On Thu, 31 May 2007 10:39:26 -0400, Mark Jacobs <[EMAIL PROTECTED]> wrote:
>TCS1 2007149 10:29:50.81 STC38156 00000200 START >EMCPCS.EMCTCP01 >TCS1 2007149 10:29:50.82 STC38156 00000000 IEE345I START >AUTHORITY INVALID, FAILED BY MVS > >What console is issuing the start command? The started task, EMCTCP, is >issuing the start command. Aargh! I forgot that we don't always put the console name in there. However, there should be 9 characters and a space preceding the "TCS1" in the SYSLOG record, which should look like: NC0000000 or NI0000000 If the second character is a 'C' that would indicate that the program issued the START command with a non-zero console id. Some programs go after a pointer called 'UCMMCENT' (which has _never_ been guaranteed to be 'not zero') to detect the UCME (console entry) for the 'one true master console'. If so, when the 1.8 system joins your sysplex, the 1.7 system clears this pointer (as there no longer is 'one true master console' after 1.8 is active), which means that this code will be interpreting the PSA as a console entry, probably getting some foul value for the console name or id. A potential bypass for this is to use the OPERCMDS class and authorize the STC to issue the appropriate START command. Security product decisions always trump base MVS authority checking. See "MVS Planning: Operations" for how to set up OPERCMDS and the START command resource profile. Scott Fagen z/OS Core Technology Design IBM Poughkeepsie ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
