Re: job started with SUB=MSTR without the owner information
There is no jobid unless the task attaches to JES and requests one. The task itself must request the connection and cannot be assigned from the outside. On Fri, Jun 5, 2009 at 1:43 AM, Tommy Tsui tommyt...@gmail.com wrote: Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
Hi all, Since we defined following statement to protect our LU on mainframe, APPC cannot access the PRDLU01 becuase without owner information, is there anyone have same problem? RDEFINE VTAMAPPL PRDLU01 UACC(NONE) OWNER(SYS1) PERMIT PRDLU01 CLASS(VTAMAPPL) ID(P428501) Thanks and regards On Sun, Jun 7, 2009 at 9:39 PM, Walt Farrellwfarr...@us.ibm.com wrote: On Fri, 5 Jun 2009 22:58:10 +0800, Tommy Tsui tommyt...@gmail.com wrote: but one of audit report shows that an invalid user try to access the APPC with ?? jobid and userid...I don't know how to answer our auditor ? What, exactly, does the audit report say? Does it say someone tried to access the APPC APPL, or does it say someone tried to sign on? Remember that APPC is a server, and as such, audit records related to it (as well as ICH408I message) generally refer to its clients. It is most likely that some user without an identity (e.g., some incoming APPC transaction that did not specify a user ID) caused your audit record. And there is nothing to tell the auditor, other than someone without an identity tried to use APPC, and the system properly failed the access, so don't worry about it. Assuming, of course, that the SMF record indicated a failure. If it indicated a success, you may have more work to do :) -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
Tommy Tsui wrote: Yes I did, I already defined STDATA field and the user is assigned to APPC at starting but why I still can't find the owner field infromation at SDSF? I just IPLed our MVS60 system running z/OS 1.10. On the log, I see: |IEF695I START APPC WITH JOBNAME APPC IS ASSIGNED TO USER SYSOPER , GROUP SYS1 And, on the (E)JES Activity display I see: |ACTIVITY PHXHQ(MVS60) Paging 0 SIO 4 CPU 11/5 zIIP 2 |Command === |Cmd JobName StepName ProcStep JobIDOwnerASID Pos DP Real |--- / --- -- -- ... |APPC APPC APPC STC SYSOPER 0021 NS FE1MB This proves the owner information is available in some control block--even for STCs started with SUB=MSTR. If SDSF always shows blanks for such STCs, I suggest using msgIEF695I during APPC startup to satisfy your auditors. -- Edward E Jaffe Phoenix Software International, Inc 5200 W Century Blvd, Suite 800 Los Angeles, CA 90045 310-338-0400 x318 edja...@phoenixsoftware.com http://www.phoenixsoftware.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
On Fri, 5 Jun 2009 22:58:10 +0800, Tommy Tsui tommyt...@gmail.com wrote: but one of audit report shows that an invalid user try to access the APPC with ?? jobid and userid...I don't know how to answer our auditor ? What, exactly, does the audit report say? Does it say someone tried to access the APPC APPL, or does it say someone tried to sign on? Remember that APPC is a server, and as such, audit records related to it (as well as ICH408I message) generally refer to its clients. It is most likely that some user without an identity (e.g., some incoming APPC transaction that did not specify a user ID) caused your audit record. And there is nothing to tell the auditor, other than someone without an identity tried to use APPC, and the system properly failed the access, so don't worry about it. Assuming, of course, that the SMF record indicated a failure. If it indicated a success, you may have more work to do :) -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
Have a look in the syslog. As no Jes output is supported if sub-mstr, joblog is routed to syslog. Itsc hak On Fri, Jun 5, 2009 at 8:43 AM, Tommy Tsui tommyt...@gmail.com wrote: Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
-Original Message- From: IBM Mainframe Discussion List On Behalf Of Tommy Tsui Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated SDSF on our z/OS 1.9 system does not show an owner for APPC, so I'm inclined to think that's normal Its workload and srvclass are both SYSTEM, and we don't have a STARTED class profile for it, so our ancient ICHRIN03 should assign it to STCUSR (but it apparently doesn't). -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
but one of audit report shows that an invalid user try to access the APPC with ?? jobid and userid...I don't know how to answer our auditor ? On Fri, Jun 5, 2009 at 7:42 PM, Chase, Johnjch...@ussco.com wrote: -Original Message- From: IBM Mainframe Discussion List On Behalf Of Tommy Tsui Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated SDSF on our z/OS 1.9 system does not show an owner for APPC, so I'm inclined to think that's normal Its workload and srvclass are both SYSTEM, and we don't have a STARTED class profile for it, so our ancient ICHRIN03 should assign it to STCUSR (but it apparently doesn't). -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
Did you assign a userid in the STDATA field of the STARTED/APPC.* general resource rule, and did you define a group as well, the user must be a member of the group if you did. Cheers, Paul Gillis -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Tommy Tsui Sent: Saturday, 6 June 2009 12:58 AM To: IBM-MAIN@bama.ua.edu Subject: Re: job started with SUB=MSTR without the owner information but one of audit report shows that an invalid user try to access the APPC with ?? jobid and userid...I don't know how to answer our auditor ? On Fri, Jun 5, 2009 at 7:42 PM, Chase, Johnjch...@ussco.com wrote: -Original Message- From: IBM Mainframe Discussion List On Behalf Of Tommy Tsui Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated SDSF on our z/OS 1.9 system does not show an owner for APPC, so I'm inclined to think that's normal Its workload and srvclass are both SYSTEM, and we don't have a STARTED class profile for it, so our ancient ICHRIN03 should assign it to STCUSR (but it apparently doesn't). -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
The last time I looked at SDSF code, the OWNER comes from JSABUSID and that's from a JES CB so you never see a OWNER in SDSF if the task was started with SUB=MSTR. George Fogg -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Chase, John Sent: Friday, June 05, 2009 4:42 AM To: IBM-MAIN@bama.ua.edu Subject: Re: job started with SUB=MSTR without the owner information -Original Message- From: IBM Mainframe Discussion List On Behalf Of Tommy Tsui Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated SDSF on our z/OS 1.9 system does not show an owner for APPC, so I'm inclined to think that's normal Its workload and srvclass are both SYSTEM, and we don't have a STARTED class profile for it, so our ancient ICHRIN03 should assign it to STCUSR (but it apparently doesn't). -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: job started with SUB=MSTR without the owner information
Yes I did, I already defined STDATA field and the user is assigned to APPC at starting but why I still can't find the owner field infromation at SDSF? On Sat, Jun 6, 2009 at 5:50 AM, Paul Gillispgil...@pc-link.com.au wrote: Did you assign a userid in the STDATA field of the STARTED/APPC.* general resource rule, and did you define a group as well, the user must be a member of the group if you did. Cheers, Paul Gillis -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Tommy Tsui Sent: Saturday, 6 June 2009 12:58 AM To: IBM-MAIN@bama.ua.edu Subject: Re: job started with SUB=MSTR without the owner information but one of audit report shows that an invalid user try to access the APPC with ?? jobid and userid...I don't know how to answer our auditor ? On Fri, Jun 5, 2009 at 7:42 PM, Chase, Johnjch...@ussco.com wrote: -Original Message- From: IBM Mainframe Discussion List On Behalf Of Tommy Tsui Hi all, I try to started a system task APPC with SUB=MSTR but can't find the owner/user or jobid information even we defined a started task to APPC.* . How can we assign a owner to this system task? Any help will be appreciated SDSF on our z/OS 1.9 system does not show an owner for APPC, so I'm inclined to think that's normal Its workload and srvclass are both SYSTEM, and we don't have a STARTED class profile for it, so our ancient ICHRIN03 should assign it to STCUSR (but it apparently doesn't). -jc- -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
