To create many RACF profiles at one time

2006-01-06 Thread Johnny Luo
Recently I've got a new test system and there is no profile in its RACF at
all.
Now I want to set RACF 'protectall',but before that,I should create profile
for all HLQs of data sets in the sytem first.

For a HlQ,I want to:
1,Define a group whose name=HLQ
2,Create a profile for it like HLQ.**  and set UACC(read)


Because there are many data sets in the sytem,it's a tiring job.
Now my plan is:
1,list all data sets in system and record  all HLQs.
2,Using JCL to issue RACF commands.

However,for each HLQ I need a JCL step and this means I must
copy-and-paste many times.So I want a better way to do this.Maybe
using REXX?

Hope anyone can give me some hints on this.







--
Best Regards,
Johnny Luo

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Define and start JES2

2006-01-06 Thread Barbara Nitz
In fact, the command is xPJES2, where x is what is specified as CONCHAR=
on the CONDEF init statement. The default is $ but you may want to
select something else for a secondary JES.

2 more comments: 
That CONCHAR (in case of my alternate JES a .) also precedes HASP-Messages.
They look like this: .HASPxxx. So automation may be affected.

If IEFUSI fails a job if it does not have a knwon subsystem name you want to
include the name of your JES in IEFUSI. My USI checks for subsystem 'JES2',
and when I started my alternate JES as JESX (to test new JES exits), all my
jobs sent there were getting a JCL error - until I included subsystem 'JESX'
in USI.

Regards, Barbara Nitz

-- 
Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko!
Satte Provisionen für GMX Partner: http://www.gmx.net/de/go/partner

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Noob question regarding zFS

2006-01-06 Thread Barbara Nitz
It is more reliable than HFS.

I think the jury is out on that one still. Until there is more usage
and acceptance, at this point I'm not sure how much I trust zFS so I
only have limited use (there have been problems but I think z/OS 1.7
made some RAS improvements). Not all that much different than PDSE was
in the not so distant past (even though PDSE has been around since
MVS/ESA). HFS may still be more stable/reliable for mission critical
applications at this point even though there are no improvements
planned.

Anyone care to comment on personal experiences (good or bad)?

Well, we converted everything but the root to zFS (under 1.4). In order to
get automation to work correctly, we had to start it sub=mstr. On our Domino
LPARS that had the effect of delaying the first automation reply  for a
lng time (it used to be 30seconds after automation started, it now is in
excess of 6 minutes). Automation can only start up the system once OMVS is
fully initialized, and OMVS only initializes when the zFSs are all started.
Confused the hell out of me the first time it happened (I had just migrated
from SA/390 1.3 to 2.2 and the automation reply did not come) and still
confuses the operators.

We were told by IBM that is is due to the fact that we have the huge zFSs
for Lotus Notes, and that the long init is normal.

As for reliability, I am not sure it is more reliable. We had/have one
incident where a zFS had to be grown and after the mail server restart it
went into a high IO loop (500 SIOs per second instead of 100 in similar
cases). The trace records we could see look like the zFSs were corrupted.

And now lets not talk about IBM software support..

Regards, Barbara Nitz

-- 
Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko!
Satte Provisionen für GMX Partner: http://www.gmx.net/de/go/partner

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: To create many RACF profiles at one time

2006-01-06 Thread Terry Sambrooks
Hi Johnny,

With regard to protecting multiple Hi-level qualifiers in RACF.

There should be no need for multiple steps or indeed REXX.

A single Batch TSO step, with all the RACF commands placed after the //SYSTSIN 
DD statement should work fine.

Sample jcl:

//jobanme JOB etc
// EXEC PGM=IKJEFT1B
//SYSTSPRT DD SYSOUT=*
//SYSTSINDD *

Kind regards - Terry 


Terry Sambrooks
Director
KMS-IT Limited
228 Abbeydale Road South
Dore
Sheffield
South Yorkshire
UK

Tel +44 (0) 114 262 0933
Web www.kmsitltd.co.uk

Reg: England  Wales 3767263 at the above address

All outgoing E-mails are scanned but it remains the responsibility of the 
recipient to ensure that their system is protected from infection by virus, 
Trojans, and worms.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Problem with SDSF : non reponse with ULOG

2006-01-06 Thread CAPRON Romain
Hello to everyone,

I have a strange problem with a TSO session...
On this session, under the ULOG panel, when we enter an OS command, we
don't see the answer...
I have look at the WTPMSG TSO profile option but it doesn't change
anything...

Does anyone have an idea?

Thanks a lot in advance,

Romain

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Problem with SDSF : non reponse with ULOG

2006-01-06 Thread Rob Scott
Check that the E-MCS console name used by SDSF for this userid is not
active anywhere in the sysplex. 

If so, you can change the console name using the SET CONSOLE name SDSF
command. 

I would suggest testing with the D T command as this is v.fast and you
should always get a response. 

Rob Scott
Rocket Software
http://www.rs.com/portfolio/mxi/


-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of CAPRON Romain
Sent: 06 January 2006 05:38
To: IBM-MAIN@BAMA.UA.EDU
Subject: Problem with SDSF : non reponse with ULOG

Hello to everyone,

I have a strange problem with a TSO session...
On this session, under the ULOG panel, when we enter an OS command, we
don't see the answer...
I have look at the WTPMSG TSO profile option but it doesn't change
anything...

Does anyone have an idea?

Thanks a lot in advance,

Romain

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Define and start JES2

2006-01-06 Thread Shmuel Metz (Seymour J.)
In [EMAIL PROTECTED], on 01/04/2006
   at 11:32 AM, Edward E. Jaffe [EMAIL PROTECTED] said:

|Cmd JobName  StepName ProcStep
|--- / 
|VTAM VTAM VTAM

Perhaps at your shop, but I've got IBM documentation that calls for a
proc name of NET.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see http://patriot.net/~shmuel/resume/brief.html 
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: EREP , sense ... manual

2006-01-06 Thread Shmuel Metz (Seymour J.)
In [EMAIL PROTECTED], on 01/04/2006
   at 02:26 PM, Bruce Black [EMAIL PROTECTED] said:

I knew that phrasing would bite me gr  I meant CCWs used with 
mainframe channels and sense presented to mainframe channels, as 
opposed to SCSI/Fibre channels. 

Which ones? The CCW opcodes and sense bytes used on a parallel channel
for, e.g., a card reader are not the same as those used for a tape
drive. The CCW opcodes and sense bytes used on an ESCON channel for,
e.g., a disk drive are not the same as those used for a tape drive.

So a 3590 books listing SCSI sense (or whatever they call it on SCSI)
may not be much help interpreting sense on your z/OS console or EREP.

True, but a book for the same type of channel also won't be of any use
if it's not for the right device.

It is hard to know what generic term to use for the mainframe.

It's hard to know why you would want one, given that each class of
device has its own opcodes and sense bytes even when on the same type
of channel.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see http://patriot.net/~shmuel/resume/brief.html 
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Erase IBM 3590 Cartridges

2006-01-06 Thread Shmuel Metz (Seymour J.)
In [EMAIL PROTECTED], on 01/05/2006
   at 02:10 PM, Jim Marshall [EMAIL PROTECTED] said:

I suggested that we just degauss the cartridges and write a new
label. My SYSPROGs seem to think IBM maintains some cartridge
statistics internal to the cartridge itself and these would be
lost.

I don't know about statistics, but aren't there timing marks? Why not
just use a DSE opcode?
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see http://patriot.net/~shmuel/resume/brief.html 
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: EREP , sense ... manual

2006-01-06 Thread Shmuel Metz (Seymour J.)
In [EMAIL PROTECTED], on 01/04/2006
   at 09:04 PM, R.S. [EMAIL PROTECTED] said:

It was called 'OEMI' I forgot what I stands for, presumably
Interface.
This book descibes BusTag infterface, including plug construction, 
signal characteristics, voltage levels etc.

Yep. Not the CCW opcodes and sense bytes for each type of device that
uses the channel.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see http://patriot.net/~shmuel/resume/brief.html 
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: ICHDEX01 question

2006-01-06 Thread Walt Farrell

On 1/5/2006 1:06 PM, [EMAIL PROTECTED] wrote:

Next question:  If I convert from masking to DES, what effect does that
have on password storage?  Specifically, we have a strong need to be
able to extract the unencrypted password in batch jobs via user exits,
which then puts the password on the jobcard for submission.  Another
exit overlays the password with X's so it does not appear in the job
output.  (I've never seen it done this way, either, and am not in a
position to change this procedure.  It is ubiquitous throughout the
entire batch environment.  And, yes, I have made my objections well
known.)

I know that DES is a better protection mechanism than masking.  If DES
allows extraction of unencrypted passwords, I will advocate a change.
If not, well then I'm just plain stuck with masking until I can build a
new solution.  Your thoughts?


Why do you need to put passwords on submitted jobs?  The system has had 
functions to avoid that for a long time (years, if not decades) now.


When a user submits a local job his identity is inherited automatically, 
without the need for a password or a user ID specification.


For NJE jobs you can use NODES profiles on the receiving system to 
indicate your level of trust in the sending system, and again you have 
the capability of inheriting the originator's ID without needing a password.


Or, for submitting a job under a different ID you can use surrogate 
processing to say that authenticated user X can submit jobs for user Y 
without a password.


By the way, your exit for suppressing the password on listings is also 
superfluous, as JES does that automatically (and has done so, again, for 
years or possibly decades).


Walt Farrell, CISSP
z/OS Security Design, IBM

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


RE : Problem with SDSF : non reponse with ULOG

2006-01-06 Thread CAPRON Romain
You're right!
This session have two active SDSF screens for the same TSO session...
So the second one can't get the E-MCS console...

Thanks for your help,

Romain


-Message d'origine-
De : IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] De la part de Rob 
Scott
Envoyé : vendredi 6 janvier 2006 13:05
À : IBM-MAIN@BAMA.UA.EDU
Objet : Re: Problem with SDSF : non reponse with ULOG

Check that the E-MCS console name used by SDSF for this userid is not
active anywhere in the sysplex. 

If so, you can change the console name using the SET CONSOLE name SDSF
command. 

I would suggest testing with the D T command as this is v.fast and you
should always get a response. 

Rob Scott
Rocket Software
http://www.rs.com/portfolio/mxi/


-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of CAPRON Romain
Sent: 06 January 2006 05:38
To: IBM-MAIN@BAMA.UA.EDU
Subject: Problem with SDSF : non reponse with ULOG

Hello to everyone,

I have a strange problem with a TSO session...
On this session, under the ULOG panel, when we enter an OS command, we
don't see the answer...
I have look at the WTPMSG TSO profile option but it doesn't change
anything...

Does anyone have an idea?

Thanks a lot in advance,

Romain

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Chase, John
 -Original Message-
 From: IBM Mainframe Discussion List On Behalf Of Charles Mills
 
 [ snip ]
 but what I would REALLY like is what I asked for: some 
 automated way of getting a user here signed on 
 automatically there. It looks like PassTicket will do 
 exactly that but I am a little boggled by all of the details 
 - it would be great to have a Redbook-style cookbook - and 
 I'd really like to understand the possible applicability of SSL/TLS.

This is OPINION based primarily on research and VERY LITTLE experience (so
far) with digital certificates and SSL/TLS:  For what you propose, I believe
digital certificates (and optionally SSL/TLS) would be simpler than
Passtickets.  My perception of Passtickets is that they are better suited
for live sign-on since there is a unique Passticket generated every time a
logon or sign-on is attempted, AND both the originating and target systems
must have their clocks pretty-well synchronized for a generated Passticket
to be considered valid by the target system.  I believe digital certificates
(with or without SSL/TLS) are better suited for batch-type sign-on,
because a digital certificate is valid for a much longer time than ten
minutes (normally) and the disparate system clocks need not be synchronized.
And depending on the relationships between your prospect's system(s) and the
target system(s), your prospect *may* be able to use self-signed
certificates (i.e., your prospect could be its own certificate authority).

-jc-

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Walt Farrell

On 1/5/2006 12:30 PM, Charles Mills wrote:

Thanks. Let me echo Bob Lester's request for more pointers if possible and
ALSO ask:

I ran across the facility called PassTicket. Wouldn't this do the job? The
job being letting a program running for user XYZ log on to FTP on a
different machine using the same userid (and assuming synchronized passwords
and clocks)? Any gotchas with PassTicket?


Good question, Charles.

PassTickets would work, but you would need to implement some code on the 
client side to calculate the PassTicket so you could then provide it in 
response to the password prompt from the server.


Prior to z/OS V1R7 that code must run APF-authorized.  In z/OS R7 we 
provide enhanced functions for generating PassTickets that can be used 
by non-APF programs or Java.  See 
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/ichza360/11.1?SHELF=EZ2ZO10FDT=20050621032554 
or http://makeashorterlink.com/?H2A842C6C for more information.


On z/OS V1R7 or later using PassTickets for functions like this has thus 
become more feasible.  However, it still does require some programming 
around the FTP process.  You can't simply run the standard FTP client.


Walt Farrell, CISSP
z/OS Security Design, IBM

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Performance study

2006-01-06 Thread Dave Cartwright
On Wed, 4 Jan 2006 14:30:02 -0500, Karl Tucker [EMAIL PROTECTED] wrote:

I will be doing a performance study using SMF data to discover trends.
Does anyone know of a free utility
that can be used to do this. I do have SAS but as yet have not decided to
use it. If you have a SAS procedure I could use that would be great. Any
other ideas are welcome.



LOTS of free SAS stuff on the CBT tape, browse file 001;

http://cbttape.org/

Can't vouch for any of it as I eschew SAS.

DC

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Erase IBM 3590 Cartridges

2006-01-06 Thread Gerhard Postpischil

Ed Gould wrote:
I always used IEBDG to create the binary zero blocks of data. I don't  
have the control cards handy but its a quick 5 minute read and 1  
minute in ISPF.


Perhaps I'm missing something here, and I don't remember 3590 hardware 
details, but for my 3480 cartridges I've always used EXCP with CCW 
opcode X'97' - Data Security Erase, chained to one Erase Gap. Works like 
a charm.


Gerhard Postpischil
Bradford, VT

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Noob question regarding zFS

2006-01-06 Thread John Eells

[EMAIL PROTECTED] wrote:




You'll still need HFS. z/FS is the z/ replacement for NFS. You might want  to 
install it just so you can keep receiving maintenace when PHB's decide it's  
something required for the survival of the 
Company.


zFS is the strategic z/OS UNIX System Services filesystem, not an 
NFS replacement.  You can choose to use HFS data sets, zFS data 
sets, or both, at any level of the z/OS UNIX filesystem 
hierarchy.  So far as I am aware, no filesystem should require 
the use of an HFS data set.


--
John Eells
z/OS Technical Marketing
IBM Poughkeepsie
[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Walt Farrell

On 1/5/2006 9:57 AM, Lester, Bob wrote:


 This does sound a lot better that the .netrc approach (which we've been 
using).  Can you point me to the relevent manuals?  Redbooks?



What level of info do you need?  If you're already using digital 
certificates then you have some basic info and infrastructure setup already.


If you're not using them, then
(a) you should be; but
(b) you'll need to do a lot more reading and experimenting.

Some information sources that should help:
(a) RACF Security Administrator's Guide chapter 21, at 
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/ICHZA760/21.0?SHELF=EZ2ZO10FDT=20050713233738 
or http://makeashorterlink.com/?P44925C6C


(b) z/OS PKI Services Guide and Reference (you may not need to use PKI 
Services, but there's also some good background info in this book) at 
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/IKYZA140/CCONTENTS?SHELF=EZ2ZO10FDN=SA22-7693-06DT=20050709135510 
or http://makeashorterlink.com/?X1DD242AB


(c) The RACF Presentations page at 
http://www-03.ibm.com/servers/eserver/zseries/zos/racf/presentations.html 
where you will find presentations on RACF and the Digital Certificate 
and some on security for z/OS Communications Server


(d) The z/OS Communications Server IP Configuration Guide and Reference 
books:


http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/F1A1B350/CCONTENTS?SHELF=EZ2ZO10FDN=SC31-8775-07DT=20050708113621 
or http://makeashorterlink.com/?N25921C6C

and
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/F1A1B450/CCONTENTS?SHELF=EZ2ZO10FDN=SC31-8776-08DT=20050707162049 
or http://makeashorterlink.com/?J16962C6C


(e) The z/OS Communications Server IP User's Guide and Commands, at 
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/F1A1B950/CCONTENTS?SHELF=EZ2ZO10FDN=SC31-8780-05DT=20050708142126 
or http://makeashorterlink.com/?B47932C6C


Walt Farrell, CISSP
z/OS Security Design, IBM

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Erase IBM 3590 Cartridges

2006-01-06 Thread willie bunter
If you mean erase data from the cartridges I would suggest to use FATS/FATAR if 
you have it.  

Gerhard Postpischil [EMAIL PROTECTED] wrote:   Ed Gould wrote:
 I always used IEBDG to create the binary zero blocks of data. I don't 
 have the control cards handy but its a quick 5 minute read and 1 
 minute in ISPF.

Perhaps I'm missing something here, and I don't remember 3590 hardware 
details, but for my 3480 cartridges I've always used EXCP with CCW 
opcode X'97' - Data Security Erase, chained to one Erase Gap. Works like 
a charm.

Gerhard Postpischil
Bradford, VT

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html




-
 Yahoo! DSL Something to write home about. Just $16.99/mo. or less

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: To create many RACF profiles at one time

2006-01-06 Thread McKown, John
 -Original Message-
 From: IBM Mainframe Discussion List 
 [mailto:[EMAIL PROTECTED] On Behalf Of Johnny Luo
 Sent: Friday, January 06, 2006 2:35 AM
 To: IBM-MAIN@BAMA.UA.EDU
 Subject: To create many RACF profiles at one time
 
 
 Recently I've got a new test system and there is no profile 
 in its RACF at
 all.
 Now I want to set RACF 'protectall',but before that,I should 
 create profile
 for all HLQs of data sets in the sytem first.
 
 For a HlQ,I want to:
 1,Define a group whose name=HLQ
 2,Create a profile for it like HLQ.**  and set UACC(read)
 
 
 Because there are many data sets in the sytem,it's a tiring job.
 Now my plan is:
 1,list all data sets in system and record  all HLQs.
 2,Using JCL to issue RACF commands.
 
 However,for each HLQ I need a JCL step and this means I must
 copy-and-paste many times.So I want a better way to do this.Maybe
 using REXX?
 
 Hope anyone can give me some hints on this.

//STEP1 EXEC PGM=IKJEFT01,REGION=0M
//SYSEXEC DD DISP=SHR,DSN=my.rexx.library
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
 EXECUTIL SEARCHDD(YES)
%DOHLQS
/*
//HLQS DD *
HLQ1
HLQ2
HLQ3
/*

In my.rexx.library have a member named DOHLQS which looks similar to:

/* REXX */
DO FOREVER
   EXECIO 1 DISKR HLQS
   IF RC  0 THEN LEAVE
   PARSE PULL HLQ
   AG HLQ OWNER(SYS1) SUPGROUP(SYS1)
   ADDSD 'HLQ.*.**' UACC(NONE) DFP(RESOWNER(SYS1)) OWNER(HLQ)
END
EXECIO 0 DISKR HLQS(FINIS


Note that you may well want to change the parameters to the AG and ADDSD
comands to fit your requirements. You can do the equivalent by just
entering the AD and ADDSD commands in the //SYSTSIN instead of the
%DOHLQS command. I just think it is a bit easier to use the REXX.


--
John McKown
Senior Systems Programmer
UICI Insurance Center
Information Technology

This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and its
content is protected by law.  If you are not the intended recipient, you
should delete this message and are hereby notified that any disclosure,
copying, or distribution of this transmission, or taking any action
based on it, is strictly prohibited.
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Validating SMP/E maintenance levels

2006-01-06 Thread McKown, John
I ran into a rather unusual problem yesterday. My SMP/E is lying to me.
I did a REPORT CROSSZONES to determine what maintenance is on my test
z/OS 1.4 system versus my production z/OS 1.4 system. I know that they
are at different maintenance levels because some of the ISMF panels are
different and some of the modules are different sizes.

The only thing that I can think of that could have happened is a failure
in a maintenance process (mine, not SMP/E's). What I do is clone my
running system to a new set of volumes (disk copy using DFDSS). I then
clip the new volumes to new volsers. I then update the SMP/E DDDEFs for
the production zone to point to these volumes. I apply maintenance. When
ready to test, I clip the new volumes back to the original volsers and
carefully IPL (due to duplicate volsers). Once up on the new volumes, I
clip the old production volumes to new names and back them up to tape.
Somewhere along the line, I must have royally messed this up. I have no
idea how, but I'll take the bullet for it.

Now, given a running system and an SMP/E zone which purports to describe
that system, is there any way to verify that the libraries and SMP/E are
properly synchronized? I'm thinking that there likely is not.

FWIW - what I did was really cheat. My test z/OS 1.4 system had all the
maintenance on it that I needed. So I simply created a clone of
production by using the test image libraries.

Thanks for any ideas.

--
John McKown
Senior Systems Programmer
UICI Insurance Center
Information Technology

This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and its
content is protected by law.  If you are not the intended recipient, you
should delete this message and are hereby notified that any disclosure,
copying, or distribution of this transmission, or taking any action
based on it, is strictly prohibited.
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Lester, Bob
|   -Original Message-
|   From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED]
|   Behalf Of Walt Farrell
|   Sent: Friday, January 06, 2006 6:47 AM
|   To: IBM-MAIN@BAMA.UA.EDU
|   Subject: Re: FTP userid propagation
|   
|   
|   On 1/5/2006 9:57 AM, Lester, Bob wrote:
|   
| This does sound a lot better that the .netrc 
|   approach (which we've been using).  Can you point me to the 
|   relevent manuals?  Redbooks?
|
|   
|   What level of info do you need?  If you're already using digital 
|   certificates then you have some basic info and 
|   infrastructure setup already.
|   
|   If you're not using them, then
|   (a) you should be; but
|   (b) you'll need to do a lot more reading and experimenting.
 
Hi Walt,

   I've got ported tools installed in my test LPAR (V1R4), and can do SSL over 
TN3270 (Extra emulator) so I think I've got the basics.  I'm  more interested 
in securing FTP via SSL/TLS.   SCP would also seem to be an option for 
transferring files.

   Thanks for all the references!

*BobL*   

--
This e-mail transmission may contain information that is proprietary, 
privileged and/or confidential and is intended exclusively for the person(s) to 
whom it is addressed. Any use, copying, retention or disclosure by any person 
other than the intended recipient or the intended recipient's designees is 
strictly prohibited. If you are not the intended recipient or their designee, 
please notify the sender immediately by return e-mail and delete all copies. 
OppenheimerFunds may, at its sole discretion, monitor, review, retain and/or 
disclose the content of all email communications.
==

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Noob question regarding zFS

2006-01-06 Thread Ed Finnell
 
In a message dated 1/6/2006 7:46:38 A.M. Central Standard Time,  
[EMAIL PROTECTED] writes:

zFS is  the strategic z/OS UNIX System Services filesystem, not an 
NFS  replacement.  You can choose to use HFS data sets, zFS data 
sets, or  both, at any level of the z/OS UNIX filesystem 
hierarchy.  So far as  I am aware, no filesystem should require 
the use of an HFS data  set.




Yeah, Senior Haffe already dinged me. It's bad being functionally  
stabilized. Any way, I'll stick to the olden stuff and join the
Disney Clipart list

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Bruce Black



The semantics confuses me.  Why was anything ever permitted
but deemed invalid?

read that as not conforming to documented syntax rules for cataloged 
datasets. 

Back in the days of CVOL catalogs, the rules were enforced almost by 
default, since a CVOL is a hierarchical structure, where each level in 
the hierarchy corresponds to one index level in the dataset name (thus 
the name index level).  The max size of each level was 8 characters 
and invalid characters or imbedded spaces caused structure errors.


In ICF catalogs, dsnames are stored as a single 44 character string, so 
theoretically any string can be cataloged, even if it doesn't meet the 
rules.  In the past, syntax checking was done in various components but 
you could bypass them.   As Mark T said, there is now an option, enabled 
by default, to syntax check dsnames in CATALOG.  


--
Bruce A. Black
Senior Software Developer for FDR
Innovation Data Processing 973-890-7300
personal: [EMAIL PROTECTED]
sales info: [EMAIL PROTECTED]
tech support: [EMAIL PROTECTED]
web: www.innovationdp.fdr.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Define and start JES2

2006-01-06 Thread Hunkeler Peter (KRDO 4)
Since this was originally a discussion related to SUBSYSTEMs:
VTAM is not a subsystem. 

It doesn't listen on the SSI for commands but seems to get 
its commands internally from the MVS command handler.

Peter Hunkeler

Credit Suisse - Information Technology

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread Ed Finnell
The auto update gnomes had M$-KB912919 waiting when I signed on this  
morning. Only about a week behind the bright folks at Zone  Labs

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread Porowski, Ken
How long before M$ buys out Zone Labs ... 

-Original Message-
Ed Finnell

The auto update gnomes had M$-KB912919 waiting when I signed on this
morning. Only about a week behind the bright folks at Zone  Labs

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Paul Gilmartin
In a recent note, Bruce Black said:

 Date: Fri, 6 Jan 2006 10:04:44 -0500
 
 Back in the days of CVOL catalogs, the rules were enforced almost by
 default, since a CVOL is a hierarchical structure, where each level in
 the hierarchy corresponds to one index level in the dataset name (thus
 the name index level).  The max size of each level was 8 characters
 and invalid characters or imbedded spaces caused structure errors.
 
What's a structure error?  My understanding is that CVOL catalogs
exploited the facilities of CKD DASD, using the index levels as the
key fields.  Of course, the length of the key field imposes the
restriction that an index level can't be longer than 8 or shorter
than 1 character.  But why any restriction for invalid characters
or imbedded spaces?  Must a key field contain no spaces, etc.?

 In ICF catalogs, dsnames are stored as a single 44 character string, so
 theoretically any string can be cataloged, even if it doesn't meet the
 rules.  In the past, syntax checking was done in various components but
 you could bypass them.   As Mark T said, there is now an option, enabled
 by default, to syntax check dsnames in CATALOG.
 
I'll restate my objection to the practice of various components
enforcing syntactic rules that are properly in the jurisdiction of
another component.  The advent of ICF catalogs should have provided
an excellent opportunity to relax an onerous syntactic restriction
and allow, for example, HFS data sets to imbed exact images of
the associated UNIX directories.  Alas, the chaos of vigilante
enforcement made this so impractical that the syntax checking
option was provided.

And I remain curious: with syntax checking enabled, will it continue
to be possible to uncatalog/delete/rename data sets having nonconforming
names, provided that at least the new name is conformant?

-- gil
-- 
StorageTek
INFORMATION made POWERFUL

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Walt Farrell

On 1/6/2006 9:47 AM, Lester, Bob wrote:

   I've got ported tools installed in my test LPAR (V1R4), and can do SSL over 
TN3270 (Extra emulator) so I think I've got the basics.  I'm  more interested 
in securing FTP via SSL/TLS.   SCP would also seem to be an option for 
transferring files.




Yes, if you've got the Ported Tools for z/OS installed then using scp 
(or, perhaps, sftp) should also provide a  better way for you to go than 
using FTP with passwords.


You can set that up to not require a password, but instead to use 
public/private key technology.


If you want more discussion about the Ported Tools I would suggest the 
MVS-OE mailing list rather than IBM-MAIN.


Walt Farrell, CISSP
z/OS Security Design, IBM

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread Ed Finnell
 
In a message dated 1/6/2006 9:36:55 A.M. Central Standard Time,  
[EMAIL PROTECTED] writes:

How long  before M$ buys out Zone Labs ... 



Probably been tossed around in Redmond, could probably do it out
of petty cash but would diminish the competitiveness of both  parties.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread Huckert, James
I thought Zone Labs and CA were in together

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Porowski, Ken
Sent: Friday, January 06, 2006 9:39 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Windows .wmf Vulnerability

How long before M$ buys out Zone Labs ... 

-Original Message-
Ed Finnell

The auto update gnomes had M$-KB912919 waiting when I signed on this
morning. Only about a week behind the bright folks at Zone  Labs

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

 
This email may contain confidential material. 
If you were not an intended recipient, 
Please notify the sender and delete all copies. 
We may monitor email to and from our network. 


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Gilbert Saint-Flour
Bruce Black wrote:

 Back in the days of CVOL catalogs, the rules were enforced almost by
 default, since a CVOL is a hierarchical structure, where each level in
 the hierarchy corresponds to one index level in the dataset name (thus
 the name index level).  The max size of each level was 8 characters
 and invalid characters or imbedded spaces caused structure errors.

If I'm not mistaken, CVAF seems to behave similarly when the VTOC is 
indexed.  You can allocate a data set with any dsname you want on a 
DASD volume that doesn't have an indexed VTOC, but when there's an 
index, I believe you can only allocate a data set that has a valid 
dsname because the index is a hierarchical structure, like a CVOL.
 
-- 

 Gilbert Saint-Flour
 GSF Software
 http://gsf-soft.com/
 mailto:[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread turner, mark
It seems to me that Zone Labs uses some of the same code (or whatever)
that CA uses. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Huckert, James
Sent: Friday, January 06, 2006 10:48 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Windows .wmf Vulnerability

I thought Zone Labs and CA were in together

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Paul Gilmartin
In a recent note, Gilbert Saint-Flour said:

 Date: Fri, 6 Jan 2006 10:48:07 -0500
 
 If I'm not mistaken, CVAF seems to behave similarly when the VTOC is
 indexed.  You can allocate a data set with any dsname you want on a
 DASD volume that doesn't have an indexed VTOC, but when there's an
 index, I believe you can only allocate a data set that has a valid
 dsname because the index is a hierarchical structure, like a CVOL.
 
As an experiment, I've created and kept a data set with a
noncomforming name.  How can I, as a user, determine whether the
VTOC naming it is indexed?  I had hoped ISPF 3.4 would tell me
this sort of thing, but I don't see it.

Did CVOL ever impose a five-level limit, or was this an urban
legend?

I don't see why the hierarchial design need be reflected in
syntax restrictions on the names.  Couldn't the service
simply break each name, regardless of content, into equal
size pieces (e.g. 9 characters) and use those as levels?
there should be no need to use periods as level separators.

-- gil
-- 
StorageTek
INFORMATION made POWERFUL

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread R.S.

Gilbert Saint-Flour wrote:


Bruce Black wrote:



Back in the days of CVOL catalogs, the rules were enforced almost by
default, since a CVOL is a hierarchical structure, where each level in
the hierarchy corresponds to one index level in the dataset name (thus
the name index level).  The max size of each level was 8 characters
and invalid characters or imbedded spaces caused structure errors.



If I'm not mistaken, CVAF seems to behave similarly when the VTOC is 
indexed.  You can allocate a data set with any dsname you want on a 
DASD volume that doesn't have an indexed VTOC, but when there's an 
index, I believe you can only allocate a data set that has a valid 
dsname because the index is a hierarchical structure, like a CVOL.


AFAIK no. I remember I found datasets with invalid names, it was on 
VTOCIXed volumes.



--
Radoslaw Skorupka
Lodz, Poland

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: CICS-VSAM

2006-01-06 Thread Sergio Lima
Hello Jon.
   
  Try put this question to CICS-L.
  This address are [EMAIL PROTECTED]
   
  Good Luck.
   
  Sergio Lima Costa
  System Consultant
  Caixa Economica Federal
  Sao Paulo - Brasil

Jón Viðar Gunnarsson [EMAIL PROTECTED] escreveu:
  Hello all

I have a VSAM file defined in a cics 3.1.0 region . The file is owend by CICSA 
and is accessed
with remote definition from CICSB and CICSC. I have ZOS1.4 on Z890.
This has been working fine fore three weeks now.. BUT,,

After I recycled CICSA , my customer began to complain that the file was 
closed. But sometimes
everything was working fine against the file, and sometimes the file seemed to 
be closed.. 


As the file was
open enable and I could not see in my monitor that there were any bottleneck in 
the system, I 
guessed that the trouble was in VSAM, and tried to RECYCLE both regions CICSA 
and CICSF..

Then The problem was solved for CICSF and CICS5.. I beleve I also need to 
Recycle CICSB
to get rid of the problem completely for the time beeing.


Does anyone know anything about problem like that ? This has to be a bug ?

Best reg.
Jon Vidar


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
  


__
Faça ligações para outros computadores com o novo Yahoo! Messenger 
http://br.beta.messenger.yahoo.com/ 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Charles Mills
Walt, thanks very much. As mentioned in the OP, the FTP INPUT (command) file
is totally built by a fairly complex program, so adding the logic to call an
address in MVS, pass two parameters, and get back 8 bytes in 2 registers is
almost trivial.

I will definitely look at the 1.7 docs. I was a little put off by the need
for Key 0 (authorization, in other words) - or rather, by the need to sell
authorization to customers - so I am glad to hear you have loosened things
up a little. Obviously not all of our customers are on 1.7, but they will be
someday.

Charles



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Walt Farrell
Sent: Friday, January 06, 2006 5:19 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: FTP userid propagation


On 1/5/2006 12:30 PM, Charles Mills wrote:
 Thanks. Let me echo Bob Lester's request for more pointers if possible and
 ALSO ask:
 
 I ran across the facility called PassTicket. Wouldn't this do the job? The
 job being letting a program running for user XYZ log on to FTP on a
 different machine using the same userid (and assuming synchronized
passwords
 and clocks)? Any gotchas with PassTicket?

Good question, Charles.

PassTickets would work, but you would need to implement some code on the 
client side to calculate the PassTicket so you could then provide it in 
response to the password prompt from the server.

Prior to z/OS V1R7 that code must run APF-authorized.  In z/OS R7 we 
provide enhanced functions for generating PassTickets that can be used 
by non-APF programs or Java.  See 
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/ichza360/11.1?SHE
LF=EZ2ZO10FDT=20050621032554 
or http://makeashorterlink.com/?H2A842C6C for more information.

On z/OS V1R7 or later using PassTickets for functions like this has thus 
become more feasible.  However, it still does require some programming 
around the FTP process.  You can't simply run the standard FTP client.

Walt Farrell, CISSP
z/OS Security Design, IBM

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Validating SMP/E maintenance levels

2006-01-06 Thread Matthew Stitt
This is where I use system symbolics.  I load the master catalog with SYSR1
for the primary IPL volume (except for sys1.parmlib if it is on there) and
use SYSR2, etc for the subsequent volumes.  I then set the symbolics in the
IEASYMxx member (except for SYSR1) and IPL.  Works great except for VSAM
files, so I keep those off the res volumes.

SYS1.PARMLIB requires a volser of ** if it's on the IPL volume.

The RCNVCAT from the CBT tape, file 542 works with minimum effort to create
the IDCAMS entries.

For the OMVS stuff, I put the IPL volume volser as part of the dataset name
and setup BPXPRMFS to use system symbolics to point to the correct version.

This way I don't worry about duplicate volsers at IPL time.

On Fri, 6 Jan 2006 08:37:55 -0600, McKown, John [EMAIL PROTECTED]
wrote:

I ran into a rather unusual problem yesterday. My SMP/E is lying to me.
I did a REPORT CROSSZONES to determine what maintenance is on my test
z/OS 1.4 system versus my production z/OS 1.4 system. I know that they
are at different maintenance levels because some of the ISMF panels are
different and some of the modules are different sizes.

The only thing that I can think of that could have happened is a failure
in a maintenance process (mine, not SMP/E's). What I do is clone my
running system to a new set of volumes (disk copy using DFDSS). I then
clip the new volumes to new volsers. I then update the SMP/E DDDEFs for
the production zone to point to these volumes. I apply maintenance. When
ready to test, I clip the new volumes back to the original volsers and
carefully IPL (due to duplicate volsers). Once up on the new volumes, I
clip the old production volumes to new names and back them up to tape.
Somewhere along the line, I must have royally messed this up. I have no
idea how, but I'll take the bullet for it.

Now, given a running system and an SMP/E zone which purports to describe
that system, is there any way to verify that the libraries and SMP/E are
properly synchronized? I'm thinking that there likely is not.

FWIW - what I did was really cheat. My test z/OS 1.4 system had all the
maintenance on it that I needed. So I simply created a clone of
production by using the test image libraries.

Thanks for any ideas.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Noob question regarding zFS

2006-01-06 Thread Aaron Walker
The main thing holding me back from going zFS everywhere (actually,
anywhere) is (was?) the dump restriction - to dump them, you have to do it
from the system where they are mounted/owned.  That's not really feasible
for me, but I knew they were working on it.  Any news?

Thanks,
Aaron

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: z/OS NFS Server. Can it be used in Windows or Novell

2006-01-06 Thread Rob Wunderlich
Neal Eckhardt wrote:
 We currently access MVS datasets from AIX. Has anybody been able to
 use NFS from Windows or Novell? There do not appear to be MVSLOGIN,etc
 programs supplied.

You can access MVS Datasets from Windows using the zos DFS SMB server. No
client programs other than standard Windows required.
-Rob

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: To create many RACF profiles at one time

2006-01-06 Thread R.S.

Johnny Luo wrote:


Recently I've got a new test system and there is no profile in its RACF at
all.
Now I want to set RACF 'protectall',but before that,I should create profile
for all HLQs of data sets in the sytem first.

For a HlQ,I want to:
1,Define a group whose name=HLQ
2,Create a profile for it like HLQ.**  and set UACC(read)


Because there are many data sets in the sytem,it's a tiring job.
Now my plan is:
1,list all data sets in system and record  all HLQs.
2,Using JCL to issue RACF commands.

However,for each HLQ I need a JCL step and this means I must
copy-and-paste many times.So I want a better way to do this.Maybe
using REXX?

Hope anyone can give me some hints on this.


It is tiring job, no doubt. IMHO it is much to less to define HLQ.** 
UACC(READ) for every HLQ.

However if you want it I have one hint to save the work:
RDEF GLOBAL DATASET
RALTER GLOBAL DATASET ADDMEM('**/READ)
SETR GLOBAL(DATASET)
SETR GLOBAL(DATASET) REFR

The above will give you UACC(READ) for *all* datasets.
Disclaimers:
1. I don't recommend such approach.
2. Check the syntax of the commands, provide missing optional parameters 
like OWNER(), etc.


--
Radoslaw Skorupka
Lodz, Poland

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Erase IBM 3590 Cartridges

2006-01-06 Thread Bruce Black



The 3590 hardware details are only available from IBM through a licence,
so if you have the licence you can find the opcodes in the
documentation; otherwise, don't feel bad about not remembering!

Luckily the 3590 accepts most of the ordinary CCWs (read, write, rewind, 
etc) that have been defined since the days of 2400 round tape reels, 
including DSE (Data Security Erase), so any 3480 or 3490 CCW book will 
do.   Only the more esoteric things, like query CCWs, mode setting CCWs 
and sense are not available publically for 3590s.


As Willie Bunter pointed out (thanks!), our products FATS has the 
ability to erase tapes, either totally or after the last file on the 
tape.  See our web site (below) or contact sales for info.


--
Bruce A. Black
Senior Software Developer for FDR
Innovation Data Processing 973-890-7300
personal: [EMAIL PROTECTED]
sales info: [EMAIL PROTECTED]
tech support: [EMAIL PROTECTED]
web: www.innovationdp.fdr.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Windows .wmf Vulnerability

2006-01-06 Thread Ray Mullins
CheckPoint/Zone Labs redistributes CA's anti-virus/anti-spyware product 

IMHO, CA's stuff has a lot less overhead than the Big 2...

 -Original Message-
 From: IBM Mainframe Discussion List 
 [mailto:[EMAIL PROTECTED] On Behalf Of turner, mark
 Sent: Friday January 06 2006 07:51
 To: IBM-MAIN@BAMA.UA.EDU
 Subject: Re: Windows .wmf Vulnerability
 
 It seems to me that Zone Labs uses some of the same code (or 
 whatever) that CA uses. 
 
 -Original Message-
 From: IBM Mainframe Discussion List 
 [mailto:[EMAIL PROTECTED] On Behalf Of Huckert, James
 Sent: Friday, January 06, 2006 10:48 AM
 To: IBM-MAIN@BAMA.UA.EDU
 Subject: Re: Windows .wmf Vulnerability
 
 I thought Zone Labs and CA were in together

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Howard Brazee
I'm passing on this question (with permission from Doc Dwarf) that I
expect a Rexx expert will come up with the best solution

[EMAIL PROTECTED] wrote in comp.lang.cobol:


[OT] IBM Mainframe DSLIST to Dataset w/ Wildcards?

All righty... here's how we're spending some slow time here.  Datasets
get 
generated on a biweekly basis with the format:

USERID01.TAn.Pooo.Ddddhhmm.node

... where n represents a division, ooo is a pay period, ddd =
'Julian' 
date, hhmm = time and .node is any one of four possible values.  The 
primary criterion of selection will be ooo, the pay period.

(Pay period is designated as single-digit year and 01 - 27, a biweekly 
cycle; research has determined that the earliest datasets are P0, year 
2000, and that no P9 exist.)

(I know... but I didn't design the naming convention.)

Folks in corner offices want these deleted and their wills be done...
but 
I'm looking to automate the task since there are about 14,000 datasets 
involved, spread out over five USERIDs... oh, and most - but not all -
are 
in MIGRAT1 or MIGRAT2 status.

Now... if I use the (Library Function) 3.4 Data Set List Utility I can 
specify a wildcarded string - eg USERID02.TA*.P0* - and the P
command-line 
option; if I log off and Keep my listing dataset I can then use it as 
input to a DFSORT, taking the listings of

USERID02.TA1.P001.NODE1
USERID02.TA1.P001.NODE2
USERID02.TA2.P001.NODE1
USERID02.TA2.P002.NODE2

... etc. and editing/reformatting them to create another file,
consisting 
of...

HDELETE USERID02.TA1.P001.NODE1
HDELETE USERID02.TA1.P001.NODE2
HDELETE USERID02.TA2.P001.NODE1
HDELETE USERID02.TA2.P002.NODE2

... and use that as a SYSTSIN for an IKJEFT01.  For the datasets that 
aren't archived I can do this again and create an IDCAMS input of

DELETE USERID02.TA3.P026.NODE3

... and get rid of the last.

Combining an interactive task, a logoff/logon sequence and a batch job
in 
this way - while it will work - offends my sense of elegance; while I
have 
a solution I'm looking for a better one.

What I'd like to do is find a utility that does in batch what the Data
Set 
List Utility does in the foreground, something that I can feed a string 
like USERID02.TA*.P0* and have it generate the listing of the datasets 
that I can feed to a SYSOUT and pass to the DFSORT edit/reformat step.

Might anyone be able to suggest where I might look to find such a
utility?

Thanks much!

DD

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: SMP/E Internet Service Retrieval

2006-01-06 Thread Edward E. Jaffe

Dave Danner wrote:


We have it working under 1.7.  It did take a little work (and an ETR with
SMP/E) but now it is working great.  We submit a RECEIVE ORDER(CONTENT
(ALL)) every morning at 0600.  It's awesome having *every* closed PTF
already received as soon as I walk in the door each morning!  And of
course, we don't have to worry about ordering/receiving preventive or
corrective service ever again.
 



Yup. I've been pushing/waiting for this for a long time -- ever since 
Greg Daynes tried to convince me to move away from SUF and embrace 
ShopzSeries for service. SUF did *everything* automatically right 
through the RECEIVE. I saw Shopz as a giant leap backwards (a leap I 
refused to take BTW) because of all the manual steps involved. Now I can 
avoid using both SUF _and_ Shopz for service and let my systems 
regularly phone home and download service just like my HMC has been 
doing for years.



As to your problem Ed, I got that one too.  Try REGION=0M (Remember this IS
Java afterall...)
 



Darn! I should have thought of that! I didn't realize the job was 
running with REGION=32M and MEMLIMIT=64M (our defaults). I added 
REGION=0M (which implies MEMLIMIT=NOLIMIT) and it worked! Thanks!


--
-
| Edward E. Jaffe||
| Mgr, Research  Development| [EMAIL PROTECTED]|
| Phoenix Software International | Tel: (310) 338-0400 x318   |
| 5200 W Century Blvd, Suite 800 | Fax: (310) 338-0801|
| Los Angeles, CA 90045  | http://www.phoenixsoftware.com |
-

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Imbriale, Donald (Exchange)
One improvement would be elimination of the P command followed by
logoff/logon.  Instead of P, use SAVE X.  This creates a data set named
X.DATASETS that can then be used as needed.  I have no answer at this
time for the automation part using a batch utility.

Don Imbriale

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf
Of Howard Brazee
Sent: Friday, January 06, 2006 1:54 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: IBM Mainframe DSLIST to Dataset w/ Wildcards?

I'm passing on this question (with permission from Doc Dwarf) that I
expect a Rexx expert will come up with the best solution

[EMAIL PROTECTED] wrote in comp.lang.cobol:


[OT] IBM Mainframe DSLIST to Dataset w/ Wildcards?

All righty... here's how we're spending some slow time here.  Datasets
get
generated on a biweekly basis with the format:

USERID01.TAn.Pooo.Ddddhhmm.node

... where n represents a division, ooo is a pay period, ddd =
'Julian'
date, hhmm = time and .node is any one of four possible values.  The
primary criterion of selection will be ooo, the pay period.

(Pay period is designated as single-digit year and 01 - 27, a biweekly
cycle; research has determined that the earliest datasets are P0, year
2000, and that no P9 exist.)

(I know... but I didn't design the naming convention.)

Folks in corner offices want these deleted and their wills be done...
but
I'm looking to automate the task since there are about 14,000 datasets
involved, spread out over five USERIDs... oh, and most - but not all -
are
in MIGRAT1 or MIGRAT2 status.

Now... if I use the (Library Function) 3.4 Data Set List Utility I can
specify a wildcarded string - eg USERID02.TA*.P0* - and the P
command-line
option; if I log off and Keep my listing dataset I can then use it as
input to a DFSORT, taking the listings of

USERID02.TA1.P001.NODE1
USERID02.TA1.P001.NODE2
USERID02.TA2.P001.NODE1
USERID02.TA2.P002.NODE2

... etc. and editing/reformatting them to create another file,
consisting
of...

HDELETE USERID02.TA1.P001.NODE1
HDELETE USERID02.TA1.P001.NODE2
HDELETE USERID02.TA2.P001.NODE1
HDELETE USERID02.TA2.P002.NODE2

... and use that as a SYSTSIN for an IKJEFT01.  For the datasets that
aren't archived I can do this again and create an IDCAMS input of

DELETE USERID02.TA3.P026.NODE3

... and get rid of the last.

Combining an interactive task, a logoff/logon sequence and a batch job
in
this way - while it will work - offends my sense of elegance; while I
have
a solution I'm looking for a better one.

What I'd like to do is find a utility that does in batch what the Data
Set
List Utility does in the foreground, something that I can feed a string
like USERID02.TA*.P0* and have it generate the listing of the datasets
that I can feed to a SYSOUT and pass to the DFSORT edit/reformat step.

Might anyone be able to suggest where I might look to find such a
utility?

Thanks much!

DD


***
Bear Stearns is not responsible for any recommendation, solicitation, 
offer or agreement or any information about any transaction, customer 
account or account activity contained in this communication.
***

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


CATALOG ACCESS ERROR

2006-01-06 Thread Mark Pace
I'm doing sms definitions for a tape library in my Driver system.
When I try to define the Tape library I keep getting a catalog access
error.
 ICF catalog error: RTC =   30  RSC =   62  MOD = F8

I've been doing a lot of searches in Book Manager, but I'm having no luck
finding the manual these codes are listed in.
I thought maybe I had run out of space in my scds, so I defined a new one,
initialized it, and then tried to add the tape library and it fails the
same way.  So it's not a space issue.

Can someone point me at the right manual for determining the problem?

Thanks very much.



Mark D Pace
Senior Systems Engineer
Mainline Information Systems
1700 Summit Lake Drive
Tallahassee, FL. 32317
Office: 850.219.5184
Fax: 888.221.9862
http://www.mainline.com


This e-mail and files transmitted with it are confidential, and are
intended solely for the use of the individual or entity to whom this e-mail
is addressed.  If you are not the intended recipient, or the employee or
agent responsible to deliver it to the intended recipient, you are hereby
notified that any dissemination, distribution or copying of this
communication is strictly prohibited.  If you are not one of the named
recipient(s) or otherwise have reason to believe that you received this
message in error, please immediately notify sender by e-mail, and destroy
the original message.  Thank You.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Richard Pinion
You might look at FDRREPORT from Innovation Data Processing (FDR/ABR).
It could scan the data sets using your wildcard patterns and generate JCL
and the appropriate utility control cards to do the job.  FDRREPORT is
available as a separate product.  FDRREPORT can also report on HSM
information.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


(fwd) Re: IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Howard Brazee
On 6 Jan 2006 11:55:56 -0800, in bit.listserv.ibm-main
[EMAIL PROTECTED] wrote:

A few months ago I had to do something similar.  Basically, I used a
batch LISTC to put what I needed out to a dataset, then I wrote a REXX
to parse out the info I needed, wrapped some IDCAMS instructions around
it and wrote it to another dataset.

You could easily modify the REXX to do what you need.  It's not
proprietary and it's pretty straightforward.  I can email it to you if
you like.  It ain't purty and the doc stinks but it gets the job done.

Regards,
Bruce

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Robert Wright
Howard Brazee wrote on 01/06/2006 13:53:57:

 I'm passing on this question (with permission from Doc Dwarf) that I
 expect a Rexx expert will come up with the best solution

 [EMAIL PROTECTED] wrote in comp.lang.cobol:


 [OT] IBM Mainframe DSLIST to Dataset w/ Wildcards?

 All righty... here's how we're spending some slow time here.  Datasets
 get
 generated on a biweekly basis with the format:

 USERID01.TAn.Pooo.Ddddhhmm.node

 ... where n represents a division, ooo is a pay period, ddd =
 'Julian'
 date, hhmm = time and .node is any one of four possible values.  The
 primary criterion of selection will be ooo, the pay period.

 (Pay period is designated as single-digit year and 01 - 27, a biweekly
 cycle; research has determined that the earliest datasets are P0, year
 2000, and that no P9 exist.)

 (I know... but I didn't design the naming convention.)

 Folks in corner offices want these deleted and their wills be done...
 but
 I'm looking to automate the task since there are about 14,000 datasets
 involved, spread out over five USERIDs... oh, and most - but not all -
 are
 in MIGRAT1 or MIGRAT2 status.

 Now... if I use the (Library Function) 3.4 Data Set List Utility I can
 specify a wildcarded string - eg USERID02.TA*.P0* - and the P
 command-line
 option; if I log off and Keep my listing dataset I can then use it as
 input to a DFSORT, taking the listings of

 USERID02.TA1.P001.NODE1
 USERID02.TA1.P001.NODE2
 USERID02.TA2.P001.NODE1
 USERID02.TA2.P002.NODE2

 ... etc. and editing/reformatting them to create another file,
 consisting
 of...

 HDELETE USERID02.TA1.P001.NODE1
 HDELETE USERID02.TA1.P001.NODE2
 HDELETE USERID02.TA2.P001.NODE1
 HDELETE USERID02.TA2.P002.NODE2

 ... and use that as a SYSTSIN for an IKJEFT01.  For the datasets that
 aren't archived I can do this again and create an IDCAMS input of

 DELETE USERID02.TA3.P026.NODE3

 ... and get rid of the last.

 Combining an interactive task, a logoff/logon sequence and a batch job
 in
 this way - while it will work - offends my sense of elegance; while I
 have
 a solution I'm looking for a better one.

 What I'd like to do is find a utility that does in batch what the Data
 Set
 List Utility does in the foreground, something that I can feed a string
 like USERID02.TA*.P0* and have it generate the listing of the datasets
 that I can feed to a SYSOUT and pass to the DFSORT edit/reformat step.

 Might anyone be able to suggest where I might look to find such a
 utility?

You should be able to use the LMDLIST service of ISPF to perform a catalog
search that would return all the data sets of interest plus some needing to
be filtered from the deletion action to a REXX exec (or compiled program if
you're more comfortable with that).  Then just walk through the list and
delete the subset needing that action.  You can test your logic by using a
SAY statement in REXX to talk about which data sets would have been deleted
by development editions of your exec before actually performing deletion.

Bob Wright - MVS Service Aids

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: IBM Mainframe DSLIST to Dataset w/ Wildcards?

2006-01-06 Thread Gilbert Saint-Flour
[EMAIL PROTECTED] wrote in comp.lang.cobol:

  What I'd like to do is find a utility that does in batch what the
 Data Set List Utility does in the foreground, something that I can
 feed a string like USERID02.TA*.P0* and have it generate the listing
 of the datasets that I can feed to a SYSOUT and pass to the DFSORT
 edit/reformat step. .

Go to the download section of my Web site at  
http://gsf-soft.com/Download/ and download FILE183.PDS.  In it, you 
will find XDELETE and XRENAME, two REXX execs which do things similar 
to what you want (if I understand you correctly).

-- 

 Gilbert Saint-Flour
 GSF Software
 http://gsf-soft.com/
 mailto:[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Bruce Black



That strikes me as a foolish decision, imposing unnecessary
constraints on the customer.  Was there any rationale for it
other than developer laziness?

Boy, Gil, you sure know how to make friends.  Remember that Mark is the 
developer (or at least the architect).


--
Bruce A. Black
Senior Software Developer for FDR
Innovation Data Processing 973-890-7300
personal: [EMAIL PROTECTED]
sales info: [EMAIL PROTECTED]
tech support: [EMAIL PROTECTED]
web: www.innovationdp.fdr.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Invalid DSN in Catalog

2006-01-06 Thread Robert A. Rosenberg
At 09:18 -0700 on 01/06/2006, Paul Gilmartin wrote about Re: Invalid 
DSN in Catalog:



Did CVOL ever impose a five-level limit, or was this an urban
legend?


It had a 22 level limit - 21 single character levels, one 1 or 2 
character level, plus 21 inter-level periods for a total file name 
length of 44. The number of levels dropped by 1 for each extra 
character in a level (after that first 2 character level) since each 
extra character replaced an inter-level period until you got to the 5 
level limit you mention which occurred with five 8 Character Indexes 
(and 4 inter-level periods).


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Noob question regarding zFS

2006-01-06 Thread Schramm, Rob
zfs shields

Well, that is mostly true. And all true if you require a perfect
logical dump of a filesystem.

the zfsadm clone command creates a .bak that is should be safe... I
can't quite convince the zFS level 2 guys of it though.  They are kinda
stuck in the perfect logical copy rut.

ZFS is journaled filesystem... so in the event that say  a system
crashes... when the ZFS filesystem is attached recovery is
attempted/performed.  If there is a problem that recovery can't deal
with .. the salvager can be invoked to help recover the filesystem.  

If I had issued the zfsadm clone  for a filesystem, a .bak version
would have been created and should be safe (barring physical problem
such as disk corruption) and could be mount read only to help
recover the filesystem.  If the filesystem is hyper-critical.. I am
starting to think that the zfsadm clone should be issued multiple
times a day.

Yep.. there are some holes that could leave you hanging.  But, what
filesystems are you talking about?  /etc  .. a heavily update
filesystem..*cough* (better not be), /var - well ok.. but they are just
logs for the most part, /tmp - shouldn't need this one.. convert to TFS
to prevent needing it.

ones that get updated all the time.. well those may require a bit more
care.

Or .. you could always issue the quiese where it is mounted, take a
physical backup, and unquiese it where it is mounted.  (checking on this
one with the ZFS folks)

p.s. if it is mounted read-only.. then there is no reason to do the
quiese processing.

/zfs shields

Rob Schramm
MVS Cowboy


-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Aaron Walker
Sent: Friday, January 06, 2006 12:47 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Noob question regarding zFS

The main thing holding me back from going zFS everywhere (actually,
anywhere) is (was?) the dump restriction - to dump them, you have to do
it from the system where they are mounted/owned.  That's not really
feasible for me, but I knew they were working on it.  Any news?

Thanks,
Aaron

--
For IBM-MAIN subscribe / signoff / archive access instructions, send
email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search
the archives at http://bama.ua.edu/archives/ibm-main.html


This e-mail transmission contains information that is confidential and may be 
privileged.   It is intended only for the addressee(s) named above. If you 
receive this e-mail in error, please do not read, copy or disseminate it in any 
manner. If you are not the intended recipient, any disclosure, copying, 
distribution or use of the contents of this information is prohibited. Please 
reply to the message immediately by informing the sender that the message was 
misdirected. After replying, please erase it from your computer system. Your 
assistance in correcting this error is appreciated.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: SMS Question Backing up the Current ACDS

2006-01-06 Thread Howard Rifkind
Thanks John ... Got it.

McKown, John [EMAIL PROTECTED] wrote:   -Original Message-
 From: IBM Mainframe Discussion List 
 [mailto:[EMAIL PROTECTED] On Behalf Of Howard Rifkind
 Sent: Thursday, January 05, 2006 3:12 PM
 To: IBM-MAIN@BAMA.UA.EDU
 Subject: SMS Question Backing up the Current ACDS
 
 
 I have made my changes and validated them, all O.K.
 
 I would now like to back up the current ACDS using the 
 SETSMS command and I see that this has never been done. I 
 have to pre alocate the ACDS back up dataset.
 
 Should this just be a plain flat file or what should be the DSORG?
 
 The current ACDS is a VSAM file primary allocation of 12 
 cylinders about half used base on the HI and LO RBA stats.
 
 Thanks.
 

What I do is:

On TSO execute the command:

DEF CLUSTER(NAME(new.acds.name) MODEL(current.acds.name))

On the MVS console enter the command:

SETSMS SAVEACDS(new.acds.name)

--
John McKown
Senior Systems Programmer
UICI Insurance Center
Information Technology

This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and its
content is protected by law. If you are not the intended recipient, you
should delete this message and are hereby notified that any disclosure,
copying, or distribution of this transmission, or taking any action
based on it, is strictly prohibited.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html




-
 Yahoo! DSL Something to write home about. Just $16.99/mo. or less

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


SMS Dataclsss

2006-01-06 Thread Howard Rifkind
In my SMS source library there is a construct for DC003.
   
  How can I relate or find out which dataclass this relates to via the ISMF 
panels.
   
  thanks.


-
Yahoo! Photos
 Ring in the New Year with Photo Calendars. Add photos, events, holidays, 
whatever.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: FTP userid propagation

2006-01-06 Thread Barry Schwarz
I don't think anyone suggested generic IDs.  The NETRC data set should be 
specific to each user authorized to do this, the same way each user has an 
ISPPROF if they are authorized to use ISPF.

Charles Mills [EMAIL PROTECTED] wrote:  I'm not a security guy. I have no 
idea what the exposures are. I suspect
they are between minimal and none. The prospect has simply stated that
generic userids are unacceptable and that the remote process must be run
under the ID of the originator. That's what I am responding to. I am not in
the business of arguing with prospects. You don't make sales arguing with
prospects who raise security objections. We have multiple customers doing it
the way we do it now with a single highly-restricted generic (to use this
prospect's term) ID and no one has reported any problems. No one has had any
objections until now.

Perhaps I am not understanding you. If you are saying give each user their
own NETRC file with UACC(NONE) I think the objection would be the
maintenance headache. Each user's password would have to be maintained once
in RACF (two instances) and once in their NETRC. I can try proposing that,
but what I would REALLY like is what I asked for: some automated way of
getting a user here signed on automatically there. It looks like
PassTicket will do exactly that but I am a little boggled by all of the
details - it would be great to have a Redbook-style cookbook - and I'd
really like to understand the possible applicability of SSL/TLS.

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Greg Saccomanno
Sent: Thursday, January 05, 2006 2:17 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: FTP userid propagation


Charles,
I am curious what security disaster exists with each of the users that
will use this process having a userid.NETRC file with a UACC(NONE) be? If

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html




-
 Yahoo! DSL Something to write home about. Just $16.99/mo. or less

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


z/OS R7 HZSQUERY documentation

2006-01-06 Thread Schiradin,Roland HG-Dir itb-db/dc
On my ToDo list for SHOWzOS 713 and the macro description in MACLIB is pretty 
fine. 
Does anybody know where this is documented?



Roland Schiradin
ALTE LEIPZIGER Lebensversicherung auf Gegenseitigkeit
IT Betrieb - DB/DC
Tel. (06171) 66-4095, Fax (06171) 66-7500-4095
mailto:[EMAIL PROTECTED]
http://www.Alte-Leipziger.de

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: Erase IBM 3590 Cartridges

2006-01-06 Thread Ed Gould

On Jan 6, 2006, at 8:57 AM, Mike Baldwin wrote:


On Fri, 6 Jan 2006 08:40:34 -0500, Gerhard Postpischil
[EMAIL PROTECTED] wrote:

Perhaps I'm missing something here, and I don't remember 3590  
hardware

details, but for my 3480 cartridges I've always used EXCP with CCW
opcode X'97' - Data Security Erase, chained to one Erase Gap.  
Works like

a charm.


The 3590 hardware details are only available from IBM through a  
licence,

so if you have the licence you can find the opcodes in the
documentation; otherwise, don't feel bad about not remembering!


So unless you have trhe doc you have really no way of knowing what an  
erase really does? (does anyone know?)


Does anyone know for say a 3490 ?

I find it extremely odd that IBM would not document a device. If this  
a propietary interface the people that need to interface with the  
device must pay IBM big $$ ? Something is rotten in Denmark as they say.


Ed

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: z/OS R7 HZSQUERY documentation

2006-01-06 Thread Mark Nelson
Roland Schiradin wrote on 01/06/2006 08:38:27 PM:

 On my ToDo list for SHOWzOS 713 and the macro description in MACLIB 
 is pretty fine. 
 Does anybody know where this is documented?

Roland, HZSQUERY is a part of the IBM Health Checker for z/OS and is 
documented in the IBM Health Checker for z/OS User's Guide 
(SA22-7994-01) manual. Complete information (including links to the 
manual) can be found at 
http://www.ibm.com/servers/eserver/zseries/zos/hchecker/. 

   - Mark

Mark Nelson, CISSP
z/OS Security Server (RACF) Design and Development
IBM Corporation
2455 South Road MS/P388
Poughkeepsie, NY 12603
(845) 435-7758, tie line 8+295-7758, fax (845) 432-9589
[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Re: SMS Dataclsss

2006-01-06 Thread Bruce Black



In my SMS source library there is a construct for DC003.
 


What do you mean by that?

If you mean that in your Data Class ACS routine there is code which 
assigns DC003 as the dataclass, then DC003 is the name of the 
dataclass.   Make sure that the ACS source member you are looking at is 
the current dataclass ACS. 

  
 How can I relate or find out which dataclass this relates to via the ISMF panels.




Display data class DC003 on the ISMF panels. 


--
Bruce A. Black
Senior Software Developer for FDR
Innovation Data Processing 973-890-7300
personal: [EMAIL PROTECTED]
sales info: [EMAIL PROTECTED]
tech support: [EMAIL PROTECTED]
web: www.innovationdp.fdr.com 


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html