zOSMF Workflows
All, I have been thinking about this for awhile,, but cant seem to find the answer. So asking my fellow listers if I am missing something. Workflows are a one and done affair, and for repeatable processes you need to add it again.The problem is that the filesystem location for the workflows are usually buried in various installation manuals, not always easy to find. Lately, I have been working with the zCX workflows to provision, alter, upgrade, etc. My question is that it would be nice if there were a panel that would optionally bookmark all of the various workflow definition files that have been used or might be used again? I dont see that? Am I missing something? There is something somewhat rudimentary in the create workflow screen with the pulldown, but I dont know if thats zOSMF doing that, or the browser doing that. But then that would likely be just for me? What if we had a public workflow that we expected many people to use to provision xyz? I'm sure there is an answer to this, I'm just not picking up on it. Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
zPCA users?
All, We are discussing zPCA - IBM Performance and Capacity Analytics, and I'd like to trade some email or even a quick phone conversation with a shop that has had some hands-on experience? Thanks, Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMP/E JCLIN processing for job updates
On Fri, 21 Apr 2023 13:10:19 -0500, Bill Giannelli wrote: >various jobs for Db2 software maintenance, such as DSNTIJUZ DSNTIJUA DSNTIJRT. >Bill >On Fri, 21 Apr 2023 10:19:07 -0500, Dave Jousma wrote: > >>On Fri, 21 Apr 2023 06:36:40 -0500, Bill Giannelli >>wrote: >> So, those are DB2 jobs. So what that tells me is that you might be editing and using the SMPE target data, vs copying the JCL out to another library to use? If so, that’s really a no-no. But if you want to make your changes properly to that dataset so that SMPE knows about the changes, you would create a USERMOD to replace the JCL with your customized JCL after merging in any changes made by the maintenance. A USERMOD will then tell you when a PTF will overwrite the JCL, and will be the signal to 1) remove your usermod and apply the PTF, and 2) re-work your usermod, and re-apply it. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMP/E JCLIN processing for job updates
On Fri, 21 Apr 2023 06:36:40 -0500, Bill Giannelli wrote: >Do many of you out there use SMP/E JCLIN processing to track and save job >updates? >Currently we do not make use of this and manually keep JCL up to date. >It seems there is a value to have SMPe ke > Bill, No one has asked yet, but I'm curious what JCL specifically, you are talking about, and needing to keep up to date? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to remove an empty USS file shipped with z/OS
On Mon, 17 Apr 2023 09:01:21 -0700, Lizette Koehler wrote: >List - > > > >I am being asked to take one of two actions on a USS file that is part of >Server Pac > >the /etc/security seems to be part of Server pac > > > So, I don’t know about you, but the /etc that comes from serverpac is not mounted, and I treat as guidelines on what needs to be changed/updated in my /etc/ that is actually mounted and in use. So, unless you are actually using Serverpac provided /etc you should be free to do with as you see fit. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Not aging well (know-it-alls)
I seem to notice a trend here on IBM-MAIN. Ive been active for probably 25 years on it, and the benefits I have received, and presume at least some of the advice/info I have provided has been helpful for some. But what I notice, and I know none of these people personally, is that as folks age we seem to get grumpier, and have to be "RIGHT" all the time. Why is that? Thinking back over the years, I recall Ed Gould, liked to argue before he faded away off the list, then there was Chris Mason (RIP), that would argue USS and whether it was ok to use for VTAM or Unix, and now we have our latest example raging as we speak. I'm nearing the end of my career too, well maybe not that close, but turned 60 this year. I certainly hope I age a bit more gracefully, and not argue if the sky is blue or turquoise. Have a good weekend, all. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Open Job posting
On Thu, 30 Mar 2023 13:20:54 -0700, Tom Brennan wrote: >Good to see! Especially the not-going-away part. >Also, this item is attractive - "SUPERVISORY RESPONSIBILITIES: None" > >On 3/30/2023 10:40 AM, Dave Jousma wrote: >> All, >> >> I have a new job posting for Mainframe Storage Management/Sysprog position >> that can be seen here: >> https://fifththird.wd5.myworkdayjobs.com/53careers/job/Cincinnati-OH/Lead-Technical-Engineer---Mainframe-Storage-Management_R40828 >> >> The job is primarily storage management, but with room for general sysprog >> cross-over. We will consider fully remote for the right individual. Our >> mainframe footprint is current, GDPS enabled, and has no plans to go away. >> >> Interested candidates should complete the online profile to be considered. >> Yep, no supervisory :). We are a pretty compact team, so while the job is Storage based, and is where the immediate need is, the breadth of work duties is pretty wide depending on experience. Feel free to reach out to me directly if there is some interest, but not ready to fill out the online paperwork. david.jou...@53.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Open Job posting
All, I have a new job posting for Mainframe Storage Management/Sysprog position that can be seen here: https://fifththird.wd5.myworkdayjobs.com/53careers/job/Cincinnati-OH/Lead-Technical-Engineer---Mainframe-Storage-Management_R40828 The job is primarily storage management, but with room for general sysprog cross-over. We will consider fully remote for the right individual. Our mainframe footprint is current, GDPS enabled, and has no plans to go away. Interested candidates should complete the online profile to be considered. Thanks! Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS File System Automove question
On Mon, 20 Mar 2023 14:42:41 +, Mark Jacobs wrote: >Thanks, no I didn't think of the chmount command. I ran a test on my sandbox. >the /u directory is showing that automove will exclude the system I specified, >but the file systems mounted under it don't show that attribute, just >Automove=Y. Do I need to change the mount attribute for all automounted file >systems, or will automove attribute for the parent /u/ directory override each >individual file system? > >Mark Jacobs > > you might unmount one, and let it mount again, and see if it inherits the settings from /u. if that works, you could try a chmount -D system /u/* to change ownership manually this time. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS File System Automove question
On Mon, 20 Mar 2023 13:04:44 +, Mark Jacobs wrote: >Thanks, but that's not helpful in my situation. The problematic file system is >under /u which is under the sysplex root, That has to be automove. > >Mark Jacobs > Correct. Then the only way to "avoid" a lpar is to avoid it with the sysplex root too. Have you tried the chmount commands? TEC1:$ chmount -D TEC2 /home TEC1:$ df -vk /home Mounted on FilesystemAvail/TotalFiles Status /home (*AMD/home) 0/40 Available AUTOMNT, Read/Write, Device:66, ACLS=N File System Owner : TEC2Automove=Y Client=N Filetag : T=off codeset=0 TEC1:$ chmount -a exclude,TEC1 /home TEC1:$ df -vk /home Mounted on FilesystemAvail/TotalFiles Status /home (*AMD/home) 0/40 Available AUTOMNT, Read/Write, Device:66, ACLS=N File System Owner : TEC2Automove=E Client=N System List (Exclude) : TEC1 Filetag : T=off codeset=0 TEC1:$ You would likely have to run a CRON job to do this, so that it is not forgotten post-ipl? Are you saying that the operating system doesnt honor these commands on shutdown? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS File System Automove question
On Mon, 20 Mar 2023 12:03:28 +, Mark Jacobs wrote: >I've been looking at that and testing somethings in our sandbox environment. >The problematic file system that's already impacted us twice is being managed >by automount and I can't see anyway to instruct OMVS not to automove >filesystems that are managed by the automount policy. > >Mark Jacobs > > >Sent from ProtonMail, Swiss-based encrypted email. > Mark, I cant tell from your description if you want automove, or not, or just not to the one certain system. Looks like the next directory up controls what happens and where, not the /AMD directory itself. Have you seen this info yet: https://www.ibm.com/docs/en/zos/2.3.0?topic=descriptions-automount-configure-automount-facility The automount file system (*AMD/) is mounted with an automove attribute of either AUTOMOVE or UNMOUNT. The automove attribute is set to UNMOUNT only when its parent file system has its automove attribute set to UNMOUNT. When the automove attribute is set to UNMOUNT, the owning system of the automount file system is identical to the owning system of the parent. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Git, and other Open Tools, Alternative for z/OS
On Fri, 17 Mar 2023 10:41:53 -0400, Matt Hogstrom wrote: >Thanks for the information Lionel. It’s good to share the efforts and let >folks know. Ideally, from my perspective, IBM should seriously consider >adding an OpenTools offering in z/OS so customers do not have to piece meal >these important tools. My candidates would be: > >bash >zsh >git >gzip >python (along with common packages) >virtualenv > They already do, but disguised. If you are licensed for ADF/z (application development foundation), it comes with Rocket GIT SMPE packaged, in it there is perl, curl, bash. Python is orderable via shopz. you can likely order it without S, so it should be a no cost item. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Git, and other Open Tools, Alternative for z/OS
On Fri, 17 Mar 2023 08:35:18 -0500, Dave Jousma wrote: >On Tue, 14 Mar 2023 09:09:11 -0500, Lionel B. Dyck wrote: > >>You no longer need to get the open tools for z/OS from Rocket Software - >>there is a new player in town - the z/OS Open Tools project. >> >> >> > >Lionel, As others have pointed out, the backend support is really the issue, >not the quality of what this project is doing. As a real life example, we >have Rocket GIT client for our DEVOPS pipelines on the mainframe. We get our >support through IBM for it. GIT V2.26.78 is working fine, but the 2 >subsequent ports, 2.26.84 and 2.26.87 have problems with code-page translation >with Jenkins jobs. the -87 port was supposed to have fixed the code-page >problems introduced in -84, but didnt. I have open case at this moment on >that. I, nor my team have the time to chase this down ourselves via >community forum where everyone is looking for answers, but when there is a >real problem, its crickets. > EDIT GIT 2.26.2 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Git, and other Open Tools, Alternative for z/OS
On Tue, 14 Mar 2023 09:09:11 -0500, Lionel B. Dyck wrote: >You no longer need to get the open tools for z/OS from Rocket Software - >there is a new player in town - the z/OS Open Tools project. > > > Lionel, As others have pointed out, the backend support is really the issue, not the quality of what this project is doing. As a real life example, we have Rocket GIT client for our DEVOPS pipelines on the mainframe. We get our support through IBM for it. GIT V2.26.78 is working fine, but the 2 subsequent ports, 2.26.84 and 2.26.87 have problems with code-page translation with Jenkins jobs. the -87 port was supposed to have fixed the code-page problems introduced in -84, but didnt. I have open case at this moment on that. I, nor my team have the time to chase this down ourselves via community forum where everyone is looking for answers, but when there is a real problem, its crickets. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Processing SMF Type 15 records help
On Thu, 16 Mar 2023 11:44:57 -0400, David Spiegel wrote: >I already included it: > >** ASMA044E Undefined symbol - SMF82ITE >** ASMA435I Record 273 in SYS1.MACLIB(IHBOPLTX) on volume: A4RES1 > > > You dont say what version of z/OS you are running this on. Those may be two separate errors. for the ASMA044E - do you have CSF crypto services installed? If not then you need to change this line _ICSFSETC '082' ICSF (nnn/000) to _ICSFSETC '000' ICSF (nnn/000) For the ASMA435I, go to that location in the assembly listing, and cut/paste the error from there. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: WLM Couple dataset?
On Thu, 9 Mar 2023 14:34:03 -0600, Bill Giannelli wrote: >thank you both!! > >-- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Just an FYI, you do not need to know the couple dataset name for WLM to update the WLM policy. You do it through the panels. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: BMC IAM and DFHSM DATALOSS
On Mon, 6 Mar 2023 22:20:59 -0500, Rob Schramm wrote: >Is CICS involved? > >Rob > >On Mon, Mar 6, 2023, 13:41 Joel C. Ewing wrote: > >> I see two possibilities: >> Hey there Rob.That's where it was detected first, however we've been able to recreate outside of CICS. I now believe the problem lies within HSM at this point. The good folks over at BMC, provided me with FDREPORT job to dump the DSCB on our test case, and indeed the DS1IND08 is turned on indicating the file has been updated since the last recall. As I initially mentioned, we see the problem on z/OS V2.4 and V2.5.I do not know when this started happening, but our developers mentioned "months" or longer, so that leads me to think about previous maintenance levels. I think I still have a sysres laying around from prior to our last maint cycle in the fall, that I may IPL in the sandbox, and see if we can recreate there. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
BMC IAM and DFHSM DATALOSS
All, We just learned that we have a problem with IAM (Innovation Access Method) the high perf replacement for VSAM. No idea how long it has been going on, and I have tickets open with both BMC and IBM on this. Seems to only affect IAM files, and exists in both z/OS V2.4, and V2.5, and multiple versions of IAM. We are currently at 10.x, but the problem occurs in V9.x as well. We see the problem mostly in our Development space, not in PROD (or nothing reported yet, but problem exists there too). We dont migrate much in PROD, and is why we havent had the problem reported there. The scenario here is - existing IAM file gets updates, records added or updated, doesnt matter. - file goes unreferenced for 7 days, so HSM migrates - file gets recalled, the updates that were made are gone. In HSM we do have FSM enabled (Fast Subsequent Migration), where if HSM is called to migrate the dataset, and it hasnt changed since last migration, it just deletes the dataset and reconnects it to the already migrated version in HSM. We've learned that turning FSM off circumvents the problem. IBM tells us that "HSM checks the DS1RECAL and DS1IND08 flags in the Format-1 DSCB of a data set to determine if a data set is eligible for fast subsequent migration. The DS1RECAL flag is used to indicate if a data set has been recalled and the DS1IND08 flag is used to indicate if a data set been modified since it was last recalled. " IBM doc seems to indicate that OPEN handles setting these bits, BMC support says they arent messing with these bits. I dont know *who* is to blame. I'd be curious to hear from other installations that use IAM, has HSM with FSM turned on. The recreate scenario is (assumes new test file) with FSM turned on 1 - Allocate test IAM file and add a record easily identifiable 2 - HSM Migrate the file 3 - HSM Recall the file 4 - RECORD ADDED IN #1 is there. 5 - Add another record with new identifiable info 6 - HSM migrate the file. 7 - HSM Restore the file. 8 - Record from #1 is there, record from #4 is not there. With FSM turned off, the dataset gets fresh migration copy every time, so the issue is masked. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: [EXTERNAL] Re: Silly JES2 question
On Wed, 1 Mar 2023 00:04:16 +0100, Radoslaw Skorupka wrote: >W dniu 28.02.2023 o 15:18, Dave Jousma pisze: >> >> There is no native z/OS support to limit who can use what job classes. We >> had to RYO inserting SAF calls in IEFUJI, IKJEFF10, and ISFUSR.IEFUJI is >> the real gate keeper, the others are just for the users convenience when >> submitting a job, or changing jobclasses in SDSF. > >Yes, you *were* right. >However it is no longer true. Since z/OS 2.1 AFAIR. >JESJOBS class. Srchfor JES.JOBCLASS.OWNER and JES.JOBCLASS.SUBMITTER > >-- Well, there you go. Just learned something new again.Thanks for that Radoslaw! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: [EXTERNAL] Re: Silly JES2 question
On Tue, 28 Feb 2023 14:12:03 +, Pommier, Rex wrote: >At this point we don't have a system limitation on who can use which job >class. It's on my list of to-dos. > >We have security on some commands, limiting who can use them. > >Rex > >-Original Message- >From: IBM Mainframe Discussion List On Behalf Of >Jeremy Nicoll >Sent: Monday, February 27, 2023 5:58 PM >To: IBM-MAIN@LISTSERV.UA.EDU >Subject: Re: [EXTERNAL] Re: Silly JES2 question > >On Mon, 27 Feb 2023, at 23:09, Pommier, Rex wrote: >> We have COMMAND=EXECUTE on a couple job classes. > >Do you limit who can use those classes? > There is no native z/OS support to limit who can use what job classes. We had to RYO inserting SAF calls in IEFUJI, IKJEFF10, and ISFUSR.IEFUJI is the real gate keeper, the others are just for the users convenience when submitting a job, or changing jobclasses in SDSF. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to determine if Enhanced HOLDDATA received?
On Thu, 19 Jan 2023 11:00:52 -0600, Dave Jousma wrote: > >Might be a SMPE doc problem? IBM is documenting a reason ID in the Class >section. I see that here: >https://www.ibm.com/docs/en/zos/2.5.0?topic=statements-hold-mcs which >documents as your said: > >CLASS >a 1- to 7-character string indicating an alternative reason to release an >exception SYSMOD for processing. A class name is specified along with a reason >ID to identify a condition when the reason ID need not be resolved. The same >class name can be specified on any number of ++HOLD statements in any number >of SYSMODs. >These are the specific values currently used by IBM: >Class >Explanation >ERREL >The SYSMOD is held for an error reason ID but should be installed anyway. IBM >has determined that the problem the SYSMOD resolves is significantly more >critical than the error reflected by the holding APAR. >HIPER >The SYSMOD is held with a hold class of HIPER (High Impact) >PE >The SYSMOD is held with a hold class of “PTF in Error”. >SECINT >The reason ID SYSMOD identifies a fix for a security or integrity error. >HOLDDATA for security or integrity fixes is available through the z Systems >Security Portal. Information on registration and accessing the z Systems >Security Portal is available at Enterprise security. If you are already >registered you can link directly to the IBM Resource Link® Security Alerts. >UCLREL >UCLIN needed for the SYSMOD has been handled by IBM and no longer requires >your attention. >YR2000 >Identifies PTFs that provide Year 2000 function, or fix a Year 2000-related >problem. >For additional information, see Naming conventions for HOLD reason IDs and >HOLD classes. > >and the note at the bottom of that section takes you here: >https://www.ibm.com/docs/en/zos/2.5.0?topic=classes-class-values. And there >is no mention of SECINT as a CLASS. Which doc is correct? I believe the >latter. > >We are getting in the weeds here, and I'm done with the back and forth. The >description above indicates SECINT is placed on the PTF that does the fix, and >I believe that is incorrect as well. In prior post, i gave an example of PTF >UI83571 that has SECINT SOURCEID from the RL ASSIGN download and receive. I >see nothing on this PTF besides that, and I believe that is by design from >IBM. I'll correct myself. i normally just download the ASSIGN file and receive that. I took a peek at the HOLDDATA file on RL and the sample PTF is in there. However, that class will only assigned if you get the data from RL which was my original point. ++ HOLD(HSMA250) FMID(HSMA250) REASON(AH50369) ERROR DATE(22355) COMMENT(SMRTDATA(FIX(UI83571) SYMP(B7.5,T7.2) CHGDT(221221))) CLASS(SECINT). -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to determine if Enhanced HOLDDATA received?
On Thu, 19 Jan 2023 16:37:28 +, Seymour J Metz wrote: >"SECINT > The reason ID SYSMOD identifies a fix for a security or integrity error. > HOLDDATA for security > or integrity fixes is available through the z Systems Security Portal. > Information on registration > and accessing the z Systems Security Portal is available at Enterprise > security (www.ibm.com/ > systems/z/solutions/enterprise-security.html). If you are already > registered you can link directly > to the IBM Resource Link� Security Alerts. " > > >-- Might be a SMPE doc problem? IBM is documenting a reason ID in the Class section. I see that here: https://www.ibm.com/docs/en/zos/2.5.0?topic=statements-hold-mcs which documents as your said: CLASS a 1- to 7-character string indicating an alternative reason to release an exception SYSMOD for processing. A class name is specified along with a reason ID to identify a condition when the reason ID need not be resolved. The same class name can be specified on any number of ++HOLD statements in any number of SYSMODs. These are the specific values currently used by IBM: Class Explanation ERREL The SYSMOD is held for an error reason ID but should be installed anyway. IBM has determined that the problem the SYSMOD resolves is significantly more critical than the error reflected by the holding APAR. HIPER The SYSMOD is held with a hold class of HIPER (High Impact) PE The SYSMOD is held with a hold class of “PTF in Error”. SECINT The reason ID SYSMOD identifies a fix for a security or integrity error. HOLDDATA for security or integrity fixes is available through the z Systems Security Portal. Information on registration and accessing the z Systems Security Portal is available at Enterprise security. If you are already registered you can link directly to the IBM Resource Link® Security Alerts. UCLREL UCLIN needed for the SYSMOD has been handled by IBM and no longer requires your attention. YR2000 Identifies PTFs that provide Year 2000 function, or fix a Year 2000-related problem. For additional information, see Naming conventions for HOLD reason IDs and HOLD classes. and the note at the bottom of that section takes you here: https://www.ibm.com/docs/en/zos/2.5.0?topic=classes-class-values. And there is no mention of SECINT as a CLASS. Which doc is correct? I believe the latter. We are getting in the weeds here, and I'm done with the back and forth. The description above indicates SECINT is placed on the PTF that does the fix, and I believe that is incorrect as well. In prior post, i gave an example of PTF UI83571 that has SECINT SOURCEID from the RL ASSIGN download and receive. I see nothing on this PTF besides that, and I believe that is by design from IBM. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to determine if Enhanced HOLDDATA received?
On Thu, 19 Jan 2023 16:13:06 +, Seymour J Metz wrote: >We may be talking at cross purposes here; I'm concerned about the hold class >SECINT, not the source with the same name. The SECINT hold is on the PTF with >the exposure, not the PTF correcting it. > > LIST HOLDDATA HOLDERROR. > > Maybe. I just ran this report on my global zone for V2.4 and V2.5 and there are no SECINT references. I dont believe SECINT is a valid Hold CLASS -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to determine if Enhanced HOLDDATA received?
On Thu, 19 Jan 2023 15:30:07 +, Seymour J Metz wrote:
>I'm concerned with the SMP side of things; as long as a PTF is correctly
>flagged as PE, I don't care about the APAR unless there is a reason to bypass.
>
>
>--
>Shmuel (Seymour J.) Metz
>http://mason.gmu.edu/~smetz3
>
I cannot say for sure if that is the case or not. When doing a maintenance
cycle, I'll pull the list from RL, and run an apply check/apply specific to
SECINT to satisfy audit requirements that we are applying vulnerability fixes.
APPLY
SOURCEID (
SECINT
)
GROUPEXTEND
(
NOAPARS
NOUSERMODS
)
BYPASS (
HOLDSYSTEM
)
NOJCLINREPORT
RETRY( YES )
My last time was a week ago, and I was surprised at the number that needed to
go on to my pretty current V2.5 zone.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UI83571.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09625.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09744.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UO02058.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UO02059.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UI83640.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09561.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09564.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09567.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09570.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09665.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09697.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09698.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UJ09729.
GIM22701IAPPLY PROCESSING WAS SUCCESSFUL FOR SYSMOD UI83424.
Spot checking the first one, It was not fixing a ERROR PTF.
Entry Type: SYSMOD Zone Name: GLOBAL
Entry Name: UI83571 Zone Type: GLOBAL
Description:
Type:PTF Status:
FMID:
Date/Time: 23.003 08:42:37 REC
-
SREL Z038
FMID HSMA250
PRE UI83116
SUP AH50369 DH50369
SOURCEID ORD00052
PUT2212
SECINT
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to determine if Enhanced HOLDDATA received?
On Thu, 19 Jan 2023 14:30:38 +, Seymour J Metz wrote: >Doesn't the process for security/integrity violations include creating an >APAR? If so, shouldn't any PTF with hold class SECINT also have an ERROR hold >with the relevant APAR number? > > >-- >Shmuel (Seymour J.) Metz >http://mason.gmu.edu/~smetz3 > APARS are created, but for customers, APARS associated with a SECINT flagged PTF result in “Document not found” when following the links. IBM doesn’t publish the APAR’s associated with SECINT fixes. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: HMC and LDAP
On Fri, 13 Jan 2023 19:58:32 +, Mark Jacobs
wrote:
>Has anyone setup their HMC to authenticate users to an ldap server? I'm not
>having much luck constructing the search filter that selects the user's entry
>in the directory.
>
>Mark Jacobs
>
Mark,
did you get an answer to this? we've been doing it for years now to AD/ED.
HTH.
Directory Entry Location
How to locate a user's directory entry: Use a DN pattern
Distinguished name pattern: uid={0},ou=accounts,ou=b2e,dc=53,dc=com
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: z/OSMF
On Fri, 2 Dec 2022 10:07:33 -0600, Carmen Vitullo wrote:
>we do share zfs's but maybe my choice of SERVER options and the
>autostart group was flawed
>
>I really don't have a need to start multiple servers, for testing, I
>take the lazy route, shutdown the prod server for a while, and start the
>new instance on my test LPAR when I need to test.
>
>
>Carmen
>
>
>On 12/2/2022 9:42 AM, Michael Babcock wrote:
>> I could never get a single instance with multiple LPARs connecting to the
>> same server because we do not share our ZFS datasets, specifically, the one
>> mounted at /global.
>>
>> Hopefully I was just doing something incorrectly. I use 1 server per LPAR
>> and each has its own autostart group.
>>
>> On Fri, Dec 2, 2022 at 7:46 AM Carmen Vitullo wrote:
>>
>>> I've only tried this once on my test LPAR when I'm installing a new OS
>>> release or maint, not much success, I've followed the guide but I must
>>> be missing something.
>>>
>>> in the started task there's 2 start up options
>>>
>>> SERVER=STANDALONE <- I use to test
>>>
>>> and
>>>
>>> SERVER=AUTOSTART <- i use from prod
>>>
>>> there's some IZUPRMxx changes, I can provide some examples of what I've
>>> used for my second LPAR
>>>
>>> Carmen
>>>
>>> On 12/1/2022 5:49 PM, Steely.Mark wrote:
We have z/OSMF active on one of ours LPAR's. Now we would like to add
>>> another LPAR.
I know their were instructions on how to perform this - I am unable to
>>> find the instructions.
If you have done this and would provide the documentation it would be
>>> appreciated.
We are z/OS v2.4
Thank You
We have shared filesystem, In IEASYSxx we specify IZU=NS and in IZUPRMNS I have
AUTOSTART(CONNECT)
AUTOSTART_GROUP('IZU')
Then we use automation to start/stop zOSMF and move it around with DVIPA as
needed for system maintenance periods. We run one instance per sysplex.
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Songs of the IBM
On Tue, 15 Nov 2022 11:03:46 -0600, Carmen Vitullo wrote: >Had me thinking of the IBM 1403 and possible the 3211 printers - there >was a card deck IIRC and IEBGENER that was used to direct print, that >deck when printed would play a song, I forget now whatr song - it was >possibly something local at my site. > >Carmen There is a link on this page Risky line printer music on a vintage IBM mainframe http://www.righto.com/2019/09/risky-line-printer-music-on-vintage-ibm.html to a short youtube https://youtu.be/Lu4SxJqU9I4 video of a old 1401 printer playing songs. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Limiting quantity of tape drives used by user
I appreciate all the comments. What I need though is an external control, like thruput manager. The developer that did this didnt even know they were tape files. So to expect them to code something is nice, and this person is now in the know on the subject, and will be going forward. Sounds like there is no such beast. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Limiting quantity of tape drives used by user
On Mon, 7 Nov 2022 12:46:11 -0600, Paul Gilmartin wrote: >On Mon, 7 Nov 2022 12:24:21 -0600, Mike Schwab wrote: > >>We had that in production One step with a huge number of datasets, so >>allocates all available tape drives even though only 1 in use at any >>one time. >> >Does UNIT=(TAPE,,DEFER), or perhaps AFF, make a difference? > >JES2 or JES3? > >-- >gil > Of course it would. But these days there are many folks that just know that they have to get a job done, not necessarily how to get the job done. Just like coding DCB and space info anymore, this is another one of those things that should be able to be externally limited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Limiting quantity of tape drives used by user
On Mon, 7 Nov 2022 12:42:24 -0600, Mark Zelden wrote: >On Mon, 7 Nov 2022 12:13:49 -0600, Dave Jousma wrote: > >>All, >> >>In many years, I haven’t seen this problem, really since the days pre-VTS, or >>even in early VTS days where tape drives were physical devices.Today we >>had a user allocate all 500 tape drives pulling data in Prod for whatever >>reason. It would sure be nice if there were some “controls” that could >>limit the simultaneous use of tape drives on a per user basis, whether batch >>job or TSO user. >> >>I don’t think there is anything today that could be done, is there?Hadnt >>had to think about this in a long time with so many virtual drives available. >> > >One of the sysplexes I work on for my client still has ThruPut Manager code to >prevent this from >happening. The code goes back to the days they when they had physical STK 3490 >then >9840 tape drives in a silo. In other sysplexes have seen what you described, >but only a couple >of times only in the last few years and we just deal with it and follow up >with a gentle hand slapping. > >Best Regards, > >Mark >-- Yep. thats what we did too. Should be a builtin feature (IMO) so that the user doesnt care, or more importantly doesnt need to know how to code UNIT=AFF -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Limiting quantity of tape drives used by user
All, In many years, I haven’t seen this problem, really since the days pre-VTS, or even in early VTS days where tape drives were physical devices.Today we had a user allocate all 500 tape drives pulling data in Prod for whatever reason. It would sure be nice if there were some “controls” that could limit the simultaneous use of tape drives on a per user basis, whether batch job or TSO user. I don’t think there is anything today that could be done, is there?Hadnt had to think about this in a long time with so many virtual drives available. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
ShopZ software report not working?
Ive noticed for some time now that my uploaded software report no longer seems to have any effect when I create an order for CBPDO products that have new version/release. I typically upload a fresh report (binary), then create a CBPDO order and typically filter by "my installed products with upgrades". So that I can see which products have installed I need to order to refresh my installation. This is a problem, because manually looking for updates is error prone, and quite time consuming. Has anyone else noticed this?I have opened a PMR with ShopZ support. Its been that way for quite awhile for me, not something that just occurred. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
realtime monitoring of various storage subpools
All, is there another method to monitor subpool usage for a specific address space besides Omegamon? I realize I could take periodic console dumps and look, but looking for other methods out of the box. We have a rogue address space with a memory leak, and wanting to track storage growth (or lack of when leak fixed). Thanks in advance. Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
More IBM LDAP questions
All,
I asked some IBM LDAP questions awhile back, and we have it configured, and
users are able to bind to it, a big thank-you to the folks that responded.
What I am looking for assistance now (or a real life example) is usage of the
ICTX plugin for remote authorizations. Server-side setup is already done, but
I cannot find any good examples of distributed side code calling LDAP for
remote authorizations. What I do find in the fine manual is:
Using remote authorization and audit
The remote authorization and audit services are enabled when the ICTX extended
operations component
is con®gured for IBM Tivoli Directory Server. Refer to “Con®guring the IBM
Tivoli Directory Server for
remote services support” on page 399 for instructions.
An application or resource manager that uses the remote audit or authorization
LDAP extended operation
must be capable of generating a request, sending it through the network to the
appropriate z/OS IBM TDS
server, and interpreting the response from the z/OS IBM TDS server. The
following steps represent the
typical sequence of events that are speci®c to the LDAP extended operations for
the remote authorization
and auditing:
1. The application must perform a simple bind to the server using an authorized
racfid=userid,cn=ictx bind distinguished name.
2. The application must build a DER-encoded extended operation request having
the de®ned ASN.1
syntax that is speci®c to the audit or authorization request. That request can
then be included with the
z/OS IBM TDS server handle and speci®c request OID on the LDAP client call,
such as
ldap_extended_operation_s(), to build the LDAP message and send it to the
server.
3. The z/OS IBM TDS receives the request and routes it to the ICTX component,
where it is decoded and
processed. ICTX veri®es the correct syntax and the requestor's authority before
invoking the SAF
authorization check or audit service to satisfy the request. The result of the
SAF service is a DERencoded response that LDAP returns
But no examples for Item #2. I find coding examples of the parameter block,
but some sample code would be worth a thousand pictures for the remote ldap
call.
The remote authorization request must contain the DER-encoding of the ASN.1
syntax. The following is
the remote authorization request syntax:
Request OID: 1.3.18.0.2.12.66
RequestValue ::= SEQUENCE {
RequestVersion INTEGER,
ItemList SEQUENCE of
Item SEQUENCE {
ItemVersion INTEGER,
ItemTag INTEGER,
UserOrGroup IA5String,
Resource IA5String,
Class IA5String,
Access INTEGER,
LogString IA5String
}}
If anyone can please assist, I'd be glad to take this offline for some
hopefully quick discussion/email.
Thanks in advance, Dave
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SLIP IF not working
On Tue, 7 Jun 2022 20:19:08 +0700, Robin Atwood wrote: >I wanted to get a dump of my server when the instruction at 001234 in module >MOD1 gets executed, so I entered: > > > >SLIP SET,IF,J=SRV1,PVTMOD=(MOD1,001234),ID=SLP1,END > > > >I made a transaction that drove MOD1 but no dump was taken. So, OK, the >offset maybe incorrect (there are lots of csects in MOD1) and I adjusted the >offset, but to no avail. So just to see if the trap worked at all, I >entered: > > > >SLIP SET,IF,J=SRV1,PVTMOD=(MOD1),ID=SLP1,END > > > >but still no dump. So I must be missing something basic; I was recently >doing a lot of SLIP SA traps and didn't have this > >trouble. MOD1 is definitely in memory at the time the SLIP command is >issued. Any advice much appreciated. > Robin, Is this module loaded by CICS? If so, there are special actions you have to take, but I do not remember. I worked with IBM support on a problem, and I recall them telling me that if loader didnt load the module that a SLIP will not work. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
IBM LDAP question
Any IBM mainframe LDAP users out there? Using SDBM (RACF backend)? I am illiterate in LDAP protocols/configuration, etc. We are trying to configure IBM LDAP so that our Beyond Trust password safe can communicate and manage its accounts in the MF space. However, we are having a problem with LDAP attributes (keywords).With SDBM backend - all the ldap attributes are prefixed racf.. such as racfPassword, yet the openldap attribute name is userpassword. So LDAP calls from password safe to mainframe LDAP are failing with: ERROR buildKeywordArray()915: No table entry for attribute 'userpassword' It cannot be this hardbut alas is, because none of us here are ldap literate at the moment. I read about creating alias's, but having hard time figuring out how to create an alias of racfPassword and calling it userpassword. If I am barking up the wrong tree, please someone point it out. If anyone can assist, I'd be grateful! we do have ticket open with IBM, but not getting a lot of traction. Thanks, Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Trying to understand SMF30_RAXFLAGS
On Mon, 18 Apr 2022 08:32:53 -0700, Charles Mills wrote: >We have a client who is trying to report on user key CSA usage. He is having >trouble understanding the IBM doc, as am I. > >The SMF doc I am familiar with documents bits as X'80', X'40', etc. But the >SMF30_RAXFLAGS doc (both the APAR and the new manual) documents the bits as >Bit 0, Bit 1, etc. Usually in mainframe documentation "bit 0" refers to the >x'80' bit. But what the client is seeing is values for SMF30_RAXFLAGS of >binary 1, 2 or 3. > >Can anyone confirm my interpretation of what he is seeing that by "bit 0" >IBM means X'01', by "bit 1" they mean x'02', and so forth? > /* 1000 = 80 = AUDIT ON */ /* 1001 = 90 = CHANGE KEY*/ /* 1010 = A0 = CADS USAGE*/ /* 1011 = B0 = CADS+CHANGE KEY */ /* 1100 = C0 = CSA USAGE */ /* 1101 = D0 = CSA+CHANGE KEY*/ /* 1110 = E0 = CSA+CADS */ /* = F0 = CSA+CADS+CHANGEKEY*/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: dequeue program
On Thu, 14 Apr 2022 16:30:49 +, Steely.Mark wrote: >There was a program that when executed would prevent the ENQ on a dataset. >This was used for jobs which would FTP a file and then use that file in steps >after the FTP. > >This was the JCL used: > >//JS010 EXEC PGM=FTPDEQ, >//PARM='data.set.name.here' >//SYSUDUMP DD SYSOUT=* > >This would be the first step in the job. > >Any one remember this program and would share a copy of it ? > There is/was a program on CBTTAPE called BYPASSNQ that I used to use a long time ago before IBM built in the ability to bypass enqueue in ISPF when coding a volser. you pass it the program you want to call as the PARM. //GO EXEC PGM=BYPASSNQ,PARM=IEHPROGM //STEPLIB DD DISP=SHR,DSN=YOUR.LOADLIB //SYSPRINT DD SYSOUT=* //DD1 DD UNIT=3390,VOL=SER=TGT10A,DISP=OLD //ABNLTERM DD SYSOUT=* //SYSUDUMP DD SYSOUT=* //SYSIN DD * SCRATCH DSNAME=SYS1.SIOALMOD,VOL=3390=TGT10A /* -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: CA-DUO
On Tue, 29 Mar 2022 18:21:31 +, Carl Edwards wrote: >Anyone know anything about CA-DUO? Is it still available, supported? > Havent heard that product mentioned since mid-80's. Is there even a need for it anymore. DOS under OS? We used it back then when converting off DOS to MVS to be able to run programs/jobs unchanged -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: LOGONID SYSLOGD NOT FOUND
On Wed, 23 Mar 2022 13:26:10 -0500, Dave Jousma wrote: > >On my systems, SYSLOGD is started out of /etc/rc > ># Start the SYSLOGD daemon for logging and tracing >/etc/syslogd.start > > >manually starting SYSLOGD can be accomplished via Superuser >/etc/syslogd.start&. (or whatever command you have set it up as) > > >Here is link from the manual: >https://www.ibm.com/docs/en/zos/2.2.0?topic=daemon-starting-stopping-syslogd > >when started at IPL it runs under the ID that OMVS runs. A manual restart >needs to happen from a UID(0) ID.Starting as a regular S SYSLOGD is >possible, but as you find, your security is not setup for that. > I hate replying to my own posts. I was a bit incomplete. Here is the contents of my syslogd.start shell script. EDIT /DEV1/etc/syslogd.start Command ===> ** *** Top of Dat 01 # Licensed Materials - Property of IBM 02 # 5694-A01 03 # (C) Copyright IBM Corp. 1992, 2002 04 # Status = CSV1R4 05 # 06 ## 07 # 08 # Start the syslog daemon 09 # 10 export _BPX_JOBNAME='SYSLOGD' 11 /usr/sbin/syslogd -f /etc/syslog.conf -c -D 740 -F 644 & 12 DATE='date' 13 echo -- /etc/syslogd.start script executed, $DATE -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: LOGONID SYSLOGD NOT FOUND
On Wed, 23 Mar 2022 10:54:28 -0500, SUBSCRIBE IBM-MAIN Srinivas Aeturi wrote: >Hi Everyone, > >We are running on z/OS 2.2. And we have configured SYSLOGD and it was running >good. >But now, The SYSLOGD ID is not existing and task SYSLOGD is not running. And >we are getting below error when we try to start it. I see no one deleted >SYSLOGD ID. But still, unable to figure out the issue what caused SYSLOGD ID >to not present in the system. Did anyone experience this problem earlier. > >ACF01004 LOGONID SYSLOGD NOT FOUND >IEF170I 1 SYSLOGD ACF01004 LOGONID SYSLOGD NOT FOUND >IEE296I SYSLOGD FAILED BY SECURITY INTERFACE. RC=0004 RSN= >SAFRC=0008 > >Thanks >Srinivas On my systems, SYSLOGD is started out of /etc/rc # Start the SYSLOGD daemon for logging and tracing /etc/syslogd.start manually starting SYSLOGD can be accomplished via Superuser /etc/syslogd.start&. (or whatever command you have set it up as) Here is link from the manual: https://www.ibm.com/docs/en/zos/2.2.0?topic=daemon-starting-stopping-syslogd when started at IPL it runs under the ID that OMVS runs. A manual restart needs to happen from a UID(0) ID.Starting as a regular S SYSLOGD is possible, but as you find, your security is not setup for that. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TWS //*%OPC and "IF"
looks like there are TWS variables for just what you need Variable name Description CDATE Current date CTIME Current time OCDATE Occurrence input arrival date OCFRSTC First calendar day in month of the occurrence input arrival date OCFRSTW First work day in the month of the occurrence input arrival date OCFRSTWYFirst work day in the year of the occurrence input arrival date OCLASTC Last calendar day in the month of the occurrence input arrival date OCLASTW Last work day in the month of the occurrence input arrival date OCLASTWYLast work day in the year of the occurrence input arrival date OCTIME Occurrence input arrival time (hours and minutes) OPIADATEOperation input arrival date (if blank, this takes the value of the occurrence input arrival date) OPIATIMEOperation input arrival time (if blank, this takes the value of the occurrence input arrival time) OPLSDATEOperation latest start date OPLSTIMEOperation latest start time -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TWS //*%OPC and "IF"
On Wed, 9 Feb 2022 14:26:54 +0100, Radoslaw Skorupka wrote: >I need to schedule some job under TWS vel IWS vel ZWS. > >The job contain full month concatenation of daily datasets. >//INPUT DD DISP=SHR,DSN=HLQ.Y2022.D0101 >// DD DISP=SHR,DSN=HLQ.Y2022.D0102 >// DD DISP=SHR,DSN=HLQ.Y2022.D0103 >... >// DD DISP=SHR,DSN=HLQ.Y2022.D0131 > > >The problem is number of days in a month. >Sometimes it is 31, 30 or 28 (and 29) days. >I would comment out last DD using some variable. >Something like the following: >//*%OPC IF month =02 then MYVAR=** ELSE MYVAR='' >the DD: >//%MYVAR DD DISP=SHR,DSN=HLQ.Y2022.D0131 >will be commented or not. >It can be IF or CASE or anything. > >Or maybe there is other way to do that? > > I have a DFDSS backup job that uses this. Here you go. //P0DPDBKP JOB (DP,8715),'DAILY DP BACKUP',CLASS=P,MSGCLASS=Y //*%OPC SCAN //*** //* CURRENT DESCRIPTION: * //* CDAY=DAY WITHIN THE WEEK, 1=MONDAY * //* CDD=DAY WITHIN THE MONTH, 1=1ST OF MONTH * //* CDDD=DAY WITHIN THE YEAR, 1=1ST DAY OF YEAR* //*** //* TEST FOR DAILY //*%OPC BEGIN ACTION=INCLUDE,PHASE=SUBMIT, //*%OPC COMP=((),(),()) // EXEC DP#BKP,FREQ=DAILY //*%OPC END ACTION=INCLUDE //* TEST FOR WEEKLY //*%OPC BEGIN ACTION=INCLUDE,PHASE=SUBMIT, //*%OPC COMP=((),(),()) // EXEC DP#BKP,FREQ=WEEKLY //*%OPC END ACTION=INCLUDE //* TEST FOR MONTHLY //*%OPC BEGIN ACTION=INCLUDE,PHASE=SUBMIT, //*%OPC COMP=((),()) // EXEC DP#BKP,FREQ=MONTHLY //*%OPC END ACTION=INCLUDE //* TEST FOR YEARLY //*%OPC BEGIN ACTION=INCLUDE,PHASE=SUBMIT, //*%OPC COMP=() //EXEC DP#BKP,FREQ=YEARLY //*%OPC END ACTION=INCLUDE -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Operations GDPS health monitoring
All We have 5 sysplex's in MGM4SITE configuration. We are about nearly fully implemented and region swap tested through all environments. We are looking at how to have our operations staff monitor GDPS for critical events.They wouldnt be expected to take any action, other than to page out the responsible team to address. Optimally, the critical errors (i.e. page out oncall) should be very limited, and anything else that can be deferred to next day should be the bulk. I would be nice if critical errors could be rolled into a site scope or some other agnostic system monitoring tool? I am looking through the GDPS Planning and implementation guides and do not really see some sort of monitoring methodology? I've asked IBM this question too, but am curious what other GDPS shops are doing for monitoring? Thanks, Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: More of LOG4J
On Tue, 18 Jan 2022 10:41:41 -0600, Kirk Wolf wrote: >Since I would guess that a majority of ibm-mainers would agree that open >source is confusing and dangerous, here's a question: > >Let's say that an organization wanted to prohibit open source. How would you >go about it? > >Kirk Wolf >Dovetailed Technologies >http://dovetail.com > We have all kinds of open source, including all the ports IBM has made available. It all depends on "who supports, when broken". We have nothing in Prod environment that isn't supported by someone (a vendor). Rocket Git client we pay for support through IBM, so that we can continue opening tickets through IBM portal. Other stuff like PDS, TASID, we have but we dont make available to general public. We have Dovetail's Wiki/Tomcat port for our own technical information repository, but even that is not used in any production business application capacity. A general user could download "stuff" i guess, but in the end, if my team didnt install it, then they are on their own, including answering to all the various review groups (audit, risk, infosec, etc). -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: zEDC Justification documents or links
On Thu, 13 Jan 2022 12:55:33 -0600, Scott Barry wrote: > >Consider with the IBM z15, there is no longer any "license requirement" for >activation - no longer implemented with (z14, z13) hardware PCIe cards >(recommended: at least 4 per CPC/CEC) involved, as the function is on-chip. >And the performance measurement moves from RMF 74 subtype 9 to subtype 10; >also, some of the SMF 30 metrics are zeroed-out as no longer relevant. > >Scott Barry >SBBTech LLC I dont believe that is true Scott. Its true that the hardware comes on z15 at no additional charge, and you'll get some compression features for free, like for Connect:Direct. But asking for ZEDC compression from a DSS job, etc still requires the software entitlement. From the white paper that Sri posted 1.3 - IBM Z hardware and OS requirements zEDC requires the following: z/OS V2R1 (or later) operating system. IBM zEnterprise EC12 CPC (with GA2 level microcode) or zBC12 CPC, or later. On z14, zEDC Express feature is sharable across up to 31 partitions and up to 16 cards per CPC. zEDC Express software feature enabled in an IFAPRDxx parmlib member. Adequate 64-bit real storage configured to this z/OS image -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: zEDC Justification documents or links
On Thu, 13 Jan 2022 16:57:40 +, Richards, Robert B. (CTR) wrote: >Anyone have some good links to share that will state why zEDC is worth >licensing and getting? > >For t e record, we already have the HW feature installed. Don’t ask. > Bob, I don't have either handy, but IMO the biggest reason to use it is if you are also doing dataset level encryption. IBM's sales slides indicate compress first, then encrypt (encrypting less physical data), to offset the resource cost of encryption. I honestly cannot think of another good reason beyond that, although there may be some. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: COBOL V6 question
On Tue, 11 Jan 2022 11:18:55 -0600, Dave Jousma wrote: > >There might still be reason for a level of panic. > >COBOL V6 required PDS-E load libraries. If you are already PDSE everywhere, >then no issue. Not hard to convert, but disruptive. >CPU to compile COBOL V6 goes up exponentially.So if CPU is constrained, >could be an issue. > >There are many new features introduced in COBOL V6. Many have hold actions >to have the enabling LE support for those functions in all environments BEFORE >rolling out the COBOL PTF, otherwise you may see errors in prod. > I should have also added that we did have some application code changes to make too. There are also some "rules" about mixed run-units (i.e. mixture of cobol versions, assembler, etc in same run unit). We are only a few shorts months away from EOS for V4.2. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: COBOL V6 question
On Tue, 11 Jan 2022 11:00:35 -0600, Carmen Vitullo wrote: >good to know ! > >seems there's been a lot of panic here for no reason, now that all the >programmers know we're using 6.2 COBOL compilers, ever issue they see is >related, seems about right, seen this reaction at more than one site. > There might still be reason for a level of panic. COBOL V6 required PDS-E load libraries. If you are already PDSE everywhere, then no issue. Not hard to convert, but disruptive. CPU to compile COBOL V6 goes up exponentially.So if CPU is constrained, could be an issue. There are many new features introduced in COBOL V6. Many have hold actions to have the enabling LE support for those functions in all environments BEFORE rolling out the COBOL PTF, otherwise you may see errors in prod. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and domain sharing
On Thu, 6 Jan 2022 16:02:22 -0400, Eric D Rossman wrote: >"Dave Jousma" wrote: > >> You have to be careful though, because the MK for the domain is the >> same on both adapters, > >That is true only if both adapters are on the same LPAR. If they are on >different LPARs, there is no requirement that they be the same. However, I >would recommend it because it makes the documentation easy (and you have >85 domains that you can use, so why not?) Eric, Thanks for the correction, you are obviously correct. At our shop, we load same MK's into the same domain number across all adapters and all CEC's for uniformity. Which stepping into GDPS over the past year has proven a good move for getting configured for region swaps. Its funny how after so many years I make certain assumptions that everyone does it the same, when that just isnt true. :) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and domain sharing
On Thu, 6 Jan 2022 16:04:59 +0100, Radoslaw Skorupka wrote: > >Thank you for the clarification and excuse me for next question: are you >sure one can have i.e. LPARX using Crypto01 in domain 10 (no other >crypto cards) *and* LPARY using Crypto02 in domain 10 both activated? >As I said my memory is poor, however I vaguely remember such combination >was impossible as well as plain domain & cryptocard sharing - that mean >several LPARs using same domain ID and same card(s). >I know such restriction is, let's say, unreasonable but AFAIR that was >in effect . Unfortunately I cannot simply check it. > > Yes. We are configured that way today. I think I am saying this correctly, but if you only have one Crypto-express feature (two adapters), then only having 1 active on an lpar could be a single point of failure. I guess having just the one feature is also SPOF too. You have to be careful though, because the MK for the domain is the same on both adapters, so assigning them to two separate lpars means same MK. We share only across like environment lpars, never Test and Prod together. We didnt start out intending on sharing domains, but getting a TKE Key ceremony to load more domains takes an act of God getting all the right people together in the room, and when we implemented GDPS I mis-counted the number of new domains needed. Mark Jacobs talked about what looks like new function I was not aware of. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and domain sharing
On Tue, 4 Jan 2022 21:48:23 +0100, Radoslaw Skorupka wrote: >Another question about ICSF: > >I vaguely remember that crypto domains had to be unique. >In other words every active LPAR can have unique domain number or >several numbers (which is another story). > >Now I just read the domain number may be shared and then CKDS/PKDS >datasets may shared as well. >Assuming we want to share CKDS/PKDS between sysplex member within CPC it >is worth to consider - less master keys to manage. > >So, is it true the domains can be shared across LPARs or I misunderstood >documentation? I'm sure our friend from IBM will chime in, but we just went through this. More than one lpar can use the same domain, but not the same domain on the same crypto adapter. We have 4 crypto express cards in each cec. As an example, In my lesser important lpars that dont have the same crypto load, i have adapter 0 and 2 on domain 0 for lpar-a, and adapter 1 and 3 on domain 0 on lpar-b. If you try to use same domain on same adapter in multiple lpars, you will get a activation failure. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and Z EOD (and Pervasive Encryption)
On Tue, 4 Jan 2022 09:21:16 -0400, Eric D Rossman wrote:
>It sounds like a "SETICSF FLUSH" command or similar is what you are
>suggesting. ("don't turn off any options, but ensure that everything up to
>that point is flushed/handled").
>
>I would ask you to open an RFE and post back here so others can vote for
>it. That will make it easier for me to push for it.
>
RFE submitted:
Headline: Add ICSF Flush command
ID:153608
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and Z EOD (and Pervasive Encryption)
On Mon, 3 Jan 2022 16:10:48 -0400, Eric D Rossman wrote: > >That's a really good question (and a complicated one). While the >recommendation is to terminate ICSF to allow for a clean shutdown of >tasks, I think a STOP ICSF can be (mostly) safely avoided. > >There are a few asynchronous tasks that ICSF cleans up when it terminates. >What comes to mind as being most relevant is data related to key usage/key >lifecycle and reference dates. Instead of recording every piece as it >happens, we queue up and periodically record it, both to SMF records >(usage/lifecycle) and in the CKDS/PKDS/TKDS records (reference dates, if >using KDSR format). > >If SMF is already stopped, ICSF SMF records related to key usage and key >lifecycle won't get recorded, so perhaps the best option would be to use >the operator commands to tell ICSF to stop recording both key >usage/lifecycle and reference dates and flush everything it has cached for >both categories. If you do that, both the SMF records and ICSF KDS updates >will happen immediately. Then, you can safely issue the Z EOD to harden >the SMF records. > >I cannot say that it's perfect (obviously, none of the actively after the >operator commands will get recorded), but at that point, you have already >terminated just about everything anyway, so you are unlikely to miss much. > Thanks again Eric. I'd like to see IBM "clean up" that last little bit of housekeeping and really make ICSF task a "hands off" task with regards to starting/stopping. Its going to get more difficult to run without anyway. For me, losing those last few SMF records or last used updates on key records is less of an issue than not being able to serve the encrypt/decrypt request at all. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ICSF and Z EOD (and Pervasive Encryption)
On Sat, 1 Jan 2022 21:01:06 -0400, Eric D Rossman wrote: >I think you have the right idea. > >You want ICSF started as early as possible and ended as late as possible. > >You likely want to use early ICSF which will run ICSF under the MASTER >address space instead of JES (either via the ICSFPROC and ICSF system >parameters [preferred] or via COMMNDxx using S CSF,SUB=MSTR) and configure >ARM to restart ICSF. I don't recall the details but I believe that ARM >will not work for system address spaces (like ICSF when started under >MASTER) on older z/OS releases. I know for sure that it works for system >address spaces on V2R5. > >Ensure that the P CSF is done after all exploiters are stopped (definitely >after Z EOD). Eric, thanks for responding from IBM. We run with early ICSF started under master from IEASYS00 settings. Is it even necessary to shutdown CSF on system shutdown? I ask because with so many things using encryption now, including CF structures, etc, there is likely a window for problems? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New Java vulnerability
On Tue, 14 Dec 2021 10:19:08 -0600, Dave Jousma wrote: > >you bring up a good point. there are hits for this in base JAVA V8 both 31bit >and 64bit, so consequently, any JAVA based app could be using, without >actually including their own copy of log4j. That also means that the local >workaround is a bit more difficult too, as the override isn't a global change, >unless I am misunderstanding? > >Isnt this a run-time option? > >‐Dlog4j2.formatMsgNoLookups=True > >No one has said if there is a method to set this as a default in JAVA itself >if no one specifies something different. I have to issue a correction. Base JAVA does not appear to have the actual log4j code in it, but something in there is/can use it. I misread the output from the tool that Itschak graciously shared. QIF0200I (QIFUSS99) JAR USING LOG4J: /RSD02A/usr/lpp/java/J8.0/lib/resources.jar QIF0200I (QIFUSS99) JAR USING LOG4J: /RSD02A/usr/lpp/java/J8.0_64/lib/resources.jar a grep of the physical resources.jar file comes out with: I extracted the resources.jar file to a separate directory, and tried to pipe the output of find . command to grep to scan all the individual files from the extract for "log4j", but I am just not unix savvy enough to make that work. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New Java vulnerability
On Tue, 14 Dec 2021 10:38:43 -0500, Phil Smith III wrote: >Making things even more confusing, there are lots of ways to use log4j, only >some of which expose this vulnerability. For example, Splunk uses it, but >says the exploit matters on "All supported non-Windows versions of 8.1.x and >8.2.x only if Hadoop (Hunk) and/or DFS are used." > > > >It appears that the offending libraries are always installed, so some/many >systems will show up in scans, but are not really at risk. The good news is >that in those cases, those jars can be renamed/moved/removed to clear up the >false positive. you bring up a good point. there are hits for this in base JAVA V8 both 31bit and 64bit, so consequently, any JAVA based app could be using, without actually including their own copy of log4j. That also means that the local workaround is a bit more difficult too, as the override isn't a global change, unless I am misunderstanding? Isnt this a run-time option? ‐Dlog4j2.formatMsgNoLookups=True No one has said if there is a method to set this as a default in JAVA itself if no one specifies something different. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New Java vulnerability
There is a IBM webinar spinning up for 12/15 IBM Security is hosting a client webinar about Log4Shell on Wednesday, December 15, 11 a.m. ET. Our X-Force team will review the implications of Log4Shell, who may be impacted, and steps clients can take to protect themselves today and in the future. To sign up for the event: https://event.on24.com/wcc/r/3570143/66C51D1B65F9821B262E9E0A36CC69C1 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: zCX Provisioning Problem
On Tue, 30 Nov 2021 05:54:25 -0600, Dave Jousma wrote: >On Tue, 30 Nov 2021 09:43:55 +, Neale Ferguson >wrote: > > >>It fails with: >> >>IDC3014I CATALOG ERROR >>IDC3009I ** VSAM CATALOG RETURN CODE IS 48 - REASON CODE IS IGG0CLAT-80 >> >>I am unable to work out what IGG0CLAT-80 is or why it’s failing. I am unsure >>why VOL is required anyway, wouldn’t the STORCLAS/DATACLAS let the system >>pick for itself? Might that volume not have enough free space? I would’ve >>hoped that the generated workflow would “just work” with the right >>parameters. So I assume one of my parameter is wrong but I didn’t see >>anywhere I could plug in a volume name into the workflow parameters. >> > >80 Explanation: Define data set with extended format > information is not valid for a non-SMS data set. Does your dataclass specify extended format? Or reduce your dataset allocation to something less than 65K tracks and try it. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: zCX Provisioning Problem
On Tue, 30 Nov 2021 09:43:55 +, Neale Ferguson wrote: >It fails with: > >IDC3014I CATALOG ERROR >IDC3009I ** VSAM CATALOG RETURN CODE IS 48 - REASON CODE IS IGG0CLAT-80 > >I am unable to work out what IGG0CLAT-80 is or why it’s failing. I am unsure >why VOL is required anyway, wouldn’t the STORCLAS/DATACLAS let the system pick >for itself? Might that volume not have enough free space? I would’ve hoped >that the generated workflow would “just work” with the right parameters. So I >assume one of my parameter is wrong but I didn’t see anywhere I could plug in >a volume name into the workflow parameters. > 80 Explanation: Define data set with extended format information is not valid for a non-SMS data set. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: z/OS 2.5 and RMF - plus the migration manual from z/OS 2.4.
On Mon, 15 Nov 2021 21:06:32 +, Richbourg, Claude wrote: >Good afternoon everyone, > >Two things that I noticed with z/OS 2.5 so far and I have a couple of >questions for the group. > >Q1: >RMF would not start after the first IPL of z/OS 2.5. >The program ERBMFMFC is not in the SYS1.SERBLNKE library that came with z/OS >2.5. >I went looking for it and found it in the z/OS 2.4 library - SYS1.SERBLINK. >Now, in z/OS 2.5 there is no SYS1.SERBLPA and SYS1.SERBLINK libraries any >more, only the SYS1.SERBLNKE file. What have I missed here and where is that >program now located? >RMF is licensed for our site, so everything needed to run it should be here in >our z/OS 2.5. > >Q2: >I don't have the migration manual from z/OS 2.4 to z/OS 2.5 anywhere in the >CPAC.** files and it was not in the IBM online pdf files downloaded for z/OS >2.5. >Is the only place to get it within z/OSMF? I had thought it would be available >to the early serverpac installers, (before January 22), so have I missed that >one as well? > >We do not have z/OSMF up and going yet, hence the early order. > Claude, the "shortcut" to figuring this stuff out is to go look at the IBM provided PROG00 member in the CPAC.PARMLIB that came with your serverpac. Before my first IPL, I review the contents of it for datasets that do not exist in my current APF/LNKLST and add them. Same with LPALST00 member in same library, where you will find the SYS21.GRBLPA entry. There are actually a number of members (if not all) that you'd want to review. IFAPRD00 is another. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TN3270 message
On Mon, 15 Nov 2021 15:59:13 +, Shaffer, Terri wrote: >Hi, > Just recently upgraded my test lpar to z/OS 2.5 and Tn3270 is displaying an > error. It still connects and I can logon but this? > >$HASP373 TN3270 STARTED >IEF403I TN3270 - STARTED - TIME=09.13.27 >IEE252I MEMBER CTIEZBTN FOUND IN SYS1.IBM.PARMLIB >EZZ6035I TN3270 DEBUG TASK EXCEPTION 145 > TASK: COMMAND CNTL MOD: EZBTMCTL > RCODE: 6013-00 CEEPIPI environments could not be initialized. > Terri, This seems to fithttps://www.ibm.com/support/pages/apar/OA61532 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Maintenance paths
On Fri, 12 Nov 2021 07:22:33 -0600, Dave Jousma wrote:
>On Fri, 12 Nov 2021 07:06:36 -0600, James C. wrote:
>
>>Normally I edit the DDEFs via jcl to /Service instead of / for maintenance
>>but I was wondering if this is still the preferred/best method? The last time
>>doing this there were 118 paths to update so not entirely trivial.
>>
>
>No need to do it manually.
>
>ZEDIT DDDEF .
> CHANGE PATH('/'*,
> '/Service'*).
> ENDZONEEDIT .
>
>Many have a Target zone dedicated to applying service that never gets IPL'd.
>Your question leads me to believe that you might be doing some kind of hybrid
>maintenance approach that could be a bit "dangerous".
>
Correcting a slight typo. without the missing / would have caused you problems.
ZEDIT DDDEF .
CHANGE PATH('/'*,
'/Service/'*) .
ENDZEDIT .
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Maintenance paths
On Fri, 12 Nov 2021 07:06:36 -0600, James C. wrote:
>Normally I edit the DDEFs via jcl to /Service instead of / for maintenance but
>I was wondering if this is still the preferred/best method? The last time
>doing this there were 118 paths to update so not entirely trivial.
>
No need to do it manually.
ZEDIT DDDEF .
CHANGE PATH('/'*,
'/Service'*).
ENDZONEEDIT .
Many have a Target zone dedicated to applying service that never gets IPL'd.
Your question leads me to believe that you might be doing some kind of hybrid
maintenance approach that could be a bit "dangerous".
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE apply error SYMLINKS
On Tue, 9 Nov 2021 08:04:56 -0600, Dave Jousma wrote: > >Jake, > >Is that an APARfix for PH38318? I see the APAR is still open. Could be a >packaging error by IBM too….. > > >I look up the same module in my 2.4 environment > > Entry Type: HFS Zone Name: MVSTZN > Entry Name: EZAMLCAT Zone Type: TARGET > > FMID: HIP6240 DISTLIB : AEZAXLT3 LASTUPD: HIP6240 TYPE=ADD > RMID: UI66498 SYSLIB : SEZAMMSC BINARY > SHSCRIPT: > > > > LINK '../ezamlcat.cat' > PARM PATHMODE(0,6,4,4) > SYMLINK '../../../../../../../../usr/lib/nls/msg/C/ezamlcat.cat' > SYMPATH '../../../../../usr/lpp/tcpip/lib/nls/msg/C/ezamlcat.cat' > > >Yours seems to have an extra directory in it? I don’t have /IBM/ in mine. > >BPXF150I MVS DATA SET WITH DDNAME SYSUT1 SUCCESSFULLY COPIED INTO BINARY >HFS FILE /Service/usr/lpp/tcpip/lib/nls/msg/C/IBM/EZAMLCAT. > >BPXF170E RETURN CODE 0081, REASON CODE 0594003D. A SYMLINK FAILED FOR >LINK NAME /Service/usr/lpp/tcpip/lib/nls/msg/C/IBM/../../ > >../../../../../... > Correction. I just went and looked at the actual filesystem -rw-r--r-- 2 BPXROOT OMVSGRP 699 Sep 25 2019 EZAITMSG -rw-r--r-- 2 BPXROOT OMVSGRP26230 Dec 23 2019 EZAMLCAT -rw-r--r-- 2 BPXROOT OMVSGRP 5026 Sep 25 2019 EZAMLRPY TEC1:$ pwd /RST01A/usr/lpp/tcpip/lib/nls/msg/C/IBM TEC1:$ My apologies for the red herring. I'd still ask IBM to investigate a possible packaging error though since it appears to be an APARfix -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE apply error SYMLINKS
On Tue, 9 Nov 2021 12:09:38 +0400, Jake Anderson wrote: >Hello > >Cross posted > >I am applying a APAR related to CSSMTP to zOS 2.4 and it fails with below >messge > >GIM42500W AN ATTEMPT TO OBTAIN THE NAME OF THE PHYSICAL DATA SET CONTAINING >A > > SYMBOLIC LINK FOR HFS EZAMLCAT IN SEZAMMSC FAILED. THE RETURN >CODE > > FROM THE BPX1LST CALLABLE SERVICE WAS '0081'X AND THE >REASON > > CODE WAS '0594003D'X. > Jake, Is that an APARfix for PH38318? I see the APAR is still open. Could be a packaging error by IBM too….. I look up the same module in my 2.4 environment Entry Type: HFS Zone Name: MVSTZN Entry Name: EZAMLCAT Zone Type: TARGET FMID: HIP6240 DISTLIB : AEZAXLT3 LASTUPD: HIP6240 TYPE=ADD RMID: UI66498 SYSLIB : SEZAMMSC BINARY SHSCRIPT: LINK '../ezamlcat.cat' PARM PATHMODE(0,6,4,4) SYMLINK '../../../../../../../../usr/lib/nls/msg/C/ezamlcat.cat' SYMPATH '../../../../../usr/lpp/tcpip/lib/nls/msg/C/ezamlcat.cat' Yours seems to have an extra directory in it? I don’t have /IBM/ in mine. BPXF150I MVS DATA SET WITH DDNAME SYSUT1 SUCCESSFULLY COPIED INTO BINARY HFS FILE /Service/usr/lpp/tcpip/lib/nls/msg/C/IBM/EZAMLCAT. BPXF170E RETURN CODE 0081, REASON CODE 0594003D. A SYMLINK FAILED FOR LINK NAME /Service/usr/lpp/tcpip/lib/nls/msg/C/IBM/../../ ../../../../../... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Multiple TSO logons within sysplex
On Fri, 5 Nov 2021 16:57:17 +0100, Radoslaw Skorupka wrote: >I just re-read Configuring ISPF for Fun and Profit presentation and >found the following link: >http://home.roadrunner.com/~pinncons/TSO LOGON with the Same Userid on >Multiple LPARs in a Sysplex.pdf > >However the link is dead. >Does anyone have the presentation? >Or any other presentation on the topic. > >My goal is to enable multiple TSO/ISPF logons within sysplex. >What I know: >- ISPPROF dataset can be shared now (it has changed) >- LIST, LOG, TEMP datasets should not be shared. The solution is exit 16 >or ISPF Configuration Utility (add to the DSNs). >- I'm not sure about PDF edit recovery files. >- Did I miss something? > We converted quite awhile back. IIRC it was mainly running ISPCCONF ISPF Multi-logon Profile Options Enter "/" to select option / Multi-logon Profile Sharing / Prompt for Profile ENQ LockoutENQ Lock Wait . . . . . 1000 / Reset Shared Profile Settings ENQ Lock Retry Count . . 1 We didnt do anything with LOG/LIST other than adding the SEQ number Temporary Data Sets Additional Qualifier . . ISP -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: automated SMS Storage pool management
On Thu, 4 Nov 2021 09:22:11 -0700, Lizette Koehler wrote: >Do you have Chicago Software Quick Ref tool? > >We actually have several part process > >The MIG setting on the Pool for auto migration when the pool reaches a certain >Percentage > >We use QW to create a Storage listing, then run a CA OPS/MVS process to parse >the output and see if the pool needs to be migrated. If yes, then we have >OPS/MVS issue the migration commands > >We also have CA Vantage to monitor the pools > >If you want further details, just send me off list > >Lizette We do. Thanks for that suggestion as well. We also have Rocket HSM reporter. That along with some of the suggestions others have given have given us plenty of food for thought. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: automated SMS Storage pool management
On Thu, 4 Nov 2021 13:08:01 +, kekronbekron wrote: >Hi Dave, > >What you've mentioned will work. >A cyclic automation rule that runs a REXX which does the following: >1. D SMS,SG(ALL) and parse its output (or maybe individual commands for just >the SGs you're interested in, to simplify parsing) >2. Check for availability of DISNEW volumes >3. V SMS command to ENABLE the volume >https://www.ibm.com/docs/en/zos/2.4.0?topic=command-changing-sms-status-storage-group-volume >4. Email about the performed action and maintain a simple status file > > Thank-you! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: automated SMS Storage pool management
On Thu, 4 Nov 2021 13:01:07 +, kekronbekron wrote: >Please do ignore this mail/thread if it seems derailing. > >It hurts to see that someone just gets to manage storage at a shop like this. >While at the same time, there's unnecessary gatekeeping on the hiring side, >asking stupid questions and completely ignoring a person's "prior art" and >capability to get $hit done. >Being on the other side of the gate, it's like skills have no respect anymore. >Just need to be 'from somewhere' or get a job via referral. >Of course, not to mention the fact that the knowing what API stands for is >enough qualification these days somehow (compared to people with actual XP). > >- KB KB, Just to be clear. I'm not the hands on the keyboard guy. I have talented staff to handle. Sometimes though its hard to see new ways of doing things, when at it for so long. That's why I ask questions. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: automated SMS Storage pool management
>You may want to pose the question at the official unofficial SA user group >found here: https://groups.io/g/SAUsers Thanks Steve! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: automated SMS Storage pool management
>Dave, > >Do you have DFSMShsm? If so, turn on Interval Migration and it manage the % >threshold of freespace for you. > >If you do not have DFSMShsm, what do you have? > >Bob Thanks Bob, we do have HSM. Sorry, I'm not well-versed in this area. Are there tools to know when you need to add capacity vs thrashing and continually migrating? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
automated SMS Storage pool management
All, I'm sure someone has solved this. I'm now managing DASD management at my shop. One thing that bothers me is my guys getting off-shift calls because some active storage pools fall below a % threshold of freespace. We arent skimpy on provisioning, but dont want to over-provision either. We are IBM system automation shop, and I asked IBM if there was any "out-of-the-box" automation for SMS we could start with and tailor to our needs. Nothing. Not looking to fully automate storage pool management, but something along the lines of having some number of volumes in DISNEW status, that could be enabled via automation - saving that middle of the night call-out, but to follow-up on next business day. Anyone doing anything like this, case to share? Thanks in advance, Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Volume allocated to *MASTER*
Richard, I didnt read every single post on the topic, but did you say if this is the SYSRES you are IPL'd from? Or an alternate that isnt supposed to be in use? Also, saw your comments about the couple of hardcoded datasets in LINKLIST that you fixed that were pointing at the volume. I thought IPL time linklist hung around forever regardless of any SET PROG statements that might have been done? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Serverpac installs January 2022 and beyond - Issues Updated
Oh, and in the custompac dialogs, there are exactly 4 jobs that I run after resolving new datasets that came along with the new release. - allocate and catalog the datasets (ALLOCDS) - restore the datasets (RESTORE) - update SMPE DDDEFS (UP) - and a modified version of RECATALOG datasets to Target(RECATDS) to only run the IEHPROGM steps Then onto applying any usermods. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Serverpac installs January 2022 and beyond - Issues Updated
>Hey Dave > I ordered both, and you are right in 4 hours I had my z/OS loaded and IPLed > at least the initial IPL in test. However > >I wanted to try z/OSMF and I actually like the dataset naming flexibility, >much better than the dialogs and Alias's discovery. > >But all the background dataset checking that use to be done in the first >SERVERPAC job, IE validate your configuration/Catalog setup, that is driving >me insane. > >That and in my mind when I build a software instance, not everything that the >SERVERPAC downloads is copied/used. > >IBM seems to force copying the CPAC and SMPE files, when I only want the SYS1 >datasets and OMVS. > >Lastly and there are many takes on this from SYSTEM Programmers, But I only >ever have one DISTRIBUTION zone and it matches my 2-3 target zones/RES vol >sets. > >This is because I always want to make sure no-one restores from the wrong >DLIBS.. So I don’t ever copy these when I clone either. Again, I havent played with the zOSMF version yet, but it sounds like we do a similar cloning process. My SYSRES volumes are mod-54's and ONLY contain the target datasets including OMVS with sysres volser as part of the dsn. All the SMPE, CPAC, junk I just dont need get installed on the DLIB volume. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Serverpac installs January 2022 and beyond - Issues Updated
I too ordered V2.5 in the "window" where you still have a choice on custompac dialogs or z/OSMF. I opted to go custompac one more time. I do echo Terri's sentiments that there should be a way to mostly seed a new z/OSMF instance whether there is a utility that reads the last saved custompac config or somehow scans your sysres. That will definitely soften the blow for moving over.Us old timers, can whip through the old dialogs in less than a day, and be pretty much ready to IPL. I understand the need to modernize the environment for the next wave. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Customized Offering Driver
>Does the custom pac for 2.5 still provide the Installing your order doc? since >if 2.5 requires z/osmf then there is an assumption on IBM's part that security >had already been setup and you are already using z/osmf > > > >Carmen Vitullo if you order V2.5 before January 1, you can have a choice and can still get it via the custom pac install method or z/OSMF. The question on delivery type (custompac or ZOSMF) comes on the panel where you specify Internet delivery. Marna mentioned this on the list awhile back I believe. We arent yet using zOSMF software installation method, so i placed my order a week or so ago to get custom pac. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMP/E GIMUNZIP HELP
>I used to download Patches from SHOPz using internet download. I have 35 of 35 >files 520 size. How can i merge to single file to become >S0001.SHOPZ.S7114481.SMPMCS.pax.Z file for me to unzip and I can receive to >SMP/E Global Zone. My SMP/E version 36.109 and OS Z/OS 2.2. No need for any of that. Just do a SMPE RECEIVE FROMNTS //STEP1EXEC SMPE //SMPNTS DD PATH='/u/smpe/zos24',PATHDISP=KEEP //SMPCNTL DD * SETBOUNDARY (GLOBAL) . RECEIVE FROMNTS(OSP01238) . With your SHOPz order you should have also gotten several JCL jobs you can copy/tailor/run for your specific order. There are several examples including manual download etc. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IPL's POR's frequency
>Just curious about how often folks here IPL their systems as a scheduled event >, once a month, once a quarter, once a year? >and same question for POR's. >I understand there are times when you HAVE to have unscheduled or hot fix >IPL's, I'm just asking in general terms. We have 2 maintenance periods per year in Prod. As part of that we: - have IBM install all MCL's - IBM & ISV software maintenance - IODF changes - POR - IPL the updates in While we could do MCL's more often, but there are still some that seem to require cycling OSA or Crypto adapters to actually activate the code onto those cards. We find just PORIng after the MCL's just makes for a cleaner update, and general system cleanup. For us, a 2 times per year cycle has also created a level of stability in the environment due to limiting how often changes get made. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Mainframe Storage position
All, Fifth Third Bank is looking to fill a position in the Mainframe space for a Storage Management professional. Home base can be Cincinnati, OH or Grand Rapids, MI. Fully remote would be considered on a case-by-case basis. Interested individuals can apply directly here: https://fifththird.wd5.myworkdayjobs.com/53careers/job/Cincinnati-OH/Lead-Technical-Engineer---Storage-Management_R22571-1 Lead Technical Engineer - Storage Management Cincinnati, OH Grand Rapids, MI Apply Make banking a Fifth Third better® We connect great people to great opportunities. Are you ready to take the next step? Discover a career in banking at Fifth Third Bank. GENERAL FUNCTION: Design and implement technology solutions using modern engineering tools and Agile practices. Work with self-directed, cross-functional, and product-oriented teams in a highly collaborative environment. Deliver some of the bank's most important products and services while developing skills and experience well beyond your initial role. All employees are responsible and accountable for risk by openly exchanging ideas and opinions, elevating concerns, and following policies and procedures as defined. Accountable for always doing the right thing for customers and colleagues, and ensuring that actions and behaviors drive a positive customer experience. Operating within the Bank's risk appetite, you will achieve results while consistently identifying, assessing, managing, monitoring, and reporting risks of all types. DUTIES AND RESPONSIBILITIES: Implement and maintain new features and capabilities while continuously improving the quality of our technical products and services Build and share technical expertise with your Agile team and other members of the organization Follow industry and organizational best practices and standards, and participate in company communities of practice to continuously refine and communicate them. Contribute to a culture of continuous improvement. Achieve operational excellence by automating processes and creating maintainable, supportable, and testable solutions Keep up with technology trends and innovations in your field(s) of practice Provide operational support and troubleshooting for your team’s products and services Maintain appropriate controls and documentation to ensure compliance with all company and regulatory requirements Provide coaching, mentoring, and training for new or less experienced team members Provide leadership and guidance to your team in your technical field(s) of expertise Other duties as assigned SUPERVISORY RESPONSIBILITIES: None MINIMUM KNOWLEDGE, SKILLS AND ABILITIES REQUIRED: Bachelor’s degree in a relevant technology field or equivalent combination of education and work experience 5+ years of engineering or other IT work experience relevant to the position Strong problem-solving and communication skills Willingness to work in a highly-collaborative environment Solid understanding and significant experience with modern software development practices, tools, and/or hardware technologies Solid understanding of IT security best practices Expertise in one or more technical and/or functional domains relevant to the position Experience designing, implementing, and supporting complex technical solutions Technical skills per the specific position’s requirements ADDITIONAL JOB SPECIFIC SKILLS Experience with enterprise storage arrays, EMC, and IBM. Experience with DFSMS and RMM. Experience with GDPS is preferred. Experience with enterprise tape backup subsystems. Experience with storage and backup management software. Experience with disaster recovery methodologies and data replication technologies. Experience with designing complex solutions to meet business requirements. Experience coding in REXX, SAS, maintaining SMS environment is preferred -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Software drag racing
I looked at the video, and looks like he is running for 5 seconds, but cannot tell how many prime numbers he calculated on the platforms he was testing. I had an old COBOL program laying around from years ago that calculates prime numbers. This morning I cranked it up to a limit of 50,000,000 and it completed in 6 seconds. This is on enterprise cobol 6 on z15. PGM-NAME EXCPCPUSRB CLOCK PRIMECB6 17971.08.00.11 000100 IDENTIFICATION DIVISION. 000200 PROGRAM-ID. PRIMECOB. 000300* EXAMPLE OF IN-LINE PERFORMS, END-IF, INITIALIZE STATEMENTS 000400 DATA DIVISION. 000500 WORKING-STORAGE SECTION. 000600 01 NUMBER-ARRAY. 000700 05 NA-LINE OCCURS 5000. 000700*05 NA-LINE OCCURS 3355440. 000710*05 NA-LINE OCCURS 26214. 000720* ABOVE OCCURS CLAUSE IS LARGEST THAT WILL WORK FOR COBOL/VS 000800 10 NA-NUMBER PIC X. 000900 88 IS-PRIME VALUE '1'. 001000 88 IS-NOT-PRIME VALUE ZERO. 001100 10 NA-PROOF PIC S9(8) BINARY. 001200 01 CANDIDATEPIC S9(8) BINARY. 001300 01 CPRIME PIC S9(8) BINARY. 001400 01 ARRAY-SIZE PIC S9(8) BINARY. 001500 001600 PROCEDURE DIVISION. 001700 MAINLINE. 001800 INITIALIZE NUMBER-ARRAY REPLACING ALPHANUMERIC BY '1' 001900 INITIALIZE NUMBER-ARRAY REPLACING NUMERIC BY ZERO 000200 002100 COMPUTE ARRAY-SIZE = LENGTH OF NUMBER-ARRAY / 5 002200 002300 PERFORM VARYING CPRIME FROM 2 BY 1 002400 UNTIL CPRIME > ARRAY-SIZE 002500 IF IS-PRIME (CPRIME) 002600 COMPUTE CANDIDATE = CPRIME + CPRIME 002700 PERFORM UNTIL CANDIDATE > ARRAY-SIZE 002800 SET IS-NOT-PRIME(CANDIDATE) TO TRUE 002900 MOVE CPRIME TO NA-PROOF(CANDIDATE) 003000 ADD CPRIME TO CANDIDATE 003100 END-PERFORM 003200 END-IF 003300 END-PERFORM 003400 003500 PERFORM VARYING CANDIDATE FROM 1 BY 1 003600 UNTIL CANDIDATE > ARRAY-SIZE 003700 IF IS-PRIME (CANDIDATE) 003800 DISPLAY CANDIDATE ' IS PRIME' 003900*ELSE 004000*DISPLAY CANDIDATE ' DIVISIBLE BY ' 004100*NA-PROOF(CANDIDATE) 004200 END-IF 004300 END-PERFORM. 004400 STOP RUN. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IBM Zcloud - is it just outsourcing ?
>No, "cloud" and "outsourcing" are two distinct concepts. While it is >very likely these days that all "outsourcing" would involve cloud-based >services, it is not true that "cloud-based" services must be "outsourced". >A corporation can easily choose to run its own distributed, in-house >cloud services. Any corporate data center that supports branch offices >with remote access over the Internet to corporate applications fits the >definition of cloud-based computing from the viewpoint of the branch >offices. If the corporate data center is not outsourced, then neither >are the cloud-based services it provides to its branches. Definitely semantics. I keep telling non-mainframers here at work that mainframe has been a "cloud" for decades. Think about it, teams just deploy their apps and they run, no server provisioning, etc.Continuous availability, nah AWS has nothing on MF. Today's "cloud" is infrastructure outsourcing, nothing less. Except that the new outsourcers (Amazon, and others), have gotten smarter. Easy to get in, costs an arm and a leg to get out. In distributed systems its a slow growth, server here, server there, before long you have 100's, 1000's of AWS instances all at the mercy of someone somewhere who knows. I used to work for IBM in the 90's in their outsourcing business. Companies that outsourced to reduce capital asset requirements but still were actively using mainframe space, didnt seem to stay outsourced long.Any deviation from original contract to add services was a nightmare. My observation is that company's where MF was stablized, or a company in financial trouble were the ones that stayed. All of this ebb's and flows over time, we'll see how this all shakes out. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS user.hfs shared
>Of course I'm missing something... >If I'm getting contention on the USER.HFS (because it's shared in the sysplex) >why does it matter what directory it's in? >/u or /home it's still the same file I think you said you have /u as part of your IBM root file system. You also said you have one system at 1.13, and one at V2.?. So that indicates to separate root filesystems. if both of them have /u in it, and you try to mount the file system at both locations, it fails. you cannot mount the same file system 2 different places in the directory tree. If indeed /u is in your IBM root filesystem, then the absolute path would be something like /root1/u/whatever and the other would be /root2/u/whatever. you can verify that by doing a df -vk /u in both locations and see what you get. My suggestion was to move your home directory to a single shared /home that is based in the highest level of sysplex root, not z/OS root. If I have misunderstood your situation, please feel free to take this offline with me if you wish. david.jou...@53.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS user.hfs shared
Elaine, you cannot have the same filesystem mounted twice(or more) in different spots in the directory tree in sysplex filesystem. As mentioned before, you really dont want to define user home directories in the root filesystem supplied by IBM. What we have done is created a automount managed directory in the sysplex root called /home that all user filesystems get mounted off from. Then from any system in the sysplex, the user is accessing the same filesystem from all systems. here is my sysplex tree structure at the highest level.in BPXPRM maps to the SYSRES - in our case RS* packs, then we have a few other, like vendor sysres (VS*), we automount NFS mounts, and then have system specific mount points (TEC*) that system specific stuff hangs off from. TEC1:$ ls -al total 200 lrwxrwxrwx 1 OMVSKERN OMVSGRP9 Jun 4 2013 $SYSNAME -> $SYSNAME/ lrwxrwxrwx 1 OMVSKERN OMVSGRP9 Jun 4 2013 $VERSION -> $VERSION/ drwxr-xr-x 24 OMVSKERN OMVSGRP 8192 Dec 15 07:28 . drwxr-xr-x 24 OMVSKERN OMVSGRP 8192 Dec 15 07:28 .. drwxr-xr-x 2 OMVSKERN OMVSGRP0 Jun 4 2013 ... drwxr-xr-x 5 OMVSKERN OMVSGRP 8192 Jun 6 2013 NFS drwxr-xr-x 2 OMVSKERN OMVSGRP0 Dec 11 2013 RSM01A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Dec 11 2013 RSM02A drwxr-xr-x 14 OMVSKERN OMVSGRP 8192 Dec 21 08:05 RST01A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Jun 6 2013 RST02A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 12 2013 RST03A drwxr-xr-x 3 OMVSKERN OMVSGRP 8192 Jun 6 2013 ServiceCICS drwxr-xr-x 3 OMVSKERN OMVSGRP 8192 Jun 6 2013 ServiceDB2 drwxr-xr-x 3 OMVSKERN OMVSGRP 8192 Aug 26 2020 ServiceQREP drwxr-xr-x 8 OMVSKERN OMVSGRP 8192 Jan 14 14:10 TEC1 drwxr-xr-x 9 OMVSKERN OMVSGRP 8192 Sep 19 2018 TEC2 drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 27 2013 VSM01A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 27 2013 VSM02A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 27 2013 VSM03A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 27 2013 VST01A drwxr-xr-x 6 OMVSKERN OMVSGRP 8192 Jan 14 09:56 VST02A drwxr-xr-x 6 OMVSKERN OMVSGRP 8192 Jan 14 09:56 VST02A drwxr-xr-x 2 OMVSKERN OMVSGRP0 Aug 27 2013 VST03A drwxr-xr-x 53 OMVSKERN OMVSGRP 8192 Aug 26 2020 altroot lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 bin -> $VERSION/bin lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 dev -> $SYSNAME/dev lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 etc -> $SYSNAME/etc dr-xr-xr-x 36 OMVSKERN TTY0 May 20 08:49 home lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 lib -> $VERSION/lib drwxr-xr-x 2 OMVSKERN OMVSGRP0 Jun 19 2014 null lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 opt -> $VERSION/opt lrwxrwxrwx 1 OMVSKERN OMVSGRP 25 Jun 6 2013 remote -> $SYSSYMA/NFS//remot lrwxrwxrwx 1 OMVSKERN OMVSGRP 16 Jun 4 2013 samples -> $VERSION/samples drwxr-xr-x 4 OMVSKERN OMVSGRP 8192 Dec 10 10:56 shared lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 tmp -> $SYSNAME/tmp lrwxrwxrwx 1 OMVSKERN OMVSGRP 10 Jun 6 2013 u -> $SYSNAME/u lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 usr -> $VERSION/usr lrwxrwxrwx 1 OMVSKERN OMVSGRP 12 Jun 4 2013 var -> $SYSNAME/var lrwxrwxrwx 1 OMVSKERN OMVSGRP 15 Aug 27 2013 vendor -> $SYSSYMA/ TEC1:$ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE Receive Order post May 1st
>This was confirmed by an individual that supports the server. The >ciphers mentioned on the IBM Support page are a subset of the ciphers >actually enabled. >https://www.ibm.com/support/pages/node/6417233 >I hope this helps. Is anyone still having trouble connecting? >Kurt Quackenbush -- IBM, SMP/E Development >Chuck Norris never uses CHECK when he applies PTFs. We are still broke since the 5/1 TLSv1.2 cutover on your end. We are assuming its a problem on our end. We do have ticket open with ATTLS support group at IBM. We do have HTTPS service working, but continue to pursue, as not sure if TESTCASE.boulder.ibm.com has same TLS requirement (havent tried that yet). -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Dynamically allocated dump dataset, wrong date/time in DSN
>Date and time are correct, the timestamp on the log shows it. Just the dataset >name for the dump has the wrong date/time. Mark, Is it possible that they could be running some tool like HourGlass fooling around with date/time? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE Receive Order post May 1st
>Dave, Here you go: >## ># # > ># Secure FTP Application # > ># # > >### Thank you, Sir! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE Receive Order post May 1st
> Well, for what it's worth, I just tried it and my job was successful, > however, I also received the SSLv23/TLSv1 messages. So I used the standard > job that IBM provided (RFNJOBS) and I turned on Debug SEC. Here is what I got (snip) Hey Tony, Thanks for this. For some reason we are still struggling. Would you be willing to share what your pagent policy for these items: FU2420 TTLSRule: secure_ftp_client_rule FU2426 TTLSGroupAction: secure_ftp_client_group FU2432 TTLSEnvironmentAction: secure_ftp_client_env looks like? I dont think there is anything sensitive, and if you'd rather, you can send to me off-list (david.jou...@53.com) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMPE Receive Order post May 1st
I should have commented that the HTTPS method is working fine. And my last successful FTPs download was last week Monday April 26th. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
SMPE Receive Order post May 1st
Anyone ordering maintenance post May 1st using FTPs to download? Here was the announcement: As of May 1, 2021, to download files from IBM's secure delivery server using FTPS, it is necessary to enable TLS 1.2 in the z/OS Communications Server FTP client program. So, we've enabled ATTLS via PAGENT TTLS Action: cAct4~TEC1_FTP_Client_Applicati Version:3 Status: Active Scope: Connection HandshakeRole: Client CtraceClearText:Off Trace: 2 TTLSConnectionAdvancedParms: SecondaryMap: On SSLv3: Off TLSv1: Off TLSv1.1: Off TLSv1.2: On TLSv1.3: On ApplicationControlled: On CertificateLabel: DigiCert Global Root CA Connection try fails on handshake. Oddly, says TLSv1 from the IBM end. EZA1701I >>> AUTH TLS SC3362 getReply: entered SC4549 getNextReply: entered with waitForData = TRUE 234 SSLv23/TLSv1 SC4241 getLastReply: entered FC3101 authServerAttls: entered SC4405 getFNDELAY: entered SC4440 setFNDELAY: entered FC3140 authServerAttls: Start Handshake FC3149 authServerAttls: ioctl() failed on SIOCTTLSCTL - EDC8121I CONNECTION RESE T. (errno2=0x77A9733D) SC4440 setFNDELAY: entered EZA2897I Authentication negotiation failed SC4289 inSession: entered EZA1534I *** Control connection with dispby-117.boulder.ibm.com dies. SC4332 SETCEC code = 10 SC3610 endSession: entered (sn=27733B18) SC2776 dataClose: entered SC3693 endSession: recv() failed - EDC8121I CONNECTION RESET. (errno2=0x76650446 ) Its entirely possible that the PAGENT policy on our end is not correct, but its also not out of the realm of possibility that there are problems on IBM end and i why I am asking here if anyone else converted to TLSv1.2 as documented? Thanks, Dave -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: RED Alert Today Regarding z/OS Service Orders
Here is the JCL. //job //* //* //* List Sysmods/Ptfs in the global zone. //* //* Update SMPCSI with the name of your global zone. //* //* If the PTF is not found in your global zone you will //* receive a return code of 04 and messages like, //*SYSMOD UI72038NOT FOUND //*SYSMOD UI72039NOT FOUND //* in your SMP/E output. //* //* //* If the PTF is found you need to check the Receive date: //* //* UI72038 TYPE= PTF //*STATUS = REC //*DATE/TIME REC = 20.339 hh:mm:ss //* //* //*DATE/TIME REC = 20.345 hh:mm:ss //* //* //STEP1 EXEC PGM=GIMSMP,REGION=0M, // PARM='DATE=U' //SMPCSI DD DISP=SHR,DSN=SMPE.GLOBAL.CSI //SMPLOG DD SYSOUT=* //SMPLOGA DD SYSOUT=* //SMPOUT DD SYSOUT=* //SMPRPT DD SYSOUT=* //SMPLIST DD SYSOUT=* //SYSPRINT DD SYSOUT=* //* //SMPCNTL DD * SET BOUNDARY(GLOBAL). LIST SYSMOD( UI72038 UI72039 UI72040 UI72041 UI72042 UI72043 UI72044 UI72046 UI72047 UI72130 UI72131 UI72132 UI72133 UI72153 UI72154 UI72158 UI72159 UI72160 UI72161 UI72176 UI72177 UI72178 UI72186 UI72187 UI72213 UI72260 UI72261 UI72263 UI72326 UI72346 UI72347 UI72349
Re: RED Alert Today Regarding z/OS Service Orders
I had 5 PTF's that fell into that receive window. at least there were 3 were not applied, so easy. The other two were in my base GDPS code. One of those I was able to apply - redo, the other was in separate FMID for GDPS and I had no choice but to delete the entire FMID and re-install it. That FMID was for the GUI - RESTful API interface, which is all ZFS based for the most part. Apply REDO didnt want to work there. So yea, wasted most of yesterday remediating this.Good timing though, in a maintenance cycle, and got this just prior to our first Production rolls... I didnt think to save off the corrupted PTF's out of SMPPTS before I nuked them. would have been interesting to see the differences. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Help with APA - Application Performance Analyzer
Yea, its not a freebie either. charged just like fault analyzer, File manager, debug.as Jerry mentioned it is bundled, which is what we have done. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Machine-readable flag for "development-only z/OS'
So, this question got me thinking. We have a few ZD instances running here. I was not fully involved with the group bringing it in, other than setting some ground rules regarding customization, and "who" would be supporting. My recollection though, is that the Terms & Conditions of ZD state "no production workload".However, to my knowledge there is no mechanical enforcement of that? I mean what constitutes production workloads? I'm only asking a theoretical question, in that since IBM doesn't enforce via mechanical means, why bother at your end Charles to try to code something for that? You know darn well the machine type will change one day, and if you code off of that, it will break your code? What if someone is testing your code validly in zD, but not using it for production? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: OMVS
As Carmen suggested, display the user's OMVS segment. Must have UID, GID minimally, probably requires home directory, and start program, usually /bin/sh -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Wait Code on IPL
Glenn, that seems odd to have RC and RSN 00.are you able to cut/paste current wait state string in its entirety? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: z/OS 1.12 ssh to LInux
only a guess. But couldnt find an encryption cipher in common? You might need to enable less secure ciphers in your linux system? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rocket Terminal Emulator (Desktop)
>Does Rocket (formerly BlueWave) support Programmed Symbol Sets (PSS)? Have >they announced plans for a Linux version? Thanks. Do you mean formerly Bluezone? I cannot answer your question about PSS, but they only support Windows in the desktop version. All other platforms are supported by their web edition.We have a subset of users with MAC workstations and have no good way to provide MF terminal emulation without buying something else. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
