Re: How to encrypt DFHSM Tapes
Lizette, EFMT2 does not mean the tape is encrypted. In fact, it means it isn't. EFMT simply means Enterprise Format. EEFMT2 is the encrypted version. EEFMT means Enterprise Encrypted Format. EFMT1 was the tape format of the original 3592 tape drives (the J1A models), EFMT2 is the TS1120 tape drives, and EFMT3 is the TS1130 drive native format which is related to the density and capacity of the tapes. Rex -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Lizette Koehler Sent: Tuesday, August 04, 2009 10:42 AM To: IBM-MAIN@bama.ua.edu Subject: Re: How to encrpyt DFHSM Tapes It was what I was told. I have not confirmed or verified my colleagues' statement. If the DFHSM tape is actually EFMT2 then I will believe that it is being encrypted but not by DFHSM. The thought was there might be a DFHSM parm that did this rather than the hardware. Lizette Why do you think HSM is not letting your tapes use the hardware encryption? dd keller Sorry, I should have included z/OS V1.9 RSU0902 Using TS3500 with 1120 E05 tape drives. We would like to be able to encrypt the DFHSM Mig tapes. We prefer using our DATACLAS but I am not sure DFHSM is letting it happen. We are using this ACS code for all of our customer backup tape data so it can be sent offsite incase of a DR. However, we want to include the DFHSM tapes as well in the encryption process. Lizette Depends on who(m) you want to do the encryption. DFHSM or the Tape Drives. See the ENCRYPT keyword on the DUMPCLASS definitions. BTW, AFAIK, this is not available for DFHSM BACKUP or MIGRATION. IIRC, this came in about the z/OS 1.7 time frame via an APAR ( I wasn't able to locate it w/a quick search). HTH, snip I am struggeling through the 2000 page hsm,dss, and ... manual. Is there a parm in DFHSM to tell him we will be using encryption on his tapes? I have an acs routine currently that says if the DSN = HSM.HMIG.* then Dataclas=ENCRYPT /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: How to encrypt DFHSM Tapes
Thanks for the correction. I should not respond from the top of the head. It never works for me. Anyway I have a clearer description of the issue. Apparently DFHSM is using ESOTERICS, and we will need to create a new esoteric (including a change to the IODF) for it to use for the E05 drives. I am not sure why since we only have one type of tape drive. We have DFHSM currently set to use the esoteric for 3590-1. I am still researching this because I believe we should be able to do this with a more general esoteric inside DFHSM. Lizette Lizette, EFMT2 does not mean the tape is encrypted. In fact, it means it isn't. EFMT simply means Enterprise Format. EEFMT2 is the encrypted version. EEFMT means Enterprise Encrypted Format. EFMT1 was the tape format of the original 3592 tape drives (the J1A models), EFMT2 is the TS1120 tape drives, and EFMT3 is the TS1130 drive native format which is related to the density and capacity of the tapes. It was what I was told. I have not confirmed or verified my colleagues' statement. If the DFHSM tape is actually EFMT2 then I will believe that it is being encrypted but not by DFHSM. The thought was there might be a DFHSM parm that did this rather than the hardware. Lizette Why do you think HSM is not letting your tapes use the hardware encryption? dd keller Sorry, I should have included z/OS V1.9 RSU0902 Using TS3500 with 1120 E05 tape drives. We would like to be able to encrypt the DFHSM Mig tapes. We prefer using our DATACLAS but I am not sure DFHSM is letting it happen. We are using this ACS code for all of our customer backup tape data so it can be sent offsite incase of a DR. However, we want to include the DFHSM tapes as well in the encryption process. Lizette Depends on who(m) you want to do the encryption. DFHSM or the Tape Drives. See the ENCRYPT keyword on the DUMPCLASS definitions. BTW, AFAIK, this is not available for DFHSM BACKUP or MIGRATION. IIRC, this came in about the z/OS 1.7 time frame via an APAR ( I wasn't able to locate it w/a quick search). HTH, snip I am struggeling through the 2000 page hsm,dss, and ... manual. Is there a parm in DFHSM to tell him we will be using encryption on his tapes? I have an acs routine currently that says if the DSN = HSM.HMIG.* then Dataclas=ENCRYPT /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: How to encrypt DFHSM Tapes
Lizette Koehler wrote: Thanks for the correction. I should not respond from the top of the head. It never works for me. Anyway I have a clearer description of the issue. Apparently DFHSM is using ESOTERICS, and we will need to create a new esoteric (including a change to the IODF) for it to use for the E05 drives. I am not sure why since we only have one type of tape drive. We have DFHSM currently set to use the esoteric for 3590-1. I am still researching this because I believe we should be able to do this with a more general esoteric inside DFHSM. Lizette Lizette, We don't have DFHSM, so I can't say anything about it. However, I think this is really a matter of how you assign the DATACLAS in you SMS ACSDC routine. If you are using the esoteric unit name to make the assignment, then you have to match what ever HSM is using. If you are using dataset names to make the assignment, then the esoteric shouldn't matter. If you look in the joblog, you should see something like: IEC205I ddname,jobname,stepname,FILESEQ=1, COMPLETE VOLUME LIST, DSN=dsname,VOLS=volser, LISTED VOL(S) HAVE BEEN DATA ENCRYPTED,KL1CD:L,KL2CD:L, KL1=key1,KL2=key2,TOTALBLOCKS=number if the tape is encrypted. -- Richard -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: How to encrypt DFHSM Tapes
Okay, after spending more than a few seconds on this, I think my answer is that we use the SETSYS USERUNITTABLE parm. This specifies ATL. Then we have a couple of other SETSYS parms SETSYS USERUNITTABLE(ATL) SETSYS TAPEUTILIZATION( UNITTYPE(ATL) PERCENTFUL(97)) SETSYS UNITNAME(ATL) SETSYS TAPEMIGRATION(ML2TAPE(TAPE(ATL))) I think this is where I have to change the process. From what I was told we need to add a new IODF for the 3592 drives for E05. Then add that Esoteric to DFHSM. I am still researching. Lizette Why do you think HSM is not letting your tapes use the hardware encryption? dd keller Sorry, I should have included z/OS V1.9 RSU0902 Using TS3500 with 1120 E05 tape drives. We would like to be able to encrypt the DFHSM Mig tapes. We prefer using our DATACLAS but I am not sure DFHSM is letting it happen. We are using this ACS code for all of our customer backup tape data so it can be sent offsite incase of a DR. However, we want to include the DFHSM tapes as well in the encryption process. Lizette Depends on who(m) you want to do the encryption. DFHSM or the Tape Drives. See the ENCRYPT keyword on the DUMPCLASS definitions. BTW, AFAIK, this is not available for DFHSM BACKUP or MIGRATION. IIRC, this came in about the z/OS 1.7 time frame via an APAR ( I wasn't able to locate it w/a quick search). HTH, snip I am struggeling through the 2000 page hsm,dss, and ... manual. Is there a parm in DFHSM to tell him we will be using encryption on his tapes? I have an acs routine currently that says if the DSN = HSM.HMIG.* then Dataclas=ENCRYPT /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: How to encrypt DFHSM Tapes
Sounds about right. IIRC, that is what we had to do also... snip Okay, after spending more than a few seconds on this, I think my answer is that we use the SETSYS USERUNITTABLE parm. This specifies ATL. Then we have a couple of other SETSYS parms SETSYS USERUNITTABLE(ATL) SETSYS TAPEUTILIZATION( UNITTYPE(ATL) PERCENTFUL(97)) SETSYS UNITNAME(ATL) SETSYS TAPEMIGRATION(ML2TAPE(TAPE(ATL))) I think this is where I have to change the process. From what I was told we need to add a new IODF for the 3592 drives for E05. Then add that Esoteric to DFHSM. /snip -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
