Re: Cloning a RACF user profile

[Anthony Saul Babonas]

The add on products make this effortless but it's really not that hard to
develop yourself.  We're doing 
this now regularly as part of a large Top Secret to RACF conversion.  
Conceptually one should know the layout of the unload file, IRRDBU00 or
TSSCFILE (which are somewhat architecturally
similar) , find the records from which to clone, format the commands and
apply them.

I have some of my old RACF to RACF cloning JCL still around somewhere, I'll
go check my diskettes!

   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Mark Zelden
Sent: Tuesday, March 18, 2008 8:34 AM
To: IBM-MAIN@bama.ua.edu
Subject: Re: Cloning a RACF user profile

On Tue, 18 Mar 2008 03:25:05 -0500, Jan MOEYERSONS
<[EMAIL PROTECTED]> wrote:

>Being confronted with similar issue, I would like to know if indeed 
>there is a sure-fire way of cloning a userid and all of its permissions 
>from an existing one? How would one go about that?
>

Not that I know of, unless you have one of the ISV RACF admin products like
BETA88,  Vanguard, Consul/RACF (purchased by IBM, now Tivoli RACF admin).

That is one of the things I always liked about ACF2.  You just copy a
userid, or add a new one with the correct UID and everything works.  Every
shop I've ever been at (and I've been at a lot - especially when I was
consulting),
it was always a battle after my userid was added.   A permit here, a permit
there and eventually I got everything I needed.

Mark
--
Mark Zelden
Sr. Software and Systems Architect - z/OS Team Lead Zurich North America /
Farmers Insurance Group - ZFUS G-ITO mailto:[EMAIL PROTECTED] z/OS
Systems Programming expert at http://expertanswercenter.techtarget.com/
Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Cloning a RACF user profile

[Anthony Saul Babonas]

We're fortunate enough to have the Vanguard products which do this easily.
I did write a process that 
read through the IRRDBU00 output for all instances of the user profile from
which you wish to clone.  Once 
the data is collected it's simple enough to create commands from the output.

A 2 step dfsort job can do it all. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Jan MOEYERSONS
Sent: Tuesday, March 18, 2008 3:25 AM
To: IBM-MAIN@bama.ua.edu
Subject: Re: Cloning a RACF user profile

>A big thanks and a virtual beer to you. And thanks to the other 
>responders, as always.
>
>>> What am I doing wrong or what else needs to be done or is there a 
>>> surefire way to clone a new userid from an existing one?
>>
Being confronted with similar issue, I would like to know if indeed there is
a sure-fire way of cloning a userid and all of its permissions from an
existing one? How would one go about that?

Thanks,

Jantje.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: CATALOG Quesiton

[Anthony Saul Babonas]

I once worked at a small shop that was a parent company with a number of
subsidiary companies.  The HLQ of the datasets of each respective company
was an 8 character acronym of the child company name.  For each HLQ a user
catalog was built.  The DSN of the user catalog was 8 bytes, an exact match
to the HLQ.  No alias required!  
This trick worked in the late '90s, not sure if it still works.


   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Traylor, Terry
Sent: Thursday, March 13, 2008 1:46 PM
To: IBM-MAIN@bama.ua.edu
Subject: Re: CATALOG Quesiton

Good reasons to reorg a catalog might include:

Remove IMBED/REPLICATE.
Out of or near out of extents.
Dead CIs.
In sufficient index and/or data CISIZE. 
Catalog is allocated in tracks rather than cylinders.


Terry Traylor
charlesSCHWAB
TIS Mainframe Storage Management
Remedy Queue: tis-hs-mstg
(602) 977-5154 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of R.S.
Sent: Thursday, March 13, 2008 12:50 AM
To: IBM-MAIN@bama.ua.edu
Subject: Re: CATALOG Quesiton

John Dawes wrote:
> Hallo To All,
>
>   Is there a way of telling if a USER CAT is near full or full?

Simplest method: see the extents in ISPF.

CAT can have up to 123 extents (cannot be multi-volume), of course the
volume cannot be full, otherwise the next extent won't have a place.
BTW: I remember an opinion of Mark Thomen (he works with catalogs in
IBM): there is no pain if your catalog have extents of splits. No need to
reorganize it.

HTH
--
Radoslaw Skorupka
Lodz, Poland


--
BRE Bank SA
ul. Senatorska 18
00-950 Warszawa
www.brebank.pl

Sd Rejonowy dla m. st. Warszawy
XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, nr rejestru
przedsibiorców KRS 025237
NIP: 526-021-50-88
Wedug stanu na dzie 01.01.2008 r. kapita zakadowy BRE Banku SA  wynosi
118.642.672 zote i zosta w caoci wpacony.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: CATALOG Quesiton

[Anthony Saul Babonas]

Other posters have responded with good, practical solutions.  We had a
"solution" years ago that was neither.  We kept several hundred dummy
aliases in a user catalog in order to keep it full, artificially.  If we
needed to define a few new ones, we deleted some dummies.

Excusing my failing memory,  but I believe the magic number was greater than
3,000.  For some reason 8,000 sticks in my mind.  Maybe it was function of
the CISIZE of the catalog itself.  ??

Where's Mark Thomen these days ?   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of John Dawes
Sent: Wednesday, March 12, 2008 1:39 PM
To: IBM-MAIN@bama.ua.edu
Subject: CATALOG Quesiton

Hallo To All,
   
  Is there a way of telling if a USER CAT is near full or full?
   
  Thanks.

   
-
Get the name you always wanted with the new y7mail email address.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: IBM announced z10 ..why so fast...any problem on z 9

[Anthony Saul Babonas]

All this "why so fast" speculation reminds me of my dearly departed mother.
For my birthday she presents me
with 2 gifts, a red shirt and a blue shirt.  I try on the red shirt, and she
asks, "what's the matter, you don't
like the blue shirt?"

   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of R.S.
Sent: Tuesday, February 26, 2008 7:26 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: IBM announced z10 ..why so fast...any problem on z 9

Tommy Tsui wrote:
> Actually, I worry becuase there are no competitors in the market, why 
> IBM announced the new CPU model so fast, it doesn't like a desktop 
> computer ..I think z9 is announced around 3 years...As I remember, IBM 
> never try to announced a new model of mainframe computer just three 
> years later...a market needs??? ..just curious...if you upgrade the 
> mianframe currently I think you also have a question...

I think it is matter of development. Sometimes changes are minor - like new
cards, even new features (STP) or "turbo" sub-generation (z/900 2xx).
Sometimes is is new model, because the changes cannot be implemented in
existing one.

Is it too frequent for you ? Then stay with old machine.
Why status of competition should influence frequency of changes ?

--
Radoslaw Skorupka
Lodz, Poland


--
BRE Bank SA
ul. Senatorska 18
00-950 Warszawa
www.brebank.pl

Sd Rejonowy dla m. st. Warszawy 
XII Wydzia Gospodarczy Krajowego Rejestru Sdowego, 
nr rejestru przedsibiorców KRS 025237
NIP: 526-021-50-88
Wedug stanu na dzie 01.01.2008 r. kapita zakadowy BRE Banku SA  wynosi
118.642.672 zote i zosta w caoci wpacony.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Are any of us this desperate?

[Anthony Saul Babonas]

"Complaining" on IBM-MAIN is better strategy than complaining to your
congressman.  One of us might come up with 
some lead on a new job.  

What's the congressman going to do for you?  Find you a job?  Convince your
next employer to pay you
what you used to get paid?  

Look how well they've dealt with the price of gasoline.  We go over there,
take over a couple of countries, control
the flow of crude, and it's still $3.00 a gallon.

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Eric Chevalier
Sent: Tuesday, November 20, 2007 1:09 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Are any of us this desperate?

On 18 Nov 2007 21:59:37 -0800,
[EMAIL PROTECTED] (Ed Gould) wrote:

>Doesn't  our elected officials have a clue what is going on?

Of course not. All y'all are too busy sitting here bitching in IBM-Main
instead of pounding on your Congressperson or Senator's door.

Tell me Ed, what's the name of *your* Congressional representative, and when
was the last time you picked up the phone and called him/her?

Eric

--
Eric Chevalier  E-mail: [EMAIL PROTECTED]
   Web: www.tulsagrammer.com
Is that call really worth your child's life?  HANG UP AND DRIVE!

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Are any of us this desperate?

[Anthony Saul Babonas]

I can get by on it.

sell the Beemer 
shoot the dog.
start using my Y2K Spam inventory.
cancel Caller ID.
stop my blood pressure meds, but wait, if I have no job I won't need them.
another "outright insult" downgrade to basic cable.
dust off the Bass boat, we need the fish.
move to India and work remotely.  $40K is a king's ransom there, so my
Indian friends tell me. 

divorce..but wait, she still has a good income, BAD IDEA!

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Mark Jacobs
Sent: Tuesday, November 20, 2007 10:30 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Are any of us this desperate?

Chase, John wrote:
>> -Original Message-
>> From: IBM Mainframe Discussion List On Behalf Of Gary Green
>>
>> [ snip ]
>> BS/BA Degree from an accredited university/college or equivalent 
>> experience 2 years in a support environment Perform Problem 
>> Determination/Prob Source Ident Perform Problem Mgmt Use RETAIN for 
>> Software Support Project Details:
>> System z z/OS and CICS technical system programming business as usual 
>> support for z/OS production environment. Primary Skill
>> Set: SW z/OS-S/390, MVS System Programmer Secondary Skill 
>> Sets:Enterprise Systems IBM System z Job Title: Software Systems 
>> Specialist Primary Skills:
>> RETAIN; Z/OS; MVS Job Industry: Computers Vacancies: 2 Job
>> City: Woodcliff Lake Job Metro Area: Woodcliff Lake Job
>> State: NJ Job Country: US Salary:
>> $20.00/HOURLY To $20.00/HOURLY Hours per Week: 40
> 
> Nothing less than an outright insult.
> 
> -jc-
> 

It's starvation wages. 20*40*52 = 41,600.

--
Mark Jacobs
Time Customer Service
Tampa, FL
--

The primary purpose of the DATA statement is to give names to constants;
instead of referring to pi as 3.141592653589793 at every appearance, the
variable PI can be given that value with a DATA statement and used instead
of the longer form of the constant.

This also simplifies modifying the program, should the value of pi change.

- FORTRAN manual for Xerox computers

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Are any of us this desperate?

[Anthony Saul Babonas]

I have been that desperate and I would apply for this job.  What they are
offering is greater than zero.
In 1991 I applied for and was accepted for such a position. The foreign
aspect that others have quoted did not
exist back then, it was simply a case of a large US insurance company
offering their version of a fair wage.
The job served its purpose for 16 months while I continued to search the
market.  When I found a better job
I took it.

Now it's 2007 and I'd do it all again, if need be. 
 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Ed Gould
Sent: Sunday, November 18, 2007 8:50 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Are any of us this desperate?

On Nov 18, 2007, at 2:46 AM, Shane wrote:
SNIP--
>
> This business is going to hell ...
>
> Shane ...
>
Shane,

I did not notice it thanks for pointing it out. Is that salary even close
down under?

Ed

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: APF-me

[Anthony Saul Babonas]

look for ich408 in syslog. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Aaron Walker
Sent: Friday, November 16, 2007 3:40 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: APF-me

Ok, I'm thick.

I'm trying to create an alias to a user catalog, and I'm getting bit.

 /* IDCAMS COMMAND */  
DEFINE ALIAS (NAME(MYALIAS) -  
   RELATE(ABC123.CATALOG) -
)  
IDC3018I SECURITY VERIFICATION FAILED  
IDC3009I ** VSAM CATALOG RETURN CODE IS 56 - REASON CODE IS
IGG0CLFT-36

**

What do I need to change where so that I can create this baby?

RC56 RSN36 tells me:
Explanation: The caller is not authorized. When no profile exists for
functions that require RACF authorization, the caller must be at least APF
authorized.

What exactly do I authorize?

Thanks,
Aaron

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: ADABAS vs IMS vs DB2 Who is faster?

[Anthony Saul Babonas]

Did I stumble into a dark closet and find myself trapped in a job interview?


-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of CICS Guy
Sent: Tuesday, October 09, 2007 1:30 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: ADABAS vs IMS vs DB2 Who is faster?

Thank goodness our moral compass is still around...
 
-Original Message-From: IBM Mainframe Discussion List
[mailto:[EMAIL PROTECTED] On Behalf Of Anton BritzSent: Tuesday, October
09, 2007 12:37 PMTo: [EMAIL PROTECTED]: Re: ADABAS vs IMS vs DB2
Who is faster?
 
Hi,
 
Summarized :
 
a) So you never worked with ADABAS in your life
b) You only worked with IMS and DB2 for 5 years... maybe as a user
 
but you are talking about :
 
a) SQL
b) Database access methods
c) Which Database people should be using
 
Summarized :
 
Are you working for the 'White house" maybe  because everybody there is also
experts but the funny part ?  "your post your findings to an IBM
technical list"...
 
Tell me , what should I invest my money in ? I need investment advice too..
 
Anton
 

-Original Message-From: IBM Mainframe Discussion List
[mailto:[EMAIL PROTECTED] On Behalf Of Anton BritzSent: Tuesday, October
09, 2007 12:37 PMTo: [EMAIL PROTECTED]: Re: ADABAS vs IMS vs DB2
Who is faster?
 
Hi,
 
Summarized :
 
a) So you never worked with ADABAS in your life
b) You only worked with IMS and DB2 for 5 years... maybe as a user
 
but you are talking about :
 
a) SQL
b) Database access methods
c) Which Database people should be using
 
Summarized :
 
Are you working for the 'White house" maybe  because everybody there is also
experts but the funny part ?  "your post your findings to an IBM
technical list"...
 
Tell me , what should I invest my money in ? I need investment advice too..
 
Anton
 
_
Boo! Scare away worms, viruses and so much more! Try Windows Live OneCare!
http://onecare.live.com/standard/en-us/purchase/trial.aspx?s_cid=wl_hotmailn
ews
--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: mass pds compress

[Anthony Saul Babonas]

back in the old days we'd simply hmig and hrecall the whole lot.  can't say
if that still works or not.


  

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Havelock, Glenn A
Sent: Friday, October 05, 2007 3:04 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: mass pds compress

If you have CA'S PDSMAN its FASTCOPY utility will handle this.

 

Regards,

 

Glenn

 

 

 

-Original Message-

From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Edward Jaffe

Sent: Friday, October 05, 2007 10:44 AM

To: IBM-MAIN@BAMA.UA.EDU

Subject: Mass PDS Compress Without Volume Specification

 

I've recently put together a service update procedure that starts by
invoking DSS to compress all PDS-type libraries whose data set names match a
given pattern. These are SMS-managed data sets and will reside on any of the
volumes in the storage group.

 

I tried this and got the error shown:

 

|1PAGE 0001 5695-DF175  DFSMSDSS V1R08.0 DATA SET SERVICES 

2007.278 10:29

|-  COMPRESS INCLUDE(EJES.PROD450*.**)

| ADR101I (R/I)-RI01 (01), TASKID 001 HAS BEEN ASSIGNED TO COMMAND

'COMPRESS'

| ADR109I (R/I)-RI01 (01), 2007.278 10:29:21 INITIAL SCAN OF USER

CONTROL STATEMENTS COMPLETED.

| ADR138E (001)-RI01 (01), REQUIRED (SUB)PARAMETER OF 'DDNAME ' IS

| MISSING ADR131E (001)-RI03 (01), ABOVE TEXT BYPASSED UNTIL NEXT

| COMMAND ADR017E (001)-CLTSK(01), 2007.278 10:29:21 TASK NOT SCHEDULED

| DUE TO

ERROR. TASK RETURN CODE 0008

|0ADR012I (SCH)-DSSU (01), 2007.278 10:29:21 DFSMSDSS PROCESSING

 

COMPLETE. HIGHEST RETURN CODE IS 0008 FROM:

|  SYNTAX

|  TASK001

 

It seems I must explicitly specify each of the volumes in the storage group
in order to compress these data sets using DSS!

 

The control statements shown below work. But, I don't like having to specify
every volume (or the data set pattern over and over for that matter).
Suppose volumes are added to or removed from the storage group in the
future?

 

COMPRESS INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV0) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV1) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV2) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV3) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV4) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV5) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV6) COMPRESS

INCLUDE(EJES.PROD450*.**) DYNAM(MVSPV7)

 

Is there another DFSMS utility I can use to compress all PDS-type data sets
matching a given data set name pattern?

 

--

Edward E Jaffe

Phoenix Software International, Inc

5200 W Century Blvd, Suite 800

Los Angeles, CA 90045

310-338-0400 x318

[EMAIL PROTECTED]

http://www.phoenixsoftware.com/

 

--

For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

 

--

For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

 

 

 

Glenn Havelock, CA

Sr Consultant

Cellular phone 908-398-7726

Office phone 908-874-9436

[EMAIL PROTECTED]  

 

 


--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Top Secret to RACF conversion.

[Anthony Saul Babonas]

We're currently converting.  Contact me off list for specifics.

tb


 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Richbourg, Claude
Sent: Thursday, September 27, 2007 1:27 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Top Secret to RACF conversion.

Good afternoon all.

We are looking into the possibility of converting from Top Secret to RACF
for our security product on the mainframe, z/OS 1.7. 
I am interested in hearing from anyone who has made this conversion.

What I would like to know from those that have are; timelines in getting it
done, any horror stories and other 'gotchas' that affected the conversion
process.

My Top Secret knowledge is so-so and my RACF knowledge is great. But I have
never done a security conversion before.
Cross posted to the RACF list also.

Thanks much in advance all.

Regards,
Claude Richbourg
Florida Department of Corrections
Systems Programmer III
850-921-1383

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Wierszyk (please ignore)

[Anthony Saul Babonas]

Really?  It was off-topic?  I thought it was OK except for a typo or 2.  :-)

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Radoslaw Skorupka
Sent: Wednesday, September 19, 2007 7:18 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Wierszyk (please ignore)

It was sent to the list by mistake, I'm sorry for off-topic message.

Radoslaw Skorupka

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: CA to IBM product swap

[Anthony Saul Babonas]

Pretty much did (or doing) them all.  No regrets.  Cultural issues aplenty,
technical issues few. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of JT
Sent: Saturday, September 15, 2007 2:15 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: CA to IBM product swap

It looks like we my be swapping out some CA products and replacing them with
IBM 'equivalents' to save big $$.  I know the success of replacing a product
has much to do with how it is used.  Having said that  - let me know your
experience with any of the following swaps and IBM's SMPO.  Any info would
be appreciated, including product features or comparisons.  I'm currently
reviewing the product websites.  Any other good sites? Any cautions?

ACF2  ===> RACF 
CA1===> RMM 
CA7===> Tivoli TWS 
CA11  ===> Tivoli TWS 
AutoSys  ===> Tivoli TWS 
SmartCon===> Tivoli TWS 
OPS/MVS===> AF/Operator 
Allocate  ===> DFSMS 
MIM   ===> GRS

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Splitting a large physical sequential dataset

[Anthony Saul Babonas]

So who can accomplish this with the fewest possible commands (JCL not
included) ? 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of David Andrews
Sent: Tuesday, September 04, 2007 3:19 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Splitting a large physical sequential dataset

On Tue, 2007-09-04 at 15:59 -0400, Raupach, Robert E (ATS, IT) wrote:
> I thought there was an easy way to write the first 100,000 records to 
> a dataset and skip the rest, then skip the first 100,000 records and 
> write the remainder to another dataset, using IEBGENER or DFSORT and 
> the right control cards.

You could use IDCAMS REPRO.  Check out the SKIP and COUNT operands.

--
David Andrews
A. Duda and Sons, Inc.
[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

POLLS -- regardless of subject.

[Anthony Saul Babonas]

Please stop.  All polls, all listservers.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Counting Records in Files

[Anthony Saul Babonas]

copy each into a pds/e, then reset the stats.  edit the pds/e, then S * G

of course if you use df/sort to copy them, just look at the output of each
copy. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Steve Grimes
Sent: Thursday, July 26, 2007 4:30 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Counting Records in Files

Hello! z/OS 1.7 here!

This is (I hope) a pre-Friday easy opinion question.   The only parameters 
are, that we have no real third party tools to solve this except SyncSort.

We need to count the number of records in about 100 flat files.Since 
we're already running these through SyncSort, I'm thinking of keeping and
parsing the output of these with Rexx, but thought I would ask first to see
if there are other nifty first.

TIA!

Stg



In order to fulfill auditor requirements, Focus needs to compare the number
of records FTP'd to FOCUS with the number of records used in its night
production database loads.

There are currently ten jobs that FTP over 100 files to the FOCUS server. 
Most of these jobs are put through an MVS SYNC SORT process to place the
data in the correct format, so a total record count for those datasets is
available in the SYSOUT.  Getting this information manually is very time
consuming, so we want to develop an automated method. 

Since a job that would read these counts from the SYSOUT file would be
cumbersome to write, I would like to know if there is a means of directly
counting the records in a dataset.  One method of counting is provided by
SYNC SORT, using the TRAILER parameter.  Do you know of any others?

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Secure clist

[Anthony Saul Babonas]

No.   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Paul Gilmartin
Sent: Thursday, July 26, 2007 3:44 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Secure clist

On Thu, 26 Jul 2007 13:55:32 -0500, Ed Gould wrote:
>
>Sigh... This was BEFORE that option was available. Please just remember 
>it JUST WASN"T ICKDSF it was a host of other "no-no"
>programs that were in sys1.linklib. It was amaspzap and others.
>
This has been discussed many times on this list.  There's nothing "no-no"
about AMASPZAP.  What's necessary is to protect the resources it might
modify, not restrict access to the program.  Otherwise an intruder can use a
handcrafted program to do whatever harm he might to with AMASPZAP.

Is ICKDSF any different?

-- gil

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: sysprog demand

[Anthony Saul Babonas]

A 50 hour week!  Egads, where do I sign up? 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Ed Gould
Sent: Thursday, July 26, 2007 2:12 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: sysprog demand

On Jul 26, 2007, at 9:05 AM, Eric Bielefeld wrote:

> I know that in Wisconsin, for the few jobs that came up lately, there 
> seems to be no shortage of people applying for them.  Also, management 
> seems to want to eliminate the positions, and make do with the rest of 
> the staff instead of replacing the person leaving.  I've found this in 
> at least 3 jobs I've applied for in Wisconsin.  One job, after not 
> hearing anything for a while, I called and they finally emailed me 
> back saying they were going to make the position part time - 10 to 15 
> hours a week.
>
> Eric Bielefeld
> Sr. z/OS Systems Programmer
> Milwaukee, Wisconsin
> 414-475-7434
Eric,

I know one place that just increased the sysprog hours from 40 to (I
think) 50 a week. IRC correctly IBM did that as they are the outsourcer.

Ed

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Secure clist

[Anthony Saul Babonas]

ummm, so what if someone copies it into their own clist lib, modifies the id
check code, then runs it?

Been there..had to be there actually.  we had an oldie where the
original developer went off to other pursuits.  my id was not
authorized..45 seconds later it was.

locks are meant to keep honest people out.

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Mark H. Young
Sent: Wednesday, July 25, 2007 2:01 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Secure clist

On Tue, 24 Jul 2007 08:40:09 -0400, Carroll, William
<[EMAIL PROTECTED]> wrote:

>Is there any way to secure certain clist from unauthorized use?
>For example if I don't want applications to get into the wlm, 
>Application, how would I do it?  If it can be done.
>Thanks In Advance.
>
>
>
>
>Bill Carroll
>
>

I've been on vacation and then bringing up a new z/OS 1.7 in our sand box.
So I haven't been on IBM-MAIN ListServ this month.

Not sure if anyone suggested putting some code in your CLIST to check if the
user is authorized to execute it?  Like a TSO Userid validation check.
Don't need anything real sofisticated and no need for a RACF/ACF2/Top Secret
call.

Just a simple id compare check.  Either you ARE in the list and can use it,
or NOT, then BYE-BYE.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Secure clist

[Anthony Saul Babonas]

DASDVOL profiles can help here..


 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Ed Gould
Sent: Wednesday, July 25, 2007 12:21 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Secure clist

On Jul 25, 2007, at 9:56 AM, Wayne Driscoll wrote:

> But what was purpose of this?  Was there a security exposure 
> identified?
> If so, what was it?  Or was it a case of "well, it's always been done 
> this way."
>
> Wayne Driscoll
> Product Developer
> JME Software LLC
> NOTE:  All opinions are strictly my own.
>

No there had been issue of people running ICKDSF and other programs under
TSO that caused issues.

Ed

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Utility to print tracks

[Anthony Saul Babonas]

Well yes, security certainly is a zoo.  The whole idea is to make sure the
proper life forms are on
the proper sides of the bars.  Once accomplished it's a pleasant place to
entertain children on a nice day. 

  

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Clark Morris
Sent: Monday, July 02, 2007 2:52 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Utility to print tracks

-- Snippage happened here

>
>The STGADMIN authority is another way to do it; it permits PRINT 
>operations if the user has the STGADMIN authority.
>   
This type of restriction would be adequate as would restricting the area to
a data set opened by the utility where the security system of choice or
affliction is invoked.  I would assume that DASDVOL access would be tightly
controlled and monitored.  Security is a zoo.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Security vs knowledge [was: RE: how to list LE options]

[Anthony Saul Babonas]

In our organization any user who requests access to any resource has to
demonstrate a business need (not want) to the owner of the resource.  The
owner of the resource is the final authority regarding the alleged business
need.  

If the manager of the SYSPROG group says it's OK for a generic civilian to
browse SYS1.PARMLIB, we permit access. Our security group diligently avoids
the decision process.



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of R.S.
Sent: Thursday, June 21, 2007 1:43 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Security vs knowledge [was: RE: how to list LE options]

Ted MacNEIL wrote:
>> Because some fool of an auditor doesn't understand mainframes?  
>> That's just BS IMHO.  Fire the auditor for incompetence
> 
> An auditor doesn't set the rules.
> They just report on compliance.
> 
> I still see no reason for a non-SYSPROG to have access to PARMLIB!

Assuiming there is a reason, including curiosity and willingness to learn.
What would you do if non-SYSPROG would ask you about some member in the
PARMLIB ?  Deny the knowledge, just beacuse you are the God ?

IMHO the poorer tuned parmlib the higher will to hide the parmlib.

--
Radoslaw Skorupka
Lodz, Poland


--
BRE Bank SA
ul. Senatorska 18
00-950 Warszawa
www.brebank.pl

Sąd Rejonowy dla m. st. Warszawy 
XII Wydział Gospodarczy Krajowego Rejestru Sądowego, 
nr rejestru przedsiębiorców KRS 025237
NIP: 526-021-50-88
Według stanu na dzień 01.01.2007 r. kapitał zakładowy BRE Banku SA (w
całości opłacony) wynosi 118.064.140 zł. W związku z realizacją warunkowego
podwyższenia kapitału zakładowego, na podstawie uchwał XVI WZ z dnia
21.05.2003 r., kapitał zakładowy BRE Banku SA może ulec podwyższeniu do
kwoty 118.760.528 zł. Akcje w podwyższonym kapitale zakładowym będą w
całości opłacone.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

CICS AEXZ abend outage for zOS 1.8/Top Secret 9.0 users.

[Anthony Saul Babonas]

Anyone else experienced this problem?  Our CICS regions have been down since
6 AM CDT Saturday due to AEXZ abend in CEMT.  This was reported to IBM who
referred us to CA.  CA confirmed the problem and provided maintenance to Top
Secret.  We've rolled back to TS 8.0 as an interim for some of our systems
that were still zOS 1.6. 

Several additional companies in addition to us have reported the same
problem.

No golf today.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Limit to the number of Aliases in a User Catalog

[Anthony Saul Babonas]

Our original experience with this was handled rather primitively.  Once a
usercat filled up we simply counted the aliases therein using listcat.
Whatever the evil number was, we simply made note of it and started defining
aliases in additional usercats.  We currently use 12 catalogs to handle TSO
user related aliases.  "Other" aliases, not related to TSO users are stored
in different usercats.  Periodically we match aliases to our security files
and delete the orphans.



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Schwarz, Barry A
Sent: Tuesday, May 29, 2007 2:05 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Limit to the number of Aliases in a User Catalog

If you run the listcat in an IDCAMS batch job (not from TSO command line),
the last page of the listing contains a count for each different type of
entry.  On my system, alias is the second type reported on.

Since your client is defining aliases, I wonder how they would expect you to
solve the problem.  You wouldn't know which ones, if any, were obsolete and
could be deleted.

I also wonder how large shops (with more than 3000 TSO users) get around
this limitation.  You don't want normal users updating the master catalog
and userid is a common hlq (even built into RACF).

-Original Message-
From: Kay Anderson [mailto:[EMAIL PROTECTED]
Sent: Friday, May 25, 2007 5:15 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Limit to the number of Aliases in a User Catalog

I did a listc and didn't see any information that would be useful.  The
reason I'm asking is because we had a severity one incident because our
client could not define anymore aliases and they berated us for not
monitoring the catalog.  I've never heard of that type of monitoring being
done before.  I was wondering if anybody else is monitoring the number of
aliases associated with a user catalog and how are they doing it. 

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Dynamic spliiting of file

[Anthony Saul Babonas]

Set up a job that creates 1,000,000 records in a pass, then submits itself
to intrdr if rc=0.


 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Rajeev Vasudevan
Sent: Monday, May 14, 2007 12:08 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Dynamic spliiting of file

Hello,
   
  Hi, 

Please provide me your suggestions/solutions to achieve the following: 

A production job runs daily and creates a huge file with 'n' number of
records. , I want to use a utility (assuming SYNCSORT with COUNT) to know
the 'n' number of records from this file and want to split the file into
equal output files (each output file should have 1,00,000 records). How to
achieve it dynamically if records vary on daily basis?  On a given day we
may get 5,00,000 and on the other day we may get 8,00,000 records. So,
depending on the count I need to split the input file into 5 or 8 pieces for
further processing. After this processing (suppose a COBOL program) I may
again get 5 or 8 files. 
  
Please provide your suggestions/solutions/ideas to this problem. Please let
me know if you need more inputs/details
   
  Thanks,
  Raj

   
-
Get the free Yahoo! toolbar and rest assured with the added security of
spyware protection. 

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: How difficult would it be for a SYSPROG ? (was RE: Mainframe Data Center Permanant Shutdown Procedure Needed)

[Anthony Saul Babonas]

Please colleagues, allow my to clarify by stating : 

SET FAVORITEEXPLETIVE=''

1. I do not believe "other platforms" are &favoriteexpletive.
2. I am not arrogant and certainly not blind.
3. I am not responsible for the mainframe market share situation.  I neither
buy nor sell mainframes.
4. I have heard the costs of hardware and software, but I still believe
arrogance is no cost.
5. I do understand the competition (&favoriteexpletive).
6. Recent young graduates are free to work on any platform of their
choosing.  Undoubtedly the market influences
   their choices.
7. I do believe the learning curve for Novell, circa 1995, was orders of
magnitude less than zOS + subsystems, circa 1995.

So fast forward 12 years, "is learning to be a PC based network "sysprog"
more difficult than zOS, less so, or about the same?

Please note, final question is posed without beliefs, opinions, standpoints,
political biases, or prejudices.  I reserve the right to invoke arrogance at
some later date.   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Bruno Sugliani
Sent: Monday, May 07, 2007 4:46 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: How difficult would it be for a SYSPROG ? (was RE: Mainframe
Data Center Permanant Shutdown Procedure Needed)

On Mon, 7 May 2007 10:00:44 +0200, R.S. <[EMAIL PROTECTED]>
wrote:

>Windows nowadays doesn't need to be rebooted so frequently and - last 
>but
not least - it is not the only PC-server system.
>
>So, I think we're laughing at our idea of PC-world, not reality.
>It's not good to underestimate the competition.

Exactly :believing other platforms are sh.. is one of the reasons we have
difficulties to get  young graduates to work in mainframe It is arrogance
from the blind and this is why mainframe is losing it's part of the market
day after day .
The costs  in hardware , in software and in arrogance will kill us !
Bruno
Bruno(dot)sugliani(at)groupemornay(dot)asso(dot)fr



 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

How difficult would it be for a SYSPROG ? (was RE: Mainframe Data Center Permanant Shutdown Procedure Needed)

[Anthony Saul Babonas]

I'm curious.  How difficult would it be a a zOS sysprog to become proficient
in a like type position on
a Windows or UNIX based system?  I have heard these jobs being referred to
as "Network Administrators" and I've
always taken that to mean sysprog in newspeak.

About 10 years ago I took a couple of classes in Novell and deduced that
anyone with zOS sysprog background could
become a guru in 2-3 days.  

"So easy a caveman could do it."


   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Howard Brazee
Sent: Thursday, May 03, 2007 11:00 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Mainframe Data Center Permanant Shutdown Procedure Needed

Our mainframe will be replaced within the next 4 years.   Lots of my
peers are retiring and working part time with the old system, which
will help tremendously with the rest wanting to be retrained.   We
already have Oracle DBAs, so our non-retired IDMS DBA will just move
over (He has retired IDMS DBAs working with him).   I don't know how
our systems people will transition.

I can't afford to retire yet, so if my ticker doesn't get worse, I will
transition to the new system.

What is interesting to observe is how the Java team will move over.
They tend to be young guns who have never gone through a major
conversion.As much as I dislike all of the complex procedures of
change control and user testing, I don't work with multitude of
objects and progressive programming changes.   I can't see that
switching to PeopleSoft's procedures will be comfortable for them.

Their life-cycle will be similar to what I've had - but quicker.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Renaming ADRDSSU

[Anthony Saul Babonas]

Surely you're not serious!  Is "getting control" an intent to prevent some
users from using ADRDSSU?

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Jon Renton
Sent: Thursday, April 26, 2007 11:07 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Renaming ADRDSSU

Hello,

we are experimenting with getting control of all ADRDSSU calls (the IBM DSS
user interface). To achieve this, we are thinking about renaming ADRDSSU and
supplying our own ADRDSSU frontend which will later call the real IBM
module.

Now my question - has anyone ever renamed modul ADRDSSU? Does this have any
effect on other systems (such as HSM) which use DSS to move their data?

Many thanks in advance.

Regards
Jon.



--
No virus found in this outgoing message.
Checked by AVG Free Edition. 
Version: 7.5.463 / Virus Database: 269.6.1/776 - Release Date: 25.04.2007
12:19

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: SYSOUT Archival Product with Content Search capability?

[Anthony Saul Babonas]

Reminds me of the time in the late '90s when "the mainframe was going away"
and we were all trooped down to the local SAP office for a demo of the
future.  One of our techies asked about report management.  Our collective
mindset that day was to ask about all the things mvs was doing for us and
how SAP would do the same.

The SAPster replied "there won't be any more reports."  Then the room went
totally silent and we listened to the lights buzz for a minute or 2. He went
on to explain that reports are old school thinking, in effect a copy of a
database, re-arranged and summarized, made nice for the simple reason that
the original database isn't.  Using his software the database would already
be "nice", hence no need to run reports, hence no need to have a report
management system.

Oh, the mainframe is still around, cranking out nice reports.  The
report-meister is SAR/VIEW, soon to be replaced by IBM's flavor of same.

And yes, content search can be done within SAR, but it's not that easy.
  

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Gray Maddry
Sent: Friday, April 20, 2007 12:21 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: SYSOUT Archival Product with Content Search capability?

Systemware has a complete suite for Mainframe and other platforms, includes
SYSOUT and report management.

E-mail correspondence to and from this address may be subject to the North
Carolina Public Records Law and may be disclosed to third parties by an
authorized state official.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: PDSE Sharing

[Anthony Saul Babonas]

RACF, ACF2 or Top Secret.Protect us from ourselves.  

My gun cabinet has a lock.  If it did not, it would be a box.


 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Dennis Trojak
Sent: Thursday, April 12, 2007 1:07 PM
To: [EMAIL PROTECTED]
Subject: PDSE Sharing

Well I hate to open this can of worms but I wonder if anybody has
suggestions on how to prevent damaging a PDSE in a dual SYSPLEX environment
running a MIMPLEX. I am running NORMAL not EXTENDED PDSESHARING and I know
that IBM (and CA) does NOT support this mode for cross-system/sysplex
updates so I follow this rule with my target datasets. The question I have
is how do I prevent users from breaking this rule with their own product
PDSEs? I can tell them to stick to the LPAR that has the PDSE open but that
doesn't guarantee they will follow the rule. I know there are other MIMPLEX
sites out there so how do you handle this?
Dennis

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: When to start security product?

[Anthony Saul Babonas]

Nah, the early start of TSS doesn't buy anything useful.  Also, if you wait
till JES is up you can see TSS output in SDSF, which often contains useful
information, and diagnostics.

Potayto, Potahto. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Thompson, Steve
Sent: Wednesday, April 11, 2007 3:05 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: When to start security product?

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Mark Yuhas
Sent: Wednesday, April 11, 2007 3:01 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: When to start security product?

We use Top Secret.  A consultant made a recommendation late last year that
Top Secret should be the first task started during the IPL procedure.  The
Security Administrator has requested this change.

Currently, we start Top Secret after JES2 completes its start procedure.
I really don't see the merit in moving the start of Top Secret earlier in
the IPL procedure.

Can anyone explain why starting Top Secret/security product is more
advantageous?



Because until it starts, you have no security? I would assume by this
question that you have the system set up to startup with the default of
EVERYONE is authorized to everything.

Otherwise, you would come up to about the point of the master scheduler
getting control, and then your operator(s) would be busy for the next
several hours replying "U" to every OPEN of every data set.

So if the first scenario is the case, all STCs that start before JES2,
whether they should or not, have access to everything.

Regards,
Steve Thompson

-- all opinions here are my own and not necessarily those of my employer. --

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Extract listing of production datasets

[Anthony Saul Babonas]

"listcat level names" from the hlq(s) of choice, then parse.  In our case we
were matching Top Secret against the catalogs, looking for orphans. Catalog
Search Interface would be faster if volume dictates.

My favorite parse tools, in preference sequence, are DF/SORT, SAS, REXX.
 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Robert Fake
Sent: Wednesday, April 11, 2007 3:39 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Extract listing of production datasets

I have a need to generate a listing of all production datasets.  The way the
production datasets are identified is via the 4th byte of the high level
qualifier.  If the 4th byte is a P, it is production.

For example:  EGMP.DATASET.ONE and DNUP.DATASET.ONE are production.

EGMT.DATASET.ONE and DNUT.DATASET.ONE are test, etc.

What is the easiest method to identify and extract to a flat file these
production dataset names?

Thanks in advance for your help.

Bob
Robert B. Fake
InfoSec, Inc.
703-825-1202 (o)
571-241-5492 (c)
949-203-0406 (efax)
[EMAIL PROTECTED]
Visit us at www.infosecinc.com

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

RACF/TSS reporting (was RE: Security Packages Percentages)

[Anthony Saul Babonas]

Bah humbug redux!  Same mediocre programmer needed (me again).  Slight twist
in that the security system outsources the data store to SMF.  Trivial for
Top Secret, merely easy in RACF.  

Did it last night, in the dark hours.Fortunately our auditors only work
in the daylight, but other interested parties do join us for late night
hijinks.

 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Rick Fochtman
Sent: Tuesday, April 10, 2007 1:13 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Security Packages Percentages


Bah humbug, any mediocre programmer (me for instance) can write every RACF
report ever wanted. Freeware (Nigel's collectionand others) abounds.

These require some knowledge of the IRRDBU00 file and some basic DF/SORT
skills. I wrote a bunch of SAS stuff years ago but I'll changing most over
to DFSORT, exploiting SPLICE and other goodies Mr. Yeager provides.

OBTW, same comment applies for Top Secret, the extract files from that
product and RACF are remarkably similar.

I respectfully disagree. The contents of the database can be reported, as
you say, by re-formatting the IRRDBU00 output. That doesn't help much when
senior management calls you at o-dark-thirty in the morning and wants to
know who's been updating a particular control PDS since 3:00 PM yesterday.
Or who invoked a particularly destructive CICS transaction and clobbered
several hundred customer-related account records. 
Reporting database contents is wonderful, especially when auditors show up,
but those audit trails in SMF are also important, especially to a fiduciary
and the inability to generate reports from those audit trails might be a
career-limiting condition.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Security Packages Percentages

[Anthony Saul Babonas]

Bah humbug, any mediocre programmer (me for instance) can write every RACF
report ever wanted.  Freeware (Nigel's collectionand others) abounds.

These require some knowledge of the IRRDBU00 file and some basic DF/SORT
skills.  I wrote a bunch of SAS stuff years ago but I'll changing most over
to DFSORT, exploiting SPLICE and other goodies Mr. Yeager provides.

OBTW, same comment applies for Top Secret, the extract files from that
product and RACF are remarkably similar.  



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Rick Fochtman
Sent: Tuesday, April 10, 2007 11:43 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Security Packages Percentages

-
No, but there is a new mainframe security package called DEADBOLT

(http://www.jmesoftware.com).
--
I haven't looked at the details yet, but based on my extensive experience
with RACF (All the way back to 1.2) and my very limited experience with ACF2
and TopSecret, I'd guess that several iterations of this new package will be
necessary before it's a really viable competitor to "The Big Three". It's
might hard to be all things to all people when it comes to security. I like
RACF the best, but even it has some drawbacks. The most obvioous drawback
that comes to mind is its mediocre reporting capabilities.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: RACF and Member Level Protection

[Anthony Saul Babonas]

ToP Secret can and does do this.  It's a bit kludgey but it does work as
advertised.  For us security folks it's a bother.   

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Tim Hare
Sent: Wednesday, April 04, 2007 2:48 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: RACF and Member Level Protection

RACF does not protect individual members - and I don't see how Top Secret 
does either.   SAF is called from OPEN, which is a dataset-level, not 
member-level function.  Top Secret could of course intercept BLDL and STOW
to provide some sort of member security - but I think those intercepts would
have a performance penalty given all of the PDS searches in an MVS shop, and
of course there are always programs which don't bother with BLDL to worry
about.

I am not a RACF "expert" (I'll leave that to Walt and Russ and others) but
reasoning tells me member protection can't be 100% - too many ways around
it.

Tim Hare
Senior Systems Programmer
Florida Department of Transportation
(850) 414-4209

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the
archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html