Re: RACF - SDSF question

[Ed Jaffe]

On 2/7/2023 5:14 PM, Seymour J Metz wrote:

Generic is usually more useful, but you can certainly use specific profiles.


Even discrete profiles can be made generic by specifying GENERIC when 
created.


That's what we do here. We have NO discrete profiles, but we do have 
generic profiles with no wildcard characters in them.



--
Phoenix Software International
Edward E. Jaffe
831 Parkview Drive North
El Segundo, CA 90245
https://www.phoenixsoftware.com/



This e-mail message, including any attachments, appended messages and the
information contained therein, is for the sole use of the intended
recipient(s). If you are not an intended recipient or have otherwise
received this email message in error, any use, dissemination, distribution,
review, storage or copying of this e-mail message and the information
contained therein is strictly prohibited. If you are not an intended
recipient, please contact the sender by reply e-mail and destroy all copies
of this email message and do not otherwise utilize or retain this email
message or any or all of the information contained therein. Although this
email message and any attachments or appended messages are believed to be
free of any virus or other defect that might affect any computer system into
which it is received and opened, it is the responsibility of the recipient
to ensure that it is virus free and no responsibility is accepted by the
sender for any loss or damage arising in any way from its opening or use.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: RACF - SDSF question

[Seymour J Metz]

Generic is usually more useful, but you can certainly use specific profiles.


From: IBM Mainframe Discussion List  on behalf of 
Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 7:40 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

I guess this bring up another question, which is probably why I am confused.

This is for MVS cancel

CANCEL jobname  MVS.CANCEL.JOB.jobname  MVS.CANCEL.**   Update  Medium

And

Table 1. RACF profiles and JES2 commands
JES2 CommandResource Name   Generic Profile Access 
Required1Security Risk
$C JJES2.CANCEL.BAT JES2.CANCEL.BAT.**  
Update  Medium
$C 'jobname'JES2.CANCEL.JOB JES2.CANCEL.**  Update  
Medium

So is the ** a generic but is the only option?

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 3:52 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that there is no jobname qualifier on the JES2.CANCEL.BAT profile. This is 
why SDSF has the extra JESSPOOL profile check that goes beyond vanilla JES2 
cancel command security.

This extra check is ONLY performed inside SDSF and is made before we build the 
operator command text.

Coincidentally I gave a presentation at virtual GSE today entitled "SDSF 
Security - How does it work under z/OS 2.5?" and the sequence of SAF checks is 
described with a few examples.

If you want, I can forward you the slide deck.

Rob Scott
Rocket Software

Sent from Samsung Mobile on O2
Sent from Outlook for 
Android

From: IBM Mainframe Discussion List  on behalf of 
Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 6:10:11 PM
To: IBM-MAIN@LISTSERV.UA.EDU 
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL




Okay, so not sure I reall understand the way this works?

Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics 
jobname like C30TCI* here? Is this the SDSF command like C, P etc?

Or under OPERCMDS I have

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

And now.

MVS.CANCEL.BAT.C30TCI*.* (G)
MVS.CANCEL.** (G)

Where does the granularity take place, for certain jobs??

I want the users to be able to cancel some batch jobs and everything they 
submitted, but not CICS, DB2 or other system things.

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 9:54 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that one of the "value add" functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like "C" and "P".

Does not stop them using freeform "slash" to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT 

Re: RACF - SDSF question

[Shaffer, Terri]

I guess this bring up another question, which is probably why I am confused.

This is for MVS cancel

CANCEL jobname  MVS.CANCEL.JOB.jobname  MVS.CANCEL.**   Update  Medium

And

Table 1. RACF profiles and JES2 commands
JES2 CommandResource Name   Generic Profile Access 
Required1Security Risk
$C JJES2.CANCEL.BAT JES2.CANCEL.BAT.**  
Update  Medium
$C 'jobname'JES2.CANCEL.JOB JES2.CANCEL.**  Update  
Medium

So is the ** a generic but is the only option?

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 3:52 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that there is no jobname qualifier on the JES2.CANCEL.BAT profile. This is 
why SDSF has the extra JESSPOOL profile check that goes beyond vanilla JES2 
cancel command security.

This extra check is ONLY performed inside SDSF and is made before we build the 
operator command text.

Coincidentally I gave a presentation at virtual GSE today entitled "SDSF 
Security - How does it work under z/OS 2.5?" and the sequence of SAF checks is 
described with a few examples.

If you want, I can forward you the slide deck.

Rob Scott
Rocket Software

Sent from Samsung Mobile on O2
Sent from Outlook for 
Android

From: IBM Mainframe Discussion List  on behalf of 
Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 6:10:11 PM
To: IBM-MAIN@LISTSERV.UA.EDU 
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL




Okay, so not sure I reall understand the way this works?

Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics 
jobname like C30TCI* here? Is this the SDSF command like C, P etc?

Or under OPERCMDS I have

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

And now.

MVS.CANCEL.BAT.C30TCI*.* (G)
MVS.CANCEL.** (G)

Where does the granularity take place, for certain jobs??

I want the users to be able to cancel some batch jobs and everything they 
submitted, but not CICS, DB2 or other system things.

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 9:54 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that one of the "value add" functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like "C" and "P".

Does not stop them using freeform "slash" to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

Re: RACF - SDSF question

[Shaffer, Terri]

Agreed, can you fwd the slide deck?

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 3:52 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that there is no jobname qualifier on the JES2.CANCEL.BAT profile. This is 
why SDSF has the extra JESSPOOL profile check that goes beyond vanilla JES2 
cancel command security.

This extra check is ONLY performed inside SDSF and is made before we build the 
operator command text.

Coincidentally I gave a presentation at virtual GSE today entitled "SDSF 
Security - How does it work under z/OS 2.5?" and the sequence of SAF checks is 
described with a few examples.

If you want, I can forward you the slide deck.

Rob Scott
Rocket Software

Sent from Samsung Mobile on O2
Sent from Outlook for 
Android

From: IBM Mainframe Discussion List  on behalf of 
Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 6:10:11 PM
To: IBM-MAIN@LISTSERV.UA.EDU 
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL




Okay, so not sure I reall understand the way this works?

Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics 
jobname like C30TCI* here? Is this the SDSF command like C, P etc?

Or under OPERCMDS I have

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

And now.

MVS.CANCEL.BAT.C30TCI*.* (G)
MVS.CANCEL.** (G)

Where does the granularity take place, for certain jobs??

I want the users to be able to cancel some batch jobs and everything they 
submitted, but not CICS, DB2 or other system things.

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 9:54 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that one of the "value add" functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like "C" and "P".

Does not stop them using freeform "slash" to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.** then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn't stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don't want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri 

Re: FTP

[Jon Newton]

Hi Steve - 

service.boulder.ibm.com is a valid address and is running FTP service.  I was 
able to successfully connect and "ls" the /s390/holddata directory.

It would be helpful to see the full job output and even better if you include 
TRACE option, eg PARM='service.boulder.ibm.com (TRACE'

My guess is that you've got some default FTP client settings which are not 
compatible with the server...  See FTP.DATA configuration data set.  The trace 
output will hopefully provide more clues.


Jon 

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Lance D. Jackson
Sent: Tuesday, February 7, 2023 1:21 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: FTP

Steve,

 

The only difference I see from what I use is the web address.  Instead of 
service.boulder.ibm.com, try testcase.software.ibm.com.

 

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Steve Beaver
Sent: Tuesday, February 7, 2023 13:09
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: FTP

 

What am I missing or is the URL incorrect?  It times out

 

 

//A819822A JOB (CISHRA,),FTPIBMHOLD,MSGCLASS=X,PRTY=14,

 

//  CLASS=S,NOTIFY=

 

//*

 

//S1 EXEC PGM=FTP,REGION=4M,PARM='service.boulder.ibm.com'

 

//SYSPRINT DD SYSOUT=*

 

//SYSMDUMP DD SYSOUT=*

 

//SYSTSPRT DD SYSOUT=*

 

//OUTPUT   DD SYSOUT=*

 

//INPUTDD *

 

ANONYMOUS

 

steve.beaver@ 

 

cd /s390/holddata

 

ls

 

locsite cy pri=01 sec=01 rec=fb lr=80 blk=8000

 

get full.txt 'A819822.HOLDDATA' (replace

 

quit

 

//

 

get year.txt 'A819822.HOLDDATA' (replace

 

quit

 

//

 

 

--

For IBM-MAIN subscribe / signoff / archive access instructions, send email to  
 lists...@listserv.ua.edu with the
message: INFO IBM-MAIN


--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: GETMAIN LOC=32

[Paul Edwards]

Yeah, not everyone wants double the amount of memory
available to properly-written 32-bit (ie using "L"
etc, not "LG" etc) programs for no cost.

Some people are perfectly happy with 2 GiB. The only
business application I've been made aware of that reaches
the 2 GiB bar is the IBM C compiler doing optimization.

BFN. Paul.




On Tue, 7 Feb 2023 15:33:38 -0600, Tom Marchant  
wrote:

>Is that all you want?
>
>
>
>"I want it because I think it would be cool" is not a business justification.
>
>-- 
>Tom Marchant
>
>On Tue, 7 Feb 2023 12:15:57 -0600, Paul Edwards  wrote:
>
>>The z/OS change that would be required to support
>>negative indexing (which, while fairly uncommon, can't
>>really be avoided - it's a fundamental part of how
>>things work), would be to map the 4-8 GiB region onto
>>0-4 GiB (DAT/virtual storage).
>
>--
>For IBM-MAIN subscribe / signoff / archive access instructions,
>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: GETMAIN LOC=32

[Joe Monk]

While I appreciate the *honorable mention*,  IBM gets all the credit.

Joe

On Tue, Feb 7, 2023 at 12:16 PM Paul Edwards  wrote:

> Since this conversation has petered out, I'd just like to
> add closure (ie add the muddy water).
>
> The z/OS change that would be required to support
> negative indexing (which, while fairly uncommon, can't
> really be avoided - it's a fundamental part of how
> things work), would be to map the 4-8 GiB region onto
> 0-4 GiB (DAT/virtual storage).
>
> This has already been proven to work with z/PDOS.
>
> Note that it took me years to realize this, and it was
> Joe Monk (who posts here) who told me the problem
> could be solved with DAT.
>
> BFN. Paul.
>
>
>
>
> On Thu, 2 Feb 2023 18:55:41 -0600, Paul Edwards 
> wrote:
>
> >Why is the first thing a concern?
> >
> >The second thing is indeed a concern, and that's the thing I
> >alluded to when I said I didn't want to muddy the waters.
> >There is a solution to that, but it requires a z/OS change.
> >
> >BFN. Paul.
> >
> >
> >
> >
> >On Fri, 3 Feb 2023 00:51:08 +, Seymour J Metz  wrote:
> >
> >>My concern is that in no case does LA clear bits 0-31 while leaving the
> lower bits intact. A secondary concern is indexing with negative index
> values.
> >
> >
> >From: IBM Mainframe Discussion List  on behalf
> of Paul Edwards 
> >Sent: Thursday, February 2, 2023 7:33 PM
> >To: IBM-MAIN@LISTSERV.UA.EDU
> >Subject: Re: GETMAIN LOC=32
> >
> >No. Marking the load module as AM64 causes that to happen.
> >
> >What's the point of having documentation for what happens in
> >the different AMODEs if you think I have no control over the
> >AMODE?
> >
> >And if I instead mark the module as AM31, I will not be able to
> >clear the upper 32 bits with an LA. But I don't need to in that
> >case.
> >
> >Perhaps it would be good if you could restate your concern
> >in a simple sentence in case I'm misunderstanding.
> >
> >BFN. Paul.
> >
> >
> >
> >
> >On Fri, 3 Feb 2023 00:26:36 +, Seymour J Metz  wrote:
> >
> >>The LA instructions do *not*  force that to be the case.
> >>
> >>
> >>--
> >>Shmuel (Seymour J.) Metz
> >>http://mason.gmu.edu/~smetz3
> >>
> >>
> >>From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on
> behalf of Paul Edwards [mutazi...@gmail.com]
> >>Sent: Thursday, February 2, 2023 6:42 PM
> >>To: IBM-MAIN@LISTSERV.UA.EDU
> >>Subject: Re: GETMAIN LOC=32
> >>
> >>On Thu, 2 Feb 2023 23:33:17 +, Seymour J Metz 
> wrote:
> >>
> >>>I now of no IBM documentation to justify an expectation that the high
> halves will be zero on entry.
> >>
> >>Correct. Which is why my opening message was to add a series of LA
> >>instructions to force that to be the case myself.
> >>
> >>The main thing I was documenting was that LA was all that was needed.
> >>Previously I thought I either needed a change to the above documentation
> >>or I needed to use the non-S/370 LMH.
> >>
> >>>Chapter 2. Linkage conventions in the Assembler Services Guide is
> pretty clear that the caller expects bits 0-31 of GPRs 2-13 to be unchanged.
> >>
> >>Within a single program, bits 0-31 will indeed be unchanged,
> >>since only 32-bit instructions like LM will be used.
> >>
> >>If called by an external program, it is probably wise for the
> >>external program to not be dependent on the called program
> >>to "do the right thing".
> >>
> >>But regardless, this is up to the user to decide what they
> >>would like to do.
> >>
> >>If you insist that the called program must restore the high
> >>halves of registers and insist to be dependent on the
> >>correct behavior of the called program, then the called
> >>program must be marked AM31 at most.
> >>
> >>That's fine ... for your site and your program.
> >>
> >>I wish to have the option of doing something different. And
> >>getting a caller to preserve their own registers instead of
> >>trusting the called program is something under my control -
> >>I don't need a z/OS change.
> >>
> >>But I am interested in confirming that I haven't missed anything,
> >>before going to the effort of making sure the caller protects
> >>itself ... on my site.
> >>
> >>Note that the effort isn't very much, because it will be for use
> >>by C programs, so there is just a single C library to do the
> >>self-protection and then all C programs benefit.
> >>
> >>BFN. Paul.
> >>
> >>--
> >>For IBM-MAIN subscribe / signoff / archive access instructions,
> >>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> >>
> >>--
> >>For IBM-MAIN subscribe / signoff / archive access instructions,
> >>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> >
> >--
> >For IBM-MAIN subscribe / signoff / archive access instructions,
> 

Re: GETMAIN LOC=32

[Tom Marchant]

Is that all you want?



"I want it because I think it would be cool" is not a business justification.

-- 
Tom Marchant

On Tue, 7 Feb 2023 12:15:57 -0600, Paul Edwards  wrote:

>The z/OS change that would be required to support
>negative indexing (which, while fairly uncommon, can't
>really be avoided - it's a fundamental part of how
>things work), would be to map the 4-8 GiB region onto
>0-4 GiB (DAT/virtual storage).

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script

[Radoslaw Skorupka]

Gentlemen,
Thank you for your help. Both on list, and off list.
I appreciate it.
I have read the examples and I'm going to implement it.


Regards
--
Radoslaw Skorupka
Lodz, Poland

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Calling a COBOL DB2 Stored Procedure

[Mike Bell]

start from the basics - I assume the plan name is DSNREXX. you can
1. bind the DSNREXX plan with your collection and it will find it in the
search list
2; SET CURRENT PACKAGESET = 'your collection'
I haven't played in this area but those are the basics.
Mike

On Tue, Feb 7, 2023 at 2:25 PM Binyamin Dissen 
wrote:

> On Tue, 7 Feb 2023 19:36:12 + Sri h Kolusu  wrote:
>
> :>>> The -805 is occurring for the SQL statement (a SELECT INTO) in the SP.
>
> :>Try the steps listed under "Problem determination" in the link below
>
> :>https://www.ibm.com/docs/en/db2-for-zos/11?topic=codes-805
>
> Thanks. The only possibility is the packageset.
>
> Is there a need to set a packageset before binding the SP package?
>
> Alternatively, is there a need for the CALLing program to set the
> packageset
> before issuing the SELECT INTO?
>
> I am missing something obvious.
>
> --
> Binyamin Dissen 
> http://www.dissensoftware.com
>
> Director, Dissen Software, Bar & Grill - Israel
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>


-- 
Mike

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: RACF - SDSF question

[Ramsey Hallman]

I don't know about others, but I would love to see the slide deck.

Ramsey

On Tue, Feb 7, 2023 at 2:53 PM Rob Scott  wrote:

> Note that there is no jobname qualifier on the JES2.CANCEL.BAT profile.
> This is why SDSF has the extra JESSPOOL profile check that goes beyond
> vanilla JES2 cancel command security.
>
> This extra check is ONLY performed inside SDSF and is made before we build
> the operator command text.
>
> Coincidentally I gave a presentation at virtual GSE today entitled "SDSF
> Security - How does it work under z/OS 2.5?" and the sequence of SAF checks
> is described with a few examples.
>
> If you want, I can forward you the slide deck.
>
> Rob Scott
> Rocket Software
>
> Sent from Samsung Mobile on O2
> Sent from Outlook for Android
> 
> From: IBM Mainframe Discussion List  on behalf
> of Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
> Sent: Tuesday, February 7, 2023 6:10:11 PM
> To: IBM-MAIN@LISTSERV.UA.EDU 
> Subject: Re: RACF - SDSF question
>
> EXTERNAL EMAIL
>
>
>
>
> Okay, so not sure I reall understand the way this works?
>
> Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics
> jobname like C30TCI* here? Is this the SDSF command like C, P etc?
>
> Or under OPERCMDS I have
>
> JES2.CANCEL.BAT.C30TCI* (G)
> JES2.CANCEL.BAT.** (G)
>
> And now.
>
> MVS.CANCEL.BAT.C30TCI*.* (G)
> MVS.CANCEL.** (G)
>
> Where does the granularity take place, for certain jobs??
>
> I want the users to be able to cancel some batch jobs and everything they
> submitted, but not CICS, DB2 or other system things.
>
> Ms Terri E Shaffer
> Senior Systems Engineer,
> z/OS Support:
> ACIWorldwide - Telecommuter
> H(412-766-2697) C(412-519-2592)
> terri.shaf...@aciworldwide.com
>
> -Original Message-
> From: IBM Mainframe Discussion List  On Behalf
> Of Rob Scott
> Sent: Tuesday, February 7, 2023 9:54 AM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: RACF - SDSF question
>
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the
> content is safe.
>
>
> Note that one of the "value add" functions of SDSF is that it can check
> for ALTER access to the JESSPOOL profile for the owner and jobname for
> destructive actions like "C" and "P".
>
> Does not stop them using freeform "slash" to issue the raw operator
> command, but removes the convenience of the action character.
>
> Rob Scott
> Rocket Software
>
> From: IBM Mainframe Discussion List  On Behalf
> Of Roger W Suhr
> Sent: 07 February 2023 14:22
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: RACF - SDSF question
>
> EXTERNAL EMAIL
>
>
>
> Hi Ms. Terri,
>
> The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel
> command.
> I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id
> profile to protect the MVS CANCEL command.
>
> So in your case, that would be something like this: (if your running CICS
> as an STC!)
> MVS.CANCEL.STC.C30TCI* (G)
> MVS.CANCEL.STC.** (G)
>
>
> Roger W. Suhr
>
> suhr...@gmail.com
>
> -Original Message-
> From: IBM Mainframe Discussion List  IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of Shaffer, Terri
> Sent: Tuesday, February 7, 2023 8:32
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: RACF - SDSF question
>
> Hi,
> I know there is a RACF group, but hopefully this is simple and I am just
> missing something I have done 100 times over with no issues.
>
> We run our CICS regions as batch jobs, and I just found out a user instead
> of them issuing a CEMT PERF SHUT command, they are canceling it.
>
> Which then causing a 100 vsam messages on startup with all the verifies,
> and if something goes wrong they call me...
>
> So I tried to stop this habit, I know they are putting a C beside the CICS
> and a $CJ(x) command
>
> So I have 2 rules in RACF under OPERCMDS
>
> JES2.CANCEL.BAT.C30TCI* (G)
> JES2.CANCEL.BAT.** (G)
>
> If I restrict the BAT.** then they cant cancel even their own batch jobs,
> So I always thought more specific is looked at first?
>
> One of my previous co-workers implemented SDSF-RACF rules converted from
> ISFPARMS.
>
> Lastly, I understand this doesn't stop them from canceling any other jobs,
> but since this is a development shop we allow more access than most.
>
> But I don't want users canceling a CICS or DB2 etc.
>
> Any ideas how they are getting the access and not stopped with the more
> specific rule??
>
>
> Ms Terri E Shaffer
> Senior Systems Engineer,
> z/OS Support:
> ACIWorldwide - Telecommuter
> H(412-766-2697) C(412-519-2592)
> terri.shaf...@aciworldwide.com
>
> 
> [https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg<
> https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg><
> https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg<
> 

Re: RACF - SDSF question

[Rob Scott]

Note that there is no jobname qualifier on the JES2.CANCEL.BAT profile. This is 
why SDSF has the extra JESSPOOL profile check that goes beyond vanilla JES2 
cancel command security.

This extra check is ONLY performed inside SDSF and is made before we build the 
operator command text.

Coincidentally I gave a presentation at virtual GSE today entitled "SDSF 
Security - How does it work under z/OS 2.5?" and the sequence of SAF checks is 
described with a few examples.

If you want, I can forward you the slide deck.

Rob Scott
Rocket Software

Sent from Samsung Mobile on O2
Sent from Outlook for Android

From: IBM Mainframe Discussion List  on behalf of 
Shaffer, Terri <017d5f778222-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 6:10:11 PM
To: IBM-MAIN@LISTSERV.UA.EDU 
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL




Okay, so not sure I reall understand the way this works?

Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics 
jobname like C30TCI* here? Is this the SDSF command like C, P etc?

Or under OPERCMDS I have

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

And now.

MVS.CANCEL.BAT.C30TCI*.* (G)
MVS.CANCEL.** (G)

Where does the granularity take place, for certain jobs??

I want the users to be able to cancel some batch jobs and everything they 
submitted, but not CICS, DB2 or other system things.

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 9:54 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that one of the "value add" functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like "C" and "P".

Does not stop them using freeform "slash" to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.** then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn't stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don't want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com


[https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg>]
 
>>
 This email message and any attachments may contain confidential, proprietary 
or non-public information. The information is intended solely for the 
designated recipient(s). If an addressing or transmission error has misdirected 
this 

Re: Calling a COBOL DB2 Stored Procedure

[Binyamin Dissen]

On Tue, 7 Feb 2023 19:36:12 + Sri h Kolusu  wrote:

:>>> The -805 is occurring for the SQL statement (a SELECT INTO) in the SP.

:>Try the steps listed under "Problem determination" in the link below

:>https://www.ibm.com/docs/en/db2-for-zos/11?topic=codes-805

Thanks. The only possibility is the packageset.

Is there a need to set a packageset before binding the SP package?

Alternatively, is there a need for the CALLing program to set the packageset
before issuing the SELECT INTO?

I am missing something obvious.

--
Binyamin Dissen 
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Virtual tape mount error

[Peter]

I can see the volcat entry

Not sure what exactly it is missing

The D SMS,VOL(xzzz) volume details



On Tue, Feb 7, 2023, 11:34 PM Mike Baldwin  wrote:

> Hi Peter,
>
> In that case, the message doc. says:
>
> MLNOTVR No TCDB TVR entry exists for this MTL volume.
>
> Regards,
> Mike Baldwin
> Cartagena Software Limited
> Markham, Ontario, Canada
> https://cartagena.com
>
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Calling a COBOL DB2 Stored Procedure

[Sri h Kolusu]

>> The -805 is occurring for the SQL statement (a SELECT INTO) in the SP.

Binyamin,

Try the steps listed under "Problem determination" in the link below

https://www.ibm.com/docs/en/db2-for-zos/11?topic=codes-805

Thanks,
Kolusu

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Virtual tape mount error

[Mike Baldwin]

Hi Peter,

In that case, the message doc. says:

MLNOTVR No TCDB TVR entry exists for this MTL volume.

Regards,
Mike Baldwin
Cartagena Software Limited
Markham, Ontario, Canada
https://cartagena.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Calling a COBOL DB2 Stored Procedure

[Binyamin Dissen]

On Tue, 7 Feb 2023 09:48:28 -0600 Mike Bell  wrote:

:>you forgot the bind step - when you created the stored procedure the JCL
:>should have had a ddname for DBRMLIB usually a pds with a member name the
:>same as your stored procedure. I don't have a sample bind handy but the
:>manual has several.

I did BIND the SP package and the EXECSQL CALL from REXX is working.

The -805 is occurring for the SQL statement (a SELECT INTO) in the SP.

:>On Tue, Feb 7, 2023 at 5:40 AM Binyamin Dissen 
:>wrote:
:>
:>> I have written a COBOL Stored Procedure and have successfully invoked it
:>> from
:>> REXX.

:>> But when I add an SQL statement to the SP, the SQL statement is getting
:>> -805.

:>> Is there a requirement to add the package(s) of external SPs to the PLAN of
:>> the invoking  program? Seems like an onerous requirement.

:>> Am I missing an obvious step?

:>> The CREATE PROCEDURE

:>> CREATE PROCEDURE SYSPROC.SP01 (
:>>IN  EMPNO   CHAR(6)   CCSID EBCDIC,
:>>OUT WORKDEPTCHAR(3)   CCSID EBCDIC,
:>>OUT INFORETURN  CHAR(100) CCSID EBCDIC)
:>>LANGUAGE COBOL
:>>READS SQL DATA
:>>EXTERNAL NAME ''
:>>PARAMETER STYLE SQL
:>>DBINFO
:>>COMMIT ON RETURN NO
:>>CALLED ON NULL INPUT

--
Binyamin Dissen 
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Virtual tape mount error

[Peter]

Hi Mike

I am getting MLNTOVR

On Tue, Feb 7, 2023, 10:54 PM Mike Baldwin  wrote:

> Hi Peter,
>
> The message IEC518I doc says: MLNOMTL Volume does not reside in this
> Manual Tape Library.
>
> System programmer response
> ...System command D SMS,VOLUME(volser) will provide additional volume
> status.
>
> Programmer response
> Report software error category to library subsystem administrator.
>
> One of our customers reported this problem before:
>
> Receive: IEC518I sfw err stat MLNOMTL
> ...
> I seem to have the MTL business working - had made an error
> defining the volume entries, and after I'd initialized the tapes, all
> seemed fine. Thanks for your help.
>
> I had originally defined them using the following:
>
> CREATEVOLUMEENTRY (NAME(VMVS011) +
>LIBRARYNAME(MTL3590) +
>STORAGEGROUP(MTL3590))
>
> which actually gives a message, which I didn't notice, saying that the
> library name has been defaulted to SHELF, even though it's specified
> explicitly.
>
> When I changed it to:
>
> CREATEVOLUMEENTRY (NAME(VMVS011) +
>LIBRARYNAME(MTL3590) +
>LOCATION(LIBRARY) +
>STORAGEGROUP(MTL3590))
>
> the entries were correct.  Also, as I said, I made sure that all the
> cartridges were initialized correctly.
>
> HTH,
> Mike Baldwin
> Cartagena Software Limited
> Markham, Ontario, Canada
> https://cartagena.com
>
>
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Virtual tape mount error

[Mike Baldwin]

Hi Peter,

The message IEC518I doc says: MLNOMTL Volume does not reside in this Manual 
Tape Library.

System programmer response
...System command D SMS,VOLUME(volser) will provide additional volume status. 

Programmer response
Report software error category to library subsystem administrator.

One of our customers reported this problem before:

Receive: IEC518I sfw err stat MLNOMTL 
...
I seem to have the MTL business working - had made an error 
defining the volume entries, and after I'd initialized the tapes, all
seemed fine. Thanks for your help.   
 
I had originally defined them using the following:   
 
CREATEVOLUMEENTRY (NAME(VMVS011) +   
   LIBRARYNAME(MTL3590) +
   STORAGEGROUP(MTL3590))
 
which actually gives a message, which I didn't notice, saying that the   
library name has been defaulted to SHELF, even though it's specified 
explicitly.  
 
When I changed it to:
 
CREATEVOLUMEENTRY (NAME(VMVS011) +   
   LIBRARYNAME(MTL3590) +
   LOCATION(LIBRARY) +   
   STORAGEGROUP(MTL3590))

the entries were correct.  Also, as I said, I made sure that all the
cartridges were initialized correctly.

HTH,
Mike Baldwin
Cartagena Software Limited
Markham, Ontario, Canada
https://cartagena.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: FTP

[Lance D. Jackson]

Steve,

 

The only difference I see from what I use is the web address.  Instead of
service.boulder.ibm.com, try testcase.software.ibm.com.

 

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of
Steve Beaver
Sent: Tuesday, February 7, 2023 13:09
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: FTP

 

What am I missing or is the URL incorrect?  It times out

 

 

//A819822A JOB (CISHRA,),FTPIBMHOLD,MSGCLASS=X,PRTY=14,

 

//  CLASS=S,NOTIFY=

 

//*

 

//S1 EXEC PGM=FTP,REGION=4M,PARM='service.boulder.ibm.com'

 

//SYSPRINT DD SYSOUT=*

 

//SYSMDUMP DD SYSOUT=*

 

//SYSTSPRT DD SYSOUT=*

 

//OUTPUT   DD SYSOUT=*

 

//INPUTDD *

 

ANONYMOUS

 

steve.beaver@ 

 

cd /s390/holddata

 

ls

 

locsite cy pri=01 sec=01 rec=fb lr=80 blk=8000

 

get full.txt 'A819822.HOLDDATA' (replace

 

quit

 

//

 

get year.txt 'A819822.HOLDDATA' (replace

 

quit

 

//

 

 

--

For IBM-MAIN subscribe / signoff / archive access instructions, send email
to   lists...@listserv.ua.edu with the
message: INFO IBM-MAIN


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: GETMAIN LOC=32

[Paul Edwards]

Since this conversation has petered out, I'd just like to
add closure (ie add the muddy water).

The z/OS change that would be required to support
negative indexing (which, while fairly uncommon, can't
really be avoided - it's a fundamental part of how
things work), would be to map the 4-8 GiB region onto
0-4 GiB (DAT/virtual storage).

This has already been proven to work with z/PDOS.

Note that it took me years to realize this, and it was
Joe Monk (who posts here) who told me the problem
could be solved with DAT.

BFN. Paul.




On Thu, 2 Feb 2023 18:55:41 -0600, Paul Edwards  wrote:

>Why is the first thing a concern?
>
>The second thing is indeed a concern, and that's the thing I
>alluded to when I said I didn't want to muddy the waters.
>There is a solution to that, but it requires a z/OS change.
>
>BFN. Paul.
>
>
>
>
>On Fri, 3 Feb 2023 00:51:08 +, Seymour J Metz  wrote:
>
>>My concern is that in no case does LA clear bits 0-31 while leaving the lower 
>>bits intact. A secondary concern is indexing with negative index values.
>
>
>From: IBM Mainframe Discussion List  on behalf of 
>Paul Edwards 
>Sent: Thursday, February 2, 2023 7:33 PM
>To: IBM-MAIN@LISTSERV.UA.EDU
>Subject: Re: GETMAIN LOC=32
>
>No. Marking the load module as AM64 causes that to happen.
>
>What's the point of having documentation for what happens in
>the different AMODEs if you think I have no control over the
>AMODE?
>
>And if I instead mark the module as AM31, I will not be able to
>clear the upper 32 bits with an LA. But I don't need to in that
>case.
>
>Perhaps it would be good if you could restate your concern
>in a simple sentence in case I'm misunderstanding.
>
>BFN. Paul.
>
>
>
>
>On Fri, 3 Feb 2023 00:26:36 +, Seymour J Metz  wrote:
>
>>The LA instructions do *not*  force that to be the case.
>>
>>
>>--
>>Shmuel (Seymour J.) Metz
>>http://mason.gmu.edu/~smetz3
>>
>>
>>From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of 
>>Paul Edwards [mutazi...@gmail.com]
>>Sent: Thursday, February 2, 2023 6:42 PM
>>To: IBM-MAIN@LISTSERV.UA.EDU
>>Subject: Re: GETMAIN LOC=32
>>
>>On Thu, 2 Feb 2023 23:33:17 +, Seymour J Metz  wrote:
>>
>>>I now of no IBM documentation to justify an expectation that the high halves 
>>>will be zero on entry.
>>
>>Correct. Which is why my opening message was to add a series of LA
>>instructions to force that to be the case myself.
>>
>>The main thing I was documenting was that LA was all that was needed.
>>Previously I thought I either needed a change to the above documentation
>>or I needed to use the non-S/370 LMH.
>>
>>>Chapter 2. Linkage conventions in the Assembler Services Guide is pretty 
>>>clear that the caller expects bits 0-31 of GPRs 2-13 to be unchanged.
>>
>>Within a single program, bits 0-31 will indeed be unchanged,
>>since only 32-bit instructions like LM will be used.
>>
>>If called by an external program, it is probably wise for the
>>external program to not be dependent on the called program
>>to "do the right thing".
>>
>>But regardless, this is up to the user to decide what they
>>would like to do.
>>
>>If you insist that the called program must restore the high
>>halves of registers and insist to be dependent on the
>>correct behavior of the called program, then the called
>>program must be marked AM31 at most.
>>
>>That's fine ... for your site and your program.
>>
>>I wish to have the option of doing something different. And
>>getting a caller to preserve their own registers instead of
>>trusting the called program is something under my control -
>>I don't need a z/OS change.
>>
>>But I am interested in confirming that I haven't missed anything,
>>before going to the effort of making sure the caller protects
>>itself ... on my site.
>>
>>Note that the effort isn't very much, because it will be for use
>>by C programs, so there is just a single C library to do the
>>self-protection and then all C programs benefit.
>>
>>BFN. Paul.
>>
>>--
>>For IBM-MAIN subscribe / signoff / archive access instructions,
>>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>>
>>--
>>For IBM-MAIN subscribe / signoff / archive access instructions,
>>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
>--
>For IBM-MAIN subscribe / signoff / archive access instructions,
>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
>>--
>>For IBM-MAIN subscribe / signoff / archive access instructions,
>>send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
>--
>For IBM-MAIN subscribe / 

Re: RACF - SDSF question

[Shaffer, Terri]

Okay, so not sure I reall understand the way this works?

Under jesspool, checks nodeid.userid.jobname.jobid, so I could add my cics 
jobname like C30TCI* here?  Is this the SDSF command like C, P etc?

Or under OPERCMDS I have

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

And now.

MVS.CANCEL.BAT.C30TCI*.* (G)
MVS.CANCEL.** (G)

Where does the granularity take place, for certain jobs??

I want the users to be able to cancel some batch jobs and everything they 
submitted, but not CICS, DB2 or other system things.

Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of Rob 
Scott
Sent: Tuesday, February 7, 2023 9:54 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL: Do not click links or open attachments unless you know the 
content is safe.


Note that one of the "value add" functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like "C" and "P".

Does not stop them using freeform "slash" to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.** then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn't stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don't want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide - Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com


[https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg]
 > This email message 
and any attachments may contain confidential, proprietary or non-public 
information. The information is intended solely for the designated 
recipient(s). If an addressing or transmission error has misdirected this 
email, please notify the sender immediately and destroy this email. Any review, 
dissemination, use or reliance upon this information by unintended recipients 
is prohibited. Any opinions expressed in this email are those of the author 
personally.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: 
INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: 
INFO IBM-MAIN


Rocket Software, Inc. and subsidiaries ■ 77 Fourth Avenue, Waltham MA 02451 ■ 
Main Office Toll Free Number: +1 855.577.4323 Contact Customer Support: 

FTP

[Steve Beaver]

What am I missing or is the URL incorrect?  It times out

 

//A819822A JOB (CISHRA,),FTPIBMHOLD,MSGCLASS=X,PRTY=14,

//  CLASS=S,NOTIFY=

//*

//S1 EXEC PGM=FTP,REGION=4M,PARM='service.boulder.ibm.com'

//SYSPRINT DD SYSOUT=*

//SYSMDUMP DD SYSOUT=*

//SYSTSPRT DD SYSOUT=*

//OUTPUT   DD SYSOUT=*

//INPUTDD *

ANONYMOUS

steve.beaver@ 

cd /s390/holddata

ls

locsite cy pri=01 sec=01 rec=fb lr=80 blk=8000

get full.txt 'A819822.HOLDDATA' (replace

quit

//

get year.txt 'A819822.HOLDDATA' (replace

quit

//


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script,

[Seymour J Metz]

I would expect an RFE for compound ISPF variable names to also request long 
names.


From: IBM Mainframe Discussion List  on behalf of 
Schmitt, Michael 
Sent: Tuesday, February 7, 2023 12:32 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: ISPF macro/script,

The bigger restriction is that any variable name known to ISPF has to be 8 
characters or less. So you'd have to squeeze the entirety of the compound name 
into 8 characters.

I kind of like that I can *prevent* ISPF from seeing variables by using illegal 
names.

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Seymour J Metz
Sent: Tuesday, February 7, 2023 10:48 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Fw: ISPF macro/script,

ISPF compound variables would cause problems for CLIST, EXEC and EXEC2, but 
that might not be a bad thing. RFE?

From: IBM Mainframe Discussion List  on behalf of 
Paul Gilmartin <042bfe9c879d-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 11:40 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: ISPF macro/script

On Tue, 7 Feb 2023 04:03:59 -0600, Willy Jensen wrote:
>...
> /* Insert template */
> s='Template line 1'
> "line_after .zl = (s)"
> s='Template line 2'
> "line_after .zl = (s)"
>
> and so on and so forth
>
For some chores similar to this it's a crying shame that ISPF shuns
compound symbols:
/* Suppose the content to insert is in stem TemplateLine.  */
do L = 1 to TemplateLine.0
address ISREDIT "line_after .zl = (TemplateLine.L)"
end L

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script,

[Seymour J Metz]

The issue is when someone has a compound or long ISPF script name and someone 
else wants to use CLIST, EXEC or EXEC2 for another script in the same 
application. I see discouraging use of those older languages for new scripts as 
a good thing, but others might not se it that way.


From: IBM Mainframe Discussion List  on behalf of 
Paul Gilmartin <042bfe9c879d-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 12:31 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: ISPF macro/script,

On Tue, 7 Feb 2023 16:48:29 +, Seymour J Metz wrote:

>ISPF compound variables would cause problems for CLIST, EXEC and EXEC2, but 
>that might not be a bad thing. RFE?
>
I would not presume to suggest that the syntax of ISPF variables be extended;
rather the relatively modest extension to script variable names.  The entire 
string
between '(' and ')' should be passed ASIS to (e.g.) IRXEXCOM and any errors
reported.

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script,

[Schmitt, Michael]

The bigger restriction is that any variable name known to ISPF has to be 8 
characters or less. So you'd have to squeeze the entirety of the compound name 
into 8 characters.

I kind of like that I can *prevent* ISPF from seeing variables by using illegal 
names.

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Seymour J Metz
Sent: Tuesday, February 7, 2023 10:48 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Fw: ISPF macro/script,

ISPF compound variables would cause problems for CLIST, EXEC and EXEC2, but 
that might not be a bad thing. RFE?

From: IBM Mainframe Discussion List  on behalf of 
Paul Gilmartin <042bfe9c879d-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 11:40 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: ISPF macro/script

On Tue, 7 Feb 2023 04:03:59 -0600, Willy Jensen wrote:
>...
> /* Insert template */
> s='Template line 1'
> "line_after .zl = (s)"
> s='Template line 2'
> "line_after .zl = (s)"
>
> and so on and so forth
>
For some chores similar to this it's a crying shame that ISPF shuns
compound symbols:
/* Suppose the content to insert is in stem TemplateLine.  */
do L = 1 to TemplateLine.0
address ISREDIT "line_after .zl = (TemplateLine.L)"
end L

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script,

[Paul Gilmartin]

On Tue, 7 Feb 2023 16:48:29 +, Seymour J Metz wrote:

>ISPF compound variables would cause problems for CLIST, EXEC and EXEC2, but 
>that might not be a bad thing. RFE?
>
I would not presume to suggest that the syntax of ISPF variables be extended;
rather the relatively modest extension to script variable names.  The entire 
string
between '(' and ')' should be passed ASIS to (e.g.) IRXEXCOM and any errors
reported.

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Fw: ISPF macro/script,

[Seymour J Metz]

ISPF compound variables would cause problems for CLIST, EXEC and EXEC2, but 
that might not be a bad thing. RFE?

From: IBM Mainframe Discussion List  on behalf of 
Paul Gilmartin <042bfe9c879d-dmarc-requ...@listserv.ua.edu>
Sent: Tuesday, February 7, 2023 11:40 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: ISPF macro/script

On Tue, 7 Feb 2023 04:03:59 -0600, Willy Jensen wrote:
>...
> /* Insert template */
> s='Template line 1'
> "line_after .zl = (s)"
> s='Template line 2'
> "line_after .zl = (s)"
>
> and so on and so forth
>
For some chores similar to this it's a crying shame that ISPF shuns
compound symbols:
/* Suppose the content to insert is in stem TemplateLine.  */
do L = 1 to TemplateLine.0
address ISREDIT "line_after .zl = (TemplateLine.L)"
end L

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script

[Paul Gilmartin]

On Tue, 7 Feb 2023 04:03:59 -0600, Willy Jensen wrote:
>...
> /* Insert template */   
> s='Template line 1' 
> "line_after .zl = (s)"  
> s='Template line 2' 
> "line_after .zl = (s)"  
>
> and so on and so forth
>
For some chores similar to this it's a crying shame that ISPF shuns
compound symbols:
/* Suppose the content to insert is in stem TemplateLine.  */
do L = 1 to TemplateLine.0
address ISREDIT "line_after .zl = (TemplateLine.L)"
end L

-- 
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: RACF - SDSF question

[Dana Mitchell]

Terri said their CICSs are run as jobs, so it would need to be:

MVS.CANCEL.JOB.C30TCI*  (G)
MVS.CANCEL.JOB.**  (G)

Dana

On Tue, 7 Feb 2023 09:22:19 -0500, Roger W Suhr  wrote:

>Hi Ms. Terri,
>
>The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
>I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
>to protect the MVS CANCEL command.
>   
>So in your case, that would be something like this: (if your running CICS as 
>an STC!)
>MVS.CANCEL.STC.C30TCI* (G)
>MVS.CANCEL.STC.** (G)
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Calling a COBOL DB2 Stored Procedure

[Mike Bell]

you forgot the bind step - when you created the stored procedure the JCL
should have had a ddname for DBRMLIB usually a pds with a member name the
same as your stored procedure. I don't have a sample bind handy but the
manual has several.

Mike

On Tue, Feb 7, 2023 at 5:40 AM Binyamin Dissen 
wrote:

> I have written a COBOL Stored Procedure and have successfully invoked it
> from
> REXX.
>
> But when I add an SQL statement to the SP, the SQL statement is getting
> -805.
>
> Is there a requirement to add the package(s) of external SPs to the PLAN of
> the invoking  program? Seems like an onerous requirement.
>
> Am I missing an obvious step?
>
> The CREATE PROCEDURE
>
> CREATE PROCEDURE SYSPROC.SP01 (
>IN  EMPNO   CHAR(6)   CCSID EBCDIC,
>OUT WORKDEPTCHAR(3)   CCSID EBCDIC,
>OUT INFORETURN  CHAR(100) CCSID EBCDIC)
>LANGUAGE COBOL
>READS SQL DATA
>EXTERNAL NAME ''
>PARAMETER STYLE SQL
>DBINFO
>COMMIT ON RETURN NO
>CALLED ON NULL INPUT
>
> --
> Binyamin Dissen 
> http://www.dissensoftware.com
>
> Director, Dissen Software, Bar & Grill - Israel
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>


-- 
Mike

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Virtual tape mount error

[Peter]

Hello

I am recieving this error message for one of our database backup system and
the drive is virtual tape drive

I see the virtual tape volser doesn't show any error status in RMM

not sure what needs to be done.

Could someone please shed some light on this



IEC518I SOFTWARE ERRSTAT: MLNOTVR 1322,,SL,HKBK03DS,MERGE

IEC502E R 1322,11209,SL,DDSAVE1-9,HKBK03DS,MERGE

IEC501A M 1322,PRIVAT,SL,NOCOMP,HKBK03DS,MERGE,BACKUP.ADAPROD

IEC518I SOFTWARE ERRSTAT: MLNOTVR 1322,,SL,HKBK03DS,MERGE

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: RACF - SDSF question

[Rob Scott]

Note that one of the “value add” functions of SDSF is that it can check for 
ALTER access to the JESSPOOL profile for the owner and jobname for destructive 
actions like “C” and “P”.

Does not stop them using freeform “slash” to issue the raw operator command, 
but removes the convenience of the action character.

Rob Scott
Rocket Software

From: IBM Mainframe Discussion List  On Behalf Of 
Roger W Suhr
Sent: 07 February 2023 14:22
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: RACF - SDSF question

EXTERNAL EMAIL



Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List 
mailto:IBM-MAIN@LISTSERV.UA.EDU>> On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.** then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn’t stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don’t want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide – Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com


[https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg]
 > This email message 
and any attachments may contain confidential, proprietary or non-public 
information. The information is intended solely for the designated 
recipient(s). If an addressing or transmission error has misdirected this 
email, please notify the sender immediately and destroy this email. Any review, 
dissemination, use or reliance upon this information by unintended recipients 
is prohibited. Any opinions expressed in this email are those of the author 
personally.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: 
INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with 
the message: INFO IBM-MAIN


Rocket Software, Inc. and subsidiaries ■ 77 Fourth Avenue, Waltham MA 02451 ■ 
Main Office Toll Free Number: +1 855.577.4323
Contact Customer Support: 
https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport
Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - 
http://www.rocketsoftware.com/manage-your-email-preferences
Privacy Policy - http://www.rocketsoftware.com/company/legal/privacy-policy


This communication and any attachments may contain confidential information of 
Rocket Software, Inc. All unauthorized use, disclosure or distribution is 
prohibited. If you are not the intended recipient, please notify Rocket 
Software immediately and destroy all copies of this communication. Thank you.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: RACF - SDSF question

[Roger W Suhr]

Hi Ms. Terri,

The OPERCMDS JES2.CANCEL.** profiles protect the JES2 ($C...) cancel command.
I believe you also need to use the OPERCMDS MVS.CANCEL.STC.mbrname.id profile 
to protect the MVS CANCEL command.

So in your case, that would be something like this: (if your running CICS as an 
STC!)
MVS.CANCEL.STC.C30TCI* (G)
MVS.CANCEL.STC.** (G)


Roger W. Suhr

suhr...@gmail.com

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Shaffer, Terri
Sent: Tuesday, February 7, 2023 8:32
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: RACF - SDSF question

Hi,
 I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.**  then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn’t stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don’t want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide – Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com


 [https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg] 
 This email message and any attachments may 
contain confidential, proprietary or non-public information. The information is 
intended solely for the designated recipient(s). If an addressing or 
transmission error has misdirected this email, please notify the sender 
immediately and destroy this email. Any review, dissemination, use or reliance 
upon this information by unintended recipients is prohibited. Any opinions 
expressed in this email are those of the author personally.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

RACF - SDSF question

[Shaffer, Terri]

Hi,
 I know there is a RACF group, but hopefully this is simple and I am just 
missing something I have done 100 times over with no issues.

We run our CICS regions as batch jobs, and I just found out a user instead of 
them issuing a CEMT PERF SHUT command, they are canceling it.

Which then causing a 100 vsam messages on startup with all the verifies, and if 
something goes wrong they call me...

So I tried to stop this habit, I know they are putting a C beside the CICS and 
a $CJ(x) command

So I have 2 rules in RACF under OPERCMDS

JES2.CANCEL.BAT.C30TCI* (G)
JES2.CANCEL.BAT.** (G)

If I restrict the BAT.**  then they cant cancel even their own batch jobs, So I 
always thought more specific is looked at first?

One of my previous co-workers implemented SDSF-RACF rules converted from 
ISFPARMS.

Lastly, I understand this doesn’t stop them from canceling any other jobs, but 
since this is a development shop we allow more access than most.

But I don’t want users canceling a CICS or DB2 etc.

Any ideas how they are getting the access and not stopped with the more 
specific rule??


Ms Terri E Shaffer
Senior Systems Engineer,
z/OS Support:
ACIWorldwide – Telecommuter
H(412-766-2697) C(412-519-2592)
terri.shaf...@aciworldwide.com


 [https://go.aciworldwide.com/rs/030-ROK-804/images/aci-footer.jpg] 

This email message and any attachments may contain confidential, proprietary or 
non-public information. The information is intended solely for the designated 
recipient(s). If an addressing or transmission error has misdirected this 
email, please notify the sender immediately and destroy this email. Any review, 
dissemination, use or reliance upon this information by unintended recipients 
is prohibited. Any opinions expressed in this email are those of the author 
personally.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IFASMFDP

[Carmen Vitullo]

yes, I replied to the OP that I responded too quickly and misspoke  - my 
bad


Carmen

On 2/7/2023 7:02 AM, Allan Staller wrote:

Classification: Confidential

NO. IFASMFDL is used to process logstreams

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Carmen Vitullo
Sent: Monday, February 6, 2023 10:43 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IFASMFDP

[CAUTION: This Email is from outside the Organization. Unless you trust the 
sender, Don’t click links or open attachments as it may be a Phishing email, 
which can steal your Information and compromise your Computer.]

yes, SMF logstreams

Carmen

On 2/6/2023 10:33 AM, Steve Beaver wrote:

Good Morning folks,



My question is an IFASMPDP process Logger files?







Regards,





Steve Beaver


--
For IBM-MAIN subscribe / signoff / archive access instructions, send
email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
Carmen

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN
::DISCLAIMER::

The contents of this e-mail and any attachment(s) are confidential and intended 
for the named recipient(s) only. E-mail transmission is not guaranteed to be 
secure or error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or may contain viruses in transmission. 
The e mail and its contents (with or without referred errors) shall therefore 
not attach any liability on the originator or HCL or its affiliates. Views or 
opinions, if any, presented in this email are solely those of the author and 
may not necessarily reflect the views or opinions of HCL or its affiliates. Any 
form of reproduction, dissemination, copying, disclosure, modification, 
distribution and / or publication of this message without the prior written 
consent of authorized representative of HCL is strictly prohibited. If you have 
received this email in error please delete it and notify the sender 
immediately. Before opening any email and/or attachments, please check them for 
viruses and other defects.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
Carmen

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IFASMFDP

[Allan Staller]

Classification: Confidential

NO. IFASMFDL is used to process logstreams

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Carmen Vitullo
Sent: Monday, February 6, 2023 10:43 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IFASMFDP

[CAUTION: This Email is from outside the Organization. Unless you trust the 
sender, Don’t click links or open attachments as it may be a Phishing email, 
which can steal your Information and compromise your Computer.]

yes, SMF logstreams

Carmen

On 2/6/2023 10:33 AM, Steve Beaver wrote:
> Good Morning folks,
>
>
>
> My question is an IFASMPDP process Logger files?
>
>
>
>
>
>
>
> Regards,
>
>
>
>
>
> Steve Beaver
>
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions, send
> email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
--
Carmen

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN
::DISCLAIMER::

The contents of this e-mail and any attachment(s) are confidential and intended 
for the named recipient(s) only. E-mail transmission is not guaranteed to be 
secure or error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or may contain viruses in transmission. 
The e mail and its contents (with or without referred errors) shall therefore 
not attach any liability on the originator or HCL or its affiliates. Views or 
opinions, if any, presented in this email are solely those of the author and 
may not necessarily reflect the views or opinions of HCL or its affiliates. Any 
form of reproduction, dissemination, copying, disclosure, modification, 
distribution and / or publication of this message without the prior written 
consent of authorized representative of HCL is strictly prohibited. If you have 
received this email in error please delete it and notify the sender 
immediately. Before opening any email and/or attachments, please check them for 
viruses and other defects.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Calling a COBOL DB2 Stored Procedure

[Binyamin Dissen]

I have written a COBOL Stored Procedure and have successfully invoked it from
REXX.

But when I add an SQL statement to the SP, the SQL statement is getting -805.

Is there a requirement to add the package(s) of external SPs to the PLAN of
the invoking  program? Seems like an onerous requirement.

Am I missing an obvious step?

The CREATE PROCEDURE

CREATE PROCEDURE SYSPROC.SP01 (   
   IN  EMPNO   CHAR(6)   CCSID EBCDIC,
   OUT WORKDEPTCHAR(3)   CCSID EBCDIC,
   OUT INFORETURN  CHAR(100) CCSID EBCDIC)
   LANGUAGE COBOL 
   READS SQL DATA 
   EXTERNAL NAME ''   
   PARAMETER STYLE SQL
   DBINFO 
   COMMIT ON RETURN NO
   CALLED ON NULL INPUT   

--
Binyamin Dissen 
http://www.dissensoftware.com

Director, Dissen Software, Bar & Grill - Israel

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script

[Willy Jensen]

If it is a short template then you can insert the lines from the macro. Replace 
the COPY command with

 /* Insert template */   
 s='Template line 1' 
 "line_after .zl = (s)"  
 s='Template line 2' 
 "line_after .zl = (s)"  

 and so on and so forth

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: ISPF macro/script

[Willy Jensen]

I think this is the shortest sample I can come up with. It generates first or 
next membername for the day, then edits that member using itself as edit macro. 
The edit macro part copies the template and saves the member. Remove the 
'CANCEL' command to stay in edit.
The command can be executed from a dataset list, or from a member list.
You must of course change the 'your.template.lib' to your own library.
/*rexx  
*/  
 Address Isredit "MACRO PROCESS (PRM)"  
 if rc=0 then exit EditMac() /* edit macro */   

 chrl='?ABCDEFGHIJKLMNOPQRSTUVWXYZ' 
 parse source @sys @what @me @ddn @where .  

 /* get dsn from parm */
 parse value translate(arg(1)," ","'()") with dsn . 

 /* get member list using TSO services */   
 zz=outtrap('mbl.') 
 "listds '"dsn"' members"   
 zz=outtrap('off')  

 /* Locate previous members with date, member base is Dyymmdd */
 mbrb='D'substr(date('s'),3)
 do n=mbl.0 to 7 by -1 until left(mbr,7)=mbrb   
   mbr=strip(mbl.n) 
 end
 if left(mbr,7)=mbrb then c=right(mbr,1)  /* found one */   
 else c='?'   /* 1st of day, use A */   
 mbr=mbrb||substr(chrl,pos(c,chrl)+1,1)   /* make new mbrname  */   

 /* edit (create) new member, using self as macro */
 Address ispexec "Edit dataset('"dsn"("mbr")') macro("@me")"
 exit 0 

/* Here is the inline edit macro */ 
EditMac:
 Address Isredit
 "(ds)=dataset" 
 "(mb)=member " 
 /* Get template */ 
 "Copy 'your.template.lib(TEMPLATE)' after .zf"  /* insert after first */ 
 /* save and quit */
 "save" 
 "cancel"/* to avoid any prompts */ 
 exit 0

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN