Hello Mate,
Please find my response below.
Can you provide the error message that was received? Masking any company
specific details. - Attached
When you say fails - what specifically fails? What access was needed.
What access was available? - CA Endevor batch job got failed due to it has
been coded with TSO SUMMIT within the job, after migration it failed, We
had coded batch ID with JCL attribute.
Did you go through the V2.3 Migration guide to see if there were any
entries that might relate to this issue? - I haven't find any relevant
solution for this root cause, we had fixed during issue, but unaware what
had changed with z/OS 2.3
Are there any system exits involved? If so, which ones? Were they
reassembled for V2.3? - there was system exit involved, and I had assembled
accordingly to my environment, but still this issue occurred
Are you JES2 or JES3? - JES2
Are all LPARs involved at V2.3? - Test and Development
Did you contact CA ACF2 to see if they have any current PTFs or Guidance
for your issue? - I had applied all z/OS 2.3 compatible fixes before z/OS
migration, Yes, I had reported this issue with CA, but they denied and told
to contact IBM support to check the z/OS internal security. no help or root
cause solution came from them
I'm already running CA ACF2 Version 16 before the z/OS 2.3 Migration.
MCAT Error, which I got after z/OS upgrade as below
13.02.58 JOB03405 ---- TUESDAY, 18 SEP 2018 ----
13.02.58 JOB03405 £HASP373 N1VRELD1 STARTED - INIT 24 - CLASS C -
SYS FRED
13.02.58 JOB03405 ACF9CCCD USERID N1V00000 IS ASSIGNED TO THIS JOB -
N1VRELD1
13.02.58 JOB03405 IEF403I N1VRELD1 - STARTED - TIME=13.02.58
13.03.22 JOB03405 GSDMV20I JOBNAME- --STEP-- -PSTEP-- CCODE ELAPSED-TIME
-CPU-TIME-
13.03.22 JOB03405 GSDMV21I N1VRELD1 S01LIST 0
00:00:23 0.14S
13.03.37 JOB03405 ACF99913 ACF2
VIOLATION-04,05,N1V00000,,SYS1.MCATV2R1.VMG3MC1,N/A
13.03.38 JOB03405 GSDMV21I N1VRELD1 S02ANAL 990
00:00:16 0.16S
13.03.39 JOB03405 GSDMV21I N1VRELD1 S03LIST FLUSH
00:00:00 0.00S
13.03.39 JOB03405 GSDMV21I N1VRELD1 S04ANAL FLUSH
00:00:00 0.00S
13.03.40 JOB03405 GSDMV21I N1VRELD1 S99MAIL 0
00:00:01 0.00S
13.03.40 JOB03405 IEF404I N1VRELD1 - ENDED - TIME=13.03.40
13.03.40 JOB03405 GSDMV22I -N1VRELD1 ENDED. NAME-ENDEVOR SUPPORT
TOTAL CPU TIME= .00 TOTAL ELAPSED TIME= .70
13.03.40 JOB03405 £HASP395 N1VRELD1 ENDED - RC=0990
PROCESS FIRST OCCURRENCES OF ELEMENT AND TYPE
RETURN CODE 0000 REASON CODE 0000 RECORDS SELECTED 00005102 RECORDS
RETURNED 00005102
1ACF0C038 ACF2 LOGONID ATTRIBUTES HAVE REPLACED DEFAULT USER ATTRIBUTES
ENTRY (A) NEV.P.TEMP.D180918.T130327.ELEMENT DELETED
INVALID DATA SET NAME, NEV.P.C4069785.P£££££££.ELEMENT.TABLE
ISPF system data set allocation error - press Enter to continue.
Temporary control card data set cannot be allocated.
DAIR RC = 12 dec, DARC = 970C hex.
ISPF102 No work file -/-Work file not open.
READY
END
Thanks and Regards,
Shashi
On Tue, Nov 20, 2018 at 8:54 PM Mike Schwab <mike.a.sch...@gmail.com> wrote:
> If you are try to update the Master Catalog you don't have an alias to
> send those entries to a user catalog. Probably a mistake when you
> tried to create the new master catalog or fall back to the old
> catalog.
> On Tue, Nov 20, 2018 at 7:41 AM Shashi Kumar <shashinaik...@gmail.com>
> wrote:
> >
> > Hello Mates,
> >
> > I'm unable to figure out root cause of the below issues after z/OS 2.3
> > Migration, as Described below
> >
> > 1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product),
> One
> > of the batch job got failed due to security issue with batch ID, where as
> > a batch code with TSO SUMMIT command within the batch job, and it failed
> > with very first instance after migration, How ever I had reached security
> > team to provide the required access, security team had code batch ID with
> > JCL attribute then it got completed successfully, but this batch was
> > successfully completing in z/OS 2.1 without JCL attribute, must wanted to
> > know does any new security rules come along with z/OS 2,3 (hoe ever I had
> > applied all CA z/OS 2.3 compatibility fixes as well), now current problem
> > is If I move onto production Lpar to migrate, what if all batch ID's
> fail's
> > (Which has TSO summit command coded on it), it will be a disaster, can
> some
> > tell me, these issue had reported in your system and what action you have
> > taken to mitigate this issue
> >
> > Hence I need your suggestion to mitigate this issue before the next
> > migration.
> >
> > 2. the batch ID had problem with another batch job, where as it was
> trying
> > to write to master catalogue (however I had try to create a new master
> > catalogue during migration unfortunately it didn't work out), where as
> > Batch ID previous used to write user catalogue but after migration it
> tried
> > to write on master catalogue directly, and previously it didn't had write
> > access, only it had read access to master catalogue.
> >
> > Need your suggestion find out the root cause of this issue as well.
> >
> > Thanks and regards,
> > Shashi
> >
> > ----------------------------------------------------------------------
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
>
>
> --
> Mike A Schwab, Springfield IL USA
> Where do Forest Rangers go to get away from it all?
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
