Re: How to reduce the overhead of WLM?
Thanks for your advice everyone. Graham: The 250ms interval seems to me to be the crux of the problem. I was hoping for a way to adjust it. We don't have all that many "user work" address spaces started. Usually only one CICS region. Jim: I've set RMPTTOM to 45000. Going from 3000 to 15000 didn't seem to have an effect, but I was hesitant at shooting too high. Allan: We have little to no usage of those subsystems--even CICS is pretty lightly used. My goal is to reduce the CPU usage in the WLM & other system address spaces because we pay for CPU cycles. Peter: That's correct. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
How to reduce the overhead of WLM?
This is probably a strange question, but is there a way to reduce WLM cpu usage? Here's the situation: - The system is a lightly used development system. Unless something is in a loop (very rare), CPU % probably is usually less than 10%. And except for system regions & CICS, it's rare to have multiple jobs running concurrently. - Only one processor defined to the VM. No ZIIP either. - We are charged for CPU cycles. - WLM is the highest consumer of CPU. JES2, TCPIP, ZFS and SDSFAUX round out the top 5 consumers. There is a lot of information about WLM tuning, but as best I can tell almost none of it relates to reducing WLM usage. From reading the Init & Tuning manual, I'm trying these settings: AIMANAGEMENT=NO HIPERDISPATCH=NO CCCAWMT=45 RMPTTOM=15000 I was thinking that perhaps reducing whatever processing intervals I could might help. But I can't tell these changes made a difference. (I don't have a tool to measure WLM usage.) Any suggestions would be appreciated. TIA, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TELNET PROFILE, strictly PDS?
As Allan said, you can compress an in-use PDS using IEBCOPY. //CMPEXEC PGM=IEBCOPY //SYSPRINT DD SYSOUT=* //SYSUT3 DD UNIT=SYSDA,SPACE=(CYL,(90)) //SYSUT4 DD UNIT=SYSDA,SPACE=(CYL,(90)) //INDD0DD DISP=SHR,DSN= //SYSINDD * C I=INDD0,O=INDD0 /* You might have to adjust the SYSUT3/4 space. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How can I keep JES2 from being SYSPLEXed?
Thanks for the tips guys.
I am using the same node name ("JES2") on both systems--that's probably why the
XCFGRPNM parm was necessary. (I NJE with a VSE machine & when the 3.1 system
is the primary/only machine I'll move the CTC connection to the new system
without changing any of the VSE stuff.)
These are 2 development systems running under VM. No production at all. Once
everything is set up on the z/OS 3.1 system, we probably will rarely run the
2.5 system. I just need them up together once in awhile to test things using a
coupling facility, like VSAM/RLS between the 2 systems.
Thanks again!
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How can I keep JES2 from being SYSPLEXed?
Thanks for your help Bruce and Paul. I was able to ask this to the IBM support team and they told me about the "XCFGRPNM" parm on the JES2 MASDEF statement. I hadn't specified a value for this, so both were using the default of "JES2". This was causing the conflict, even though my intent was that they not be part of the same MAS. Adding “XCFGRPNM=someuniqueval” to the MASDEF statements allowed both systems to come up, apparently independently of each other. (I used JES2Z3 on my S0W3 system and JES2Z4 on my S0W1 system.) I did a cold start on the S0W3 JES, and these Groups/Members were used: GROUP SYSJES MEMBER S0W3 GROUP JES2Z3 MEMBER JES2$S0W3 GROUP SYSJ2$XD MEMBER JES2Z3$S0W3$ I did not do a cold start on the S0W1 JES, and I believe it used the former/default value: GROUP SYSJES MEMBER S0W1 GROUP JES2 MEMBER JES2$S0W1 GROUP SYSJ2$XD MEMBER JES2$S0W1$$$ Thanks again, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
How can I keep JES2 from being SYSPLEXed?
I have two systems that I want to share dasd and allow for VSAM RLS between the systems, but I don’t want to SYSPLEX JES2. I have MASDEF SHARED=NOCHECK. What else can I do to un-sysplex JES? Is it safe to delete the JES2 and/or SYSJES group definitions from XCF? I don't have a JES_CKPT_1 structure defined at all. Background: I’m trying to add a z/OS 3.1 ( S0W1) to a sysplex where z/OS 2.5 (Z3- S0W3) is running, but ONLY for VSAM RLS. I don’t want to “plex” anything more than is needed for VSAM/RLS—not JES, not SYSLOG, not VTAM, not SMF or anything else. The systems are running fine stand-alone (each with their own set of disks, including the volume with the CDS), but when I try to use the same CDS disk between the systems, the first system comes up fine, but JES2 on the system brought up last complains that it cannot find the checkpoint datasets of the OTHER system: Z4 : H *$HASP284 JES2 INITIALIZATION CHECKPOINT DIALOG STARTED Z4 : H *$HASP277 JES2 CAN NOT FIND OR USE THE CHECKPOINT DATA SET(S) Z4 : H THAT WERE IN USE WHEN THE MAS WAS LAST ACTIVE BECAUSE VOLUME Z4 : H FOR CKPT1 NOT MOUNTED Z4 : H * Z4 : H CURRENT CHECKPOINT VALUES: Z4 : H CKPT1=(DSNAME=SYS1.HASPCKPT,VOLSER=B5SYS1,INUSE=YES), Z4 : H CKPT2=(DSNAME=SYS1.HASPCKP2,VOLSER=B5CFG1,INUSE=YES) Z4 : H * Z4 : H VALID RESPONSES ARE: Z4 : HCKPT1=... - UPDATE CURRENT CHECKPOINT SPECIFICATION WITH Z4 : HCKPT2=...THE VALUES USED WHEN JES2 MAS WAS LAST ACTIVE Z4 : H'RECONFIG' - THE CHECKPOINT DATA SET(S) THAT WERE IN USE Z4 : H WHEN JES2 WAS LAST ACTIVE ARE NO LONGER Z4 : H AVAILABLE (ALL-MEMBER WARM START ONLY) Z4 : H'CONT' - ATTEMPT INITIALIZATION WITH THE VALUES LISTED Z4 : H'TERM' - TERMINATE JES2 INITIALIZATION ON THIS MEMBER Z4 : H *04 $HASP272 ENTER RESPONSE (ISSUE D R,MSG=$HASP277 FOR RELATED MSG) "Z4" is the z/OS 3.1 system. The “B5SYS1” and “B5CFG1” volumes belong to the z/OS 2.5 system. If I bring up z/OS 3.1 with z/OS 2.5 down and then try to bring up z/OS 2.5, the same message is displayed except it identifies the volumes belonging to the other system. I can RECONFIG with the correct CKPT volumes, but it always ends with: Z4 : $HASP478 INITIAL CHECKPOINT READ IS FROM CKPT1 Z4 : (SYS1.HASPCKPT ON A3SYS1) Z4 : LAST WRITTEN THURSDAY, 18 JAN 2024 AT 21:57:08 (GMT) Z4 : $HASP792 JES2 HAS JOINED XCF GROUP JES2 THAT INCLUDES ACTIVE MEMBERS Z4 : THAT ARE NOT PART OF THIS MAS Z4 : MEMBER=JES2$S0W3,REASON=DIFFERENT COLD START TIME Z4 : $HASP428 CORRECT THE ABOVE PROBLEMS AND RESTART JES2 Z4 : IXZ0002I CONNECTION TO JESXCF COMPONENT DISABLED, Z4 : GROUP JES2 MEMBER JES2$S0W1 Z4 : $HASP9085 JES2 MONITOR ADDRESS SPACE STOPPED FOR JES2 Z4 : $HASP085 JES2 TERMINATION COMPLETE Like I said, I don't want a MAS at all--each JES2 should be separate. (This has already gone too long, but here are some displays that might help:) Both JES parms use the same MASDEF definition: MASDEF SHARED=NOCHECK, CKPTLOCK=INFORM, RESTART=NO, DORMANCY=(25,300), HOLD=10, LOCKOUT=1200 Z3 $dmasdef (If other system is down, after a cold start.) $HASP843 MASDEF > $HASP843 MASDEF OWNMEMB=S0W3,AUTOEMEM=OFF,CKPTLOCK=INFORM, $HASP843 COLDTIME=(2022.313,18:50:45),COLDVRSN=z/OS 2.5, $HASP843 ENFSCOPE=SYSPLEX,DORMANCY=(25,300),HOLD=10, > $HASP843 LOCKOUT=1200,RESTART=NO,SHARED=NOCHECK, <== $HASP843 SYNCTOL=120,WARMTIME=(2024.018,22:05:36), $HASP843 XCFGRPNM=JES2,QREBUILD=0,CYCLEMGT=MANUAL, $HASP843 ESUBSYS=HASP Z4 $DMASDEF (If other system is down, after a cold start.) Z4 : $HASP843 MASDEF Z4 : $HASP843 MASDEF OWNMEMB=S0W1,AUTOEMEM=OFF,CKPTLOCK=INFORM, Z4 : $HASP843 COLDTIME=(2024.019,21:00:02),COLDVRSN=z/OS 3.1, Z4 : $HASP843 ENFSCOPE=SYSPLEX,DORMANCY=(25,300),HOLD=10, Z4 : $HASP843 LOCKOUT=1200,RESTART=NO,SHARED=NOCHECK, <== Z4 : $HASP843 SYNCTOL=120,XCFGRPNM=JES2,QREBUILD=0, Z4 : $HASP843 CYCLEMGT=MANUAL,ESUBSYS=HASP Z3 d xcf,group IXC331I 17.49.11 DISPLAY XCF 833 GROUPS(SIZE): ATRRRS(3)COFVLFNO(2) DSNDPDG(2) EZBTCPCS(1)HSFIXC(1) IDAVQUI0(3) IGG0CAS(2) IGWXSGIS(4) IOEZFS(2) > ISTCFS01(1) IXCLO008(2) JES2(1) <== N1(3) SYSBPX(2) SYSDAE(4) SYSENF(2) SYSGRS(2)SYSGRS2(1)
Re: FTP problem
fwiw, I wrote a bash script to run gsktrace and ftp it to a Windows FTP server. (I connect to z/OS using SSH to run it.) >cat gskput #!/bin/bash HOST='winpc' USER='winuserid' PASSWD='winpwd' cd /tmp rm /tmp/gsk.out gsktrace /tmp/gskmack.trc > /tmp/gsk.out ftp -n -v $HOST << EOT ascii user $USER $PASSWD prompt cd /C/Temp/ put /tmp/gsk.out /C/Temp/gsk.out quit EOT rm gskmack.tmp rm gsk.out Transferring it as ascii works for me. (/C/Temp/ is mapped by the FTP server to a folder on the Windows PC.) hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Chaining format 9 and format 3 DSCBs in EAV VTOC
Thank you for the confirmation Radoslaw. Whatever I tried with either VSAM or PDSe, I could not get more than 123 extents on a volume. But I also never found the right document to describe the 123-extent limit. SO, I guess there wouldn't be a reason for multiple format-9 records for the same file. 10 DS9F3 slots can point to 130 extents. Thanks to you and Bill for your help! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Chaining format 9 and format 3 DSCBs in EAV VTOC
Hi Bill. I can confirm that in a format-3 record with all 13 slots filled, the DS3PTRDS field points to the CCHHR of the next format-3. And the "next" slot in the format-9 record then points to the next format-3. I tried to confirm that there will be a second format-9 record for a file with > 133 extents. And that the DS9PTRDS field in the first format-9 will point to the second format-9 record. But I've not been able to create a dataset with > 123 extents. I believe 255 are possible. From z/OS 2.5 DFSMS Using Data Sets: "You can expand the space for a nonstriped VSAM component to 255 extents. For SMS-managed VSAM data sets, this extent limit is removed if Extent Constraint Removal is specified in the Data Class. The theoretical limit is then the maximum number of volumes (59), times 123 extents per volume, or 7257 extents." ...so I don't know if > 123 extents is possible on a single volume. Anyway, thanks again for your help! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Chaining format 9 and format 3 DSCBs in EAV VTOC
Thanks Bill, that's very helpful. Please let me see if I have this straight yet: - If there is a format-8 DSCB, there will be a format-9 DSCB. - If there are > 3 extents (which are handled by the format-1) but < 133 extents, the format-9 record's DS9PTRDS will -> the first format-3 record. - For each 13 extents (after the first 3), an additional format-3 record will be created. The CCHHR of the n+1 format-3 record will be in the "n" format-3's DS3PTRDS. (Is it also in the "n" DS9F3 slot?) - There will not be an additional format-9 (subtype 1) record unless there are more than 10 format-3 records. If there are > 133 extents, the DS9PTRDS in the first format-9 record will point to the second format-9 record. Otherwise it will point to the first format-3 record? Thanks again! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Chaining format 9 and format 3 DSCBs in EAV VTOC
Hello Listers, I have a question about how additional extents for a dataset are chained together for files on EAV volumes. If I understand correctly: - The format 8 record has slots to keep track of the first 3 extents of a dataset (DS1EXT1/DS1EXT2/DS2EXT3). - If there are more than 3 extents, the DS1PTRDS will point to a format 9 record - The format 9 record contains pointers in the DS9F3 area to point to up to 10 format 3 records - Each format 3 record can point to up to 10 extents - The DS9PTRDS description contains the text: "FORWARD CHAIN POINTER (CCHHR) TO THE NEXT FORMAT 9 DSCB -> OR TO THE FIRST FORMAT 3 DSCB IF DATA SET HAS MORE THAN 3 EXTENTS. OTHERWISE ZERO." There wouldn't be a format 9 record if there weren't more than 3 extents. So I think the comment on the DS9PTRDS field is confusing. It seems there are 2 ways extents could be chained via the DSxPTRDS fields: DS9PTRDS -> the next FMT 9 record, whose DS9PTRDS -> another FMT 9 record, or DS9PTRDS -> the next FMT 3 record, whose DS3PTRDS -> another FMT 3 record My question is: If there are more than 13 extents, will the DS9PTRDS always point to another format 9 record? Or are there circumstances when it will point to a format 3 record? Or, maybe restated: What will the DS3PTRDS field contain when the format 3 record has been pointed to by a format 9 record, when there is another format 3 record? The graphics in https://www.ibm.com/docs/en/zos/2.5.0?topic=components-data-set-control-block-dscb-types show DS3PTRDS->another format 3 for non-EAV records, but they don't show multiple format 9 records. Thanks for your help! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SSHD terminates immediately with permission(?) problem
A big "Thank you" to all of you listers who chimed in on my "EDC5111I Permission denied. (errno2=0x744C7246)." message. Almost everyone was on the right track. Changing to port showed that it was just port 22. Commenting out the RESTRICTLOWPORTS and the PORT reservation for "22 SSHD" showed it was one of those. Restoring RESTRICTLOWPORTS showed it was the port reservation for "22 SSHD" that was the problem. (The proc that's started is SSHD, but it always starts SSHDx--usually 3, sometimes 4.) I didn't expect the TCPPROF entries--neither of those I mentioned have changed for years. My suspicion is that there was some service applied that perhaps actually started enforcing the port reservation to just "SSHD". Thanks again, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
SSHD terminates immediately with permission(?) problem
I've done something wrong that I can't identify, and now SSHD terminates
immediately after starting.
I'm not getting anything helpful on the console or in the joblog. But I am
getting these msgs in syslog:
OMVSKERN SSHD3sshd[67174408]: error: FOTS1442 Bind to port 22 on :: failed:
EDC5111I Permission denied. (errno2=0x744C7246).
OMVSKERN SSHD3sshd[67174408]: error: FOTS1442 Bind to port 22 on 0.0.0.0
failed: EDC5111I Permission denied. (errno2=0x744C7246).
OMVSKERN SSHD3sshd[67174408]: fatal: FOTS1464 Cannot bind any address.
I've looked up the 7246 code:
JRPORTACCESSAUTH EQU 29254* User does not have authority to access
this port.
OMVSKERN's is UID(0). Has ALTER access to BPX.DAEMON. Port 22 is not in use,
per D TCPIP,,N,SOCKETS
None of the files in /etc/ssh had changed for 4 years, so I don't think it's
there. (I did set LogLevel to DEBUG3, which didn't help any.)
The only things I can think of that I might have messed up something with keys.
I did try some weeks ago to set up a certificate to bypass entering my
password when using "ssh user@zos" and didn't get that to work. And I did
install a new CERTAUTH this week for the new IBM service requirement ("DigiCert
Global Root G2"), 'tho I can't imagine that would matter.
Any suggestions would really be appreciated...I'm not much good with entering
USS commands via a 3270 screen.
TIA,
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rexx Exec to Build 10,000 PDS Members: ALLOC vs ISPF Services vs ?
Gil, For instream data, you should be ok by specifying a unique DLM value on the SYSIN DD statement. But if the data contained statements starting with ./ statements, that would be a problem. I don't know about the UPDTE program mentioned from the CBTAPE. But Lennie is right--IEBUPDTE only does 80-byte records. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rexx Exec to Build 10,000 PDS Members: ALLOC vs ISPF Services vs ?
I don't know about the logic required to create a member -- Kolusu might have the best idea. But creating one long sequential file with all the members and using IEBUPDTE is pretty simple: //STEP1EXEC PGM=IEBUPDTE,PARM=MOD //SYSPRINT DD SYSOUT=* //SYSUT1 DD DISP=OLD,DSN=SOME.PDSE //SYSUT2 DD DISP=OLD,DSN=SOME.PDSE //SYSINDD DATA ./ADD NAME=BLUE1 The sky appears blue because of a phenomenon called Rayleigh scattering. ./ADD NAME=BLUE2 When sunlight enters the Earth's atmosphere, it is scattered in all directions by the gases and particles in the air. ./ADD NAME=BLUE3 Blue light has a shorter wavelength and is more easily scattered than other colors, which is why we see the sky as blue during the day. /* // (I've included blank lines around the text for clarity here. All that's needed between members is the ./ ADD NAME=membername.) This assumes you want to recreate the PDSE each time. "Monica" says IEBUPDTE won't delete from a PDSE like it will from a PDS. (I've not found "Monica" to be all that accurate so far though.) Hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What is BPXAS and how do I make them stop piling up?
Charles, imo Seymour was on the right track. Could it have been that someone issued a $T JOBCLASS command? (Or maybe from SDSF.) We usually run with STC and TSU OUTDISP=(PURGE,PURGE), and the SYSOUTs disappear at end of task. But sometimes I want to see the output so I issue $T STCCLASS,OUTDISP=(HOLD,HOLD) and they accumulate in the JES queue until I change it back. This would affect all STC sysouts, not just BPXAS. (If BPXAS is an STC--after all the discussion I'm not sure.) If you don't want any of that class, try $T JOBCLASS(STC),OUTDISP=(PURGE,PURGE)...or ...(PURGE,HOLD) if you want to keep them for abnormal terminations. (I suppose there's a chance something in your IEFUJP exit changed, if this doesn't help.) hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Almost gone
Sorry to see you go John. Your brilliance and humility have been noticed, and much appreciated. May God bless you richly in this next phase of life. Maranatha! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Can you connect to the PTF download site with z/OS FTP?
Generally speaking (I don't know about IBM support) you can get the FTP client
to connect via TLS 1.2 without using AT-TLS if you specify the right settings.
But you'll still need the certificates added to a RACF keyring.
//*---
//FTPS EXEC PGM=FTP,REGION=4M,
// PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV")/ftp.whatever.com 21 -e')
//STDENV DD *
GSK_PROTOCOL_TLSV1_2=ON
//* GSK_TRACE=0x
//* GSK_TRACE_FILE=/tmp/gsk.trc
//* The 2 stmts above can be temporarily uncommented for debugging
//SYSFTPD DD *,SYMBOLS=(JCLONLY)
CLIENTERRCODESEXTENDED
EPSV4 TRUE
EXTENSIONSAUTH_TLS
FWFRIENDLYTRUE
KEYRING /
PASSIVEIGNOREADDR TRUE
SECUREIMPLICITZOS FALSE
SECURE_FTPREQUIRED
SECURE_MECHANISM TLS
SECURE_DATACONN PRIVATE
SECURE_CTRLCONN PRIVATE
SECURE_HOSTNAME REQUIRED
TLSMECHANISM FTP
TLSRFCLEVEL RFC4217
//* DEBUG SEC
//* TRACE
//* The 2 stmts above can be temporarily uncommented for debugging
//*
This worked on z/OS 2.4 and 2.5. Maybe earlier.
If you capture the trace, you'll need to use the gsktrace command to decipher
it:
gsktrace /tmp/gsk.trc > /tmp/gsk.out
"DEBUG" and "TRACE" are just routed to SYSOUT, so they're easier. But there is
a lot of information on the key exchange in the gsk trace.
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IEBGENER and JES System Symbol
Hey Gil. I changed to //SYSINDD *,SYMBOLS=(EXECSYS,SYSPRINT) and the log showed the PROC variables in the SYSIN data NOT being substituted. - If I only code the & parameters in the SYSIN data, JES complains with IEFC657I messages because I didn't use the parms to the PROC: 3 //RECATL PROC DSN=,VOL= //EX1 EXPORT SYMLIST=* //RECTIDX EXEC PGM=IDCAMS //SYSPRINT DD SYSOUT=L //SYSINDD *,SYMBOLS=(EXECSYS,SYSPRINT) //PEND //* 4 //R1 EXEC RECATL,DSN=WRL1.LINEAR,VOL=MACK07 5 ++RECATL PROC DSN=,VOL= 6 ++EX1 EXPORT SYMLIST=* 7 ++RECTIDX EXEC PGM=IDCAMS 8 ++SYSPRINT DD SYSOUT=L 9 ++SYSINDD *,SYMBOLS=(EXECSYS,SYSPRINT) STMT NO. MESSAGE 4 IEFC001I PROCEDURE RECATL WAS EXPANDED USING INSTREAM PROCEDURE DEFINITION 4 IEFC657I THE SYMBOL DSN WAS NOT USED 4 IEFC657I THE SYMBOL VOL WAS NOT USED - If I add dummy SET statements to get around the IEFC657I messages, but use the same symbol names in the SYSIN data as the PROC uses, SYSIN doesn't get changed: //RECATL PROC DSN=,VOL= //EX1 EXPORT SYMLIST=* // SET DS= // SET VL= //RECTIDX EXEC PGM=IDCAMS //SYSPRINT DD SYSOUT=L //SYSINDD *,SYMBOLS=(EXECSYS,SYSPRINT) DEFINE CLUSTER(NAME() - RECATALOG LINEAR VOL()) - DATA(NAME()) //PEND //* //R1 EXEC RECATL,DSN=WRL1.LINEAR,VOL=MACK07 SYSIN: RECORD 1 BEFORE SUBSTITUTION SYSIN: DEFINE CLUSTER(NAME() - SYSIN: RECORD 1 AFTER SUBSTITUTION DEFINE CLUSTER(NAME() - SYSIN: DEFINE CLUSTER(NAME() - SYSIN: RECORD 2 BEFORE SUBSTITUTION SYSIN:RECATALOG LINEAR VOL()) - SYSIN: RECORD 2 AFTER SUBSTITUTION SYSIN:RECATALOG LINEAR VOL()) - SYSIN: RECORD 3 BEFORE SUBSTITUTION SYSIN:DATA(NAME()) SYSIN: RECORD 3 AFTER SUBSTITUTION IDC3203I ITEM '' DOES NOT ADHERE TO RESTRICTIONS RECATALOG LINEAR VOL()) - DATA(NAME()) IDC3202I ABOVE TEXT BYPASSED UNTIL NEXT COMMAND. CONDITION CODE IS 12 IDC0002I IDCAMS PROCESSING COMPLETE. MAXIMUM CONDITION CODE WAS 12 SYSIN:DATA(NAME()) - If I rename the PROC variables using SET statements, and then use the SET names in SYSIN, it works: //RECATL PROC DSN=,VOL=MACK07 //EX1 EXPORT SYMLIST=* // SET DS= // SET VL= //RECTIDX EXEC PGM=IDCAMS //SYSPRINT DD SYSOUT=L //SYSINDD *,SYMBOLS=(EXECSYS,SYSPRINT) DEFINE CLUSTER(NAME() - RECATALOG LINEAR VOL()) - DATA(NAME()) //PEND //* //R1 EXEC RECATL,DSN=WRL1.LINEAR,VOL=MACK07 SYSIN: RECORD 1 BEFORE SUBSTITUTION SYSIN: DEFINE CLUSTER(NAME() - SYSIN: RECORD 1 AFTER SUBSTITUTION SYSIN: DEFINE CLUSTER(NAME(WRL1.LINEAR) - SYSIN: RECORD 2 BEFORE SUBSTITUTION SYSIN:RECATALOG LINEAR VOL()) - SYSIN: RECORD 2 AFTER SUBSTITUTION SYSIN:RECATALOG LINEAR VOL(MACK07)) - SYSIN: RECORD 3 BEFORE SUBSTITUTION SYSIN:DATA(NAME()) SYSIN: RECORD 3 AFTER SUBSTITUTION DEFINE CLUSTER(NAME(WRL1.LINEAR) - RECATALOG LINEAR VOL(MACK07)) - DATA(NAME(WRL1.LINEAR.DATA)) IDC3013I DUPLICATE DATA SET NAME IDC3009I ** VSAM CATALOG RETURN CODE IS 8 - REASON CODE IS IGG0CLEH-38 IDC3003I FUNCTION TERMINATED. CONDITION CODE IS 12 IDC0002I IDCAMS PROCESSING COMPLETE. MAXIMUM CONDITION CODE WAS 12 SYSIN:DATA(NAME(WRL1.LINEAR.DATA)) (The dataset was fine before I started, so IDCAMS fails rc 12. But the variables in the SYSIN data were substituted correctly.) - -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IEBGENER and JES System Symbol
I can't explain why, but it works for me if I follow the //EX1 EXPORT SYMLIST=* with SET statements using "renamed" variables, and then use the new names in the in-stream data: //RECATL PROC DSN=,VOL= //EX1 EXPORT SYMLIST=* // SETDS= // SETVL= //RECATEXEC PGM=IDCAMS //SYSPRINT DD SYSOUT=L //SYSINDD *,SYMBOLS=(EXECSYS) DEFINE CLUSTER(NAME() - LINEAR RECATALOG VOL()) - DATA(NAME()) //* // PEND Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SYSTEM REXX use
Hi Ken.
You may probably(?) already have an AXR00 PARMLIB member (or some other suffix,
pointed to from IEASYSxx via the AXR=(xx) parameter.
The AXRxx member lets you define a prefix character (like $ for JES2) that
provides an alternative to using F AXR,rexxname:
/***/
/* THIS IS A SAMPLE AXR00 MEMBER OF SYS1.PARMLIB */
/***/
CPF('@',SYSPLEX)/* 1st char is SYSREXX prefix char */
AXRUSER(IBMUSER)
REXXLIB ADD DSN(USER.SAXREXEC)
REXXLIB ADD DSN(ADCD.)
REXXLIB ADD DSN(SYS1.SAXREXEC)
--
With the above version of AXR00 in use, system rexx routines can be stored in
any of the 3 REXXLIB libraries listed. And they can be started by just
entering "@rexxname".
So if I have a system Rexx routine named TCPTRACE, instead of starting it with
F AXR,TCPTRACE, I can just type @TCPTRACE START 10.1.1.1
I don't believe TSO facilities are available, so this may not be what you're
looking for.
Hth.
~Wendell Lovewell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Location of forms code in z/OS manuals
Seymour, could you use the Title tag? root@WLPC:/a/temp# pdfinfo sg246818.pdf | grep Title Title: Merging Systems into a Sysplex Gil, thanks for the tip on pdfinfo. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Finding uncatalogued datasets
Hi Jack. I'm going thru a similar process, although with a much smaller number of volumes. ADRDSSU also allows you to specify STORGRP instead of the volser: DUMP OUTDD(BUFILE) STORGRP(MACS)- DATASET(INCLUDE(**,- USERCAT.MACK01 - ) - EXCLUDE(SYS1.V*.**)- BY(DSCHA,EQ,YES) - ) - OPTIMIZE(4) SHARE TOL(IOER,ENQF) COMPRESS With TYPRUN=NORUN, or with my "BUFILE" set to DD DUMMY, an error will be generated and RC set to 8 for each dataset that is not cataloged. Some of the parms are only of use when I do actually do the DUMP. This will run a long time though, so with 8000 volumes you might want something less resource instead. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: REXX outside TSO
re: "Cygwin? The only thing that made Windows tolerable for me. Ubuntu basn?" The recent versions of Windows allow running Ubuntu or more other distributions of Linux, m/l "natively". Look up "Windows Subsystem for Linux" or "wsl.exe" or https://docs.microsoft.com/en-us/windows/wsl/ All of the Linux tools are available, from whatever distro you'd like. ~ Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is deliverycb-bld.dhe.ibm.com the wrong host for HTTPS PTF downloads?
I was the name-dropper Kurt. I thought I saw you discussing with someone, somewhere, something about using or not using delivery"cb"-bld.dhe.ibm.com vs delivery"something else"... (Can I make that any more vague? :) ) Anyway, "cb" is working now. At least I could get the files with Download Director. Thanks, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is deliverycb-bld.dhe.ibm.com the wrong host for HTTPS PTF downloads?
Wouldn't you know it? Just as soon as I posted the question, I tried the JNLP download it it worked. Sorry to have troubled you. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Is deliverycb-bld.dhe.ibm.com the wrong host for HTTPS PTF downloads?
I'm trying to download service for APAR PH39134 from ShopZ. I tried installing Java 8 so I could run the JNLP ShopZ provided, but it always displays "Server busy, try again later". I've tried using the RNFJOBH job provided by ShopZ, but I'm getting: GIM44336S ** AN UNUSUAL CONDITION OCCURRED. GIMJVGET - java.net.SocketException: Read failed I googled & found https://downforeveryoneorjustme.com/deliverycb-bld.dhe.ibm.com, which says "It's not just you-deliverycb-bld.dhe.ibm.com is down". I skimmed a thread here not that long ago about "deliverycb-bld.dhe.ibm.com", in which Kurt might have said to use a different server---but I can't find it now. Is "deliverycb-bld.dhe.ibm.com" temporarily unavailable, or has ShopZ sent me to the wrong server? Thanks, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Job submission from CMS to MVS
>>Except for instream data sets. Are you actually commenting >>your instream data in that fashion‽ I'm keeping source code on the PC, so the compiles and other types of jobs often include the source code itself in the jobstream. I do have comments past 80 in the program source. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Job submission from CMS to MVS
Hi Gil. >>Would a unit record device other than PUN (perhaps PIPEd) >>relax that constraint? >>As I learned Pipelines I adopted the habit of DEFINing a fresh >>UR device rather than saving and restoring the characteristics >>of an existing one (and CONT can't be restored.) The last time I made much use of the CMS version was probably before Pipelines even existed! >>I wrote an ISPF Edit macro to submit with no F-80 limitation. My Kedit macro allows > 80 byte records. But it's not the default, because I use beyond col 80 as line comments that are intentionally stripped off before being FTP'd to JES. (FTP doesn't have the restriction, but I usually wanted it so I could comment in cols 80+) >>> ... And RSCS will (I think) propagate the >>CMS userid as already validated (that might not be the case now). Seems like >>I might have written a JES exit to accept the userid on the spool file as the >>MVS userid for the job when it was read from the virtual card reader. (Same >>disclaimer.) > >>Our admins, rather, replicated the RACF profiles from our TSO >>IDs to our CMS IDs. The problem I had going from CMS to MVS with the userids was that, without an exit, I couldn't propagate the password safely. I think I used a JES exit to handle reader input like it was already authenticated, similar to what RSCS/NJE would do. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Job submission from CMS to MVS
Hi Shmuel. Many years ago, I used a virtual card reader on MVS and the CMS users used a REXX exec to 'SPOOL PUN TO zosvm...' 'PUNCH fn ft fm ( NOH' 'CLOSE PUN' You might have to play games to have longer than 80-byte records in your jobs. And RSCS will (I think) propagate the CMS userid as already validated (that might not be the case now). Seems like I might have written a JES exit to accept the userid on the spool file as the MVS userid for the job when it was read from the virtual card reader. (Same disclaimer.) A great addition was to have a "SUB" XEDIT program, so you can (as you do from TSO), enter "SUB" on the XEDIT command line to submit the job you're editing. And "cmp" would format the JCL and compile the program I was editing. It's probably been 30 years now that I've strongly preferred a PC editor named Kedit (from Mansfield software). The PC editor isn't limited to interactions like an AID key--you can use ctrl- or alt- versions of any key for certain functions (many that I create). I now keep all my source on a PC and use a Kedit version of my old SUB XEDIT to submit jobs via FTPs using "SITE FILETYPE=JES". So I still use "SUB" and "CMP" and several other macros to submit jobs. Since our JES Report Broker (aka JRB) product will FTP listings when they complete (you could maybe use IDz or some other tool to return the listings, or view them in SDSF), I use it (JRB) to return the listings to the Windows FTP server on my PC. An open-source program named "FileWatcher" detects the file is returned and invokes Kedit to edit the listing. Sounds convoluted, but it's usually maybe 5 seconds or so between my entering "SUB" on my editor command line and the listing popping up back in the editor. No JCL editing or looking for the right listing to view. Plus, there are no 3270-screen-size limitations on how much of the source or listing I see. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: CICS/TS 4.1 3270 question
Hi John. I'd look a different direction myself. "All of a sudden" implies to me that something changed. So...what changed? If nothing changed on the host, I'd maybe investigate to see if an automatic (or otherwise) update has happened on the PC emulator. Just my 2 cents. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: conditional JCL - Reinvent the wheel?
Billy's example explains it very well. A) "IF" cannot be the first step, thus his IEFBR14 call B) "IF" only allows numerics. // IF (="YES") will not work like you want, but // IF (=1) or // IF (=0) will work. I don't know how high of a value you can check, but I've used up to 5 (for day-of-the-week) successfully. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Kudos to IBM
It's not exactly a refresh Paul, but change the '4' to a '5' and you have: https://www-01.ibm.com/servers/resourcelink/svc00100.nsf/pages/zOSV2R5IndexFile/$file/index.html Gary Puchkoff mentioned yesterday the z/OS 2.5 PDFs were available. KC not until GA. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: zPDT question
Ubuntu 18.04 LTS was and is just fine, but it'd be my guess you're not going to have success with Windows in between it and the hardware. But https://groups.io/g/zPDT is the place to be told that for certain. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a vertical split in ISPF?
You configured the 3174 controller to use 4 of it's ports to support 4 different LUs on the same coax, and it had to be in DFT mode. Then I think the 4 LU's were configurable to whatever screen size you wanted, but you might have had to give up some of the 3290's memory to get the 160 by ? screen size. My ears were younger back then & I could rest my eyes and listen for the high-pitched sound that meant the screen was being refreshed again (back in the days of "seconds" response time). My older boss didn't really believe me the time he caught me at it! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Assembler Language Programming for IBM System z Servers
Thanks René! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Assembler Language Programming for IBM System z Servers
The book shows the copyright is held by IBM, but it doesn't appear to have a normal IBM manual number. Is there anyone from IBM who could do something about this? Maybe get the source released to a Creative Commons license if they don't plan to update it? Please? Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Assembler Language Programming for IBM System z Servers
Hello all. Does anyone know if Dr Ehrman's excellent assembler book could be updated for the new instructions released since 2015? Or, at least refreshed with current standards for PDF-page generation standards? What I mean is, it would really be helpful if: a) The pages in the Table of Contents were hyperlinks to the actual pages referenced, and b) The page numbers in the TOC matched the page numbers in the PDF file. For example, "MVCLE" is listed in the TOC on page 411. But if you alt-g to go to the 411th page in the PDF, you end up on the page displaying "373" at the bottom. More recent manuals "document" page numbers match the "pdf" page numbers. But as best I can tell Dr. Ehrman's book hasn't been updated to reflect this. Is there any chance someone from IBM is reading this & can do something about this? Please? (I know this might make more sense to post on the Assembler list, but I'm guessing it's more likely to be seen here.) TIA, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: "Wrong" Size Allocation with AVGREC?
Thanks for the tip Cliff. Ours Bytes/Track was still set at 47,476. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TSO RECEIVE and System Determined Blksize - New RFE
Shmuel, I believe that's the way it works for existing files that have been opened and closed, whether SDB=Y or N. SDB comes into play when a file is allocated but not written to by the allocating program. This is from the ISMF help for the SDB setting: Use the FORCE SYSTEM DETERMINED BLOCKSIZE (SDB) field to specify that the system ignore a user-specified block size if no program opens the new data set for writing while it still is allocated. This prevents the user from overriding a system-determined block size. Possible values: Y If no program opens the data set for writing while the new data set still is allocated, then the system will discard a BLKSIZE value coded by the user. The system will attempt to calculate an optimal block size. If a program opens the data set for output while it still is allocated, then the user-specified BLKSIZE will take effect and override a system-determined block size. N If the user specifies a BLKSIZE value, it will take effect and override a system-determined block size. This is the normal way for the system to run. Since IEBCOPY is adjusting the blksize, it must be that RECEIVE did the allocation first and deallocated the empty file. Then SDB says "I can do better" & changed the blksize. Then when IEBCOPY is called it says "that's not right, I'll fix it". Makes me wonder if anyone uses SDB. Plus, how is 32720 an "optimal" block size? Optimal for disk sales? :) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: TSO RECEIVE and System Determined Blksize - New RFE
It's hard to tell exactly what's going on under the covers, but as best I've
been able to deduce in this particular case is:
1) RECEIVE reads the INMR02 record, sees the original PDSE was blksize 27920
and allocates it that way, but does not open it.
2) SDB steps in, says "they really want 32720" and changes the (VTOC?) entry to
that. (32720 seems like a really poor choice)
3) IEBCOPY is called, opens the 32720 file, starts reloading the file and
notices that it should be 27920 (not sure how), issues IEB1139W, & RC4
4) RECEIVE sees IEBCOPY's RC4, says 'uh-oh' (technical term), ends with RC12
Why is it not a bug? That's a really good question Shmuel. Imo it is a bug.
I've been going back and forth with IBM to correct it since December. I'm
honestly not sure they ever really understood what was going on, even when the
job was as simple as this:
//TRANRECV JOB CLASS=A
//EXP EXPORT SYMLIST=(*)
//*
// SET INFILE=
// SET XMIFILE=
// SET OUTFILE=
//*
//TRANSMIT EXEC PGM=IKJEFT01,DYNAMNBR=05
//SYSTSPRT DD SYSOUT=*
//INFILE DD DISP=SHR,DSN=
//XMIFILE DD DSN=,DISP=(NEW,PASS),
//DCB=(DSORG=PS),LIKE=
//SYSTSIN DD *,SYMBOLS=(JCLONLY)
TRANSMIT,SYS1.,DDNAME(INFILE), +
OUTDDNAME(XMIFILE)
/*
//*
//RECEIVE EXEC PGM=IKJEFT01,DYNAMNBR=05
//MSGFILE DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//XMIT DD DISP=SHR,DSN=
//SYSTSIN DD *,SYMBOLS=(JCLONLY)
RECEIVE INDDNAME(XMIT),
DA('')
//
Every week or two IBM support would give me some reason why it couldn't be
done. Once it was "just turn off SDB for that job". Finally they said "It's
not possible, open an RFE.". You can read the whole story here if you want:
https://www.ibm.com/mysupport/s/case/5003p2TsDUDAA3/iebcopy-msg-ieb1139w-incorrectly-generated-when-systemdeterminedblocksize-yes
Or, just vote early, vote often here:
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe_ID=148961
Thanks to those of you who have already voted.
Paul, I believe it's a problem with RECEIVE because RECEIVE is pre-allocating
the file. All it would need to do is open and close the file before calling
IEBCOPY and SDB would stay out of it--SDB doesn't get involved if the program
that allocates the file also opens it. But IEBCOPY could have also noted that
the file was empty when it started and therefore known it was ok to change the
DCB information & not RC=4. (If the file weren't empty, the IEB1139W message
would be warranted.)
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTP-SSL from z/OS client to Linux
Re: "The format is gsktrace > gskfile.trc > gsk.out " John is right--it's just gsktrace gskfile.trc > gsk.out Sorry guys. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
TSO RECEIVE and System Determined Blksize - New RFE
If anyone has had a problem trying to use System Determined Blocksize with TSO RECEIVE and getting a message IEB1139W like: IEB1139W THE OUTPUT DATA SET BLOCK SIZE IS BEING REDUCED FROM 32720 TO 27920 BYTES. ANY EXISTING PHYSICAL RECORDS LONGER THAN 27920 BYTES ARE FAT BLOCKS AND MAY CAUSE I/O ERRORS. ...because SDB was changing the blksize between the time RECEIVE allocated the file according to the DCB information in the INMR02 record in the XMIT file and the time IEBCOPY tries to open it, I've opened an RFE in the hopes that IBM will correct the problem. Please consider watching and/or voting for RFE # 148961: TSO RECEIVE should correctly handle System Defined Blocksize = YES at http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe_ID=148961 Thanks for your support. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTP-SSL from z/OS client to Linux
Hi Steve.
I've found the SSL trace information written into a USS file to be somewhat
easier to use. You can turn on GSK_TRACE flags and specify a trace file using
STDENV similar to the example below IF you specify the
PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV") (the _S is crucial or the DD * input
won't work):
//FTPS EXEC PGM=FTP,REGION=4M,
// PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV")/ftp.linuxsite.com 21 -e')
//STDENV DD *
GSK_PROTOCOL_TLSV1_2=ON
GSK_TRACE=0x
GSK_TRACE_FILE=/tmp/gskfile.trc
//*
//SYSFTPD DD *,SYMBOLS=(JCLONLY)
CLIENTERRCODES EXTENDED
EPSV4 TRUE
EXTENSIONSAUTH_TLS
FWFRIENDLYTRUE
KEYRING /
PASSIVEIGNOREADDR TRUE
SECUREIMPLICITZOSFALSE
SECURE_FTPREQUIRED
SECURE_MECHANISM TLS
SECURE_DATACONN PRIVATE
SECURE_CTRLCONN PRIVATE
SECURE_HOSTNAMEREQUIRED
TLSMECHANISM FTP
TLSRFCLEVEL RFC4217
//* TRACE
//* DEBUG SEC
//* You can also add other debugging or trace options to SYSFTPD
//OUTPUT DD SYSOUT=*
//INPUTDD *,SYMBOLS=(JCLONLY)
ftpuid
ftppwd
etc
QUIT
//*
The above step doesn't require AT-TLS changes or changes to your FTPDATA
datasets, but I don't think the changes you've alreayd made there will prevent
you from specifying the GSK options via STDENV.
With the GSK_TRACE flags set, the SSL information will be written to the file
you specify in GSK_TRACE_FILE. There is a USS utility named gsktrace that you
will need to read the trace file and interpret it into something you can read.
The format is gsktrace > gskfile.trc > gsk.out
The gsktrace output will be pretty detailed, but you can usually find an error
of some kind.
These manuals, especially the first one, will probably help:
SC14-7495-30 Cryptographic Services System Secure Sockets Layer Programming
SC27-3651-30 IP Configuration Reference
GC27-3652-30 IP Diagnosis Guide
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
TSO RECEIVE and System Determined Blksize (was: TSO XMIT and no member list)
Radoslaw, Could you please elaborate on your comment "never solved issue like non-SDB (system determined blocksize) in XMIT and RECEIVE command"? I have been having an issue with TSO RECEIVE (and a program that also calls IEBCOPY) when SDB is "Y". IEBCOPY is having some sort of problem and displaying this message: IEB1139W THE OUTPUT DATA SET BLOCK SIZE IS BEING REDUCED FROM 32720 TO 27920 BYTES. ANY EXISTING PHYSICAL RECORDS LONGER THAN 27920 BYTES ARE FAT BLOCKS AND MAY CAUSE I/O ERRORS. and ending with a return code of 4. The dataset being RECEIVEd is actually fine, as the LRECL is always less than 27920 (80 in this case). But RECEIVE sees the RC=4 from IEBCOPY and ends with RC=12. IBM currently has case number TS004689510 open for this, but I assumed it was a new issue although I only have SDB=Y on right now for testing. Any thoughts? ~ Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: GSE UK Virtual Conference - Week 2 coming up - you can still register
Thanks for the tip. These sessions are mostly too early in the morning for those of us in the Western hemisphere. The little "tape"(?) symbol that indicates a recording is available seems to only be for the general sessions. Are the technical sessions being recorded? Is there a way to listen to them other than being "live"? Thanks, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Batch SFTP without client keys or USS files?
I guess I misspoke. I'm trying to connect to a server supporting SFTP on port . FTP and FTPS on other ports. Sorry. The Windows SFTP command works fine. I just can't see the difference in my job between yours and Ed's. Thanks, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Batch SFTP without client keys or USS files?
I'm sorry Rajesh. I meant to say that the job will run on other z/OS systems. I can't require CO:Z to be present. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Batch SFTP without client keys or USS files?
Thanks for asking, but no special characters. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Batch SFTP without client keys or USS files?
Thank you Rajesh, but the job will be running on z/OS systems. I cannot require any additional software like COZBATCH to be installed. Best Regards, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Batch SFTP without client keys or USS files?
Thanks Kurt! I did see Ed's presentation, but at the time it was a solution for which I didn't have a problem, so it stayed in the bit bucket. Unfortunately, even with your and Ed's expert help, I'm still stumped. I just don't seem to be able to get the "SSH_ASKPASS" to work, even after reading what literally seems to be everything on the Internet about it. (My 2 hour job's gone 2 days now...) Just a reminder: I'm going from a z/OS sftp client to a non-z/os ftp server where I can't store user keys. StrictHostKeyChecking=no is saving the non-z/OS server's keys in ~/.ssh/known_hosts, but I need to specify a userid/pwd to access the server. What I have is: // EXPORT SYMLIST=(*) // SET FROM=USER.DFDSS.XMI // SET TO=CUS12345.ESTFILE //* //SFTP EXEC PGM=BPXBATCH //STDENV DD * SSH_ASKPASS=/tmp/sftp.pw.sh DISPLAY=DISPLAY //* //STDPARM DD *,SYMBOLS=JCLONLY SH cd /tmp; echo cp -Bv "//''" /tmp/ cp -Bv "//''" /tmp/ echo "echo 'ftppwd'" > sftp.pw.sh; chmod 700 sftp.pw.sh; echo "cd /FTPDir"> sftp.cmds; echo "put /tmp/ " >> sftp.cmds; echo "quit" >> sftp.cmds; chmod 600 sftp.cmds; echo ''; echo '-sftp.cmds contents:'; cat sftp.cmds; echo ''; echo '-sftp.pw.sh contents:'; cat sftp.pw.sh; echo ''; /bin/sftp -b sftp.cmds -oBatchMode=no -oPort= -oPasswordAuthentication=yes -oPreferredAuthentications=password -oStrictHostKeyChecking=no -oHostbasedAuthentication=no -oCheckHostIP=no -oPubkeyAuthentication=no -oLogLevel=DEBUG2 -oUser=ftpuser ftp.ftpserver.com; rm sftp.pw.sh; rm sftp.cmds; rm //* //STDOUT DD SYSOUT=M //STDERR DD SYSOUT=M //* Maybe my STDENV isn't getting read, but I can't prove it. I'm getting: FOTS1373 ftpu...@ftp.ftpserver.com: Permission denied (publickey,keyboard-interactive,password). Here's the tail of my output w/DEBUG1: debug1: Host '[ftp.ftpserver.com]:' is known and matches the RSA host key. debug1: Found key in /.ssh/known_hosts:2 debug1: cipher_init: aes128-ctr from source CPACF, used in non-FIPS mode debug1: rekey after 4294967296 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: cipher_init: aes128-ctr from source CPACF, used in non-FIPS mode debug1: rekey after 4294967296 blocks debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,keyboard-interactive,password debug1: No more authentication methods to try. FOTS1373 ftpu...@ftp.ftpserver.com: Permission denied (publickey,keyboard-interactive,password). debug1: zsshSmfSetConnSmfStatus: SMF status is 0 Connection closed. FOTS0841 Connection closed Here's the head, showing the contents of my sftp.pw.sh and sftp.cmds files: cp -Bv //'USER.DFDSS.XMI' /tmp/CUS12345.ESTFILE USER.DFDSS.XMI -> /tmp/CUS12345.ESTFILE: binary -sftp.cmds contents: cd /FTPDir put /tmp/CUS12345.ESTFILE CUS12345.ESTFILE quit -sftp.pw.sh contents: echo 'ftppwd' FSUM1012 The initial working directory was not specified. FSUM1006 A shell was not specified. Processing continues using the default shell name. stty: !FSUMB045 failed to get termios attributes: EDC5134I Function not implemented. debug1: Reading configuration data /etc/ssh/ssh_config debug1: zsshSmfSetConnSmfStatus: SMF status is 0 debug2: resolving "ftp.ftpserver.com" port debug2: ssh_connect_direct: needpriv 0 debug1: Connecting to ftp.ftpserver.com [192.208.58.102] port . debug1: Connection established. ... My /etc/ssh/ssh_config only has an entry for Ciphers and MACS - I think that's what IBM ships. I don't have my own ~/.ssh/ssh_config. Anyone have any ideas? Thanks again, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Batch SFTP without client keys or USS files?
Is it possible to code a proc that would invoke SFTP to transfer a file to or
from a non-z/OS ftp server using only that server's public key and a
userid/password combination like you would use for FTP or FTPS?
I need to distribute this outside our company, so using CO:Z isn't an option.
Adding keys to the server for the clients is not either. And modifying USS
files like /etc/ssh/config or even ~/.ssh/anything is probably also off limits.
I might be able to get away with stashing something in /tmp, but even that
might be a problem. I can (since I have to) assume z/OS 2.2 or later for
OpenSSH availability.
I was able to do this for FTPS by distributing the FTP server's public key as a
.PEM file & installing it into RACF, then adding it to a keyring. But so far
with SFTP, I'm stumped. Has anyone tried this?
TIA,
Wendell
fwiw, here is the FTPS proc:
//*---
//* TERSE a file & FTP it
//*---
//FTPSTRS PROC ZOSFILE=,
// FTPFILE=,
// OUTCLS=*,
// TMPHLQ=,
// TRSDISP=(NEW,PASS),
// KEYOWNR=TCPIP,
// KEYRING=FTPS.KEYRING
//*
//EXP EXPORT SYMLIST=*
// SETFTPFID=
// SETFTPOWN=
// SETFTPKEY=
//*
//*---
//TERSEEXEC PGM=TRSMAIN,PARM=PACK
//SYSPRINT DD SYSOUT=
//INFILE DD DISP=SHR,DSN=
//OUTFILEDD DSN=,
// DISP=(),
// RECFM=FB,BLKSIZE=0,LRECL=1024,
// LIKE=
//*---
//FTPS EXEC PGM=FTP,REGION=4M,COND=(0,LT),
// PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV")/ftp.server.com 21 -e')
//STDENV DD *
GSK_PROTOCOL_TLSV1_2=ON
//SYSFTPD DD *,SYMBOLS=(JCLONLY)
CLIENTERRCODES EXTENDED
EPSV4TRUE
EXTENSIONS AUTH_TLS
FWFRIENDLY TRUE
KEYRING/
PASSIVEIGNOREADDR TRUE
SECUREIMPLICITZOS FALSE
SECURE_FTP REQUIRED
SECURE_MECHANISM TLS
SECURE_DATACONNPRIVATE
SECURE_CTRLCONNPRIVATE
SECURE_HOSTNAME REQUIRED
TLSMECHANISM FTP
TLSRFCLEVEL RFC4217
//* TRACE
//TRSFILE DD DISP=SHR,DSN=*.TERSE.OUTFILE
//OUTPUT DD SYSOUT=
//INPUT DD *,SYMBOLS=(JCLONLY)
ftpuser
ftppwd
sendsite
cd /somedir
BINARY
PUT //DD:TRSFILE
QUIT
//*
// PEND
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTPS Explicit Connection
I can't help you much on the server side of the equation, but this excerpt from
an FTP client job will get you started:
01 //FTPS EXEC PGM=FTP,REGION=4M,
02 // PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV")/10.1.1.1 5521 -e')
03 //STDENV DD *
04 GSK_PROTOCOL_TLSV1_2=ON
05 //* GSK_TRACE=0x
06 //* GSK_TRACE_FILE=/tmp/gsk.trc
07 //* The 2 stmts above can be temporarily uncommented for debugging
08 //SYSFTPD DD *,SYMBOLS=(JCLONLY)
09 CLIENTERRCODESEXTENDED
10 EPSV4 TRUE
11 EXTENSIONSAUTH_TLS
12 FWFRIENDLYTRUE
13 KEYRING TCPIP/your.FTP.KEYRING
14 PASSIVEIGNOREADDR TRUE
15 SECUREIMPLICITZOS FALSE
16 SECURE_FTPREQUIRED
17 SECURE_MECHANISM TLS
18 SECURE_DATACONN PRIVATE
19 SECURE_CTRLCONN PRIVATE
20 SECURE_HOSTNAME REQUIRED
21 TLSMECHANISM FTP
22 TLSRFCLEVEL RFC4217
23 TRACE
24 //*
Line
02 _CEE_ENVFILE_S=DD:STDENV
- Allows you to specify LE overrides via a SYSIN DD rather than a VB dataset
0.1.1.1 5521
- Your server IP address & port
-e
Exit step with FTP return code instead of 0 (probably overridden)
05 & 06
GSK_TRACE...
Turns on GSK tracing for FTP client, writes trace records into /tmp/gsk.trc
file
Use gsktrace "gsk.trc > gsk.out" command to format into human readable.
Very helpful
13 You will have to have a public/private key known to the server, and a
public key or
CA cert shared with the client (if on the same system, then on the same
key ring is fin)
11 & 16 are also important
You'll need to use the manuals to understand most of the commands, but this
will get you started.
Some of these manuals may help:
SC14-7495-30 Cryptographic Services System Secure Sockets Layer Programming
SC27-3651-30 IP Configuration Reference
GC27-3652-30 IP Diagnosis Guide may be useful if you are getting GSK errors.
SA23-2292-30 Security Server RACF Command Language Reference contains the
syntax for the RACDCERT instructions.
HTH,
Wendell Lovewell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTPS Handshake Error
We have certificates RACLISTED (no idea what that equates to in Top Secret). I
do:
RACDCERT ID() TRUST ADD('') -
WITHLABEL('ftp.mackinney.com')
RACDCERT ADDRING() ID()
SETROPTS RACLIST(DIGTCERT DIGTRING) REFRESH
RACDCERT ID() CONNECT(CERTAUTH USAGE(CERTAUTH) -
LABEL('AAA Certificate Services') -
RING())
SETROPTS RACLIST(DIGTCERT DIGTRING) REFRESH
I had to do the REFRESH to the DIGTCERT class after adding the cert and keyring
before I could connect the cert to the keyring. Then another refresh (this time
was probably for the DIGTRING--I'm lazy and just duplicated the line).
Also, don't miss the part in the previous post about telling the policy agent
to refresh it's security settings.
Wendell
(I posted this once, but it didn't seem to end up in the right thread. Please
forgive me if this is a duplicate. Or if the first was done wrong.)
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTPS Handshake Error
We have certificates RACLISTED (no idea what that equates to in Top Secret). I
do:
RACDCERT ID() TRUST ADD('') -
WITHLABEL('ftp.mackinney.com')
RACDCERT ADDRING() ID()
SETROPTS RACLIST(DIGTCERT DIGTRING) REFRESH
RACDCERT ID() CONNECT(CERTAUTH USAGE(CERTAUTH) -
LABEL('AAA Certificate Services') -
RING())
SETROPTS RACLIST(DIGTCERT DIGTRING) REFRESH
I had to do the REFRESH to the DIGTCERT class after adding the cert and keyring
before I could connect the cert to the keyring. Then another refresh (this time
was probably for the DIGTRING--I'm lazy and just duplicated the line).
Also, don't miss the line in the previous post about telling the policy agent
to refresh it's security settings.
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: FTPS Handshake Error
Hello Roberto. In RACF-land, I'd look for an ICH message on the console to make sure you don't need to PERMIT the client or the server access to the keyring. I've found the gsk trace file to be very helpful--if the security manager doesn't tell you via a console message. Telling PAGENT about the security change might also be needed on the side that's failing. Here is a section of some documentation I wrote up for debugging such errors for one of our products: - (One of the examples:) EZD1287I TTLS Error RC: 406 Initial Handshake 477 LOCAL: 172.29.127.60..1173 REMOTE: 172.29.127.60..5401 JOBNAME: MBXWL RULE: MBX_STC_Rule The RC values are most helpful. Since there is a policy used for both inbound (MBX_CICS_Rule) and outbound (MBX_STC_Rule—note the rules in play are also displayed on the console), there will likely be two EZD1287I messages displayed if there is a problem. (Both sides will experience a problem.) You can find an explanation for these in the SC14-7495-30 Cryptographic Services System Secure Sockets Layer Programming manual, currently in chapter 13. SC27-3651-30 IP Configuration Reference contains the syntax for the AT-TLS policy (/etc/pagent_TTLS.conf). GC27-3652-30 IP Diagnosis Guide may be useful if you are getting GSK errors. SA23-2292-30 Security Server RACF Command Language Reference contains the syntax for the RACDCERT instructions. If you need to see the GKY messages, set the Trace value in the TTLSGroupAction parms for both the MBX_CICS_Rule and MBX_STC_Rule to Trace 255. When you upload /etc/pagent_TTLS.conf, the policy agent will re-install the policy. If you make RACF changes to the keyrings, you need to tell the policy agent to refresh it’s settings for them. You can do this by changing the EnvironmentAction value & reloading the pagent_TTLS.conf file. - HTH, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Working link for current 3270 Data Stream
GA23-0059-4 is already on Bitsavers: http://bitsavers.trailing-edge.com/pdf/ibm/3270/GA23-0059-4_3270_Data_Stream_Programmers_Reference_Dec88.pdf -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Substituting SYSIN variables via EXPORT SYMLIST containing mixed-case values
Thanks for all the detail Gil! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Substituting SYSIN variables via EXPORT SYMLIST containing mixed-case values
Well John, to risk stating the obvious, "You're a genius!" :) Thanks a lot! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Substituting SYSIN variables via EXPORT SYMLIST containing mixed-case values
Is there a way to get a mixed-case string substituted into SYSIN data using "EXPORT SYMLIST=*" and the "DD *,SYMBOLS=(JCLONLY)" facility? I'm trying to download files from an FTP server to z/OS using a PROC similar to this: //*- //FTPTEST PROC FTPFILE= //*- //FTP EXEC PGM=FTP,REGION=4M //XMIFILE DD DSN=SOMEFILE.XMIT, // DISP=(NEW,CATLG),... //* //INPUTDD *,SYMBOLS=(JCLONLY) blah blah blah BINARY GET //DD:XMIFILE QUIT /* // PEND Without the EXPORT SYMLIST=*, doesn't get replaced in the SYSIN: EZA1460I Command: EZA1736I GET //DD:XMIFILE EZA1701I >>> RETR 550 : No such file or directory So with it added: //*--- //FTPTEST PROC FTPFILE= //EXPEXPORT SYMLIST=* // SET FTPFID= //FTP ... ...and the GET changed to: GET //DD:XMIFILE With a lower-case value in FTPFILE, the job errors out with a JCL problem before it starts: //FTPTEST EXEC PROC=FTPTEST, // FTPFILE='ht.jst0c1.xmi' In the joblog: 5 XX SETFTPFID= IEFC653I SUBSTITUTION JCL - FTPFID=ht.jst0c1.xmi ... And: 5 IEFC620I UNIDENTIFIABLE CHARACTER h ON THE SET STATEMENT 5 IEFC620I UNIDENTIFIABLE CHARACTER t ON THE SET STATEMENT 5 IEFC620I UNIDENTIFIABLE CHARACTER j ON THE SET STATEMENT .. Although with an upper-case FTP file name: //FTPTEST EXEC PROC=FTPTEST, // FTPFILE='HT.JST0C1.XMI' The job runs, but of course that file doesn't exist on the FTP server so the RETR fails: EZA1701I >>> RETR HT.JST0C1.XMI 550 HT.JST0C1.XMI: No such file or directory If you try changing the SET for FTPFID in the PROC to allow lower-case by using apostrophes: // SETFTPFID='' ...that passes the string as-is and the RETR fails: EZA1701I >>> RETR 550 : No such file or directory So, is there any way to get the in the GET command to be replaced with a mixed-case value? TIA, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Passing STDENV DD to FTP via SYSIN
Charles: Password is in the clear, just like it's always been. The main
security is controlled by directory permissions on the server--it's really a
"dump it here". They can't even see what they've uploaded. The download
directory (stuff from us) is read-only. Like I said, "kicking and screaming"...
Frank: //CEEOPTS is very close to what I was looking for!
//FTPXFER EXEC PGM=FTP,REGION=4M,
// PARM=('ENVAR("GSK_PROTOCOL_TLSV1_2=ON")/(EXIT')
...works great if all I want to do is force TLS 1.2. But there are a couple of
other environment variables that are really handy for debugging:
GSK_TRACE=0x and GSK_TRACE_FILE=/tmp/gskc.trc
and while:
//FTPXFER EXEC PGM=FTP,REGION=4M,
//
PARM=('ENVAR("GSK_PROTOCOL_TLSV1_2=ON","GSK_TRACE=0x","GSK_TRACE_FILE=/tmp/gskc.trc")/(EXIT')
...is possible, it pushes the limits of the PARM value's max length.
But I can add as many variables with CEEOPTS as I want:
//FTPXFER EXEC PGM=FTP,REGION=4M,PARM='(TIMEOUT 30 EXIT'
//CEEOPTS DD *
ENVAR("GSK_PROTOCOL_TLSV1_2=ON",
"GSK_TRACE=0x",
"GSK_TRACE_FILE=/tmp/gskb.trc")
//*
However, I did stumble across what a really wanted as I was closing out all the
web pages I had open for this.
https://www.ibm.com/support/knowledgecenter/SSLTBW_2.2.0/com.ibm.zos.v2r2.halz002/ip_env_var_used_by_tcpip_appls.htm
...is the page I'd overlooked. It explains that while _CEE_ENVFILE requires a
VB255 dataset, _CEE_ENVFILE_S isn't so picky. So:
//FTPXFER EXEC PGM=FTP,REGION=4M,
// PARM=('ENVAR("_CEE_ENVFILE_S=DD:STDENV")/(TIMEOUT 30 EXIT')
//STDENV DD *
GSK_PROTOCOL_TLSV1_2=ON
//* GSK_TRACE=0x
//* GSK_TRACE_FILE=/tmp/gskc.trc
//SYSFTPD DD *
...is really what I was looking for in the first place. I can leave the TRACE
vars commented, but if there is a problem they can easily be un-commented and
the /tmp/gskc.trc file can be used to see exactly what's going on under the
covers. (BTW, this trace appears to provide a lot more information than
processing a GSKSRVR/GSKWRTR trace with IPCS and "CTRACE COMP(GSKSRVR)
DDNAME(IPTRACE) FULL"--but it's probable that I just don't know what I'm doing
with IPCS.)
Anyway, thanks again to all!
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Passing STDENV DD to FTP via SYSIN
Hey Charles,
No nuclear secrets here. I've been pulled kicking & screaming into adding this
level of security anyway.
I'm shooting for the absolute easiest way to give any z/OS and z/VSE customer
the ability to upload a file to a server that requires a secured connection. I
don't see a way around the certificates, but at least I have been able to set
up a single job a RACF admin could run to set up a keyring they can use. But I
couldn't find a combination of parameters that would get SSL or TLS 1.1 working
with this particular server (that I don't control).
I used the info from that URL because one of the last things I want to do is
require customers to set up a TLS policy just to upload a file. By forcing TLS
1.2 and these other SYSFTPD parameters, I think I can at least keep away from
having to get into any (other than RACF) system-type files:
//FTPXFER EXEC PGM=FTP,REGION=4292K,
//PARM=('POSIX(ON) ALL31(ON)',
// 'ENVAR("GSK_PROTOCOL_TLSV1_2=ON")/(EXIT')
//SYSFTPD DD *
CLIENTERRCODES EXTENDED
EPSV4TRUE
EXTENSIONS AUTH_TLS
FWFRIENDLY TRUE
KEYRINGTCPIP/MACK.FTP.KEYRING
PASSIVEIGNOREADDR TRUE
SECUREIMPLICITZOS FALSE
SECURE_FTP REQUIRED
SECURE_MECHANISM TLS
SECURE_DATACONNPRIVATE
SECURE_CTRLCONNPRIVATE
SECURE_HOSTNAMEREQUIRED
TLSMECHANISM FTP
TLSRFCLEVEL CCCNONOTIFY
//*
//INPUT DD *
(Normal, non-FTPS commands still go here)
(Bernd, you were spot-on. I answered my own question the same way about
midnight last night.)
I'm just glad it works!
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Passing STDENV DD to FTP via SYSIN
Hey Charles, I took you seriously the first time. I appreciate your interest
in helping.
Bottom line, I'd like to come up with a job any z/OS customer could run,
without requiring changes to any of their system files (like FTPCDATA or AT-TLS
or RACF) that would allow them to transmit files to/from an FTP site using
FTPS.
I've pretty much given up on that--I can't find a way to do it without
installing certificates used by the FTP server into their RACF/ACF2/Top Secret
databases. And even with the certificates in RACF, the only way I've gotten it
to work is force FTP to use TLS 1.2 by setting the "GSK_PROTOCOL_TLSV1_2"
environment variable to "ON" per this URL:
https://www.ibm.com/support/pages/zos-communications-server-tls-needed-implement-tls-v12
That page does say for FTP the STDENV dataset should be RECFM=VB. (I did try
various combinations of DD *,DCB=(...), including DCB=(RECFM=VB), but JES
didn't seem to allow that.) Gil might be on to something with the temporary
datasets not being available to spawned processes, but I've cataloged the
IEBGENER'd file and the job still fails like it doesn't find the
"GSK_PROTOCOL_TLSV1_2=ON" variable.
---
I'm not sure how to close this out, but as I've been typing this, I did figure
out how to get around the STDENV problem. I'm going to go ahead and leave what
I've said so far in case someone else comes across this in the future, but
here's a work-around:
What I was trying to do was:
//FTPXFER EXEC PGM=FTP,REGION=4292K,
//PARM=('POSIX(ON) ALL31(ON)',
// 'ENVAR("_CEE_ENVFILE=DD:STDENV")/(EXIT')
//STDENV DD *
GSK_PROTOCOL_TLSV1_2=ON
//*
Where the 'ENVAR("_CEE_ENVFILE=DD:STDENV") is telling LE to look for
environment variables in the STDENV DD. The STDENV file wasn't being found,
but all it has is one variable name and value. So it occurred to me that I
could just put the variable and value in the PARM:
//FTPXFER EXEC PGM=FTP,REGION=4292K,
//PARM=('POSIX(ON) ALL31(ON)',
// 'ENVAR("GSK_PROTOCOL_TLSV1_2=ON")/(EXIT')
Turns out, it works!
Thanks for all your help.
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Passing STDENV DD to FTP via SYSIN
Hello,
I'm setting up a batch job to access our FTP server using FTPS and TLS 1.2.
(Forgive me if that nomenclature is less than perfect.)
I've imported certficates, built a keyring, and come up with a combination of
FTP client parameters that will allow me to connect to the server and upload a
file:
//FTPXFER EXEC PGM=FTP,REGION=4292K,
//PARM=('POSIX(ON) ALL31(ON)',
// 'ENVAR("_CEE_ENVFILE=DD:STDENV")/(EXIT')
//OUTPUT DD SYSOUT=*
//STDENV DD DISP=SHR,DSN=WRL1.FTPS.STDENV
//*
//* //STDENV DD *
//* GSK_PROTOCOL_TLSV1_2=ON
//*
//SYSFTPD DD *
CLIENTERRCODES EXTENDED
EPSV4TRUE
EXTENSIONS AUTH_TLS
FWFRIENDLY TRUE
KEYRING TCPIP/FTP.KEYRING
PASSIVEIGNOREADDR TRUE
SECUREIMPLICITZOS FALSE
SECURE_FTP REQUIRED
SECURE_MECHANISM TLS
SECURE_DATACONNPRIVATE
SECURE_CTRLCONNPRIVATE
SECURE_HOSTNAME REQUIRED
TLSMECHANISM FTP
TLSRFCLEVEL CCCNONOTIFY
/*
//INPUTDD *
I'm trying to make this as self-contained as possible, and would like to supply
the variables via SYSIN rather than require the PS file named on the
un-commented version of the STDENV DD. BPXBATCH is the only program I can find
documented that says "//STDENV DD *" is supported. FTP, at least with the PARM
I'm using, seems to ignore it.
Is it possible to supply STDENV to FTP via SYSIN?
I hate to admit it, but I thought "Ok, I'll just IEBGENER the variable(s) into
a VB LRECL=255 BLKSIZE=27998 file (like the one that works), and use that. But
strangely, I can't get that to work either--even though SUPERC confirms the
files match.
TIA,
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to un-duplex a logstream?
Skip, you nailed it. We did have a STRUCTURE defined, and it did have DUPLEX(ENABLED) specified. I just wasn't looking in the right place. There is only one place to look now. Thanks for the tip! Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to un-duplex a logstream?
Thanks Carmen! That was it! z setxcf start,pol,TYPE=CFRM,polnm=CFRM1 IXC511I START ADMINISTRATIVE POLICY CFRM1 FOR CFRM ACCEPTED IXC512I POLICY CHANGE IN PROGRESS FOR CFRM TO MAKE CFRM1 POLICY ACTIVE. 2 POLICY CHANGE(S) PENDING. IXG219I SYSTEM LOGGER PROCESSED TRANSITION TO SIMPLEX MODE FOR STRUCTURE MACK_GENERAL I could have read all weekend and probably not have figured that out! Best regards, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How to un-duplex a logstream?
Thanks for your help Barbara. But I may be too ignorant about all of this to follow your instructions. DUPLEX isn't an option for the DEFINE STRUCTURE in the "LOGR keywords and parameters" section of SA23-1399-30, so I'm guessing you're talking about the STRUCTURE parameters in the "CFRM parameters" section. I didn't previously have a STRUCTURE named MACK_GENERAL in my CFRM policy (assuming you mean in the "DATA TYPE(CFRM)...DEFINE POLICY...") only a "DEFINE STRUCTURE NAME(MACK_GENERAL) in my "DATA TYPE(LOGR)..." settings. So I added one to my CFRM POLICY: //SYSINDD * DATA TYPE(CFRM) REPORT(YES) DEFINE POLICY NAME(CFRM1) REPLACE(YES) CF NAME(CFCC1) TYPE(SIMDEV) MFG(IBM) PLANT(EN) SEQUENCE(000CFCC1) PARTITION(0) CPCID(00) DUMPSPACE(1) CF NAME(CFCC2) TYPE(SIMDEV) MFG(IBM) PLANT(EN) SEQUENCE(000CFCC2) PARTITION(0) CPCID(00) DUMPSPACE(1) (all other STRUCTUREs excluded) STRUCTURE NAME(MACK_GENERAL) INITSIZE(30M) SIZE(100M) DUPLEX(DISABLED) ENCRYPT(NO) PREFLIST(CFCC1,CFCC2) // I ran the job, bounced the z/OS system and the coupling facilities, but D XCF,STR still shows DUPLEX ENABLED: D XCF,STR,STRNAME=MACK_GENERAL IXC360I 14.08.56 DISPLAY XCF STRNAME: MACK_GENERAL STATUS: NOT ALLOCATED POLICY INFORMATION: POLICY SIZE: 45 M POLICY INITSIZE: 30 M POLICY MINSIZE : 0 M FULLTHRESHOLD : 80 ALLOWAUTOALT : NO REBUILD PERCENT: N/A DUPLEX : ENABLED <=== ALLOWREALLOCATE: YES PREFERENCE LIST: CFCC1CFCC2 ENFORCEORDER : NO EXCLUSION LIST IS EMPTY ...and when I open a file using a logstream using this structure, it's plain that DUPLEX is still in effect. SO, I can't tell that I've accomplished anything at all. Including not comprehending the difference between a STRUCTURE in the CFRM policy and in the LOGR definition. Or what I'm doing wrong. :( Thanks again, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
How to un-duplex a logstream?
I'm trying to turn off duplexing in a logstream because it's driving our zPDT
system to it's knees when we close an RLS file.
I've redefined the logstream:
LINE # CONTROL CARDS
1 DATA TYPE(LOGR) REPORT(YES)
2 CONTINUE
3 DEFINE LOGSTREAM NAME(MACK.LOGSTRM)
4STRUCTNAME(MACK_GENERAL)
5DESCRIPTION(MACK_GENERAL_LOG)
6DASDONLY(NO)
7WARNPRIMARY(YES)
8DIAG(YES)
9 LS_DATACLAS(LOGR24K)
10 LS_SIZE(20480)
11 HLQ(LOGGER)
12 LOWOFFLOAD(0)
13 HIGHOFFLOAD(80)
14 STG_DATACLAS(LOGR4K)
15 STG_DUPLEX(NO)
16 LOGGERDUPLEX(COND)
17 RETPD(14)
18 AUTODELETE(YES)
Here's the IXCMIAPU report:
LOGSTREAM NAME(MACK.LOGSTRM) STRUCTNAME(MACK_GENERAL) LS_DATACLAS(LOGR24K)
LS_MGMTCLAS() LS_STORCLAS() HLQ(LOGGER) MODEL(NO) LS_SIZE(20480)
STG_MGMTCLAS() STG_STORCLAS() STG_DATACLAS(LOGR4K) STG_SIZE(0)
LOWOFFLOAD(0) HIGHOFFLOAD(80) STG_DUPLEX(NO) DUPLEXMODE() <---
RMNAME() DESCRIPTION(MACK_GENERAL_LOG) RETPD(14) AUTODELETE(YES)
OFFLOADRECALL(YES)
ZAI(NO) ZAIDATA('NO_ZAIDATA') WARNPRIMARY(YES) LS_ALLOCAHEAD(0)
DASDONLY(NO) DIAG(YES) LOGGERDUPLEX(COND) <--- EHLQ(NO_EHLQ)
GROUP(PRODUCTION)
But when I try to open a file that's defined to use MACK.LOGSTRM, it ends up
changing it back to duplex mode after generating a couple of hundred messages,
starting with these:
IXG117I DUPLEXING REBUILD STARTED FOR STRUCTURE MACK_GENERAL
1 OF 1 LOGSTREAMS CONNECTED TO STRUCTURE:
MACK.LOGSTRM
IXC571I SYSTEM-MANAGED DUPLEXING REBUILD FOR STRUCTURE
MACK_GENERAL HAS COMPLETED THE STARTUP PHASE
AND IS ENTERING THE QUIESCE PHASE.
TIME: 08/20/2020 19:23:22.360420
AUTO VERSION: D8668875 19A79A00
IXC571I SYSTEM-MANAGED DUPLEXING REBUILD FOR STRUCTURE
MACK_GENERAL HAS COMPLETED THE QUIESCE PHASE
AND IS ENTERING THE ALLOCATION PHASE.
TIME: 08/20/2020 19:23:22.380045
AUTO VERSION: D8668875 19A79A00
...and ending with:
IXG219I SYSTEM LOGGER PROCESSED TRANSITION TO DUPLEX MODE
FOR STRUCTURE MACK_GENERAL
Can someone please tell me how to disable duplexing for a logstream? And for a
structure, if that's a possible--I can't find any IXCMIAPU DEFINE STRUCTURE
parameter for DUPLEX, but when I do:
D XCF,STR,STRNAME=MACK_GENERAL
IXC360I 19.55.20 DISPLAY XCF
STRNAME: MACK_GENERAL
STATUS: REASON SPECIFIED WITH REBUILD START:
POLICY-INITIATED
DUPLEXING REBUILD
METHOD: SYSTEM-MANAGED
AUTO VERSION: D8668875 19A79A00
PHASE: DUPLEX ESTABLISHED <---
EVENT MANAGEMENT: MESSAGE-BASED
TYPE: LIST
POLICY INFORMATION:
POLICY SIZE: 45 M
POLICY INITSIZE: 30 M
POLICY MINSIZE : 0 M
FULLTHRESHOLD : 80
ALLOWAUTOALT : NO
REBUILD PERCENT: N/A
DUPLEX : ENABLED <---
ALLOWREALLOCATE: YES
PREFERENCE LIST: CFCC1CFCC2
ENFORCEORDER : NO
EXCLUSION LIST IS EMPTY
TIA,
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: AT-TLS ?
Lionel, what type of endpoints are you wanting to use AT-TLS to secure? I might have some notes that would help. Here is some general information about diagnosing AT-TLS errors: If there is a problem making the connection, AT-TLS will display error on the console. Here are a few examples. The endpoints were a started task (XYZSTC) and a CICS region (CICSA): EZD1287I TTLS Error RC: 417 Initial Handshake 560 LOCAL: 10.1.1.1..1213 REMOTE: 10.1.1.1..5401 JOBNAME: XYZSTC RULE: XYZ_STC_Rule USERID: STCOPER GRPID: 000F ENVID: 0013 CONNID: 06DE EZD1287I TTLS Error RC: 435 Initial Handshake 561 LOCAL: 10.1.1.1..5401 REMOTE: 10.1.1.1..1213 JOBNAME: CICSA RULE: XYZ_CICS_Rule USERID: CICSA GRPID: 000E ENVID: 0014 CONNID: 06DF EZD1287I TTLS Error RC: 508 Initial Handshake 462 LOCAL: 10.1.1.1..1206 REMOTE: 10.1.1.1..5401 JOBNAME: XYZSTC RULE: XYZ_STC_Rule USERID: STCOPER GRPID: 000F ENVID: 0010 CONNID: 06B9 EZD1287I TTLS Error RC: 438 Initial Handshake 463 LOCAL: 10.1.1.1..5401 REMOTE: 10.1.1.1..1206 JOBNAME: CICSA RULE: XYZ_CICS_Rule USERID: CICSA GRPID: 000E ENVID: 0011 CONNID: 06BA EZD1287I TTLS Error RC: 5006 Initial Handshake 476 LOCAL: 10.1.1.1..5401 REMOTE: 10.1.1.1..1173 JOBNAME: CICSA RULE: XYZ_CICS_Rule USERID: CICSA GRPID: 000E ENVID: 000E CONNID: 05A4 EZD1287I TTLS Error RC: 406 Initial Handshake 477 LOCAL: 10.1.1.1..1173 REMOTE: 10.1.1.1..5401 JOBNAME: XYZSTC RULE: XYZ_STC_Rule The RC values are most helpful. Since there is a policy used for both inbound (XYZ_CICS_Rule) and outbound (XYZ_STC_Rule—note the rules in play are also displayed on the console), there will likely be two EZD1287I messages displayed if there is a problem. (Both sides will experience a problem.) You can find an explanation for these in the SC14-7495-30 Cryptographic Services System Secure Sockets Layer Programming manual, currently in chapter 13. SC27-3651-30 IP Configuration Reference contains the syntax for the AT-TLS policy (/etc/pagent_TTLS.conf). GC27-3652-30 IP Diagnosis Guide may be useful if you are getting GSK errors. SA23-2292-30 Security Server RACF Command Language Reference contains the syntax for the RACDCERT instructions. If you need to see the GKY messages, set the Trace value in the TTLSGroupAction parms for both the XYZ_CICS_Rule and XYZ_STC_Rule to Trace 255. When you upload /etc/pagent_TTLS.conf, the policy agent will re-install the policy. If you make RACF changes to the keyrings, you need to tell the policy agent to refresh it’s settings for them. You can do this by changing the EnvironmentAction value & reloading the pagent_TTLS.conf file. Hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: AW: Using Windows ssh with z/OS
Thanks to everyone for the advice. Installing Rocket's bash provided the cursor history scrolling I was looking for. I don't perceive a difference between TERM=xterm+256color and TERM=xterm in the command-line-only functions I use. (I don't see any coloring in the ls or other output for either value.) I have "bash" as the last line in /etc/profile. This seems to work, but I do have to enter "exit" twice to close the window. Is there a way to invoke bash so that this is not necessary? I'm also not sure if this matters, but "echo $SHELL" still shows "/bin/sh", not "/bin/bash". - Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Using Windows ssh with z/OS
When connecting to z/OS (USS) using ssh, I'd like the USS shell to handle keys the same way Ubuntu does. I have these settings: echo $TERM displays xterm-color256 echo $SHELL displays /bin/sh Specifically, I'd like: a) The cursor-up key to perform the "history-search-backward" function b) The cursor-down key to perform the "history-search-forward" function c) The cursor-left and cursor-right keys to move thru the command just retrieved d) To be able to change the command by moving the cursor and typing over the retrieved command I've been able to use stty erase ^? in /etc/profile to set the backspace key, but my attempts at using ~/.inputrc to control the cursor keys have been unsuccessful. Trying different terminal types (eg export TERM=xterm or export TERM=vt100) has also not helped. Does anyone know how to do this? Best Regards, Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: z/OS Cross-memory server code walkthrough
Thanks. They still have it Thursday. Hopefully the agenda will be updated before the conference starts. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: z/OS Cross-memory server code walkthrough
Sounds like a good session Rob. Scrolling through the sessions on the SHARE app, I can't find it. What are the session number and time? Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rexx or similar to clone a RACF user?
Sorry, IRRDUB00 is not sufficient. It's the first step used by a REXX program named DBSYNC. You'll need to download it and use IRRDUB00's output from your current RACF database as the "old file" (INDD1) and a dummy file as the "new file" (INDD2) as input to DBSYNC. It's DBSYNC that generates the RACF statements. Googling "RACF" "DBSYNC" will get you the information you need. Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rexx or similar to clone a RACF user?
It's might be a bit excessive, but if you have RACF administrator authority, and an editor that will edit what might be a very large file, you could run IRRDBU00 and create a sequential file containing definitions of pretty much everything in your database except certificates and passwords. Edit the output and look for all of the statements that have the userid in them. Extract them to another file, change all the old userid to new userid, and run them through a batch TSO step to create the new user. I use a PC editor named Kedit that will edit a file with millions of lines and quickly find all occurrences of a string. YMMV. Hope this helps, Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Using Google Chrome to open IBM z/OS 2.4 Library Index ???
Lionel, Could it be that your PDF reader (or maybe the reader that Chrome wants to use) doesn't support PDFx files? I usually use PDF-XChange, but it doesn't support PDFx files so I also got the text when I tried with it. I installed Adobe reader and from File Explorer right-clicked and selected "Opened With", Adobe Reader and it worked fine. Hth, Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: WTO for message that will require explicit deletion?
Hi Charles. If you're running z/OS under z/VM, you can define a "real" console for your testing. I use address 3E0 because (I think) it was already in the HCD definitions provided by DTSC. You need an entry in your CONSOLxx parmlib member that can be as simple as CONSOLE DEVNUM(3E0) ROUTCODE(ALL) Or most of the parms specified, like this: CONSOLE DEVNUM(3E0) ROUTCODE(1-10,12-128) UNIT(3270-X) AUTH(MASTER) DEL(RD) RNUM(19) RTME(1) MFORM(J,T) SEG(19) AREA(NONE) NAME(S0W103E0) You also need a SPECIAL 3E0 3270 statement in your (VM) directory, or I think you could issue "CP DEFINE GRAF 3E0" from the machine's PROFILE EXEC. Once set up, you set your 3270 emulator to connect to the VM address (not your z/OS address) and (at DTSC) port 23. You'll get a VM logon screen, from where you'll use the CP DIAL ETPmyzos 3E0. You'll have to specify your authorization via your ETPuserid and password, and then the DIAL will complete. To tell z/OS to use it as a console after you DIAL, you'll also need to issue VARY 3E0,ONLINE and VARY 3E0,CONSOLE commands to activate it. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New look and linking for V2.3 product documentation PDFs
Hi Sue, I know we've beaten on you pretty badly here. So now that I've had time to use some of them, I thought I'd say that I really like the look of the new PDFs. You can't please all the people all the time, and you could never please all of us any of the time! Thanks for working so diligently to improve them. Best regards, Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New look and linking for V2.3 product documentation PDFs
Hi Tom. You can change the way Chrome handles PDFs via chrome://settings/content/pdfDocuments?search=pdf index.html will get you to the file you want, but since you're going through a web browser, clicking the link, at least in Chrome, will cause the file to be copied to your download folder before it's opened--even if it's already there. If you open the same manual 3 times, you end up with 3 copies of it in your folder. Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: New look and linking for V2.3 product documentation PDFs
Thanks for the update Sue. I'm not sure how we would find out this information without your posting it here. I personally really appreciate you continuing to create the PDF versions of the manuals. But there are a couple of things that would make them a lot easier to use. 1) Could you please use the full title names (minus "/" and ":" characters) for the file names? The 8.3 file names (actually, they aren't all 8-character anymore) are not very usable. If we download the HLASM and MFA zip files, we get: asmg1023.pdf asmi1023.pdf asmp1023.pdf asmr1023.pdf asmtic23.pdf asmtis23.pdf asmtiu23.pdf asmtug23.pdf azfi100_v1r3.pdf azfli100_v1r3.pdf azfpd130.pdf azfu100_v1r3.pdf I generally use Windows File Explorer to find a manual I've downloaded. But to be able to find something by the file system name, I have to open each to determine which manual it is, copy the title (and maybe the publication number), close the pdf and then rename it. "asmr1023.pdf" is not meaningful. "SC26-4940-08 HLASM Language Reference.pdf" is. And if the title has a slash, colon, or other invalid character for a file name, I have to remove those. (There might be reasons to replace the spaces with underscores.) It's often easier to copy the pub # and title and use "Save As" so that I can use the full title as a file name. Of course, this breaks any links between manuals. 2) The second thing to please stop dividing the manuals into sections so that the page numbers referenced from the TOC and all other places within the manual are the actual PDF page numbers. PDF doesn't (generally) recognize sections like this, so page numbers cited in the manual are always several pages short of the PDF page number. (Hyperlinks from the TOC are great, but references to page numbers within the text are usually not set up as links.) So, to jump to a page (Ctrl-G in most PDF readers) I usually add at least 10 pages to get close, then scroll to what the book thinks is the right page. For example, in "asmr1023.pdf", if you want to go to page 61, you would actually need to enter "77" because of the reset in the page numbers after the first 16 pages. In John Erhman's wonderful Assembler book there's a 42 page difference, and there are so many references to page numbers in the text that I used a PDF editor to delete everything prior to what it calls page 1 so that I could go directly to the referenced page--at the cost of having a table of contents. Thanks for listening. Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Using IPCS ACTIVE and alt ASID to display extended private storage
The location I need to check (1B12D080) is also not in the SVC dump:
BLSPDISD 62') ADDRESS(1B127C20.) STORAGE -
Command ===> SCROLL ===> CSR
1B127C20 C500 001B1271 B004 F50103D4 | E...5..M |
1B127C30 D6C4C9C9 C9D540E3 D9C1D3FF FF00 | ODIIIN TRAL. |
1B127C40.:1B127FFF.--All bytes contain X'00'
1B128000.:1B12.--Storage not available
1B13 F3F5 0051C4E2 D7C7C3D6 D940C7C3 | 35DSPGCOR GC |
1B130010 D9F1 2000 | R0.. |
1B130020 001E 206C1AD2 5000 | .%.K&... |
(I specified ASID=62,SDATA=RGN for the DUMP options.)
However, if I issue an ISPF START command from the TSO userid running the
application, and use IPCS from there to display ACTIVE storage (for that user's
ASID--62), the memory is still allocated:
BLSPDISD 62') ADDRESS(1B12D080.) STORAGE --
Command ===> SCROLL ===> CSR
1B12D080 00516000 00516000 011E 1B53A000 | ..-...-. |
1B12D090 1B12D078 1B12D078 | ..}...}. |
1B12D0A0 00D9 00D9 1B12D0F0 | ...R...R..}0 |
1B12D0B0 1B12D3C0 1B12C808 | ..L{..H. |
1B12D0C0 1B12B498 0007 | ...q |
1B12D0D0.:1B12D0DF.--All bytes contain X'00'
I don't know how to explain this mystery, but I think I can manage by using
IPCS in the second session. I appreciate your help Benjamin--thanks for all
your help.
Wendell
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Using IPCS ACTIVE and alt ASID to display extended private storage
I apologize: 2000.:5FFF.--Storage not available 6000 6008 C9D2D1D3 D1F14040 | ..-.IKJLJ1 | Our private area starts at x'6000'. The CSA starts at x'8', which I cannot display. What I really want to see is at x'1B12D080'. Although I can see some of the extended private area (which starts at x'1AC0'), I cannot display that area: 1ACD7110 4007C1E4 E3D6D940 40400500 | .AUTOR .. | 1ACD7120.:1ACD7FFF.--All bytes contain X'00' 1ACD8000.:7EAEDFFF.--Storage not available 7EAEE000 E5E2D4D7 7EB2A000 1000 0018 | VSMP=... | I don't know what is different starting at x'7EAEE000'. Our reserved area starts at x'8000': NAME Start-Address End-Address Size HV-SHARED0200_ 0001_ 510T HV-COMMON01EF_8000 01FF_66G HV-PRIVATE 0048_ 01EF_7FFF 1694G LOCALSYSAREA 0008_ 0047_ 256G RESERVED _8000 0007_30G EXTENDED-PRIVATE _1AC0 _7FFF 1620M EXTENDED-CSA _0868D000 _1ABF 293M EXTENDED-MLPA_ _ 0 EXTENDED-FLPA_0868A000 _0868CFFF 12288 EXTENDED-PLPA_032C6000 _08689FFF 85776K EXTENDED-SQA _01DA3000 _032C5FFF 21644K EXTENDED-R/W-NUC _01D53000 _01DA2FFF 327680 EXTENDED-R/O-NUC _0100 _01D520AF 13640K R/O-NUC _00FDE000 _00FF 139264 R/W-NUC _00FD2000 _00FDD457 46168 SQA _00E93000 _00FD1FFF 1276K PLPA _00CB1000 _00E92FFF 1928K FLPA _00CA6000 _00CB0FFF 45056 MLPA _00CA5000 _00CA5FFF 4096 CSA _0080 _00CA4FFF 4756K PRIVATE _6000 _007F 8168K V=R _6000 _0004BFFF 286720 SYSTEM _2000 _5FFF 16384 PSA _ _1FFF 8192 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Using IPCS ACTIVE and alt ASID to display extended private storage
Thanks for your replies. I had done a REFRESH in RACF for the FACILITY profile changes. If I start IPCS in an alternate session and then allow the application to abend, I can still view memory areas after the abend via ACTIVE in the alternate session, but not from a second TSO user. (But viewing from a split screen affects the getmain'd addresses I'm trying to view.) Could there be something about storage keys that I'm missing? The application does run from an APF authorized library, but AC=0. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Using IPCS ACTIVE and alt ASID to display extended private storage
Thanks for the tip on the FACILITY profiles for BLSACTV.SYSTEM and BLSACTV.ADDRSPAC. Adding them and giving myself access to them did change the results. But it still appears I cannot display any storage allocated to the program I'm debugging in the other address space. For example, if while in BROWSE on the ACTIVE addess space for ASID(x'0062'), I try to display the PSW address or the storage address I know is being overwritten (loc 1b12d080. ASID(X'0062') ), it displays: ASID(X'0062') ADDRESS(1B109000.) STORAGE -- Command ===> 1B109000.:7F484FFF.--Storage not available 7F485000 C300 00500044 E3C9D97A 18B0 Same with any other address that happens to be in a register at the time of the abend. (Including the base register for the program.) All of these areas are in the dump if I process it that way, but I'd really like to look at some addresses during the process. Anyone have an idea what I'm doing wrong? Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Using IPCS ACTIVE and alt ASID to display extended private storage
I'm trying to debug TSO process on USERA by using IPCS from USERB by specifying ACTIVE and ASID(x'USERA's asid'). An address I need to display is in USERA's extended private area, but LOC is only working up to the top of the extended CSA. LOC for any extended private address results in "1AC0.:_.--Storage not available". Is there a command or setting somewhere that I can change to allow me to view the extended private area of another user? TIA, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Where are the IBMLINK SIS fuinctions today?
The drop-down for "From Date" only goes back to 2013. But you can keep clicking the "back" arrow and go back apparently as far as you want. (I gave up in 1991.) However, it still didn't return anything for OA32850. I tried IBMLINK, but keep getting "Internal server error" messages. The link I was using was the one mentioned previously: https://www14.software.ibm.com/support/customercare/psearch/search?domain=gapar Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Zowe needs node.js, which you have to pay for on z/OS
Sorry Tim, but I don't understand. You said: "Node.js for z/OS is downloadable at no additional charge, and the Zowe documentation refers you directly to that downloadable release at:https://developer.ibm.com/node/sdk/ztp -- and not to anybody's sales representative." But that page says: "The code and application programming interfaces herein are trial information that may not be made generally available by IBM as or in a product. You are permitted to use the information only for internal use for evaluation purposes and not for use in a production environment." "downloadable at no additional charge" seems to be only for trial purposes. Without knowing that there will be enough customers using node.js to achieve a critical mass, vendors will have a hard time justifying writing applications that depend on it--Zowe or otherwise. Wendell Lovewell MacKinney Systems, Inc. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: How do I use 3270-4E on TSO?
Hi Tony. There are different ways to log on to an application using VTAM/Switch. Please give us (MacKinney Systems) a call and ask for tech support. They'll get you going. Best regards, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IBM ZD
Hi Dave. I don't have any ideas about the cost, but you might try googling "RD". Or, take a look at the article "Automate z Systems Application Testing on the Cloud" at http://ibmsystemsmag.com/mainframe/administrator/systemsmanagement/rdandt-cloud/ hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Session Manager
Gadi, MacKinney Systems sells a very affordable VTAM session manager we call VTAM/Switch. We'd be glad to talk to you about it. But if you do not have connectivity between the LPARs, no z/OS-based session manager will be able to acquire a session in a different LPAR. If you mainly want a clear indication of your current LPAR/application, maybe customizing the emulator's title bar to include the host name or VTAM applid would help. The emulators I've worked with have the ability to allow you to customize the value displayed at the top of each emulator session's window. I probably run 5 or 6 different emulator sessions, with at least 2 connected to VTAM/Switch with a handful of sessions open under them. I also use "Send To/Desktop" on my emulator definitions to create shortcuts to them on the Desktop. This allows me to assign "Shortcut Keys" for each session. I then use the unique shortcut key to switch to the session I want. For example, I can press Ctrl-Alt-1 and get to a session which is connected to VTAM/Switch running on one system, Ctrl-Alt-2 immediately brings up a VTAM/Switch session on a different system. Ctrl-Alt-z gets me a z/OS Console. And so on. I use the shortcut keys to get immediate access to the session I want, and the title is customized to verify that I'm on the correct system. Hth, Wendell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Cobol EBCDIC to ASCII
Hi Scot. It appears that EZACIE2A and EZACIA2E are aliases for EZACICTR.A, which is described in http://www-01.ibm.com/support/docview.wss?uid=swg21256665 This isn't really a COBOL answer, but it seems to me you could replace the table names in EZACICTR from "US", "CANADIAN", "DUTCH"... to the codepage names supplied in the comments: TRFIRST DS0A DCCL8'AUSGER',A(AUSGER) Austrian/German CECP 273 DCCL8'BELGIAN',A(BELGIAN) Belgian (New) CECP 500 DCCL8'CANADIAN',A(CANADIAN) Canadian Bilingual CECP 037 ... DCCL8'TELNETSE',A(TELNETSE) DCCL8'UK',A(UK) English (UK) CECP 285 DCCL8'US',A(US) English (US) CECP 037 TRENDEQU * This doesn't help identify the codepage, but when you have it, it would allow you to pass the codepage number instead of the table name. It also appears that EZACICTR allows you to pass a complete table instead of the table name, if that would somehow be easier: * *** * * MULTIPLE mode calls * *** * MOVE 'US' to TABLE-NAME. * CALL 'EZACIE2A' USING OUT-BUFFER LENGTH TABLE-NAME * RETURNING RET-CODE. * CALL 'EZACIA2E' USING OUT-BUFFER LENGTH TABLE-NAME * RETURNING RET-CODE. * * *** * * Optional call valid for either mode * *** * CALL 'EZACICTR' USING OUT-BUFFER LENGTH TRANSLATE-TABLE * RETURNING RET-CODE. hth, Wendell Lovewell -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: LRS VPS Printer Replacment
Hello "zos"! MacKinney Systems' JQP will meet your needs at a very affordable price. Please give us a call! Wendell Lovewell MacKinney Systems 417-882-8012 -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: IEBUPDTE question
Hey Tony, For $1000 a year our Global Search and Replace can unload and load a whole PDS, optionally making changes to the members. Maybe not a great one-time solution but a handy tool to have around. You could write a REXX program to read the file and call IEBUPDTE for each member, ignoring the ./ records. Myself, if I was starting with a PC file, I'd write a KEDIT macro to split them up and use FTP with MPUT. Wendell Lovewell MacKinney Systems -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: PCOMM macro/script - Copy Screens, Copy Append
We've used Passport for several years. Here's a VBScript example for Passport
that will allow you to specify the number of screens you want to copy and
optionally the beginning and ending row on the screen. After it copies each
screen and appends it to a temporary file, it invokes my editor so that I can
see the whole capture.
Comments start with a single quote. At the end there is another way of doing
this using VBScripts FileScriptingObject (FSO). Passport had some issues with
a 60x100 screen that way, so I stayed with the first version. But maybe it
matches PCOMM's functions better. At least it shows how to work with FSOs.
The macrouses Passport functions:
GetScreenSize
AppendPSToFile
SendHostKeys
WaitForHostUpdate
And the VBScript functions:
MsgBoxGetInput
Shell
I have the macro assigned to CTRL-S in my Passport keyboard so that I can just
press Ctrl-S and be prompted for the number of pages, begin row & end row on
each screen. It saves the screen & pages down that number of times, then
starts my editor with the results in the C:\temp file.
- Wendell Lovewell
' ***
' This macro will page through a TRACK or XRAY storage display (D dataname or A
address)
' and copy the number of pages you supply into a file named c:\temp\text.txt
' Assigned to Alt-D
Sub ZMain()
Dim Text, ret, nTimes, K, L, wrk, wrk2, wrk3
Dim strText
Dim nScreenSize, nRows, bRow, eRow, nCols
nScreenSize = GetScreenSize
If nScreenSize = 3564 Then nrows = 27
if nScreenSize = 3440 Then nrows = 43
if nScreenSize = 2560 Then nrows = 32
if nScreenSize = 1920 Then nrows = 24
if nScreenSize = 7200 Then nrows = 60
bRow = 7
eRow = nRows - 2
nCols = 80
If nScreenSize = 7200 Then ncols = 69
ret = Shell("c:\util\rm.bat C:\Temp\test.txt",6)' Call BAT file to delete
previous version of the file
strText = "Screen Size = " & nScreenSize & " - " & nRows & " rows" & vbCRLF
strText = strText & "Enter the number of screens to copy, optionally with
',bRow,eRow'"
nTimes = MsgBoxGetInput (strText)
K = InStr(nTimes,"*")
If K > 0 Then
L = K - 1
nTimes = Left(nTimes,L)
bRow = 1
eRow = Nrows
End If
K = InStr(nTimes,",")
If K > 0 Then
L = K - 1
wrk2 = nTimes 'temp hold nTimes in wrk2
nTimes = Left(nTimes,L)
L = K + 1
wrk = Mid(wrk2,L) 'wrk = part after nTimes,
K = Instr(wrk,",") 'Is there a comma?
If K > 0 Then
L = K - 1
bRow = Mid(wrk,l,1)
l = k + 1
wrk = Mid(wrk,l) 'wrk now = part after 2nd ","
If Trim(wrk) > "" Then
eRow = Trim(wrk)
Else
eRow = NRows
End If
End If
End If
'***
' Now, copy the data to the file via Passport's AppendPSToFile function
for k = 1 to nTimes
Ret = AppendPSToFile("c:\temp\test.txt",bRow,2,eRow,ncols)
SendHostKeys ("")
ret = WaitForHostUpdate(3)
Next
'***
If bRow = 7 Then
ret = Shell("c:\util\x.bat C:\Temp\test.txt ( PROFILE CopyDumpToFPE",1)
Else
ret = Shell("c:\util\x.bat C:\Temp\test.txt",1)
End If
End Sub
'
'**
' ' This is close to working, but also hung on the 60 x 100 screen size
' ' Needs crlf at end of each line
'
' Sub ZMainDidnotwork()
' Dim Text, ret, nTimes, k
' Dim strText, nRet
' Dim nCursorRow
' Dim nScreenSize, nRows, strCopyArea, EndRow, nBytes
'
' ' nCursorRow = GetCursorRow
' ' strText = "Current row position = " & nCursorRow
'
' ' nRet = MsgBox (strText, 0, "Row Position")
'
' nScreenSize = GetScreenSize
' If nScreenSize = 3564 Then nrows = 27
' if nScreenSize = 3440 Then nrows = 43
' if nScreenSize = 2560 Then nrows = 32
' if nScreenSize = 1920 Then nrows = 24
' if nScreenSize = 7200 Then nrows = 60
' EndRow = nRows - 2
'
' strText = "Screen Size = " & nScreenSize & " - " & nRows & " rows" & vbCRLF
' strText = strText & "Enter the number of screens to copy"
' nTimes = MsgBoxGetInput (strText)
'
' strCopyArea = ""
' nBytes = (Nrows - 6 - 2) * 80
'
' for k = 1 to nTimes
'Ret = SelectArea(7,1,nRows,80)
'strCopyArea = StrCopyArea & GetString (7,1,nBytes)
'
'SendHostKeys ("")
'ret = WaitForHostUpdate(5)
'Next
'
' strText = "The length of the data copied is " & Len(StrCopyArea)
' ret = MsgBox (strText,0,"Bytes Copied")
'
' ret = Shell("c:\util\rm.bat C:\Temp\CopyDump.txt",6)
' Call PutString (strCopyArea)
' ret = Shell("c:\util\x.bat C:\Temp\CopyDump.txt",1)
' End Sub
'
'
' Function PutString(fileText
Re: IBM Session Manager replacement
MacKinney Systems as VTAM/Switch. We'll help you with converting your session manager definitions, and more than a couple of you could license it for $60k a year! (Dennis, give us a call!) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Windows 10 Pro automatic update
Any version of Windows can have the update service disabled. 1) From a DOS window, enter "services.msc". 2) Find the line that has "Windows Update" on it. Right-click and select "Properties". 3) Change the "Startup Type" to "Disabled". This will prevent it from starting next boot. 4) Click "Stop" to stop it running immediately. 5) Click "Ok'. When you decide to let it update, do the reverse--select Automatic (Delayed Start) for the Startup Type, and click "Start". It will take some time for it to catch up. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Windows 10 Pro automatic update
The automatic updates messed up my systems so frequently that I ended up disabling the Windows Updates service on them. If/when I decide to apply service, I'll do it when I want. Imo Microsoft's decision to force Win10 reboots may end up making it less safe because people stop getting updates at all. On a related note, Mozilla has announced that they expect Firefox version 60 to be the first 100% safe Internet browser. However, an unfortunate side effect of this accomplishment is that they have been unable to find a web site that you can access. (I had to revert to Firefox release 51 and switched to "Never check for updates" because they dropped NPAPI support and a some of the web sites I need stopped working. I still find myself being forced to use Edge or Chrome now and then.) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Vendor Licensing Frustrations
I work for a vendor, so I understand the necessity of making sure that licensed products are used properly. But I also understand the inconvenience for both the customer and the vendor of managing software keys. I’m wondering what the list’s response would be toward implementing a system that automatically managed the keys by allowing the software to “phone home” to update them. My thoughts are that each time the software was started, and perhaps periodically, it would report its own key (to identify the customer), CPU id, MSU and/or whatever licensing metric was used. If a verification response could not be obtained, either because of license expiration or communication errors, a grace period of “n” days would be allowed. There would obviously be encryption, high availability, and possibly even customer firewall considerations. But it seems like a fair trade to me. Opinions? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Invalid characters in JCL symbols passed to SYSIN within a PROC
-- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
