ICH409I: Abend during RACF processing

What it means

Programs ask RACF security questions through the RACROUTE macro. The common requests are REQUEST=AUTH (the old RACHECK), REQUEST=VERIFY (RACINIT), REQUEST=DEFINE (RACDEF) and REQUEST=LIST (RACLIST). RACF also builds in-storage generic profiles (GENLIST), runs directed authorization checks (DIRAUTH), and runs callable services named IRRSxx00. When any of these abends, RACF writes ICH409I and stops processing the request.

The message reads ICH409I abend-code[-yy] ABEND DURING request PROCESSING or ... PARAMETER VALIDATION. The yy part, when present, is the hex value of register 15, which often holds a reason code. PARAMETER VALIDATION means RACF was still checking what the caller passed, so the caller is the likely culprit. PROCESSING means RACF was working on the request.

The last two digits of the abend code matter. Codes ending in 82, 83, 84 or 85 come from the RACF SVCs (for example 282 for RACHECK), and C6 or C7 endings are also RACF's own. Those are listed in the RACF abend codes section of IBM's RACF Messages and Codes. Any other abend code is a general system abend that happened during RACF processing, such as a program check, and you look it up in z/OS MVS System Codes.

The message goes to the security and programmer routing codes, so it appears in the system log as well as the job log.

Common causes

• The calling program passed a bad parameter list, a bad class name or storage it doesn't own. This is the usual cause when the message says PARAMETER VALIDATION.
• A resource class used by a product is defined wrongly in the class descriptor table, for example with a MAXLENGTH that is too short for the resource names the product checks.
• A product changed security environments in a way RACF didn't expect, for example a server task checking authority on behalf of a client user.
• A RACF installation exit or other code running inside RACF processing failed with a program check.
• A RACF or product defect fixed by maintenance. IBM and vendors have published APARs for specific ICH409I abends.

How to find the problem

1. Read the abend code, the -yy value, the request type and the word after DURING in ICH409I.
2. If the code ends in 82, 83, 84, 85, C6 or C7, look up the code and register 15 value in the RACF abend codes section of RACF Messages and Codes. Otherwise use z/OS MVS System Codes.
3. Find the job or started task that issued the request in the system log. Note which product or program was running.
4. Get the dump, if one was taken, and check which module failed. If it belongs to the calling product rather than RACF, take it to that product's support.
5. For a product-specific resource class, display it with RLIST CDT classname CDTINFO and compare it with the product's installation instructions.

How to fix it

• Correct the calling program or the product setup when the caller is at fault.
• Fix a class descriptor table entry with RDEFINE or RALTER on the CDT class, then refresh with SETROPTS RACLIST(CDT) REFRESH.
• Search IBM support and the product vendor's site for the exact abend and reason, and apply any matching PTF.
• Report the exact message text to the systems programmer or RACF administrator and keep the output and dump for problem determination.

What it looks like

ICH409I 282-054 ABEND DURING RACHECK PROCESSING

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s documentation for your z/OS release.