How to turn on debug tracing to troubleshoot problems in DSI Server which manifest itself by authorization errors received in eTrust Admin, when integrated with mainframe security products like CA's ACF2 and Top Secret and IBM's RACF.

Document ID : KB000055711
Last Modified Date : 14/02/2018
Show Technical Document Details

How to set the appropriate debug tracing value

To start the trace in DSI server, there are three alternate ways to set a parameter that will effectively set the necessary tracing level.

The debug parameter value should be set to 65533.


The debug value can be set from 0 to 65535.

Value 65533 gives CA support the significant amount of tracing that is required as a base to further investigate the possible root cause of this type of issue.

With debug tracing turned on, the trace information will be generated in the file <Default Installation Directory>/ stderr.log

The first two methods are not dynamic and the generation of trace information will continue, as long as these parameters are in effect.

To turn of the debug trace, reverse the actions outlined below.

Method 1

Update the si.conf configuration file:

  1. Edit the file <Default Installation Directory>/ si.conf

  2. Set the debug parm as follows:
    "debug 65533".

  3. Re-start DSI server on the Mainframe.

Method 2

Update the started task JCL for DSI

  1. Add a "-d 65533" parm in the DSI started task JCL parm line.

  2. Re-start the DSI server task.

Method 3

Dynamically turn on tracing by issuing the necessary command on the mainframe console screen.

Issue the following command:

F dsijobname,APPL=SET,DEBUG,65533

This command will increase the debug dynamically and it is not necessary to restart DSI server on the mainframe.


To stop the logging, issue the same command with 0 (zero) value.