Re: dfsort SUM processing
Yes, I think you are right. And if you tried it with 'BI'? Would it work? Melhores Cumprimentos Joao Bentes de Jesus Best Regards "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: ITschak Mugzach To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-10-24 15:22 Subject:[EXTERNAL] Re: dfsort SUM processing Sent by:IBM Mainframe Discussion List I think CH is invalid for sum בתאריך יום ה׳, 24 באוק׳ 2019, 17:10, מאת Joao Bentes < joao.bentes.je...@pt.ibm.com>: > Hi, > > Have you tried it with "CH" instead of "ZD"? For the intended purpose it > should work. And if yes, did it abend as well? > > Best Regards > > Joao Bentes de Jesus > > > "Do the difficult things while they are easy and do the great things while > they are small. A journey of a thousand miles must begin with a single > step." > Laozi > > > > From: ITschak Mugzach > To: IBM-MAIN@LISTSERV.UA.EDU > Date: 2019-10-24 14:54 > Subject:Re: [External] dfsort SUM processing > Sent by:IBM Mainframe Discussion List > > > > It is not a copy paste. I might count wrong. > > בתאריך יום ה׳, 24 באוק׳ 2019, 16:44, מאת Lars H?glund < > lars.hogl...@alecta.se>: > > > x'f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f5' is 16 digits or > > > > But right, it should work anyhow even if You are doing sum on the first > 15 > > > > //Lasse > > > > -Ursprungligt meddelande- > > Fr?n: IBM Mainframe Discussion List F?r > > ITschak Mugzach > > Skickat: den 24 oktober 2019 15:37 > > Till: IBM-MAIN@LISTSERV.UA.EDU > > ?mne: Re: [External] dfsort SUM processing > > > > No, and even if so, all are numbers and can be sub summerized with a > valid > > sign of F. > > > > בתאריך יום ה׳, 24 באוק׳ 2019, 16:35, מאת Lars H?glund < > > lars.hogl...@alecta.se>: > > > > > Isn't this 16 numbers and You are doing sum on 15 > > > > > > //Lasse > > > > > > -Ursprungligt meddelande- > > > Fr?n: IBM Mainframe Discussion List F?r > > > ITschak Mugzach > > > Skickat: den 24 oktober 2019 15:19 > > > Till: IBM-MAIN@LISTSERV.UA.EDU > > > ?mne: Re: [External] dfsort SUM processing > > > > > > Rex, > > > > > > x'F5' is a valid sign for (positive) ZD field. I already read this > > > section, and the number to sum (all are the same) is valid ZD number. > > > > > > ITschak > > > > > > On Thu, Oct 24, 2019 at 4:15 PM Pommier, Rex > > > wrote: > > > > > > > Just a wild guess here, is the SUM statement looking for a signed > > field? > > > > > > > > From the DFSORT manual: > > > > An invalid PD or ZD sign or digit results in a data exception (0C7 > > > > ABEND); 0-9are invalid for the sign and A-F are invalid for the > digit. > > > > For example, a ZDvalue such as 3.5 (X'F34BF5') results in an 0C7 > > > > because "." (X'4B') is treated as an invalid digit. ICETOOL's > > > > DISPLAY or VERIFY operator can be used to identify decimal values > > > > with invalid digits. ICETOOL's VERIFY operator can be used to > > > > identify decimal values > > > with invalid signs. > > > > > > > > Rex > > > > > > > > -Original Message- > > > > From: IBM Mainframe Discussion List On > > > > Behalf Of ITschak Mugzach > > > > Sent: Thursday, October 24, 2019 8:09 AM > > > > To: IBM-MAIN@LISTSERV.UA.EDU > > > > Subject: [External] dfsort SUM processing > > > > > > > > the following situation return abend0c7: > > > > 1. sort fields=(1,4,ch,a,9,5,ch,a) > > > >sum fields=(245,15,ZD) > > > >sum statement caused the abend. without sum, no issue. > > > > > > > > 2. run icetool verify and print. bothe ended with rc=0. print show > > > > x'f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f5' > > > > with seems to be ok. > > > > > > > > why am I getting abend0c7? > > > > > > > > -- > > > > ITschak Mugzach > > > > *|** IronSphere Platform* *|* *Information Security Contiguous > > > > Monitoring for Legacy **| * > > > > > > > >
Re: dfsort SUM processing
Hi, Have you tried it with "CH" instead of "ZD"? For the intended purpose it should work. And if yes, did it abend as well? Best Regards Joao Bentes de Jesus "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: ITschak Mugzach To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-10-24 14:54 Subject:Re: [External] dfsort SUM processing Sent by:IBM Mainframe Discussion List It is not a copy paste. I might count wrong. בתאריך יום ה׳, 24 באוק׳ 2019, 16:44, מאת Lars H?glund < lars.hogl...@alecta.se>: > x'f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f5' is 16 digits or > > But right, it should work anyhow even if You are doing sum on the first 15 > > //Lasse > > -Ursprungligt meddelande- > Fr?n: IBM Mainframe Discussion List F?r > ITschak Mugzach > Skickat: den 24 oktober 2019 15:37 > Till: IBM-MAIN@LISTSERV.UA.EDU > ?mne: Re: [External] dfsort SUM processing > > No, and even if so, all are numbers and can be sub summerized with a valid > sign of F. > > בתאריך יום ה׳, 24 באוק׳ 2019, 16:35, מאת Lars H?glund < > lars.hogl...@alecta.se>: > > > Isn't this 16 numbers and You are doing sum on 15 > > > > //Lasse > > > > -Ursprungligt meddelande- > > Fr?n: IBM Mainframe Discussion List F?r > > ITschak Mugzach > > Skickat: den 24 oktober 2019 15:19 > > Till: IBM-MAIN@LISTSERV.UA.EDU > > ?mne: Re: [External] dfsort SUM processing > > > > Rex, > > > > x'F5' is a valid sign for (positive) ZD field. I already read this > > section, and the number to sum (all are the same) is valid ZD number. > > > > ITschak > > > > On Thu, Oct 24, 2019 at 4:15 PM Pommier, Rex > > wrote: > > > > > Just a wild guess here, is the SUM statement looking for a signed > field? > > > > > > From the DFSORT manual: > > > An invalid PD or ZD sign or digit results in a data exception (0C7 > > > ABEND); 0-9are invalid for the sign and A-F are invalid for the digit. > > > For example, a ZDvalue such as 3.5 (X'F34BF5') results in an 0C7 > > > because "." (X'4B') is treated as an invalid digit. ICETOOL's > > > DISPLAY or VERIFY operator can be used to identify decimal values > > > with invalid digits. ICETOOL's VERIFY operator can be used to > > > identify decimal values > > with invalid signs. > > > > > > Rex > > > > > > -Original Message- > > > From: IBM Mainframe Discussion List On > > > Behalf Of ITschak Mugzach > > > Sent: Thursday, October 24, 2019 8:09 AM > > > To: IBM-MAIN@LISTSERV.UA.EDU > > > Subject: [External] dfsort SUM processing > > > > > > the following situation return abend0c7: > > > 1. sort fields=(1,4,ch,a,9,5,ch,a) > > >sum fields=(245,15,ZD) > > >sum statement caused the abend. without sum, no issue. > > > > > > 2. run icetool verify and print. bothe ended with rc=0. print show > > > x'f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f5' > > > with seems to be ok. > > > > > > why am I getting abend0c7? > > > > > > -- > > > ITschak Mugzach > > > *|** IronSphere Platform* *|* *Information Security Contiguous > > > Monitoring for Legacy **| * > > > > > > > > > -- For IBM-MAIN subscribe / signoff / archive access instructions, > > > send email to lists...@listserv.ua.edu with the message: INFO > > > IBM-MAIN > > > > > > > > > The information contained in this message is confidential, protected > > > from disclosure and may be legally privileged. If the reader of > > > this message is not the intended recipient or an employee or agent > > > responsible for delivering this message to the intended recipient, > > > you are hereby notified that any disclosure, distribution, copying, > > > or any action taken or action omitted in reliance on it, is strictly > > > prohibited and may be unlawful. If you have received this > > > communication in error, please notify us immediately by replying to > > > this message and destroy the material in its entirety, whether in > > electronic or hard copy format. Thank you. > > > > > > > > > > > > -- For IBM-MAIN subscribe / signoff / archive access instructions, > > > s
Re: Tracing RACF?
Have you tried setting the UAUDIT attribute to the userid an analyzing the SMF type 80 that it generates after that? Melhores Cumprimentos João Bentes de Jesus SO Delivery Urbanização Tagus Parque R Dr. Mario Soares Edifício 11 - A1.73 2744-005 Porto Salvo Portugal Phone. (+351) 210072077 email: joao.bentes.je...@pt.ibm.com "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Sean Gleann To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-09-30 15:35 Subject:[EXTERNAL] Re: Tracing RACF? Sent by:IBM Mainframe Discussion List Thanks to all who have responded so far, and apologies for not responding sooner (other work took precedence, unfortunately). Trouble is - I'm no closer to a solution (but I haven't tried the GTF/IPCS idea yet). More on this if I have some news Thanks again Sean On Fri, 27 Sep 2019 at 22:44, Tom Marchant < 000a2a8c2020-dmarc-requ...@listserv.ua.edu> wrote: > On Fri, 27 Sep 2019 00:13:25 -0500, Bruce Hewson wrote: > > >SMS will catalog in the MASTER CATALOG. It does override the > >access rules. It really is important that ALIAS entries are defined > >for any GROUP or USER created. If the USER has access to create > >the dataset then SMS will catalog that dataset. I have plenty of > >evidence to this. > > I knew I'd seen situations where it did not, so I did a quick search. > > > https://www.ibm.com/support/knowledgecenter/SSLTBW_2.3.0/com.ibm.zos.v2r3.adru000/r2109.htm > > > SMS-managed data sets: > Access to SMS-managed data sets gives you access to the user catalog > for the data sets. However, for a RACF-protected master catalog, you > also need UPDATE-access authority to add or delete an SMS-managed > data set entry. > > > -- > Tom Marchant > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Salvo disposto de outra forma acima: / Unless stated otherwise above: Companhia IBM Portuguesa, S.A. Sociedade Anónima com o Capital Social de ? 15.000.000 Registada na Conservatória do Registo Comercial de Lisboa, sob o número único fiscal e de matrícula 500068801 Edifício ?Office Oriente? Rua do Mar da China, Nº 3 Parque das Nações, 1990-138 LISBOA -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Tracing RACF?
Hi, If you want to trace a specific userid you will have to set it with the UAUDIT attribute. That way, all of its accesses will be recorded on SMF type 80 and you will be able to analyze it using ICETOOL or a similar tool. There are several examples on the SYS1.SAMPLIB(IRRICE) that is shipped with z/OS. Best Regards João Bentes de Jesus "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Sean Gleann To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-09-25 12:06 Subject:[EXTERNAL] Tracing RACF? Sent by:IBM Mainframe Discussion List Following a set of somewhat distressing events here, I discovered - the hard way - that our master catalog was poorly protected, and so I now have to fix it. The situation is that all users of the my system can create, read, write, update, delete files that are cataloged in the MasterCat. The original intention was that each user-id is defined in the MCat as an alias that points to one of several User Catalogs, depending on the user's 'department' within the company. That way, user id 'X1' creates 'X1.TEST', and it gets cataloged in a UCAT. So far, so good. Now I've found that if 'X1' creates file 'TEST1', it gets cataloged in the MCAT. In order to prevent this, I've used existing information to act as a model for permit 'MASTERV.CATALOG' generic id(X1) access(read) and specified that. Now, if user X1 tries to create 'X1.TEST', the result is a RACF authorisation failure. Again, so far, so good Taking the test a bit further though, I've now found that user X1 is allowed to delete file 'TEST1' from the MCat! My conclusion so far is that X1 must be getting the required access rights from another user id/group/etc, but I can't see anything apposite in any examination I do of the RACF rules (I use output from the DBSYNC Rexx procedure for this). So... Can anyone spot my error and suggest a different 'permit' command, please? Alternatively, I looked at the idea of tracing RACF activity on behalf of a specific user with SET TRACE(USERID(X1)) - but I can't see where generated output goes to nor how to interrogate it. I *have* seen mention of using GTF for this purpose, along with IPCS, but my experience with both those tools is so limited that I didn't look much further in those references - skipped on past them, looking for other possibilities but not finding any. Any help gratefully appreciated Sean -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Salvo disposto de outra forma acima: / Unless stated otherwise above: Companhia IBM Portuguesa, S.A. Sociedade Anónima com o Capital Social de ? 15.000.000 Registada na Conservatória do Registo Comercial de Lisboa, sob o número único fiscal e de matrícula 500068801 Edifício ?Office Oriente? Rua do Mar da China, Nº 3 Parque das Nações, 1990-138 LISBOA -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Tracing RACF?
Hi, Regarding the access list for UCATS, if they are for SMS datasets, you do not need to have them with UPDATE(*); READ(*) will be enough. Only those creating non-SMS entries will need UPDATE access. Best Regards "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Allan Staller To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-09-25 15:34 Subject:[EXTERNAL] Re: Tracing RACF? Sent by:IBM Mainframe Discussion List That is not considered a good practice in RACF circles. The best practice would be: MCAT - UACC(NONE) READ(*) ALTER(sysprogs) (note: No update access except via sysprogs) UCAT - UACC(NONE) UPDATE(*) ALTER(sysprogs) -Original Message- From: IBM Mainframe Discussion List On Behalf Of Tom Conley Sent: Wednesday, September 25, 2019 9:29 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Tracing RACF? On 9/25/2019 9:57 AM, Joao Bentes wrote: > Hi, > > If memory serves me right, as long as you have ALTER to the dataset, > you need update to the catalog in order to create it, but you do not > need any access to the catalog in order to delete it. > > Best Regards > > > "Do the difficult things while they are easy and do the great things > while they are small. A journey of a thousand miles must begin with a > single step." > Laozi > > > > From: Sean Gleann > To: IBM-MAIN@LISTSERV.UA.EDU > Date: 2019-09-25 12:06 > Subject:[EXTERNAL] Tracing RACF? > Sent by:IBM Mainframe Discussion List > > > > Following a set of somewhat distressing events here, I discovered - > the hard way - that our master catalog was poorly protected, and so I > now have to fix it. The situation is that all users of the my system > can create, read, write, update, delete files that are cataloged in the MasterCat. > > The original intention was that each user-id is defined in the MCat as > an alias that points to one of several User Catalogs, depending on the > user's 'department' within the company. That way, user id 'X1' creates > 'X1.TEST', and it gets cataloged in a UCAT. > > So far, so good. > > Now I've found that if 'X1' creates file 'TEST1', it gets cataloged in > the MCAT. In order to prevent this, I've used existing information to > act as a model for permit 'MASTERV.CATALOG' generic id(X1) > access(read) and specified that. > > Now, if user X1 tries to create 'X1.TEST', the result is a RACF > authorisation failure. > > Again, so far, so good > > Taking the test a bit further though, I've now found that user X1 is > allowed to delete file 'TEST1' from the MCat! > > My conclusion so far is that X1 must be getting the required access > rights from another user id/group/etc, but I can't see anything > apposite in any examination I do of the RACF rules (I use output from > the DBSYNC Rexx procedure for this). > > > So... Can anyone spot my error and suggest a different 'permit' > command, please? > Alternatively, I looked at the idea of tracing RACF activity on behalf > of a specific user with SET TRACE(USERID(X1)) - but I can't see where > generated output goes to nor how to interrogate it. I *have* seen > mention of using GTF for this purpose, along with IPCS, but my > experience with both those tools is so limited that I didn't look much > further in those references - skipped on past them, looking for other > possibilities but not finding any. > > Any help gratefully appreciated > Sean > If you're the owner of the dataset, you will get the authority to delete the catalog entry. You should have your master cat set up with UACC(READ) and all your usercats with UACC(UPDATE). Put them in the global access table for a nice performance boost. Only allow update and alter to the master cat and alter for usercats to your catalog administrators. Good luck. Regards, Tom Conley -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ::DISCLAIMER:: The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. E-mail transmission is not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or may contain viruses in transmission. The e mail and its contents (with or without referred errors) shall therefore not attach any liability on the originator or HCL or its affiliates. Views or opinions, if any, presented in this email are solely those of the author and may not necessarily reflect the views or opinions
Re: Tracing RACF?
Hi, If memory serves me right, as long as you have ALTER to the dataset, you need update to the catalog in order to create it, but you do not need any access to the catalog in order to delete it. Best Regards "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Sean Gleann To: IBM-MAIN@LISTSERV.UA.EDU Date: 2019-09-25 12:06 Subject:[EXTERNAL] Tracing RACF? Sent by:IBM Mainframe Discussion List Following a set of somewhat distressing events here, I discovered - the hard way - that our master catalog was poorly protected, and so I now have to fix it. The situation is that all users of the my system can create, read, write, update, delete files that are cataloged in the MasterCat. The original intention was that each user-id is defined in the MCat as an alias that points to one of several User Catalogs, depending on the user's 'department' within the company. That way, user id 'X1' creates 'X1.TEST', and it gets cataloged in a UCAT. So far, so good. Now I've found that if 'X1' creates file 'TEST1', it gets cataloged in the MCAT. In order to prevent this, I've used existing information to act as a model for permit 'MASTERV.CATALOG' generic id(X1) access(read) and specified that. Now, if user X1 tries to create 'X1.TEST', the result is a RACF authorisation failure. Again, so far, so good Taking the test a bit further though, I've now found that user X1 is allowed to delete file 'TEST1' from the MCat! My conclusion so far is that X1 must be getting the required access rights from another user id/group/etc, but I can't see anything apposite in any examination I do of the RACF rules (I use output from the DBSYNC Rexx procedure for this). So... Can anyone spot my error and suggest a different 'permit' command, please? Alternatively, I looked at the idea of tracing RACF activity on behalf of a specific user with SET TRACE(USERID(X1)) - but I can't see where generated output goes to nor how to interrogate it. I *have* seen mention of using GTF for this purpose, along with IPCS, but my experience with both those tools is so limited that I didn't look much further in those references - skipped on past them, looking for other possibilities but not finding any. Any help gratefully appreciated Sean -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Salvo disposto de outra forma acima: / Unless stated otherwise above: Companhia IBM Portuguesa, S.A. Sociedade Anónima com o Capital Social de ? 15.000.000 Registada na Conservatória do Registo Comercial de Lisboa, sob o número único fiscal e de matrícula 500068801 Edifício ?Office Oriente? Rua do Mar da China, Nº 3 Parque das Nações, 1990-138 LISBOA -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: CONSOLE command failing - what else to check?
Have you checked the profiles on the CONSOLE class? Best Regards Joao Bentes de Jesus "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Todd Burrell <todd_burr...@csx.com> To: IBM-MAIN@LISTSERV.UA.EDU Date: 2017-08-16 16:52 Subject:CONSOLE command failing - what else to check? Sent by:IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> I have 2 users and one can successfully execute the CONSOLE command while running it in a started task and in batch, but the other user cannot. From what I can tell they are both connected to the same RACF groups and both should have all of the necessary access required to run the CONSOLE command - but one fails with a RC 36 which indicates they are not authorized? Also, there are no RACF error messages for the failing user - and nothing when I ran RACFICE this morning in the violation report? I seem to remember there is something else that might need to get changed in TSO? Does anyone have anything else I can check? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Salvo disposto de outra forma acima: / Unless stated otherwise above: Companhia IBM Portuguesa, S.A. Sociedade Anónima com o Capital Social de ? 15.000.000 Registada na Conservatória do Registo Comercial de Lisboa, sob o número único fiscal e de matrícula 500068801 Edifício ?Office Oriente? Rua do Mar da China, Nº 3 Parque das Nações, 1990-138 LISBOA -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SAS user abend code documentation?
Barbara, Do those userids have a default group with an OMVS segment as well? "Do the difficult things while they are easy and do the great things while they are small. A journey of a thousand miles must begin with a single step." Laozi From: Barbara NitzTo: IBM-MAIN@LISTSERV.UA.EDU Date: 2017-03-23 11:44 Subject:SAS user abend code documentation? Sent by:IBM Mainframe Discussion List We are currently experiencing abend u1335 in SAS 9.4_m3 in different jobs. My first step would be to determine what that user abend actually tells me - but I cannot find the book containing the abend code meanings. Does anyone know what book contains that information? (We already have a ticket open with SAS, and we were told to make sure that the users have an OMVS segment because they don't. Well, they DO have an OMVS segment, and it is old news that bpx.default.user doesn't work anymore under 2.1) Thanks, Barbara -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN Salvo disposto de outra forma acima: / Unless stated otherwise above: Companhia IBM Portuguesa, S.A. Sociedade Anónima com o Capital Social de ? 15.000.000 Registada na Conservatória do Registo Comercial de Lisboa, sob o número único fiscal e de matrícula 500068801 Edifício ?Office Oriente? Rua do Mar da China, Nº 3 Parque das Nações, 1990-138 LISBOA -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN