Actually I believe that the 'concerned' group is right. Not only do each of our sysplexes have its own unique RACF data base, one 'bronze-plex' full-function parallel sysplex has two different RACF data bases. This is because a while back we bolted together a development plex and a Tier 2 production plex for software licensing reasons. Access rules for the development system are not necessarily appropriate for the production system, so we've kept two RACF data bases.
What you *cannot* do is share two RACF data bases via coupling facility structures. On the other hand, you *can* share some systems via CF and leave the other(s) non-shared. In our case, we're fortunate to have only one production system in this sysplex, so he is non-shared. The development systems can then use CF structures for themselves. If you have to share two or more systems in the traditional non-CF manner, you take some performance hit, but it's mainly a management headache. Remember the bad old days when you had to follow up a profile update with a REFRESH on all sharing systems? You're back there again--but only if you have 2+ non-CF systems. . . JO.Skip Robinson Southern California Edison Company Electric Dragon Team Paddler SHARE MVS Program Co-Manager 626-302-7535 Office 323-715-0595 Mobile jo.skip.robin...@sce.com From: Tom Ambros <thomas_amb...@keybank.com> To: IBM-MAIN@LISTSERV.UA.EDU, Date: 07/23/2013 08:55 AM Subject: Two RACF databases with different definitions in a single sysplex? Sent by: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> A group is concerned that we have a single RACF database and there is no 'test' RACF database where the organization can implement 'test' rulesets. We have two sysplexes - a systems sandbox with no applications and a mixed development/production sysplex where all the applications reside. The only way I see this happening is if non-production partitions refer to one RACF database and the production partitions refer to the other. However, there is no binary separation of production and non-production work, and all resources (datasets etc.) are accessible from every partition. Intuitively I think their idea is not good practice, to say the very least. Does anybody know of IBM documentation that can allow me to back up my assertion that they are proposing a mistake? Thomas Ambros Operating Systems and Connectivity Engineering 518-436-6433 ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
