIDs; a list of all ACIDs that match a masked value in a control statement; or a combination of both specifications.

If you masked even one entry in your synchronization control statement, the report lists all values in alphanumeric order. If you used no masked entries in this synchronization, the values are listed in the order in which you specified them, with the exception of the PUBLIC user ID. PUBLIC is listed last if your input contained no masks or if there is no PUBLIC user ID in the Security File. For each entry, CADB2SCP displays

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SCP DB2 SYNCHRONIZATION UTILITY ‑ USERID EXTRACT TRACE BATCH 1 PAGE 2 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ CA‑Top Secret INCLUDE KEYWORD KEYWORD ACID EXCLUDE REASON VALUE ============= ======= ======== ======================== USER1 INCLUDE USER USER* USER2 EXCLUDE USER USER2 USER3 EXCLUDE USER USER3 USER4 EXCLUDE PROFILE RSCHCLK USER5 INCLUDE DEPARTMENT RESEARCH USER6 INCLUDE USER USER* USER7 INCLUDE USER USER* TEST1 INCLUDE USER TEST* TEST2 INCLUDE USER TEST* PUBLIC INCLUDE <SYSTEM> <GRANT TO PUBLIC>

Field Descriptions

CA‑Top Secret ACID

Lists the ACIDs that are extracted from the CA Top Secret Security File.

INCLUDE/EXCLUDE

Indicates the results of processing the synchronization control statement for this user. The synchronization control statement is an INCLUDE or EXCLUDE.

Keyword Reason

Specifies the keyword that is specified on the control statement. This keyword is the reason that the ACID was included or excluded. A value of <SYSTEM> indicates that this user is included by the Catalog Synchronization Utility and not because of an synchronization control statement.

Keyword Value

Specifies the value that the CA Top Secret Option for DB2 Catalog Synchronization Utility uses to match the ACIDs with the Security File. A value of <GRANT TO PUBLIC> indicates that this is the special DB2 authorization ID used to grant resource privileges to PUBLIC. When this appears, resource privileges permitted to the ALL Record are ignored for this batch. Only resource privileges defined by GRANT TO PUBLIC control statements are used as the permitted privileges for user PUBLIC.

CADB2SCP-Resource Extract Trace

The CADB2SCP report provides the reason for including or excluding each resource in a synchronization batch. TSDB2SY2 extracts from the DB2 subsystem all resource names requested in the synchronization control statements. The result can be a series of specifically‑defined resource names; a list of all resources that match a masked value in a control statement; or a combination of both specifications. For each resource name, CADB2SCP displays

Resources are listed by resource type. The resource names within a type are listed in alphanumeric order if you used a mask for any entry within that type. If you did not mask any entries within a type, all resource names for that type are listed in the order in which you specified them.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SCP DB2 SYNCHRONIZATION UTILITY ‑ RESOURCE EXTRACT TRACE BATCH 1 PAGE 3 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ DB2 RESOURCE INCLUDE KEYWORD RESOURCE NAME EXCLUDE VALUE ======== =========================== ======= ==================== BPL BP0 INCLUDE BP* BPL BP1 INCLUDE BP* DBS EMPDB01 INCLUDE EMP* DBS PAYDBT1 INCLUDE PAY???? DBS PAYDB01 INCLUDE PAY???? DBS PAYDB02 INCLUDE PAY???? PLN DSNEDCL INCLUDE DSN* PLN DSNESPCS INCLUDE DSN* PLN DSNESPRR INCLUDE DSN* PLN DSNESPCS INCLUDE DSN* PLN DSNQCATV INCLUDE DSN* PLN DSNTIA23 INCLUDE DSN* SYS SYSADM INCLUDE SYSADM

Field Descriptions

DB2 Resource

Indicates the resource that is being extracted from the DB2 tables.

Resource Name

Specifies the name of the resource that is being extracted. System privileges are treated like resources, but they do not actually exist in the DB2 catalog. Therefore, when a system privilege is being synchronized, all system privileges are listed here.

INCLUDE/EXCLUDE

Indicates the results of processing the INCLUDE or EXCLUDE synchronization control statement for this resource.

Keyword Value

Specifies the value that the CA Top Secret Option for DB2 Catalog Synchronization Utility uses to match the resources with in the DB2 tables.

CADB2SED-DB2 Resource Status Trace

The CADB2SED report lists the current status of resources in the DB2 catalog. It shows the users who are granted access to each resource and the current privileges or level of authorization granted. The main purpose of this report is to display the current resource's status from a DB2 perspective, so that you can compare it to the results of the CA Top Secret Option for DB2 resource validation call. All entries are sorted, then listed, in this order:

  1. User ID
  2. Resource type
  3. Resource name

User IDs are listed in the same order as they are in the CADB2SCP Userid Extract Trace report. Resource types and names are listed, for each user ID, in the same order as they are in the CADB2SCP Resource Extract Trace report. See the descriptions of these reports, earlier in this section, for details about sort order.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SED DB2 SYNCHRONIZATION UTILITY ‑ DB2 RESOURCE STATUS TRACE BATCH 1 PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ USERID RESOURCE RESOURCE ACCESS GRANT GRANTEE TYPE NAME ALLOWED OPTION ======== ======== =========================== ==================== ================== RRUS8 BPL BP1 USE RRUS8 DBS EMPDB01 DISPLAYDB WITH GRANT OPTION RRUS8 DBS EMPDB01 STARTDB RRUS8 DBS EMPDB01 STATS RRUS8 DBS EMPDB01 STOPDB RRUS8 PLN DSNTIA23 EXECUTE TEST1 DBS EMPDB01 DBADM USER1 BPL BP0 USE WITH GRANT OPTION USER1 BPL BP1 USE WITH GRANT OPTION USER1 DBS EMPDB01 ALL DB2 OWNER USER1 SYS SYSADM SYSADM USER5 SYS SYSADM SYSADM USER6 DBS EMPDB01 DBADM

Field Descriptions

User ID Grantee

Names the user who is granted a privilege in the DB2 table.

Resource Type

Indicates the type of resource to which a report line refers.

Resource Name

Specifies the name of the resource that is found in the DB2 tables.

Access Allowed

Specifies the privilege that was granted by the GRANT statement in the DB2 table. If the user named in the USERID GRANTEE column is the user that created the resource in DB2, this field is specified as ALL.

GRANT Option

Specifies WITH GRANT OPTION if this user can grant this privilege to another user. If the user named in the USERID GRANTEE column is the user that created the resource in DB2, this field is DB2 OWNER.

CADB2SUA-Security Validation Trace

The CADB2SUA report shows a summary of the results of each successful resource validation call. The resource validation calls are performed to determine which users have access to the requested DB2 resources. If a user is not authorized to a resource at any level, no report detail line is produced. If resource validations cannot be performed for a user, for example, if the user is suspended, an informational message is produced specifying the reason. These messages are produced even if the TRACE is not specified.

All entries are sorted, then listed, in this order:

  1. User ID
  2. Resource type
  3. Resource name

User IDs are listed in the same order as they are in the CADB2SCP Userid Extract Trace report. Resource types and names are listed, for each user ID, in the same order as they are in the CADB2SCP Resource Extract Trace report. See the descriptions of these reports, earlier in this section, for details about sort order.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SUA DB2 SYNCHRONIZATION UTILITY ‑ SECURITY VALIDATION TRACE BATCH 1 PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ USERID RESOURCE RESOURCE ACCESS OWNER GRANTEE TYPE NAME ALLOWED OPTION ======== ======== =========================== ==================== ================== RRUS8 BPL BP1 USE RRUS8 DBS EMPDB01 STATS RRUS8 PLN DSNESPCS EXECUTE RRUS8 PLN DSNESPRR EXECUTE USER1 BPL BP1 USE USER1 DBS EMPDB01 <NOT CHECKED> USER1 DBS PAYDB01 DBADM OWNER USER5 DBS EMPDB01 DBADM OWNER USER6 BPL BP0 USE USER7 BPL BP0 USE USER7 DBS EMPDB01 CREATETAB USER7 DBS EMPDB01 CREATETAB USER7 DBS EMPDB01 CREATETAB PUBLIC BPL BP0 USE PUBLIC PLN DSNTIA23 EXECUTE

Field Descriptions

User ID Grantee

Specifies the ACID that was used in the resource validation call for this resource.

Resource Type

Indicates the type of resource for which the resource validation call was made. This resource type is the same one specified on the INCLUDE statement.

Resource Name

Specifies the resource name for which the resource validation call was made. This resource name is the same name included through the resource extract process detailed in the TSDB2SY2 component.

Access Allowed

Specifies the privileges that are permitted to the resource. If the user named in the USERID GRANTEE column is the user that created the resource, this field value is: <NOT CHECKED>.

Owner Option

Indicates that the ACID owns the resource, so further resource validation calls are bypassed. An owner of a resource is defined in CA Top Secret through the TSS ADDTO command. Owners of a resource are given the WITH GRANT OPTION privilege when the SQL GRANT statements are created. The value in this field is OWNER if the ACID in the USERID GRANTEE field is the owner in CA Top Secret. The value in this field is DB2 OWNER if the user named in the USERID GRANTEE column is the user that created the resource.

CADB2SGS-DB2 SQL Generated Statement Report

The TSDB2SY2 job performs resource validation calls based on the information provided by the INCLUDE and EXCLUDE statements. From the results of these calls, TSDB2SY2 generates SQL GRANT and REVOKE statements that bring the DB2 catalog up‑to‑date with the CA Top Secret Option for DB2 authorizations.

The CADB2SGS report lists the GRANT and REVOKE statements that are generated as a result of the resource validation calls. TSDB2SY2 writes these statements to the GRANTS and REVOKES files.

The exception to this is that if you specified VIEW ACTION(WARN) in your synchronization control statement, TSDB2SY2 does not include in the REVOKES file any statement that, if executed, would drop a view. Instead, these REVOKE statements are listed in the CADB2SGS report and are accompanied by CAD2236I messages that list the names of the views that are dropped if the REVOKES are executed. You can edit the statements in the GRANTS and REVOKES files before executing them in DB2.

‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ 04/11/99 10.05 CADB2SGS DB2 SYNCHRONIZATION UTILITY ‑ DB2 SQL GENERATED STATEMENT REPORT BATCH 1 PAGE 1 ‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑‑ DB2 SQL GENERATED STATEMENTS ==================================================================================================== REVOKE DISPLAYDB, STARTDB, STOPDB ON DATABASE EMPDB01 FROM RRUS8 BY ALL GRANT EXECUTE ON PLAN DSNESPCS TO RRUS8 GRANT EXECUTE ON PLAN DSNESPRR TO RRUS8 REVOKE EXECUTE ON PLAN DSNTIA23 FROM RRUS8 BY ALL REVOKE DBADM ON DATABASE EMPDB01 FROM TEST1 BY ALL REVOKE USE OF BUFFERPOOL BP0 FROM USER1 BY ALL GRANT DBADM ON DATABASE PAYDB01 TO USER1 WITH GRANT OPTION REVOKE SYSADM FROM USER1 BY ALL REVOKE SYSADM FROM USER5 BY ALL GRANT DBADM ON DATABASE EMPDB01 TO USER5 WITH GRANT OPTION GRANT USE OF BUFFERPOOL BP1 TO USER6 REVOKE DBADM ON DATABASE EMPDB01 FROM USER6 BY ALL GRANT USE OF BUFFERPOOL BP1 TO USER7 GRANT DROP, LOAD, CREATETAP ON DATABASE EMPDB01 TO USER7 GRANT USE OF BUFFERPOOL BP0 TO PUBLIC GRANT EXECUTE ON PLAN DSNTIA23 TO PUBLIC