On IBM i systems sold per user, the 7.6 documentation requires entitlements for the maximum number of users authenticated at the same time. The number WRKLICINF shows is something else: it counts *ENABLED profiles. IBM writes that the second can legitimately be higher than the first.
The two numbers
| What it counts | Where to read it | |
|---|---|---|
| The entitlement you buy (5770-SS1, feature 5052) | users signed on at the same time | the licence terms |
| The 5052 usage count | *ENABLED profiles, excluding IBM-supplied ones | WRKLICINF, option 8 |
The support note "Enabled versus Concurrent Users for 57xxSS1 Feature 5052" says it plainly: the counter was designed to count enabled profiles, whatever they do; showing concurrent users "was never a design requirement"; and there is no interface that gathers them all. The 7.6 documentation calls the profile count "a tool" to help stay compliant.
What happens when you exceed it
When enabled profiles exceed the installed entitlement you get CPF9E17, Usage limit exceeded - operator action required. It stops nothing: the same note says there is no hard stop either when a profile is created or at sign-on, because no licensing is done at sign-on. The count changes when a profile becomes *ENABLED.
The opposite case has its own message: CPF9E2D, Usage limit cannot be less than current usage, when you try to install a key for fewer users than the enabled profiles.
The message is not the rule.
CPF9E17says enabled profiles exceed the entitlement. It does not say the licence is breached, because the licence counts something else. The reverse holds too: a system without the message is not compliant for that reason.
Taking a profile out of the count
A profile that must stay enabled but is not a person can be excluded from the count with the QLZACUEA API (Change User Entitlement Attribute), called with CALL and format CEAI0100. The 7.6 documentation gives an example for a profile named EXAMPLE: the first parameter is a fixed-length field and the blanks matter, so copy it from the IBM page rather than from retyped text.
The same API can also disable a profile, which for the counter is the other route: a *DISABLED profile is not counted.
On subscription
In the IBM i subscription, users are bought separately in the P05 and P10 tiers: IBM's FAQ on the subscription transition (updated 27 May 2026) says that in the P05 tier they are sold in blocks of 10 (it used to be blocks of 5), or as Unlimited Users in the countries where that option exists. With Unlimited Users the counting question does not arise.
When keys expire, the same FAQ says the warning messages for 5052 start fourteen days earlier.
Measure before touching profiles
Before disabling or excluding anything you need to know which enabled profiles no longer sign on. QSYS2.USER_INFO tells you:
SELECT AUTHORIZATION_NAME, USER_CLASS_NAME,
PREVIOUS_SIGNON, LAST_USED_TIMESTAMP
FROM QSYS2.USER_INFO
WHERE STATUS = '*ENABLED'
ORDER BY PREVIOUS_SIGNON;
PREVIOUS_SIGNON is the last sign-on; a null means the profile has never signed on, and in Db2 for i a null sorts after every date, so those profiles come out at the bottom. LAST_USED_TIMESTAMP gives the last day the profile was used by any route, even without an interactive sign-on: a service profile used by programs has a recent second column and an old first one, and disabling it stops something.
The query also lists IBM-supplied profiles, which the 5052 count excludes.
Example
The figures are illustrative: they show the reasoning and do not come from a measurement.
A P05-tier system has entitlements for 40 users. WRKLICINF counts 57 enabled profiles, and every time one is created CPF9E17 arrives. The query above shows 9 profiles that have not signed on for more than a year and 6 that never have; of those 15, 3 have a LAST_USED_TIMESTAMP from last week and are service profiles.
What follows:
- the 12 truly unused profiles are disabled, after asking whoever owns them: the counter drops to 45, and the system has three fewer ways in;
- the 3 service profiles stay enabled, and can be excluded from the count with
QLZACUEA; - how many users are signed on together at peak still has to be estimated (
WRKACTJOBshows part of it, not all): that number, not 57, is the one to compare with the 40 entitlements.
Which releases
The page on per-user licensing and the QLZACUEA example come from the 7.6 documentation. The support note on enabled versus concurrent users is from November 2019 and cites V5R4 and V6R1 PTFs: the behaviour it describes is not tied to a release. QSYS2.USER_INFO and the four columns in the query are in the 7.6 documentation.
Comments
No comments yet. Be the first to comment!
You need an account to comment. Log in · Sign up