Re: (closed) Extended Beta program for TSSO replacement Product
Hi all, Thanks to everyone that responded so quickly. We had to close the enrollment because we got 90 responses before noon today and we wanted to leave some slots open for our existing client base. Those that responded should receive a email back from the client support people by tomorrow night. Anyone who responded and doesn't hear back from them by that time should feel free to contact me directly and I'll make sure you don't get dropped. Thanks again, and happy testing. Brian -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
You can also look at Chapter 4.21 of the ABCs of z/OS System Programming Vol 2 RedBook. Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Charles Mills Sent: Wednesday, September 08, 2010 8:02 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? Thanks. That's certainly better than anything else I found. But I would really like a formal or fairly formal *definition* of APF authorization. (And to re-iterate the point in my OP, yes, I know informally well enough what APF authorization does. I was hoping for a formal statement.) Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Starr, Alan Sent: Wednesday, September 08, 2010 4:32 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? Charles, Take a look at chapter 21 of the Authorized Assembler Programming GUIDE. That may help. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
I really have to chuckle at the question Charles since I'll wager at some point in time every person on this list has asked this same question. To date I really know of no single place where APF is outlined, explained, and/or documented other than what's in the Authorized Guide. Not the greatest but the place to start... It's easy to know how to get APF authorized. The trickier part is knowing the many ways to lose it and tricks on how to get around it. Regards, Stan Stan Weyman Senior Software Engineer stan.wey...@emc.com EMC² (508)249-3966 where information lives It is wise to keep in mind that neither success nor failure is ever final... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Charles Mills Sent: Wednesday, September 08, 2010 7:26 PM To: IBM-MAIN@bama.ua.edu Subject: Where is APF documented? I know what APF-authorization means for a dataset well enough to use it. I'm writing a manual and I would like a formal definition of APF-authorization. I search the book manager z/OS MVS shelf for APF and I get lots of hits but the ones I looked at are either very peripheral or else they are how to set up your APF list in PARMLIB or the SETPROG APF command. Where is a formal statement of what APF-authorization means? Charles Mills -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... Does this help you? Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Thanks all. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Veilleux, Jon L Sent: Thursday, September 09, 2010 4:26 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? You can also look at Chapter 4.21 of the ABCs of z/OS System Programming Vol 2 RedBook. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX : how to determine the member name of a DD card
On Wed, 8 Sep 2010 10:58:14 +0200, CUNY Yann yc...@externe.generali.fr wrote: //IN DD DSN=P3CUN.YANN.JCL(TEST14),DISP=SHR I need, in my rexx, to retrieve the member name of the DD CARD IN. With the LISTDSI, I just have the pds name. Any idea ? You can use OUTTRAP function to trap the output from the 'LISTA STATUS' TSO command. Then parse through and find the DD you are interested in. Dana -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
help with error bpxp006e
I get this error every so often on my test lpar . The system would hang for several minutes sometimes release and continue but once in a while stop dead.I would just reipled and it worked. I always thought that the production lpar had a dataset the test lpar needed. BUT last night during a scheduled ipl of the production lpar the same thing happpend for the first time. We reipled and it worked. So this morning I try to google the error can't find it, I look for UNIX System Services Messages and Codes ,not in there. I found a site but am blocked from it by the network ss and trying to beg to get access grates on my nerves. We are a small monoplex shop. Does anyone have any idea where I might find help for this? Anyone have ideas what could be causing it,how to prevent it? thanks in advance Mace -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: JES2 vs. JES3
ISTR hearing, circa 1967, that ASP had its roots in the 7xxx world, with a 1440 or some other 14xx series machine(s) used as the Attached Support Processors effectively doing the card and printer I/O to relieve the main processor(s?) of these I/O intensive tasks. I also most definitely heard in a presentation in 1967 on HASP (Houston Automatic SPool or some such, Shmuel will know) was initially built by four SEs in IBM's Houston office. The story goes that they pushed their desks hard together so they sat in two pairs, facing each other, and thus kept the communication lines as short and responsive as possible. Graeme At 09:38 AM 9/09/2010, you wrote: Shmuel Metz (Seymour J.) wrote: In 1792f2.291be9b9.39b92...@aol.com, on 09/08/2010 at 01:30 PM, Ed Finnell efinnel...@aol.com said: Huh? HASP was the efforts of NASA Houston and came out as Half ASP. Do you have a citation for that? I never saw the term before I suggested HASP is Half ASP for a project button. I worked as an operator at the the L.A. Scientific Center in Westwood (data center on the U.C.L.A campus) when DCS was initially developed on a 7094 with a 7040 as the support processor (before that they tried a 1410). Art Walters was one of the leads. I recall the term Half ASP used a couple of times somewhat sarcastically. I also recall that HASP was already known as a product (Type III?) out of Houston. This was around 1965. Walter Rue -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX : how to determine the member name of a DD card
Can you use ISRDDN and parse the output? Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dana Mitchell Sent: Thursday, September 09, 2010 9:13 AM To: IBM-MAIN@bama.ua.edu Subject: Re: REXX : how to determine the member name of a DD card On Wed, 8 Sep 2010 10:58:14 +0200, CUNY Yann yc...@externe.generali.fr wrote: //IN DD DSN=P3CUN.YANN.JCL(TEST14),DISP=SHR I need, in my rexx, to retrieve the member name of the DD CARD IN. With the LISTDSI, I just have the pds name. Any idea ? You can use OUTTRAP function to trap the output from the 'LISTA STATUS' TSO command. Then parse through and find the DD you are interested in. Dana -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: help with error bpxp006e
http://www-03.ibm.com/systems/z/os/zos/bkserv/lookat/index.html and specifically: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2M3A1/SPTM 004277 found 21 hits here: http://www-01.ibm.com/support/advsrch.wss?rs=0loc=en_US use BPXP006E as the keyword. snip I get this error every so often on my test lpar . The system would hang for several minutes sometimes release and continue but once in a while stop dead.I would just reipled and it worked. I always thought that the production lpar had a dataset the test lpar needed. BUT last night during a scheduled ipl of the production lpar the same thing happpend for the first time. We reipled and it worked. So this morning I try to google the error can't find it, I look for UNIX System Services Messages and Codes ,not in there. I found a site but am blocked from it by the network ss and trying to beg to get access grates on my nerves. We are a small monoplex shop. /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
EMC DLm Memory Leak Heads Up
This is a heads up for anyone who has a EMC DLm(Disk Library for Mainframe) at firmware level 2.1.1. On August 24th we were called by the operators that there were pending tape mounts on the DLm of over 10 minutes. Upon further investigation we were able to determine all of the pending mounts was to one of the two VTE's. We PUTTY'ed into the box and the one VTE was not responding to commands. With the help of EMC support personel we were instructed on how to reboot the VTE in question and it cleared up the issue. Handily the other VTE did the same the next night. We opened an issue with EMC and here is their response below. This hopefully will save someone an outage. This is for DLm's at firmware 2.1.1. quote In regards to SR snip to outage of VTE2 in DLm snip on 24th August, we have examined the logs and they have shown the following error which has been streaming most of the day. 08/24/2010 05:09:53 VTE2 VT: DLm839E: Unable to assess space for /tapelib1/AB (5): Cannot allocate memory This is a known issue which relates to a memory leakage problem and is fixed in the VTE application version 2.1.2 and above. It is recommended that all VTE’s be upgraded to the latest firmware as soon as possible. The current GA level is 2.1.2p2. Until the firmware is upgraded, any VTE’s below 2.1.2 (your current level for this DLm is 2.1.1) should be rebooted monthly as a circumvention to this memory leakage problem (which is what you did on the 24th August). The tape drives assigned to this VTE being rebooted must be varied offline before the reboot. /quote Regards to all, Patrick Lyon -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: help with error bpxp006e
there's a great site out there that you can use to research those kind of problems: http://www-03.ibm.com/systems/z/os/zos/bkserv/lookat/index.html I researched your bpxp006e there and there's a whole laundry list of things that might be going on ... hope this helps /s/ tuco bonno; Graduate, College of Conflict Management; University of SouthEast Asia; I partied on the Ho Chi Minh Trail - tiến lên !! -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Larry Macioce Sent: Thursday, 09 September, 2010 09:25 AM To: IBM-MAIN@bama.ua.edu Subject: help with error bpxp006e I get this error every so often on my test lpar . The system would hang for several minutes sometimes release and continue but once in a while stop dead.I would just reipled and it worked. I always thought that the production lpar had a dataset the test lpar needed. BUT last night during a scheduled ipl of the production lpar the same thing happpend for the first time. We reipled and it worked. So this morning I try to google the error can't find it, I look for UNIX System Services Messages and Codes ,not in there. I found a site but am blocked from it by the network ss and trying to beg to get access grates on my nerves. We are a small monoplex shop. Does anyone have any idea where I might find help for this? Anyone have ideas what could be causing it,how to prevent it? thanks in advance Mace -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Yeah, it's documented bottom-up and in the wrong place. APF is not an authorized assembler service. APF authorization is in the realm of operations and security, not assembler programming. Sure, it impacts assembler programs and programmers, but it also impacts COBOL and Rexx programs. Catalog management affects assembler programs, but it's not documented with the GET macro. APF is a facility for identifying certain load libraries to z/OS. If an executable program is (1) stored in an APF-authorized library and (2) link-edited with AC(1) then it is said to be APF-authorized. APF-authorized programs are eligible to use certain privileged facilities of z/OS that are not available to non-APF-authorized programs. Among these facilities are the ability to switch into supervisor mode and/or storage protection key zero. The documentation for each z/OS program service generally indicates whether the service requires APF authorization. Certain services require APF authorization only for certain combinations of parameters. A service requires APF authorization if in IBM's judgment it has the potential to affect the integrity, reliability, or availability of z/OS. As an untrusted programmer can freely link edit or bind a program with AC(1), an installation can only protect these privileged facilities by using RACF or another security subsystem to control the ability to store programs into APF-authorized libraries, and also the ability to APF-authorize a load library. Everything else is a detail. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Stan Weyman Sent: Thursday, September 09, 2010 5:46 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? I really have to chuckle at the question Charles since I'll wager at some point in time every person on this list has asked this same question. To date I really know of no single place where APF is outlined, explained, and/or documented other than what's in the Authorized Guide. Not the greatest but the place to start... It's easy to know how to get APF authorized. The trickier part is knowing the many ways to lose it and tricks on how to get around it. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
I'm fine. I'm just surprised that something so important is not defined but rather is described in a scattershot manner. As I said in another post, I'm not dealing with auditors; that was just a way of framing the question. I am technical and I know pretty-much what APF does. I just thought that surely there was a semi-formal statement somewhere, as opposed to a bunch of scattered details. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Elardus Engelbrecht Sent: Thursday, September 09, 2010 6:01 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Everything else is a detail. truer words have yet to be said g... Stan Weyman Senior Software Engineer stan.wey...@emc.com EMC² (508)249-3966 where information lives It is wise to keep in mind that neither success nor failure is ever final... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Charles Mills Sent: Thursday, September 09, 2010 9:39 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? Yeah, it's documented bottom-up and in the wrong place. APF is not an authorized assembler service. APF authorization is in the realm of operations and security, not assembler programming. Sure, it impacts assembler programs and programmers, but it also impacts COBOL and Rexx programs. Catalog management affects assembler programs, but it's not documented with the GET macro. APF is a facility for identifying certain load libraries to z/OS. If an executable program is (1) stored in an APF-authorized library and (2) link-edited with AC(1) then it is said to be APF-authorized. APF-authorized programs are eligible to use certain privileged facilities of z/OS that are not available to non-APF-authorized programs. Among these facilities are the ability to switch into supervisor mode and/or storage protection key zero. The documentation for each z/OS program service generally indicates whether the service requires APF authorization. Certain services require APF authorization only for certain combinations of parameters. A service requires APF authorization if in IBM's judgment it has the potential to affect the integrity, reliability, or availability of z/OS. As an untrusted programmer can freely link edit or bind a program with AC(1), an installation can only protect these privileged facilities by using RACF or another security subsystem to control the ability to store programs into APF-authorized libraries, and also the ability to APF-authorize a load library. Everything else is a detail. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Stan Weyman Sent: Thursday, September 09, 2010 5:46 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? I really have to chuckle at the question Charles since I'll wager at some point in time every person on this list has asked this same question. To date I really know of no single place where APF is outlined, explained, and/or documented other than what's in the Authorized Guide. Not the greatest but the place to start... It's easy to know how to get APF authorized. The trickier part is knowing the many ways to lose it and tricks on how to get around it. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Charles Mills wrote: I'm fine. I'm just surprised that something so important is not defined but rather is described in a scattershot manner. Yup. I agree with you and thanks for the new word of the day: 'scattershot'. ;-D (can't resist this one...) I am technical and I know pretty-much what APF does. Me too, perhaps if you pose your question on Assembler-L, some wise guru could help you out there. Strange that no one from IBM replied to you sofar... I just thought that surely there was a semi-formal statement somewhere, as opposed to a bunch of scattered details. If you find your answer, tell IBM-MAIN please. ;-) Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Elardus Engelbrecht elardus.engelbre...@sita.co.za wrote in message news:listserv%201009090856450243.1...@bama.ua.edu... Charles Mills wrote: I'm fine. I'm just surprised that something so important is not defined but rather is described in a scattershot manner. Yup. I agree with you and thanks for the new word of the day: 'scattershot'. ;-D (can't resist this one...) I am technical and I know pretty-much what APF does. Me too, perhaps if you pose your question on Assembler-L, some wise guru could help you out there. Strange that no one from IBM replied to you sofar... I just thought that surely there was a semi-formal statement somewhere, as opposed to a bunch of scattered details. If you find your answer, tell IBM-MAIN please. ;-) Groete / Greetings Elardus Engelbrecht Probably APF is so trivial and obvious to the MVS system programmers, that no one ever found the need to define it properly. Compare it to instruction, all instructions are documented in great detail, but I cannot remember having seen a definition of instruction ;-). Kees. For information, services and offers, please visit our web site: http://www.klm.com. This e-mail and any attachment may contain confidential and privileged material intended for the addressee only. If you are not the addressee, you are notified that no part of the e-mail or any attachment may be disclosed, copied or distributed, and that any other action related to this e-mail or attachment is strictly prohibited, and may be unlawful. If you have received this e-mail by error, please notify the sender immediately by return e-mail, and delete this message. Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its employees shall not be liable for the incorrect or incomplete transmission of this e-mail or any attachments, nor responsible for any delay in receipt. Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch Airlines) is registered in Amstelveen, The Netherlands, with registered number 33014286 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX compiler for CGI REXX execs
IBM has a REXX compiler (IBM program number 5695-013, if I recall correctly). Yes, there's a performance benefit, and if you run a sufficient amount of REXX it's a prudent business decision to get the compiler (and associated library). Compiled programs are still able to run on any z/OS system using the Alternate REXX Library, which is no additional charge. I don't expect there'd be any particular issue or challenge using compiled REXX programs via CGI, considering that CGI can invoke all sorts of (authorized) things. - - - - - Timothy Sipples Resident Enterprise Architect STG Value Creation Complex Deals Team IBM Growth Markets (Based in Singapore) E-Mail: timothy.sipp...@us.ibm.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: z990s still running?
Is anybody assuming that people (and thus organizations) always and everywhere act rationally? I hope not. :-) Lots of actions and attitudes are irrational, and some of those are a lot of fun. That said, I can think of a couple rational situations in which operating a z990 makes sense, even though we've already seen 3 generations of replacement machines, each far better than the previous. To pick an example, a university delivering mainframe training to students through the IBM Academic Initiative might very well run a z990 with the latest and greatest software releases. - - - - - Timothy Sipples Resident Enterprise Architect STG Value Creation Complex Deals Team IBM Growth Markets (Based in Singapore) E-Mail: timothy.sipp...@us.ibm.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX : how to determine the member name of a DD card
Here is some sample REXX code that will list the dataset allocated to ddname DD1 using Listalc st. /* rexx */ Z=OUTTRAP(SYSOUTLINE.,'*',NOCONCAT) ADDRESS TSO INDEX=' ' LISTALC STATUS Z=OUTTRAP(OFF) I=1 DO i=1 to SYSOUTLINE.0 test=word(sysoutline.i,1) if test='DD1' then do x=i-1 say sysoutline.x i=sysoutline.0 end end exit Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Veilleux, Jon L Sent: Thursday, September 09, 2010 9:28 AM To: IBM-MAIN@bama.ua.edu Subject: Re: REXX : how to determine the member name of a DD card Can you use ISRDDN and parse the output? Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dana Mitchell Sent: Thursday, September 09, 2010 9:13 AM To: IBM-MAIN@bama.ua.edu Subject: Re: REXX : how to determine the member name of a DD card On Wed, 8 Sep 2010 10:58:14 +0200, CUNY Yann yc...@externe.generali.fr wrote: //IN DD DSN=P3CUN.YANN.JCL(TEST14),DISP=SHR I need, in my rexx, to retrieve the member name of the DD CARD IN. With the LISTDSI, I just have the pds name. Any idea ? You can use OUTTRAP function to trap the output from the 'LISTA STATUS' TSO command. Then parse through and find the DD you are interested in. Dana -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
This looks pretty good: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2E2B0/1.6 quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote The first sentence pretty much says it all. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On Thu, 2010-09-09 at 09:07 -0500, McKown, John wrote: quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote The first sentence pretty much says it all. Hmmm - somebody mentioned details ... I'm sure some fella that used to answer to the moniker Craddock is about to come crashing in to this discussion. Is a program authorised because of how it's defined (on disk), or how it's defined when running ?. Details, details ... Shane ... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: z990s still running?
Timothy Sipples pisze: Is anybody assuming that people (and thus organizations) always and everywhere act rationally? I hope not. :-) Lots of actions and attitudes are irrational, and some of those are a lot of fun. BTDT. :-( BTW: What camel is? The camel is a horse designed by committee... -- Radoslaw Skorupka Lodz, Poland -- BRE Bank SA ul. Senatorska 18 00-950 Warszawa www.brebank.pl Sd Rejonowy dla m. st. Warszawy XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, nr rejestru przedsibiorców KRS 025237 NIP: 526-021-50-88 Wedug stanu na dzie 01.01.2009 r. kapita zakadowy BRE Banku SA (w caoci wpacony) wynosi 118.763.528 zotych. W zwizku z realizacj warunkowego podwyszenia kapitau zakadowego, na podstawie uchway XXI WZ z dnia 16 marca 2008r., oraz uchway XVI NWZ z dnia 27 padziernika 2008r., moe ulec podwyszeniu do kwoty 123.763.528 z. Akcje w podwyszonym kapitale zakadowym BRE Banku SA bd w caoci opacone. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
YES! That's it! Exactly. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 7:08 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? This looks pretty good: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2E2B0/1.6 quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. It means that APF-authorized code *should* use RACROUTE requests and avoid doing anything privileged on behalf of users that are not defined with sufficient authority. There is also the z/OS Statement of Integrity which aludes to APF-authotization as one of the three authorized states, along with supervisor state and protection key less than 8. Date: Thu, 9 Sep 2010 08:01:27 -0500 From: elardus.engelbre...@sita.co.za Subject: Re: Where is APF documented? To: IBM-MAIN@bama.ua.edu Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... Does this help you? Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX : how to determine the member name of a DD card
Works fine ! thank you ... -Message d'origine- De : IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] De la part de Veilleux, Jon L Envoyé : jeudi 9 septembre 2010 16:04 À : IBM-MAIN@bama.ua.edu Objet : Re: REXX : how to determine the member name of a DD card Here is some sample REXX code that will list the dataset allocated to ddname DD1 using Listalc st. /* rexx */ Z=OUTTRAP(SYSOUTLINE.,'*',NOCONCAT) ADDRESS TSO INDEX=' ' LISTALC STATUS Z=OUTTRAP(OFF) I=1 DO i=1 to SYSOUTLINE.0 test=word(sysoutline.i,1) if test='DD1' then do x=i-1 say sysoutline.x i=sysoutline.0 end end exit Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Veilleux, Jon L Sent: Thursday, September 09, 2010 9:28 AM To: IBM-MAIN@bama.ua.edu Subject: Re: REXX : how to determine the member name of a DD card Can you use ISRDDN and parse the output? Jon L. Veilleux veilleu...@aetna.com (860) 636-9179 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dana Mitchell Sent: Thursday, September 09, 2010 9:13 AM To: IBM-MAIN@bama.ua.edu Subject: Re: REXX : how to determine the member name of a DD card On Wed, 8 Sep 2010 10:58:14 +0200, CUNY Yann yc...@externe.generali.fr wrote: //IN DD DSN=P3CUN.YANN.JCL(TEST14),DISP=SHR I need, in my rexx, to retrieve the member name of the DD CARD IN. With the LISTDSI, I just have the pds name. Any idea ? You can use OUTTRAP function to trap the output from the 'LISTA STATUS' TSO command. Then parse through and find the DD you are interested in. Dana -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html This e-mail may contain confidential or privileged information. If you think you have received this e-mail in error, please advise the sender by reply e-mail and then delete this e-mail immediately. Thank you. Aetna -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
FW: Where is APF documented?
Doh! I forgot the URL for the Statement of Integrity ... http://www-03.ibm.com/systems/z/os/zos/features/racf/zos_integrity_statement.html Date: Thu, 9 Sep 2010 10:34:41 -0400 From: jayare...@hotmail.com Subject: Re: Where is APF documented? To: IBM-MAIN@bama.ua.edu 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. It means that APF-authorized code *should* use RACROUTE requests and avoid doing anything privileged on behalf of users that are not defined with sufficient authority. There is also the z/OS Statement of Integrity which aludes to APF-authotization as one of the three authorized states, along with supervisor state and protection key less than 8. Date: Thu, 9 Sep 2010 08:01:27 -0500 From: elardus.engelbre...@sita.co.za Subject: Re: Where is APF documented? To: IBM-MAIN@bama.ua.edu Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... Does this help you? Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Charles Mills wrote: YES! That's it! Exactly. I've quoted only the very same first sentence from the same book for you to keep my post rather short. And I agree with John McKown about the first sentence of course. Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
It's authorized because of how it is defined on disk. How it behaves when running determines whether or not it truly needs to be authorized to accomplish what it is attempting to do. IEFBR14 could be linkedited as AC(1) into an authorized library. That particular instantiation of IEFBR14 would then be authorized. Bill Fairchild Rocket Software -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Shane Sent: Thursday, September 09, 2010 9:24 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? On Thu, 2010-09-09 at 09:07 -0500, McKown, John wrote: quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote The first sentence pretty much says it all. Hmmm - somebody mentioned details ... I'm sure some fella that used to answer to the moniker Craddock is about to come crashing in to this discussion. Is a program authorised because of how it's defined (on disk), or how it's defined when running ?. Details, details ... Shane ... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX compiler for CGI REXX execs
On 9/9/2010 2:24 PM, Timothy Sipples wrote: IBM has a REXX compiler (IBM program number 5695-013, if I recall correctly). Yes, there's a performance benefit, and if you run a sufficient amount of REXX it's a prudent business decision to get the compiler (and associated library). Compiled programs are still able to run on any z/OS system using the Alternate REXX Library, which is no additional charge. I don't expect there'd be any particular issue or challenge using compiled REXX programs via CGI, considering that CGI can invoke all sorts of (authorized) things. - - - - - Timothy Sipples Resident Enterprise Architect STG Value Creation Complex Deals Team IBM Growth Markets (Based in Singapore) E-Mail: timothy.sipp...@us.ibm.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html Hi Thank you Thimoty. If I remember correctly, for a while the REXX compiler was free, anyhow I will try to get it (we are business partner) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On Thu, 9 Sep 2010 07:34:23 -0700, Charles Mills charl...@mcn.org wrote: YES! That's it! Exactly. Charles ...snipped... This looks pretty good: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2E2B0/1.6 quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote That may have made you happy, Charles, but technically it's wrong. A program is only APF-authorized if it's running. It only becomes APF-authorized while running only if: (a) it resides in an APF-authorized library and is link-edited with AC(1) and when it's started it comes from that APF-authorized library and (some other stuff here omitted for simplicity, such as some UNIX aspects, tasklibs, etc.) -and- (a1) it's run by the initiator directly; or (a2) it's run by some other mechanism that supports starting APF-authorized programs, such as IKJEFTSR, or execmvs(), or ATTACH with RSAPF=YES; -or- (b) it resides in an APF-authorized library and it's loaded by a program already running APF-authorized. The fact that it's in an APF-authorized library and link-edited with AC(1) does not make it APF-authorized. It merely makes it possible to run APF-authorized, subject to some other conditions. The fact that it's in an APF-authorized library and -not- linked AC(1) does not make it not APF-authorized. It merely means that when it runs it won't be APF-authorized by default. But it might be APF-authorized if run by something that's already running APF-authorized. And all this ignores programs that run in supervisor state or system key, which is very closely related to running APF-authorized. But wasn't your question more about what a program running APF-authorized can do? That has a very simple answer, in a z/OS context: Basically, anythying it wants to. In the most simple terms it can issue MODESET to switch to supervisor state or system key, and that's really what APF-authorization means. But in slightly more complex terms it can also use privileged system macros that honor APF-authorization as one means of control. But the important thing is that anything it wants to. It can bypass all security in the system, access any data in the system, and hide all traces that it has done that. I'm not sure we have any documentation that says that all in one place, and little (if any) of the documentation properly distinguishes between being APF-authorized and having the capability of becoming APF-authorized. We even have (or had?) documentation in the z/OS UNIX System Services books stating that having the +a extended attribute makes a UNIX executable APF-authorized, and that's also wrong. It really means consider this program as residing in an APF-authorized library. It seems to be a hard concept to understand, and to describe properly. -- Walt Farrell IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: z990s still running?
On Thu, 9 Sep 2010 16:28:45 +0200, R.S. r.skoru...@bremultibank.com.pl wrote: Timothy Sipples pisze: Is anybody assuming that people (and thus organizations) always and everywhere act rationally? I hope not. :-) Lots of actions and attitudes are irrational, and some of those are a lot of fun. BTDT. :-( BTW: What camel is? The camel is a horse designed by committee... -- We say Elephant is mouse built to government specifications Radoslaw Skorupka Lodz, Poland -- BRE Bank SA ul. Senatorska 18 00-950 Warszawa www.brebank.pl -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Thanks, Walt. That clarifies things. wasn't your question more about what a program running APF-authorized can do? Nope. Not at all. As I have said several times now I have a good working understanding of the practical effects APF-authorization. I was looking for a formal statement that I could point customers at. If one is going to sell a product that will be evaluated by people who are not mainframe experts, and one is going to say it requires APF authorization, it would be nice IMHO if one defined or pointed them to a definition of that term. As you point out, I am not the only one who is a little fuzzy on the exact definition. In fact, I think IBM uses the same term to mean (different) related things: I think IBM refers to datasets as being APF-authorized, when in fact, as you say below, it is running programs that are APF authorized, not datasets. A dataset is really APF-authorization eligible or something like that. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Walt Farrell Sent: Thursday, September 09, 2010 7:58 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? On Thu, 9 Sep 2010 07:34:23 -0700, Charles Mills charl...@mcn.org wrote: YES! That's it! Exactly. Charles ...snipped... This looks pretty good: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2E2B0/1.6 quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote That may have made you happy, Charles, but technically it's wrong. A program is only APF-authorized if it's running. It only becomes APF-authorized while running only if: (a) it resides in an APF-authorized library and is link-edited with AC(1) and when it's started it comes from that APF-authorized library and (some other stuff here omitted for simplicity, such as some UNIX aspects, tasklibs, etc.) -and- (a1) it's run by the initiator directly; or (a2) it's run by some other mechanism that supports starting APF-authorized programs, such as IKJEFTSR, or execmvs(), or ATTACH with RSAPF=YES; -or- (b) it resides in an APF-authorized library and it's loaded by a program already running APF-authorized. The fact that it's in an APF-authorized library and link-edited with AC(1) does not make it APF-authorized. It merely makes it possible to run APF-authorized, subject to some other conditions. The fact that it's in an APF-authorized library and -not- linked AC(1) does not make it not APF-authorized. It merely means that when it runs it won't be APF-authorized by default. But it might be APF-authorized if run by something that's already running APF-authorized. And all this ignores programs that run in supervisor state or system key, which is very closely related to running APF-authorized. But wasn't your question more about what a program running APF-authorized can do? That has a very simple answer, in a z/OS context: Basically, anythying it wants to. In the most simple terms it can issue MODESET to switch to supervisor state or system key, and that's really what APF-authorization means. But in slightly more complex terms it can also use privileged system macros that honor APF-authorization as one means of control. But the important thing is that anything it wants to. It can bypass all security in the system, access any data in the system, and hide all traces that it has done that. I'm not sure we have any documentation that says that all in one place, and little (if any) of the documentation properly distinguishes between being APF-authorized and having the capability of becoming APF-authorized. We even have (or had?) documentation in the z/OS UNIX System Services books stating that having the +a extended attribute makes a UNIX executable APF-authorized, and that's also wrong. It really means consider this program as residing in an APF-authorized library. It seems to be a hard concept to understand, and to describe properly. -- Walt Farrell IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
Elardus wrote: Agreed. Chap 21 is indeed useful, but could be too technical for auditors. Maybe someone should suggest to IBM that they write a redbook about audit related items? Auditing z/OS - for dummies (not sysprogs but aud.) Birger Heede On 09-09-2010 15:02, Elardus Engelbrecht wrote: Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... Does this help you? Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: EPILOG question
Hopefully that SYSPRINT actually has a SYSOUT= or other appropriate options other than *. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Cobe Xu Sent: Wednesday, September 08, 2010 Wednesday 10:42 PM To: IBM-MAIN@bama.ua.edu Subject: Re: EPILOG question thanks Norman... Just figured out.. I did a silly move that put SYSPRINT DD after RKM2IN DD On Thu, Sep 9, 2010 at 2:02 AM, Norman Hollander on DesertWiz norman.hollan...@desertwiz.biz wrote: Have you called support to get help? It may be a known problem, or others may have already reported it. zNorman -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Cobe Xu Sent: Wednesday, September 08, 2010 Wednesday 10:40 AM To: IBM-MAIN@bama.ua.edu Subject: EPILOG question Hi list, We recently upgraded to Omegamon XE v420, everything looks fine, except I could not gen reports using EPILOG obtain command in batch, which works in the old version. The job gets rc 0, but no record printed. While I use EPILOG session command line can display information. Any one encounter similar thing? any idea will be appriciated. Thanks! here is my JCL: //EXPORT EXEC PGM=KEPOBTN,REGION=4096K,PARM='EPPROD=EP' //STEPLIB DD DISP=SHR,DSN=SYS1.OZOS1.TKANMOD //RKANPAR DD DISP=SHR,DSN=SYSU.OZOS1.AHD5.RKANPARU //RKM2OUTR DD SYSOUT=*REPORT LISTING //RKM2OUTO DD SYSOUT=*OBTAIN MESSAGE LOG //RKM2OUTM DD SYSOUT=*EPILOG MESSAGE LOG //OUTREP DD DSN=OUTREP,DISP=(NEW,PASS,DELETE),UNIT=3390, //DCB=(RECFM=VB,LRECL=4096,BLKSIZE=27998),SPACE=(TRK,(1,1)) //ABNLIGNR DD DUMMY //RKM2OUTD DD DSN=MYUID.EPILOG.REPORT,DISP=(MOD,CATLG), // SPACE=(CYL,(2,1)),UNIT=SYSDA, // DCB=(DSORG=PS,RECFM=V,LRECL=4096) //RKM2IN DD * //SYSPRINT DD * OBTAIN STC(CNMS) INT - ELEMENTS(SMFID,SDATE,STIME,STCNAME,CPUTRXTM) - FORMAT(PC) OUTFILE(RKM2OUTD) REPLACE /* -- Cobe Xu Best Regards --- zOS Performance Capacity Analyst E2E Performance Analyst Email: cob...@gmail.com --- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- Cobe Xu Best Regards --- zOS Performance Capacity Analyst E2E Performance Analyst Email: cob...@gmail.com --- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: z990s still running?
On Thu, Sep 9, 2010 at 11:06 AM, Matthew Stitt mathwst...@bellsouth.net wrote: We say Elephant is mouse built to government specifications Or rather, Robert A. Heinlein did. -- zMan -- I've got a mainframe and I'm not afraid to use it -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX compiler for CGI REXX execs
On Thu, Sep 9, 2010 at 10:56 AM, Miklos Szigetvari miklos.szigetv...@isis-papyrus.com wrote: Thank you Thimoty. If I remember correctly, for a while the REXX compiler was free, anyhow I will try to get it (we are business partner) On at least one platform, the runtime is included -- but I disbelieve that the compiler was EVER free. I remember the doc alone being a killer: a 108-page manual was $54 at one point. For the mathematically challenged, that's exactly fifty cents PER PAGE. And it wasn't even in color. -- zMan -- I've got a mainframe and I'm not afraid to use it -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: REXX : how to determine the member name of a DD card
I would try LISTDSI('xxx file). It might return the dsnname into SYSDSNAME
which you can investigate using member=(word(translate(sysdsname,'
',()'),2)
ITschak
On Thu, Sep 9, 2010 at 5:35 PM, CUNY Yann yc...@externe.generali.fr wrote:
Works fine ! thank you ...
-Message d'origine-
De : IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] De la
part de Veilleux, Jon L
Envoyé : jeudi 9 septembre 2010 16:04
À : IBM-MAIN@bama.ua.edu
Objet : Re: REXX : how to determine the member name of a DD card
Here is some sample REXX code that will list the dataset allocated to
ddname DD1 using Listalc st.
/* rexx */
Z=OUTTRAP(SYSOUTLINE.,'*',NOCONCAT)
ADDRESS TSO
INDEX=' '
LISTALC STATUS
Z=OUTTRAP(OFF)
I=1
DO i=1 to SYSOUTLINE.0
test=word(sysoutline.i,1)
if test='DD1' then do
x=i-1
say sysoutline.x
i=sysoutline.0
end
end
exit
Jon L. Veilleux
veilleu...@aetna.com
(860) 636-9179
-Original Message-
From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On
Behalf Of Veilleux, Jon L
Sent: Thursday, September 09, 2010 9:28 AM
To: IBM-MAIN@bama.ua.edu
Subject: Re: REXX : how to determine the member name of a DD card
Can you use ISRDDN and parse the output?
Jon L. Veilleux
veilleu...@aetna.com
(860) 636-9179
-Original Message-
From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On
Behalf Of Dana Mitchell
Sent: Thursday, September 09, 2010 9:13 AM
To: IBM-MAIN@bama.ua.edu
Subject: Re: REXX : how to determine the member name of a DD card
On Wed, 8 Sep 2010 10:58:14 +0200, CUNY Yann yc...@externe.generali.fr
wrote:
//IN DD DSN=P3CUN.YANN.JCL(TEST14),DISP=SHR
I need, in my rexx, to retrieve the member name of the DD CARD IN.
With
the LISTDSI, I just have the pds name.
Any idea ?
You can use OUTTRAP function to trap the output from the 'LISTA STATUS'
TSO command. Then parse through and find the DD you are interested in.
Dana
--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html
This e-mail may contain confidential or privileged information. If you
think you have received this e-mail in error, please advise the sender by
reply e-mail and then delete this e-mail immediately.
Thank you. Aetna
--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html
This e-mail may contain confidential or privileged information. If
you think you have received this e-mail in error, please advise the
sender by reply e-mail and then delete this e-mail immediately.
Thank you. Aetna
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
In other words we will never, EVER shoot you in the foot but will make it quite easy for you to shoot yourself. Does that about cover it? Stan Weyman Senior Software Engineer stan.wey...@emc.com EMC² (508)249-3966 where information lives It is wise to keep in mind that neither success nor failure is ever final... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of J R Sent: Thursday, September 09, 2010 10:40 AM To: IBM-MAIN@bama.ua.edu Subject: FW: Where is APF documented? Doh! I forgot the URL for the Statement of Integrity ... http://www-03.ibm.com/systems/z/os/zos/features/racf/zos_integrity_statement.html Date: Thu, 9 Sep 2010 10:34:41 -0400 From: jayare...@hotmail.com Subject: Re: Where is APF documented? To: IBM-MAIN@bama.ua.edu 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. It means that APF-authorized code *should* use RACROUTE requests and avoid doing anything privileged on behalf of users that are not defined with sufficient authority. There is also the z/OS Statement of Integrity which aludes to APF-authotization as one of the three authorized states, along with supervisor state and protection key less than 8. Date: Thu, 9 Sep 2010 08:01:27 -0500 From: elardus.engelbre...@sita.co.za Subject: Re: Where is APF documented? To: IBM-MAIN@bama.ua.edu Charles Mills wrote: Thanks. That's certainly better than anything else I found. Agreed. Chap 21 is indeed useful, but could be too technical for auditors. But I would really like a formal or fairly formal *definition* of APF authorization. This could be messy as I just found out. May I join you? ;-D Here's a way to re-phrase the question. Suppose an auditor said show me a definition of APF authorization and a statement of what it means. Where would you point him? (No smart answers please.) Look at Init and Tuna Ref. I quote this useful statement you can fire of at your auditors: 'The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions.' Other useful quote from 'Assembler Services Guide': 'The authorized program facility (APF) helps your installation protect the system. APF-authorized programs can access system functions that can affect the security and integrity of the system.' Failing that, research the words 'supervisor state/status', MODESET. Other useful quote (yes, I know it is very technical), you can rewrite for brevity, from 'Security Server RACF Security Administrator's Guide': 'Programmers Writing Authorized Applications: Programmers writing authorized applications (that is, APF-authorized programs) can use the RACROUTE macro to request security-related services,...'. It means, being in APF status, you can do 'privileged' things. February 25, 2003, SHARE Session Number: 2889 is also interesting, but very technical... Does this help you? Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
thank you for clarifying that Walt! g Stan Weyman Senior Software Engineer stan.wey...@emc.com EMC² (508)249-3966 where information lives It is wise to keep in mind that neither success nor failure is ever final... -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Walt Farrell Sent: Thursday, September 09, 2010 10:58 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Where is APF documented? On Thu, 9 Sep 2010 07:34:23 -0700, Charles Mills charl...@mcn.org wrote: YES! That's it! Exactly. Charles ...snipped... This looks pretty good: http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IEA2E2B0/1.6 quote The authorized program facility (APF) allows your installation to identify system or user programs that can use sensitive system functions. To be APF-authorized, programs must reside in APF-authorized libraries, and be link-edited with authorization code AC=1. The system maintains a list of APF-authorized libraries that contains the following information for each library: /quote That may have made you happy, Charles, but technically it's wrong. A program is only APF-authorized if it's running. It only becomes APF-authorized while running only if: (a) it resides in an APF-authorized library and is link-edited with AC(1) and when it's started it comes from that APF-authorized library and (some other stuff here omitted for simplicity, such as some UNIX aspects, tasklibs, etc.) -and- (a1) it's run by the initiator directly; or (a2) it's run by some other mechanism that supports starting APF-authorized programs, such as IKJEFTSR, or execmvs(), or ATTACH with RSAPF=YES; -or- (b) it resides in an APF-authorized library and it's loaded by a program already running APF-authorized. The fact that it's in an APF-authorized library and link-edited with AC(1) does not make it APF-authorized. It merely makes it possible to run APF-authorized, subject to some other conditions. The fact that it's in an APF-authorized library and -not- linked AC(1) does not make it not APF-authorized. It merely means that when it runs it won't be APF-authorized by default. But it might be APF-authorized if run by something that's already running APF-authorized. And all this ignores programs that run in supervisor state or system key, which is very closely related to running APF-authorized. But wasn't your question more about what a program running APF-authorized can do? That has a very simple answer, in a z/OS context: Basically, anythying it wants to. In the most simple terms it can issue MODESET to switch to supervisor state or system key, and that's really what APF-authorization means. But in slightly more complex terms it can also use privileged system macros that honor APF-authorization as one means of control. But the important thing is that anything it wants to. It can bypass all security in the system, access any data in the system, and hide all traces that it has done that. I'm not sure we have any documentation that says that all in one place, and little (if any) of the documentation properly distinguishes between being APF-authorized and having the capability of becoming APF-authorized. We even have (or had?) documentation in the z/OS UNIX System Services books stating that having the +a extended attribute makes a UNIX executable APF-authorized, and that's also wrong. It really means consider this program as residing in an APF-authorized library. It seems to be a hard concept to understand, and to describe properly. -- Walt Farrell IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On Thu, Sep 9, 2010 at 8:39 AM, Charles Mills charl...@mcn.org wrote: Yeah, it's documented bottom-up and in the wrong place. APF is not an authorized assembler service. APF authorization is in the realm of operations and security, not assembler programming. Sure, it impacts assembler programs and programmers, but it also impacts COBOL and Rexx programs. Catalog management affects assembler programs, but it's not documented with the GET macro. what little documentation there is is older than Methuselah's tomcat and you have to be schooled in interpreting the arcane way things are described. Be thankful for what exists. APF is a facility for identifying certain load libraries to z/OS. If an executable program is (1) stored in an APF-authorized library and (2) link-edited with AC(1) then it is said to be APF-authorized. Keep in mind that APF authorization is an attribute of a running job step. A job step becomes APF authorized if and only if the job step program is linked AC(1) *and* is loaded from a dataset in the APF list. If the job step is APF authorized then the job step task and all of its subtasks are considered authorized. Otherwise none of the tasks are authorized. As an untrusted programmer can freely link edit or bind a program with AC(1), an installation can only protect these privileged facilities by using RACF or another security subsystem to control the ability to store programs into APF-authorized libraries, and also the ability to APF-authorize a load library. True. One point to note is that the AC attribute has no effect whatsoever on programs that are not job step programs, but I'd like a dollar for every loadlibrary that has AC(1) sprayed around like confetti. -- This email might be from the artist formerly known as CC (or not) You be the judge. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Moving JES2 NJE function from one system to another in a MAS?
On Thu, 9 Sep 2010 10:57:52 -0700, Mark T. Regan, K8MTR netsfw-ibmm...@yahoo.com wrote: We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? A lot of assumptions made below so we need more information. 1) Is this something that was done prior to acquisition and you just need to documented it, or was it never set up to do this before? 2) Are both LPARs in the same MAS? 3) Are there any static NJE connections defined (CONNECT statements in JES2)? 4) Is it SNA or TCP/IP NJE? Assuming it is SNA and both LPARs are in the same MAS: 1) If both LPARs have their own LOGON (VTAM APPL), all you may need to do is restart the connections from the other LPAR ($SN,A=applid). You need to have the LOGON active and active/idle lines. 2) If they have the same APPL, then you probably have to $PLGN(n) from one LPAR and start it on the other before you can start nodes. Again, you also need defined / active and idle lines. This assumes the other LPARs VTAM definitions are in place to do so. If the VTAMLST is shared, you probably inact the node on one LPAR and activate it on the other. 3) If static connections are defined, the other end must have the mas member defined or it won't connect. I've seen it done both ways: Same APPLID that gets moved or each LPAR with its own APPLID. If you define a new / 2nd appl, then coordination is needed with your partners, so I think sharing the same APPLID is more common. I haven't had to do something like this from scratch (I've defined new nodes and swapped SNA for IP) in more years than I can recall specifically, so I hope I didn't forget something or give you wrong information. Regards, Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On Thu, 9 Sep 2010 09:58:19 -0500, Walt Farrell wfarr...@us.ibm.com wrote: . . . And all this ignores programs that run in supervisor state or system key, which is very closely related to running APF-authorized. Included in the breed of programs that reside in APF-authorized libraries, are *not* link-edited with AC(1), yet when run can effectively do anything they please, are ones often forgotten. Think PPT. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
I use a steplib of the linklib pds on the new ipl volume. Use volser for the A1 volume on all three locations. Mike Wickman -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 3:09 PM To: IBM-MAIN@bama.ua.edu Subject: Re: [IBM-MAIN] Disable Wait After Maintenance I had that originally, the job asked me to over write TZ11P1, so I terminated. Didn't want to write over the ipl text on the volser with no maint. *05 ICK21836D IPL TEXT EXISTS ON TZ11P1. REPLY U TO OVERLAY, ELSE T So you are saying to setup like this, that will over write the TZ11P1 volser. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11P1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 4:03 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:57 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance John, thanks for the sample. My jcl used is below, I got cc=12. Volser=TZ11A1 is the volser with the maint, my current running res volume is TZ11P1 without maint. Is this jcl correct? tks //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11A1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* ICKDSF - MVS/ESADEVICE SUPPORT FACILITIES 17.0 REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP ICK00700I DEVICE INFORMATION FOR 340B IS CURRENTLY AS FOLLOWS: PHYSICAL DEVICE = 3390 STORAGE CONTROLLER = 2105 STORAGE CONTROL DESCRIPTOR = E8 DEVICE DESCRIPTOR = 0C ADDITIONAL DEVICE INFORMATION = 4835 TRKS/CYL = 15, # PRIMARY CYLS = 10017 ICK04000I DEVICE IS IN SIMPLEX STATE ICK03091I EXISTING VOLUME SERIAL READ = TZ11A1 ICK31300I VERIFICATION FAILED: VOLUME-SERIAL WRONG. ICK30003I FUNCTION TERMINATED. CONDITION CODE IS 12 15:47:3909/09/10 You kept the constant IPLVOL in the VERIFY. You need to replace that with the actual volser of TZ11P1. C 'IPLVOL' 'TZ11P1' ALL WORD and try again. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at
Re: Disable Wait After Maintenance
-Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 3:09 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance I had that originally, the job asked me to over write TZ11P1, so I terminated. Didn't want to write over the ipl text on the volser with no maint. *05 ICK21836D IPL TEXT EXISTS ON TZ11P1. REPLY U TO OVERLAY, ELSE T So you are saying to setup like this, that will over write the TZ11P1 volser. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11P1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* Huh? I'm confused. You say that SYS1.NUCLEUS has been maintenanced. It is on the IPL volume. Therefore, you must update the IPL text on that same volume. But you also say that TZ11P1 has not been maintenanced. Either it has or it has not. Can't be both. Point the job at the volser which has been maintenanced. It is should be what you are IPLing from. If not, then I'm totally bewildered. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt ++ HOLD(UA54213) SYS FMID(HBB7760) REASON(ACTION) DATE(10133) COMMENT ( * FUNCTION AFFECTED: BCP (OA32814) * * IPL/NIP * *LOADxx processing * * DESCRIPTION : Action updates* * TIMING : Pre-Apply * This apar fix modifies modules IEAIPL00 and IEAIPL01. Both parts need to have the same assemble date when they are applied to a system, otherwise a WAIT075 RSN0006 will be issued. IEAIPL01 gets applied via normal SMP/E install. IEAIPL00 will be installed to SAMPLIB where IEAIPL00 resides. It is then necessary to install the IPL TEXT on the SYSRES pack using ICKDSF or some other appropriate utility.). Jim Mulder z/OS System Test IBM Corp. Poughkeepsie, NY -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
-Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:57 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance John, thanks for the sample. My jcl used is below, I got cc=12. Volser=TZ11A1 is the volser with the maint, my current running res volume is TZ11P1 without maint. Is this jcl correct? tks //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11A1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* ICKDSF - MVS/ESADEVICE SUPPORT FACILITIES 17.0 REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP ICK00700I DEVICE INFORMATION FOR 340B IS CURRENTLY AS FOLLOWS: PHYSICAL DEVICE = 3390 STORAGE CONTROLLER = 2105 STORAGE CONTROL DESCRIPTOR = E8 DEVICE DESCRIPTOR = 0C ADDITIONAL DEVICE INFORMATION = 4835 TRKS/CYL = 15, # PRIMARY CYLS = 10017 ICK04000I DEVICE IS IN SIMPLEX STATE ICK03091I EXISTING VOLUME SERIAL READ = TZ11A1 ICK31300I VERIFICATION FAILED: VOLUME-SERIAL WRONG. ICK30003I FUNCTION TERMINATED. CONDITION CODE IS 12 15:47:3909/09/10 You kept the constant IPLVOL in the VERIFY. You need to replace that with the actual volser of TZ11P1. C 'IPLVOL' 'TZ11P1' ALL WORD and try again. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
I had that originally, the job asked me to over write TZ11P1, so I terminated. Didn't want to write over the ipl text on the volser with no maint. *05 ICK21836D IPL TEXT EXISTS ON TZ11P1. REPLY U TO OVERLAY, ELSE T So you are saying to setup like this, that will over write the TZ11P1 volser. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11P1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 4:03 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:57 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance John, thanks for the sample. My jcl used is below, I got cc=12. Volser=TZ11A1 is the volser with the maint, my current running res volume is TZ11P1 without maint. Is this jcl correct? tks //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11A1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* ICKDSF - MVS/ESADEVICE SUPPORT FACILITIES 17.0 REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP ICK00700I DEVICE INFORMATION FOR 340B IS CURRENTLY AS FOLLOWS: PHYSICAL DEVICE = 3390 STORAGE CONTROLLER = 2105 STORAGE CONTROL DESCRIPTOR = E8 DEVICE DESCRIPTOR = 0C ADDITIONAL DEVICE INFORMATION = 4835 TRKS/CYL = 15, # PRIMARY CYLS = 10017 ICK04000I DEVICE IS IN SIMPLEX STATE ICK03091I EXISTING VOLUME SERIAL READ = TZ11A1 ICK31300I VERIFICATION FAILED: VOLUME-SERIAL WRONG. ICK30003I FUNCTION TERMINATED. CONDITION CODE IS 12 15:47:3909/09/10 You kept the constant IPLVOL in the VERIFY. You need to replace that with the actual volser of TZ11P1. C 'IPLVOL' 'TZ11P1' ALL WORD and try again. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
John, thanks for the sample. My jcl used is below, I got cc=12. Volser=TZ11A1 is the volser with the maint, my current running res volume is TZ11P1 without maint. Is this jcl correct? tks //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11A1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* ICKDSF - MVS/ESADEVICE SUPPORT FACILITIES 17.0 REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP ICK00700I DEVICE INFORMATION FOR 340B IS CURRENTLY AS FOLLOWS: PHYSICAL DEVICE = 3390 STORAGE CONTROLLER = 2105 STORAGE CONTROL DESCRIPTOR = E8 DEVICE DESCRIPTOR = 0C ADDITIONAL DEVICE INFORMATION = 4835 TRKS/CYL = 15, # PRIMARY CYLS = 10017 ICK04000I DEVICE IS IN SIMPLEX STATE ICK03091I EXISTING VOLUME SERIAL READ = TZ11A1 ICK31300I VERIFICATION FAILED: VOLUME-SERIAL WRONG. ICK30003I FUNCTION TERMINATED. CONDITION CODE IS 12 15:47:3909/09/10 -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 3:25 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:16 PM To: IBM-MAIN@bama.ua.edu Subject: Disable Wait After Maintenance I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt The wait ending with x'075' indicates that the IPL text on the IPL volume does not match the code in SYS1.NUCLEUS. I'd suggest running ICKDSF and putting the new IPL text on the IPL volume. The x'074' may also be this. I'd try redoing the IPL text first. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=?? //SYSINDD * REFORMAT DDNAME(iplvol) - VERIFY(iplvol) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* //iplvol DD DISP=OLD, // UNIT=3390, // VOL=SER=iplvol iplvol is the volser of the IPL volume. ?? is the volser of the volume containing the maintenanced version of SYS1.SAMPLIB. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the
Re: Disable Wait After Maintenance
From the MVS Systems Codes: xrr00www 00600075 is Wait State 75 Reason code 6 00900074 is Wait State 74 Reason code 9 From the description for Wait State 74: 09 Code was loaded from a new restart PSW. This code will be loaded when a restart is issued on a processor that has a zero prefix register. The prefix register is zero when the operator attempts to do a restart too early in IPL or in a logically offline processor in LPAR mode. From the description for Wait State 75 06 The IPL text on the volume used to IPL did not match the nucleus code resident on that volume. From the descriptions is seems that there is something wrong with the load parms specified at IPL time Verify Correct load parms issued at HMC. At the HMC the IPL volume and the loadparms are specified. It seems from the 075-06 that the last 2 bytes of the loadparms are in error. The loadparm is LLPPNN. = IODF device, LL = loadxx suffix, PP = prompt option, NN = nucleus suffix. Details on the above can be found in MVS SYSTEM COMMANDS under topic 1.1.3.1 INITIALIZE SYSTEM CONTROLPROGRAM, A2 FIELD Verify the volume has IPL text on it Verify the correct address was specified for the IPL volume. It *MUST* contain SYS1.NUCLEUS. HTH, snip I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
We had the same problem. A ptf required that new IPL code is required on the IPL'Able volume. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 2:25 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:16 PM To: IBM-MAIN@bama.ua.edu Subject: Disable Wait After Maintenance I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt The wait ending with x'075' indicates that the IPL text on the IPL volume does not match the code in SYS1.NUCLEUS. I'd suggest running ICKDSF and putting the new IPL text on the IPL volume. The x'074' may also be this. I'd try redoing the IPL text first. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=?? //SYSINDD * REFORMAT DDNAME(iplvol) - VERIFY(iplvol) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* //iplvol DD DISP=OLD, // UNIT=3390, // VOL=SER=iplvol iplvol is the volser of the IPL volume. ?? is the volser of the volume containing the maintenanced version of SYS1.SAMPLIB. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html == This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
Matt, Use volser TZ11A1 in the verify parm and elsewhere VERIFY(TZ11A1) Cliff McNeill Date: Thu, 9 Sep 2010 16:08:51 -0400 From: mda...@pch.com Subject: Re: Disable Wait After Maintenance To: IBM-MAIN@bama.ua.edu I had that originally, the job asked me to over write TZ11P1, so I terminated. Didn't want to write over the ipl text on the volser with no maint. *05 ICK21836D IPL TEXT EXISTS ON TZ11P1. REPLY U TO OVERLAY, ELSE T So you are saying to setup like this, that will over write the TZ11P1 volser. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDD DD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11P1 //SYSIN DD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 4:03 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:57 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance John, thanks for the sample. My jcl used is below, I got cc=12. Volser=TZ11A1 is the volser with the maint, my current running res volume is TZ11P1 without maint. Is this jcl correct? tks //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDD DD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11A1 //SYSIN DD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* ICKDSF - MVS/ESA DEVICE SUPPORT FACILITIES 17.0 REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP ICK00700I DEVICE INFORMATION FOR 340B IS CURRENTLY AS FOLLOWS: PHYSICAL DEVICE = 3390 STORAGE CONTROLLER = 2105 STORAGE CONTROL DESCRIPTOR = E8 DEVICE DESCRIPTOR = 0C ADDITIONAL DEVICE INFORMATION = 4835 TRKS/CYL = 15, # PRIMARY CYLS = 10017 ICK04000I DEVICE IS IN SIMPLEX STATE ICK03091I EXISTING VOLUME SERIAL READ = TZ11A1 ICK31300I VERIFICATION FAILED: VOLUME-SERIAL WRONG. ICK30003I FUNCTION TERMINATED. CONDITION CODE IS 12 15:47:39 09/09/10 You kept the constant IPLVOL in the VERIFY. You need to replace that with the actual volser of TZ11P1. C 'IPLVOL' 'TZ11P1' ALL WORD and try again. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Disable Wait After Maintenance
I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
Did you redo the IPLTEXT after the maint? WAIT075 RC06 The IPL text on the volume used to IPL did not match the nucleus code resident on that volume -Original Message- Dazzo, Matt I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
IPLTEXT Dazzo, Matt mda...@pch.com Sent by: IBM Mainframe Discussion List IBM-MAIN@bama.ua.edu 09/09/2010 02:17 PM Please respond to IBM Mainframe Discussion List IBM-MAIN@bama.ua.edu To IBM-MAIN@bama.ua.edu cc Subject Disable Wait After Maintenance I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html ** This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ** -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
Did you re-write the IPLTEXT from SYS1.SAMPLIB on the target volume? Waitstate 75 rsn 06 says, The IPL text on the volume used to IPL did not match the nucleus code resident on that volume. Mark Jacobs -Original Message- From: IBM Mainframe Discussion List on behalf of Dazzo, Matt Sent: Thu 9/9/2010 3:16 PM To: IBM-MAIN@bama.ua.edu Subject: Disable Wait After Maintenance I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
-Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 2:16 PM To: IBM-MAIN@bama.ua.edu Subject: Disable Wait After Maintenance I installed z1.11 and it's up and running in our sand box with no problems. There were approximately 310 PTF's that were in the smpe zones not applied, so I ran an smpe apply with no issues to an alternate set of res volumes. When attempting to ipl from the alternate res volume I get a disabled wait psw 000A00600075 and 000A00900074. I have read the process of determining the reason code from the MVS codes book but 'no comprehend'. What is the easiest way to determine why I'm getting this psw? Thanks Matt The wait ending with x'075' indicates that the IPL text on the IPL volume does not match the code in SYS1.NUCLEUS. I'd suggest running ICKDSF and putting the new IPL text on the IPL volume. The x'074' may also be this. I'd try redoing the IPL text first. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=?? //SYSINDD * REFORMAT DDNAME(iplvol) - VERIFY(iplvol) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* //iplvol DD DISP=OLD, // UNIT=3390, // VOL=SER=iplvol iplvol is the volser of the IPL volume. ?? is the volser of the volume containing the maintenanced version of SYS1.SAMPLIB. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Moving JES2 NJE function from one system to another in a MAS?
We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? Thanks, Mark Regan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
-Original Message- From: IBM Mainframe Discussion List On Behalf Of Stan Weyman In other words we will never, EVER shoot you in the foot but will make it quite easy for you to shoot yourself. Does that about cover it? We'll provide you with a gun and all the ammo you want. :-) -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: z990s still running?
-Original Message- From: IBM Mainframe Discussion List On Behalf Of R.S. Timothy Sipples pisze: Is anybody assuming that people (and thus organizations) always and everywhere act rationally? I hope not. :-) Lots of actions and attitudes are irrational, and some of those are a lot of fun. BTDT. :-( BTW: What camel is? The camel is a horse designed by committee... Over here it's camel - elephant and horse - mouse. :-) -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Moving JES2 NJE function from one system to another in a MAS?
It's not that straight forward. Are the systems in a MAS? You can setup JES2 to have the NJE definitions on both systems, and have the connections started on both, or on one and waiting on the other. Several different options depending on what you are trying to do. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Mark T. Regan, K8MTR Sent: Thursday, September 09, 2010 Thursday 10:58 AM To: IBM-MAIN@bama.ua.edu Subject: Moving JES2 NJE function from one system to another in a MAS? We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? Thanks, Mark Regan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Multi-Factor Authentication
I posed this question to the RACF list but want to hit this audience: Does anyone use Multi-Factor Authentication with RSA on the mainframe ? If so, please share your experience and the product you are using. You can email me off list at: js...@cms.hhs.gov Thanks! Joe -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On 9 September 2010 12:39, Chris Craddock crashlu...@gmail.com wrote: True. One point to note is that the AC attribute has no effect whatsoever on programs that are not job step programs, but I'd like a dollar for every loadlibrary that has AC(1) sprayed around like confetti. A related point is that (duh) the AC attribute *does* have an effect on any program that *is* invoked as a job step program from an authorized library. Any program not intended to run as a job step program may nonetheless be so invoked by any user at all with read access to the library. A program in an APF authorized library (or UNIX equivalent) that is linked AC(1) *must* protect itself from unexpected invocation as a job step program (or UNIX equivalent). Every one of those wished-for dollars is a potential exposure. Tony H. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Moving JES2 NJE function from one system to another in a MAS?
Norm, Yes, these two are in the same MAS. What we want to do is to set up a process to move NJE in case of an extended outage on the owning NJE LPAR. Right now this JES2 MAS has a couple of SNA/NJE external connections with business partners. We will also want to do the same for TCP/NJE, but for internal connections with our JES3PLEX. Thanks, Mark Regan From: Norman Hollander on DesertWiz norman.hollan...@desertwiz.biz To: IBM-MAIN@bama.ua.edu Sent: Thu, September 9, 2010 2:24:30 PM Subject: Re: Moving JES2 NJE function from one system to another in a MAS? It's not that straight forward. Are the systems in a MAS? You can setup JES2 to have the NJE definitions on both systems, and have the connections started on both, or on one and waitingon the other. Several different options depending on what you are trying to do. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Mark T. Regan, K8MTR Sent: Thursday, September 09, 2010 Thursday 10:58 AM To: IBM-MAIN@bama.ua.edu Subject: Moving JES2 NJE function from one system to another in a MAS? We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? Thanks, Mark Regan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Moving JES2 NJE function from one system to another in a MAS?
Mark, My answers are just after your questions: 1) Is this something that was done prior to acquisition and you just need to documented it, or was it never set up to do this before? As far as I know, it has not been done before. 2) Are both LPARs in the same MAS? Yes they are 3) Are there any static NJE connections defined (CONNECT statements in JES2)? Not sure on this. Our JES2 person has been out this week. 4) Is it SNA or TCP/IP NJE? Primarily SNA/NJE due to them have some NJE with external business partners, but we would want to expand this to TCP/NJE once it has been set up on the same JES2 MAS. Thanks, Mark Regan From: Mark Zelden mzel...@flash.net To: IBM-MAIN@bama.ua.edu Sent: Thu, September 9, 2010 2:22:24 PM Subject: Re: Moving JES2 NJE function from one system to another in a MAS? On Thu, 9 Sep 2010 10:57:52 -0700, Mark T. Regan, K8MTR netsfw-ibmm...@yahoo.com wrote: We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? A lot of assumptions made below so we need more information. 1) Is this something that was done prior to acquisition and you just need to documented it, or was it never set up to do this before? 2) Are both LPARs in the same MAS? 3) Are there any static NJE connections defined (CONNECT statements in JES2)? 4) Is it SNA or TCP/IP NJE? Assuming it is SNA and both LPARs are in the same MAS: 1) If both LPARs have their own LOGON (VTAM APPL), all you may need to do is restart the connections from the other LPAR ($SN,A=applid). You need to have the LOGON active and active/idle lines. 2) If they have the same APPL, then you probably have to $PLGN(n) from one LPAR and start it on the other before you can start nodes. Again, you also need defined / active and idle lines. This assumes the other LPARs VTAM definitions are in place to do so. If the VTAMLST is shared, you probably inact the node on one LPAR and activate it on the other. 3) If static connections are defined, the other end must have the mas member defined or it won't connect. I've seen it done both ways: Same APPLID that gets moved or each LPAR with its own APPLID. If you define a new / 2nd appl, then coordination is needed with your partners, so I think sharing the same APPLID is more common. I haven't had to do something like this from scratch (I've defined new nodes and swapped SNA for IP) in more years than I can recall specifically, so I hope I didn't forget something or give you wrong information. Regards, Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Moving JES2 NJE function from one system to another in a MAS?
Mark- Mark Z. has it right. You could set it up so both MAS members are defined so that they each have connections to the other NJE nodes. Good for throughput, since you can have other nodes send to both halves of the MAS, and good for availability, since each half is active in case one side is down. You will need unique VTAM nodes (if using SNA), but most places (I would say) do it that way, or it is easy to setup. -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Mark Zelden Sent: Thursday, September 09, 2010 Thursday 11:22 AM To: IBM-MAIN@bama.ua.edu Subject: Re: Moving JES2 NJE function from one system to another in a MAS? On Thu, 9 Sep 2010 10:57:52 -0700, Mark T. Regan, K8MTR netsfw-ibmm...@yahoo.com wrote: We've never had to do this before, but since acquiring these two JES2 (we're a JES3 shop) systems via an acquisition, we need to set up a process to move NJE from one JES2 LPAR to another. Can anyone supply me with the commands to move NJE? A lot of assumptions made below so we need more information. 1) Is this something that was done prior to acquisition and you just need to documented it, or was it never set up to do this before? 2) Are both LPARs in the same MAS? 3) Are there any static NJE connections defined (CONNECT statements in JES2)? 4) Is it SNA or TCP/IP NJE? Assuming it is SNA and both LPARs are in the same MAS: 1) If both LPARs have their own LOGON (VTAM APPL), all you may need to do is restart the connections from the other LPAR ($SN,A=applid). You need to have the LOGON active and active/idle lines. 2) If they have the same APPL, then you probably have to $PLGN(n) from one LPAR and start it on the other before you can start nodes. Again, you also need defined / active and idle lines. This assumes the other LPARs VTAM definitions are in place to do so. If the VTAMLST is shared, you probably inact the node on one LPAR and activate it on the other. 3) If static connections are defined, the other end must have the mas member defined or it won't connect. I've seen it done both ways: Same APPLID that gets moved or each LPAR with its own APPLID. If you define a new / 2nd appl, then coordination is needed with your partners, so I think sharing the same APPLID is more common. I haven't had to do something like this from scratch (I've defined new nodes and swapped SNA for IP) in more years than I can recall specifically, so I hope I didn't forget something or give you wrong information. Regards, Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On 9 September 2010 11:20, Charles Mills charl...@mcn.org wrote: Thanks, Walt. That clarifies things. wasn't your question more about what a program running APF-authorized can do? Nope. Not at all. As I have said several times now I have a good working understanding of the practical effects APF-authorization. I was looking for a formal statement that I could point customers at. If one is going to sell a product that will be evaluated by people who are not mainframe experts, and one is going to say it requires APF authorization, it would be nice IMHO if one defined or pointed them to a definition of that term. One possibly useful phrase in this context is Trusted Computing Base. The TCB can, as Walt says, do *anything* with the hardware and the data. An APF-authorized program becomes part of the TCB, like it or not. If you don't trust it, you have a serious problem. (Yes, I appreciate that TCB may in some circles have a formal definition, and in particular its once-popular use in the context of the Rainbow Books and such is now little heard. But it may get across the concept that certain claims for any proposed addition to the TCB should be demanded of its author/vendor/supplier/installer.) Tony H. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: JES2 vs. JES3
previous ibm-main (at google) references were direct couple at la science center and ucla (that morphed into ASP on 360) http://www.garlic.com/~lynn/2010n.html#3 http://www.garlic.com/~lynn/2010n.html#7 ibm 7090 wiki page mentions two 7094/7044 direct couple systems at caltech/jpl http://en.wikipedia.org/wiki/IBM_7090 jes 2/3 wiki page also mentions asp evolving from 7094/7044 direct couple http://en.wikipedia.org/wiki/Job_Entry_Subsystem_2/3 -- virtualization experience starting Jan1968, online at home since Mar1970 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
On Thu, 9 Sep 2010 16:07:43 -0400, Jim Mulder wrote: ++ HOLD(UA54213) SYS FMID(HBB7760) REASON(ACTION) DATE(10133) COMMENT This apar fix modifies modules IEAIPL00 and IEAIPL01. Both parts need to have the same assemble date when they are applied to a system, otherwise a WAIT075 RSN0006 will be issued. Ah! A good excuse for not performing maintenance close to midnight. -- gil -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
Thanks to all who responded, I took pieces from each response and put it all together. It was the IPLTEXT that was the problem. Matt -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of McKown, John Sent: Thursday, September 09, 2010 4:23 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Dazzo, Matt Sent: Thursday, September 09, 2010 3:09 PM To: IBM-MAIN@bama.ua.edu Subject: Re: Disable Wait After Maintenance I had that originally, the job asked me to over write TZ11P1, so I terminated. Didn't want to write over the ipl text on the volser with no maint. *05 ICK21836D IPL TEXT EXISTS ON TZ11P1. REPLY U TO OVERLAY, ELSE T So you are saying to setup like this, that will over write the TZ11P1 volser. //STEP001 EXEC PGM=ICKDSF, // REGION=2M //SYSPRINT DD SYSOUT=* //IPLDDDD DSN=SYS1.SAMPLIB(IEAIPL00), // DISP=SHR,UNIT=SYSDA,VOL=SER=TZ11A1 //IPLVOL DD DISP=OLD, // UNIT=3390, // VOL=SER=TZ11P1 //SYSINDD * REFORMAT DDNAME(IPLVOL) - VERIFY(IPLVOL) - IPLDD(IPLDD,OBJFORMAT) NOBOOTSTRAP /* Huh? I'm confused. You say that SYS1.NUCLEUS has been maintenanced. It is on the IPL volume. Therefore, you must update the IPL text on that same volume. But you also say that TZ11P1 has not been maintenanced. Either it has or it has not. Can't be both. Point the job at the volser which has been maintenanced. It is should be what you are IPLing from. If not, then I'm totally bewildered. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: EMC DLm Memory Leak Heads Up
We had the EXACT same problem. Funny, it seemed to take our EMC service folks a couple of weeks to figure this out. We put the 2.1.2p2 on a week ago and so far no problems. (Although it takes a while for the memory leak to show itself.) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: EMC DLm Memory Leak Heads Up
We had our EMC hang July 7/8 and we are apply patches for memory leaks. On Thu, Sep 9, 2010 at 4:52 PM, Mark Young myo...@checkfree.com wrote: We had the EXACT same problem. Funny, it seemed to take our EMC service folks a couple of weeks to figure this out. We put the 2.1.2p2 on a week ago and so far no problems. (Although it takes a while for the memory leak to show itself.) -- Mike A Schwab, Springfield IL USA Where do Forest Rangers go to get away from it all? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Possible DFSORT problem?
John, You don't mention whether your Enterprise COBOL 3.4 program was compiled with FASTSRT or not. My guess is that it was. You might try recompiling and running it with NOFASTSRT. You said (later in the thread) that you have created a PMR, but trying with NOFASTSRT might (or might not) help you identify where the problem is. You also don't mention if your COBOL SORT has any input or output procedures. That too might be relevant. Having said all of this, I am certain that IBM L2 will get to the bottom of this. original note follows We are having a problem with a COBOL internal sort. If we run the job with no PARM=, the job abends with U4082-2. If it runs with PARM='TRAP(OFF)', it abends with S0C4-38 in ICEF64A. The latter dump has the following indicative dump: SYSTEM COMPLETION CODE=0C4 REASON CODE=0038 TIME=09.01.18 SEQ=26947 CPU= ASID=005D PSW AT TIME OF ERROR 078D2001 80060D28 ILC 6 INTC 38 NO ACTIVE MODULE FOUND NAME=UNKNOWN DATA AT PSW 00060D22 - E2E3D6D9 C540D21D 40006004 AR/GR 0: /_8005D88E 1: 0020/_0005F530 2: /1199_0002 3: /1199_0004 4: /_00074B00 5: /_00060D28 6: /11A1_0588 7: /0008_0584 8: /_0001 9: /_00060CD8 A: /_050D7056 B: /_85145028 C: /_050D6CC0 D: /_0005F000 E: /_850D70B2 F: /_0004 END OF SYMPTOM DUMP I have a SYSMDUMP from both runs. I am indeed running in AMODE(64). The instruction abending is D2 1D 4006 6004. As you can see, R6 has a non-zero value, 11A1, in the high word of the 64-bit register. And the SYSMDUMP show the TRNE as 11A1_ . So, do I have a LE problem or a DFSORT problem? That is, to which should I open a PMR? I'm thinking DFSORT. I don't see anything like this in IBMLink. -- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * (817)-691-6183 cell mailto:john.mck...@healthmarkets.com john.mck...@healthmarkets.com * http://www.healthmarkets.com/ www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to mailto:lists...@bama.ua.edu lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Fw: [TSO-REXX] Is CLIST on its way out?
Sorry, this may be my ISP faul. It was intended for the list, and I'm not sure which one. - I'm a SuperHero with neither powers, nor motivation! Kimota! -Original Message- From: Ted MacNEIL eamacn...@yahoo.ca Date: Thu, 9 Sep 2010 22:55:21 To: Paul Gilmartinpaulgboul...@aim.com Reply-To: eamacn...@yahoo.ca Subject: Re: [TSO-REXX] Is CLIST on its way out? And, clearly, the ISPF EDIT MACRO interface was conceived by designers totally alien to the Rexx environment: o Why is the initial host command environment not ISREDIT, but TSO? o Why must the programmer code address ISREDIT MACRO (EARGS), rather than parse arg EARGS? Choir? Preaching? - I'm a SuperHero with neither powers, nor motivation! Kimota! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Disable Wait After Maintenance
IPLTEXT I'm sure one of the PTF had a ++ACTION hold to rebuild. It's a bad idea to apply mass maintenance and not look at ACTION holds (in particular) closely. Of course all holds should be reviewed because even doc holds sometimes contain actions (although they shouldn't). Mark -- Mark Zelden - Zelden Consulting Services - z/OS, OS/390 and MVS mailto:mzel...@flash.net Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html Systems Programming expert at http://expertanswercenter.techtarget.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Where is APF documented?
On Thu, Sep 9, 2010 at 3:39 PM, Tony Harminc t...@harminc.net wrote: On 9 September 2010 12:39, Chris Craddock crashlu...@gmail.com wrote: ... I'd like a dollar for every loadlibrary that has AC(1) sprayed around like confetti... snip Every one of those wished-for dollars is a potential exposure. http://bama.ua.edu/archives/ibm-main.html yeah I know, I just didn't feel like going off on one of my normal rants about integrity exposures. It seems like nobody listens anyway. -- This email might be from the artist formerly known as CC (or not) You be the judge. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: JES2 vs. JES3
WalterR wrote: Shmuel Metz (Seymour J.) wrote: In 1792f2.291be9b9.39b92...@aol.com, on 09/08/2010 at 01:30 PM, Ed Finnell efinnel...@aol.com said: Huh? HASP was the efforts of NASA Houston and came out as Half ASP. Do you have a citation for that? I never saw the term before I suggested HASP is Half ASP for a project button. I worked as an operator at the the L.A. Scientific Center in Westwood (data center on the U.C.L.A campus) when DCS was initially developed on a 7094 with a 7040 as the support processor (before that they tried a 1410). Art Walters was one of the leads. I recall the term Half ASP used a couple of times somewhat sarcastically. I also recall that HASP was already known as a product (Type III?) out of Houston. This was around 1965. Walter Rue -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html On second thought, I realized a mistake in my Half ASP recollection. It was a phonetic mistake, perhaps due to age. What I actually heard was Half-vast... preceded by Vast Concept, which while cute was somewhat beyond sarcastic. Apologies! Walter Rue . -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: O/T IBM to Ship World's Fastest Computer Chip
--- On Wed, 9/8/10, Mike Schwab mike.a.sch...@gmail.com wrote: ---snip Just got a good example of journalistic incompetence. http://twitpic.com/2lqaqh The accompanying map is clipped, but appears to locate Bornholm on the western side Sweden. Must be a secret astronaut training base G Gerhard Postpischil Bradford, VT Surprised no one has found it in all the time since Tycho was training there. Maybe he had Galileo convert a diving bell to a space capsule? And actually built his helicopter to retrieve it after a launch. -- And a Chinese built solid rocket (firecracker) to lift the space capsule? Here are some more interesting details to this new processor:http://www.extremetech.com/article2/0,2845,2368264,00.aspIBM Describes Fastest Microprocessor Ever -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Archive login rejects
Anyone else having password rejected problems on the archive ?. Has happened twice in the last week, and now it won't let me in at all. Might be Darren giving me a (not so) subtle hint. Shane ... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
