Re: Z/VM 5.3 and VTAM and GCS
Jim, Check out SC24-6098-02 (z/VM Group Control System) Appendix A (Tailoring and Building the GCS Nucleus) - subsection headed, Creating a New GCS Nucleus Build List. Items 7 and 8 at the bottom of page 544 through to the top of Page 547) are what you need. It's terse to the point of incomprehensibility unless you have prior experience of nucleus addressing in a VM context (something which, nowadays, fewer and fewer people have need of) but this is definitely your, official reference point. Essentially, what you need to do is to widen the gaps between GCALP and GCTZET (to expand Low Common Storage), and/or between GCTBHC and GCTEHC (to expand High Common Storage) by changing / replacing the SLC (Set Location Counter) files referenced by the load list. It's these, gaps which define the amount of Low/High Common Storage (CSA in z/OS parlance) available to a particular GCS group and it's thi s Common Storage which is used by VTAM (and any other app which needs to share storage between separate tasks running in the group). As you're carrying forward an existing update I'll assume that you can work out how much increase you need by referring back to your previous system but, if not, then ask again and maybe somebody a bit more current than I am on VTAM will be able to offer some pointers. The precise mechanics of WHAT to do are (IMV) fairly well-described in th e manual (albeit without any real explanation as to WHY) but if you want to explore the background to this further - or have other questions - then please say so and I'll try (no doubt along with others) to expand on the above and clarify what's going on. Don't forget to put in your notes that the GCS NSS definitions (DEFNSS stuff) need to be reviewed / adjusted to match with whatever locations ar e used by the loadlist or you'll end up building a new nucleus in storage and then saving the wrong stuff into the NSS - a practice that can be the source of some serious head-scratching until the penny (dime?) drops ... Regards Jeff Gribbin
Re: IBMLink 3270 (VM, greenscreen, aka: productive) - VM Registration Tool sunset.
On Wednesday, 09/12/2007 at 02:07 EDT, Mike Walter [EMAIL PROTECTED] wrote: Even though the quotes news above specifically reports changes to the VM Registration Tool, I called the 800 number to ask if a user can still change their IBMLink VM (a new term from IBM!) password after October 31, 2007 in light of the statement * No changes can be made to your company or users on the VM side.). From the VM Registration Tool heading one could presume that everything else including password changes should still work. But given the frequent errors/misunderstandings regarding pretty much everything to do with IBMLink VM, I simply want to be prepared. The gentleman I spoke with had a heavy Indian accept and asked multiple unrelated questions, but as best I could tell users will still be able to change their own passwords. I won't be too surprised if his reply and reality don't mesh after October 31. Time will tell... I confirmed with IBMLink Powers That Be that, yes, you will still be able to change your VM password. You just won't be able to change any of the VM registrations or their entitlements. [And while they say IBMLINK VM, we all know that's just VMLINK IBM spelled sideways, sort of. At least it's a valid CMS command ;-) ] Alan Altmark z/VM Development IBM Endicott
Define NIC and COUPLE
Hello list, When I define a NIC for the linuxmachine I use something like: DEFINE NIC F00 TYPE QDIO COUPLE F00 SYSTEM OSNLINUX In the directory the NIC is specified as special. In one machine we have defined three NIC's. F00 coupled to AOSN, F10 coupled to AOSNBU and F20 coupled to OSNLINUX. The F20 was created to mov e the linuxmachine to vswitch. F00 was the old connection to guest LAN. Today we had to disconnect F00 from the guest LAN and then redefine F00 t o connect to the Vswitch. Then the F00 would replace the F20 device and the machine would be moved to the vswitch. I have found something I can't explain. The NIC F00 was coupled to AOSN just after the DEFINE command, no couple was needed. But we wanted the NI C to be coupled to OSNLINUX so the couple to AOSN was not correct. I did no t expect the define to automatically connect to the guest LAN. What could b e the logic? Did I have to UNCOUPLE first? Thanks, Berry.
Re: z/VM and Linux in the news....
It would be VERY interesting to read the notes from the Chicago session -- and forward them on to (skeptical) management! Dave Jones [EMAIL PROTECTED] Sent by: The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU 09/12/2007 02:44 PM Please respond to The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU To IBMVM@LISTSERV.UARK.EDU cc Subject Re: z/VM and Linux in the news Thanks for the invite, Mike, but next week I will be in warm and sunny San Antonio (my favorite city) for the zExpo. Maybe you can attend the meeting in Chicago and post some notesseems Mr. Teles is busy doing more with the mainframe than simply playing games. Mike Walter wrote: Dave, Come to New York at the end of the Month and you can ask the CEO of Hoplon those questions your self. ;) Why wait that long? If the suspense is too much, wrangle yourself an invitation to the Linux on System z Executive Advisory Council meeting in Chicago next week, Thursday September 25 (08:00-12:30). Chicago's a lot closer to you than is New York. Anyone interested should contact their IBM rep. From the invitation: We have an exciting Agenda for the half-day session. Our first speaker is IBM VP Leslie Gordon who will discuss IBM's own consolidation project announced in August where IBM will be taking the workload of 3,900 distributed servers and consolidating those workloads onto Linux on System z. Next up, Monte Bauman will be presenting System z Cost and Value Modeling which was used for IBM's Project Big Green and can be used for your consolidation projects. Last, but certainly not least, is Tarquinio Teles, CEO of Brazil-based Hoplon. Mr. Teles will be presenting some of the Linux on System z projects that Hoplon is doing in some areas a diverse as media conference centers, high-performance financial analysis, and most notable, the GameFrame where Hoplon has integrated the IBM Cell with Linux for System z to produce an Internet gaming environment. Mike Walter Hewitt Associates Any opinions expressed herein are mine alone and do not necessarily represent the opinions or policies of Hewitt Associates. Bill Munson [EMAIL PROTECTED] Sent by: The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU 09/12/2007 12:49 PM Please respond to The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU To IBMVM@LISTSERV.UARK.EDU cc Subject Re: z/VM and Linux in the news Dave, Come to New York at the end of the Month and you can ask the CEO of Hoplon those questions your self. ;) Linux on System z Executive Advisory Council IBM Corporation 590 Madison Avenue, 12th Floor Room 1219 New York City Friday, September 28, 9 AM 12:30 PM Youre invited to join us for the next session of the Linux on System z Executive Advisory Council. We launched this council in 2002 in order to garner your insights and foster communications among the System z Linux community. We are excited to welcome Tarquinio Teles, CEO of Hoplon of Brazil which has embarked on a project to integrate the Cell Broadband Engine with the IBM System z Mainframe . We will also discuss z/VM as it compares to other virtualization technologies, System z architecture as it compares to RISC architecture, and the major announcement made by IBM to consolidate 3900 of its own distributed servers to Linux on System z under z/VM from a business, technical, and financial perspective. Agenda 8:30 am Arrival and Continental Breakfast 9:00 am Opening Remarks IBM Major Project Green Server Consolidation Len Santalucia, IBM Americas System z Linux Impact Team 9:15 am Comparison of Virtualization Technologies Reed Mullen, Software Prod Mgr System z Virtualization Technology 10:15 amArchitectural Comparison of System z vs RISC Rory Canellis, Competive Intelligence Analyst, Systems z Marketing 11:15 amBitVerse Financial Analysis Algorithym, Virtual Conferencing Center, GameFrame on IBM System z Linux, z/VM Cell BE Technologies Tarquinio Teles, CEO of Hoplon 12:00 pm Open Discussion with all speakers Plan next session 12:30 pm Close and Departure RSVP Andy Greco [EMAIL PROTECTED], (603)472-4169 or Len Santalucia: [EMAIL PROTECTED], (212) 493-5957. Bill Munson VM System Programmer Office of Information Technology State of New Jersey (609) 984-4065 President MVMUA http://www.marist.edu/~mvmua Dave Jones wrote: (Sorry for the cross-posting, but I thought both lists would like to read about this) Here's an interesting article about how Brazilian companies are using IBM mainframes in new and, shall we say, unique ways Joe Clabby's Brazilian mainframe adventure travel log, ( http://searchdatacenter.techtarget.com/tip/0,289483,sid80_gci1271026,00.html?track=NL-576ad=603746asrc=EM_NLT_2178510 ) (and watch out for line wrap on that long URL
Re: IBMLink 3270 (VM, greenscreen, aka: productive) - VM Registration Tool sunset.
I confirmed with IBMLink Powers That Be that, yes, you will still be able to change your VM password. You just won't be able to change any of the VM registrations or their entitlements. [And while they say IBMLINK VM, we all know that's just VMLINK IBM spelled sideways, sort of. At least it's a valid CMS command ;-) ] Alan Altmark z/VM Development IBM Endicott Thanks, Alan. Good news indeed from the P.T.B. And to all who want to continue to use IBMLink greenscreen. BTW, this morning I received an e-mail update notification related to a PMR that I opened yesterday using the web-based IBMLink. (I opened it there because it's an easy place to paste wider console logs than the XEDIT screens on IBMLink greenscreen). I tried to click on the URL listed to get me back to the IBMLink PMR. It did not respond. After a 2+ minute wait without any progress, I opened another window and entered the commands to logon to IBMLink greenscreen - in 15 seconds I was logged on and into the actual PMR. Now... in all fairness, we were having Novell LAN performance problems at the time, so accessing the web-based IBMLink could have been related to that. But it's another link in the chain that can fail. I'll continue to choose the right tool for the job. Just because you have a spider, not everything is a web. :-) Mike Walter Hewitt Associates Any opinions expressed herein are mine alone and do not necessarily represent the opinions or policies of Hewitt Associates. The information contained in this e-mail and any accompanying documents may contain information that is confidential or otherwise protected from disclosure. If you are not the intended recipient of this message, or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message, including any attachments. Any dissemination, distribution or other use of the contents of this message by anyone other than the intended recipient is strictly prohibited.
Tape Drives in z/OS under z/VM
For those of you who run z/OS under z/VM, how do you handle tape drives ? In a native LPAR sysplex, all z/OS systems have access to all the tape drives. Is there a way to share a tape drive between z/OS systems running under z/VM ? ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. **
Re: Z/VM 5.3 and VTAM and GCS
Thank you very much Jeff. This is what I was looking for. Jim Hughes 603-271-5586 There's no sense in being precise when you don't even know what you're talking about. John von Neumann =-Original Message- =From: The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] On =Behalf Of Jeff Gribbin, EDS =Sent: Thursday, September 13, 2007 2:46 AM =To: IBMVM@LISTSERV.UARK.EDU =Subject: Re: Z/VM 5.3 and VTAM and GCS = =Jim, =Check out SC24-6098-02 (z/VM Group Control System) Appendix A (Tailoring = = =and Building the GCS Nucleus) - subsection headed, Creating a New GCS = = =Nucleus Build List. Items 7 and 8 at the bottom of page 544 through to = = =the top of Page 547) are what you need. = =It's terse to the point of incomprehensibility unless you have prior =experience of nucleus addressing in a VM context (something which, =nowadays, fewer and fewer people have need of) but this is definitely =your, official reference point. = =Essentially, what you need to do is to widen the gaps between GCALP and = = =GCTZET (to expand Low Common Storage), and/or between GCTBHC and GCTEHC = = =(to expand High Common Storage) by changing / replacing the SLC (Set =Location Counter) files referenced by the load list. = =It's these, gaps which define the amount of Low/High Common Storage =(CSA in z/OS parlance) available to a particular GCS group and it's thi= =s =Common Storage which is used by VTAM (and any other app which needs to = = =share storage between separate tasks running in the group). As you're =carrying forward an existing update I'll assume that you can work out how= = =much increase you need by referring back to your previous system but, if = = =not, then ask again and maybe somebody a bit more current than I am on = = =VTAM will be able to offer some pointers. = =The precise mechanics of WHAT to do are (IMV) fairly well-described in th= =e =manual (albeit without any real explanation as to WHY) but if you want to= = =explore the background to this further - or have other questions - then = = =please say so and I'll try (no doubt along with others) to expand on the = = =above and clarify what's going on. = =Don't forget to put in your notes that the GCS NSS definitions (DEFNSS = = =stuff) need to be reviewed / adjusted to match with whatever locations ar= =e =used by the loadlist or you'll end up building a new nucleus in storage = = =and then saving the wrong stuff into the NSS - a practice that can be the= = =source of some serious head-scratching until the penny (dime?) drops ... = =Regards =Jeff Gribbin
Re: z/VM 5.2 ICC console connection problems
On Wednesday, 09/12/2007 at 01:33 EDT, James M [EMAIL PROTECTED] wrote: sorry...I hit submit by accident. The trace does not point out any obvious clues. I see the initial three way handshake then I see the icc port send a do tn3270e command the pc sends an ack the icc sends back fin I'm not enough of an ip guru to diagnose exactly why that happened or for that matter if that info is in the trace. Was there a time delay between the ack and fin? Your PC should have sent WILL TN3270E. If you want, send me your pcap file. Alan Altmark z/VM Development IBM Endicott
Re: Tape Drives in z/OS under z/VM
Try the multi-attach option on ATTACH. You can attach the same drive to multiple virtual machines.
Re: Tape Drives in z/OS under z/VM
On Thursday, 09/13/2007 at 11:25 EDT, Daniel Allen [EMAIL PROTECTED] wrote: For those of you who run z/OS under z/VM, how do you handle tape drives ? In a native LPAR sysplex, all z/OS systems have access to all the tape drives. Is there a way to share a tape drive between z/OS systems running under z/VM ? Use ATTACH with the MULTIUSER option. As long as your z/OS tape manager is using ASSIGN to assume ownership of the drive at tape mount time, all will work. Alan Altmark z/VM Development IBM Endicott
Re: z/VM and Linux in the news....
sigh OK, I'll try to take good notes and post them here afterward if IBM has no problems with that at the meeting. No promises on whether that actually gets done (lots of other things happening in my life right now) nor how good the notes might be. However, the handouts are generally posted at: https://extranet.lotus.com/zlinuxcouncil But your IBM'er has to sign you up for that web site, and invite you to the Council meetings. The target audience for the Linux on System z Executive Advisory Council is senior management. If I understood correctly they were targeting CEOs and CIOs, but have been letting technical managers such as myself show up. The sessions don't get down to the bits and bytes levels (for that, go to SHARE), but stay at a higher level; again targeted to their desired audience. I'll ask if I can post the session handouts somewhere that everyone can access. IBM might be wise to do that anyway, so that sysprogs can print them off to hand to their own management - particularly for customer sites where the invitees cannot or will not attend. Often, insurrections start from the bottom anyway. :-) Mike Walter Hewitt Associates Any opinions expressed herein are mine alone and do not necessarily represent the opinions or policies of Hewitt Associates. [EMAIL PROTECTED] Sent by: The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU 09/13/2007 07:41 AM Please respond to The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU To IBMVM@LISTSERV.UARK.EDU cc Subject Re: z/VM and Linux in the news It would be VERY interesting to read the notes from the Chicago session -- and forward them on to (skeptical) management! Dave Jones [EMAIL PROTECTED] Sent by: The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU 09/12/2007 02:44 PM Please respond to The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU To IBMVM@LISTSERV.UARK.EDU cc Subject Re: z/VM and Linux in the news Thanks for the invite, Mike, but next week I will be in warm and sunny San Antonio (my favorite city) for the zExpo. Maybe you can attend the meeting in Chicago and post some notesseems Mr. Teles is busy doing more with the mainframe than simply playing games. Mike Walter wrote: Dave, Come to New York at the end of the Month and you can ask the CEO of Hoplon those questions your self. ;) Why wait that long? If the suspense is too much, wrangle yourself an invitation to the Linux on System z Executive Advisory Council meeting in Chicago next week, Thursday September 25 (08:00-12:30). Chicago's a lot closer to you than is New York. Anyone interested should contact their IBM rep. From the invitation: We have an exciting Agenda for the half-day session. Our first speaker is IBM VP Leslie Gordon who will discuss IBM's own consolidation project announced in August where IBM will be taking the workload of 3,900 distributed servers and consolidating those workloads onto Linux on System z. Next up, Monte Bauman will be presenting System z Cost and Value Modeling which was used for IBM's Project Big Green and can be used for your consolidation projects. Last, but certainly not least, is Tarquinio Teles, CEO of Brazil-based Hoplon. Mr. Teles will be presenting some of the Linux on System z projects that Hoplon is doing in some areas a diverse as media conference centers, high-performance financial analysis, and most notable, the GameFrame where Hoplon has integrated the IBM Cell with Linux for System z to produce an Internet gaming environment. Mike Walter Hewitt Associates Any opinions expressed herein are mine alone and do not necessarily represent the opinions or policies of Hewitt Associates. Bill Munson [EMAIL PROTECTED] Sent by: The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU 09/12/2007 12:49 PM Please respond to The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU To IBMVM@LISTSERV.UARK.EDU cc Subject Re: z/VM and Linux in the news Dave, Come to New York at the end of the Month and you can ask the CEO of Hoplon those questions your self. ;) Linux on System z Executive Advisory Council IBM Corporation 590 Madison Avenue, 12th Floor Room 1219 New York City Friday, September 28, 9 AM 12:30 PM Youre invited to join us for the next session of the Linux on System z Executive Advisory Council. We launched this council in 2002 in order to garner your insights and foster communications among the System z Linux community. We are excited to welcome Tarquinio Teles, CEO of Hoplon of Brazil which has embarked on a project to integrate the Cell Broadband Engine with the IBM System z Mainframe . We will also discuss z/VM as it compares to other virtualization technologies, System z architecture as it compares to RISC architecture, and the major announcement made by IBM to consolidate 3900 of its own distributed
Re: Define NIC and COUPLE
If the NICDEF in the directory specifies a vswitch or LAN for automatic connection at logon, then a DEFINE for that device will also automaically connect it. You have multiple ways to get where you want to go, but a good start will be to update the directory first with what you want the final configuration to look like. This way you won't get automatic couples associated with your old configuration. Brian Nielsen On Thu, 13 Sep 2007 07:55:00 -0500, Berry van Sleeuwen [EMAIL PROTECTED] wrote: Hello list, When I define a NIC for the linuxmachine I use something like: DEFINE NIC F00 TYPE QDIO COUPLE F00 SYSTEM OSNLINUX In the directory the NIC is specified as special. In one machine we have defined three NIC's. F00 coupled to AOSN, F10 coupled to AOSNBU and F20 coupled to OSNLINUX. The F20 was created to move the linuxmachine to vswitch. F00 was the old connection to guest LAN. Today we had to disconnect F00 from the guest LAN and then redefine F00 to connect to the Vswitch. Then the F00 would replace the F20 device and th e machine would be moved to the vswitch. I have found something I can't explain. The NIC F00 was coupled to AOSN just after the DEFINE command, no couple was needed. But we wanted the NIC to be coupled to OSNLINUX so the couple to AOSN was not correct. I did not expect the define to automatically connect to the guest LAN. What could be the logic? Did I have to UNCOUPLE first? Thanks, Berry. = ===
Re: z/VM and Linux in the news....
Mike, My take on the council meetings is a little different than yours. While the target audience may be senior executive management, the reality is that they welcome the technical folks just as enthusiastically. I have attended the council meeting in my area since its inception. I do download the presentations and circulate them around the shop to interested parties. My local Linux on System z folks have encouraged me to do so. My council meeting (Atlanta) is tomorrow and, unfortunately, Mr. Teles of Hoplon is not on our agenda. Not to worry, I have and will continue to download new presentations from any of the nine other councils as I notice them. :-) Bob Richards VP, Enterprise Technologist - - Enterprise Technology Infrastructure- - Mainframe Services Capacity Performance Mgmt - - Office: 404-575-2798Mobile: 610-246-2943 - - email: [EMAIL PROTECTED] - From: The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] On Behalf Of Mike Walter Sent: Thursday, September 13, 2007 11:40 AM To: IBMVM@LISTSERV.UARK.EDU Subject: Re: z/VM and Linux in the news sigh OK, I'll try to take good notes and post them here afterward if IBM has no problems with that at the meeting. No promises on whether that actually gets done (lots of other things happening in my life right now) nor how good the notes might be. However, the handouts are generally posted at: https://extranet.lotus.com/zlinuxcouncil But your IBM'er has to sign you up for that web site, and invite you to the Council meetings. The target audience for the Linux on System z Executive Advisory Council is senior management. If I understood correctly they were targeting CEOs and CIOs, but have been letting technical managers such as myself show up. The sessions don't get down to the bits and bytes levels (for that, go to SHARE), but stay at a higher level; again targeted to their desired audience. I'll ask if I can post the session handouts somewhere that everyone can access. IBM might be wise to do that anyway, so that sysprogs can print them off to hand to their own management - particularly for customer sites where the invitees cannot or will not attend. Often, insurrections start from the bottom anyway. :-) Mike Walter Hewitt Associates Any opinions expressed herein are mine alone and do not necessarily represent the opinions or policies of Hewitt Associates. LEGAL DISCLAIMER The information transmitted is intended solely for the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this email in error please contact the sender and delete the material from any computer. SunTrust and Seeing beyond money are federally registered service marks of SunTrust Banks, Inc. [ST:XCL]
Re: z/VM 5.2 ICC console connection problems
I may have the issue resolved. I reinstalled the os (win2k) emulator (hummingbird). I can now connect to the icc port. But I didn't get all the way in because the LU is in use. When I go back to the mainframe location tomorrow I will know for sure. It's very troubling not knowing what broke especially considering it's our mainframe console. I'm now wondering if there are certain emulators that are better than others. Does IBM support/recommend certain emulators? Here I am blaming the emulator - maybe I should be considering a linux based icc console. Getting back to the pcap file - it looks like there was about 10 seconds elapsed from act to fin. If you really want I can send the pcap file. If so let me know where to send it. Thanks for the help. -Jim On 9/13/07, Alan Altmark [EMAIL PROTECTED] wrote: On Wednesday, 09/12/2007 at 01:33 EDT, James M [EMAIL PROTECTED] wrote: sorry...I hit submit by accident. The trace does not point out any obvious clues. I see the initial three way handshake then I see the icc port send a do tn3270e command the pc sends an ack the icc sends back fin I'm not enough of an ip guru to diagnose exactly why that happened or for that matter if that info is in the trace. Was there a time delay between the ack and fin? Your PC should have sent WILL TN3270E. If you want, send me your pcap file. Alan Altmark z/VM Development IBM Endicott
Re: Tape Drives in z/OS under z/VM
Daniel, For our JES2 guests, we attach tape drives to all the guests using ATTACH or DEDICATE with the MULTIUSER option. The guests run CA's MIA product to control sharing. We also use MIA on our JES2 LPAR systems. Our JES3 LPAR systems use JES3's own tape sharing support. This requires multi-system assign, which is not supported for guests using MULTIUSER. We don't want to make our test guests different than the LPAR systems that they model, so we don't run MIA on the JES3 guests. We just don't share drives between them. Dennis Chelsea Clinton asked a returning US Soldier about fear. He said there were only three things he was afraid of: Osama, Obama and Yo Mama. -- Truckee Tahoe Times From: The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] On Behalf Of Daniel Allen Sent: Thursday, September 13, 2007 08:24 To: IBMVM@LISTSERV.UARK.EDU Subject: [IBMVM] Tape Drives in z/OS under z/VM For those of you who run z/OS under z/VM, how do you handle tape drives ? In a native LPAR sysplex, all z/OS systems have access to all the tape drives. Is there a way to share a tape drive between z/OS systems running under z/VM ? ** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. **
Re: z/VM 5.2 ICC console connection problems
Jim, I have always had good luck using IBM's Personal Communications TN3270 (PCOMM) emulator. The current version is, I believe, 5.8, at least for Windows XP James M wrote: I may have the issue resolved. I reinstalled the os (win2k) emulator (hummingbird). I can now connect to the icc port. But I didn't get all the way in because the LU is in use. When I go back to the mainframe location tomorrow I will know for sure. It's very troubling not knowing what broke especially considering it's our mainframe console. I'm now wondering if there are certain emulators that are better than others. Does IBM support/recommend certain emulators? Here I am blaming the emulator - maybe I should be considering a linux based icc console. Getting back to the pcap file - it looks like there was about 10 seconds elapsed from act to fin. If you really want I can send the pcap file. If so let me know where to send it. Thanks for the help. -Jim On 9/13/07, Alan Altmark [EMAIL PROTECTED] wrote: On Wednesday, 09/12/2007 at 01:33 EDT, James M [EMAIL PROTECTED] wrote: sorry...I hit submit by accident. The trace does not point out any obvious clues. I see the initial three way handshake then I see the icc port send a do tn3270e command the pc sends an ack the icc sends back fin I'm not enough of an ip guru to diagnose exactly why that happened or for that matter if that info is in the trace. Was there a time delay between the ack and fin? Your PC should have sent WILL TN3270E. If you want, send me your pcap file. Alan Altmark z/VM Development IBM Endicott -- DJ V/Soft
Re: z/VM 5.2 ICC console connection problems
We use both IBM PCOMM and Attachmate. Started with IBM PCOMM when we had 2074s and kept using it when we switched to ICC connections. We have both zVM and zOS consoles setup with IBM PCOMM and ICC. Paul Feller -Original Message- From: The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] On Behalf Of Dave Jones Sent: Thursday, September 13, 2007 12:36 PM To: IBMVM@LISTSERV.UARK.EDU Subject: Re: z/VM 5.2 ICC console connection problems Jim, I have always had good luck using IBM's Personal Communications TN3270 (PCOMM) emulator. The current version is, I believe, 5.8, at least for Windows XP James M wrote: I may have the issue resolved. I reinstalled the os (win2k) emulator (hummingbird). I can now connect to the icc port. But I didn't get all the way in because the LU is in use. When I go back to the mainframe location tomorrow I will know for sure. It's very troubling not knowing what broke especially considering it's our mainframe console. I'm now wondering if there are certain emulators that are better than others. Does IBM support/recommend certain emulators? Here I am blaming the emulator - maybe I should be considering a linux based icc console. Getting back to the pcap file - it looks like there was about 10 seconds elapsed from act to fin. If you really want I can send the pcap file. If so let me know where to send it. Thanks for the help. -Jim On 9/13/07, Alan Altmark [EMAIL PROTECTED] wrote: On Wednesday, 09/12/2007 at 01:33 EDT, James M [EMAIL PROTECTED] wrote: sorry...I hit submit by accident. The trace does not point out any obvious clues. I see the initial three way handshake then I see the icc port send a do tn3270e command the pc sends an ack the icc sends back fin I'm not enough of an ip guru to diagnose exactly why that happened or for that matter if that info is in the trace. Was there a time delay between the ack and fin? Your PC should have sent WILL TN3270E. If you want, send me your pcap file. Alan Altmark z/VM Development IBM Endicott -- DJ V/Soft
Re: z/VM 5.2 ICC console connection problems
I have had good results with X3270 on Debian Etch. We use it on all of our consoles. James M wrote: It's very troubling not knowing what broke especially considering it's our mainframe console. I'm now wondering if there are certain emulators that are better than others. Does IBM support/recommend certain emulators? Here I am blaming the emulator - maybe I should be considering a linux based icc console. -- Stephen Frazier Information Technology Unit Oklahoma Department of Corrections 3400 Martin Luther King Oklahoma City, Ok, 73111-4298 Tel.: (405) 425-2549 Fax: (405) 425-2554 Pager: (405) 690-1828 email: stevef%doc.state.ok.us
Re: z/VM 5.2 ICC console connection problems
On Thursday, 09/13/2007 at 12:41 EDT, James M [EMAIL PROTECTED] wrote: I'm now wondering if there are certain emulators that are better than others. Does IBM support/recommend certain emulators? Here I am blaming the emulator - maybe I should be considering a linux based icc console. IBM sells its own emulator, IBM Personal Communications (PCOMM). However, it would be hard to say that IBM recommends any particular emulator in this respect, however, since telnet is an open standard. If ICC isn't operating according to the RFCs, then we'll fix it. Getting back to the pcap file - it looks like there was about 10 seconds elapsed from act to fin. If you really want I can send the pcap file. If so let me know where to send it. At this point the question is moot. The 10-second delay confirms, I think, that the ICC was waiting for the WILL TN3270E from your PC. After 10 seconds with no response from your PC, he [appropriately] closed the connection. Alan Altmark z/VM Development IBM Endicott
Multiple Certificates on One VM System
Is there any way to share server certificates between SSLSERV and other applications on the same VM system? (In my case the other application is Illustro z/Web Server for VM.) Do I have to order a separate certificate for each? (Costs $$$.) Essentially, a certificate just certifies a particular domain, so why should I need two of them? I could use the SSLSERV to provide SSL services to the z/Web server, but since the SSLSERV encryption is transparent to the application, there doe s not appear to be any way for an application (CGI) running on the web server to obtain information on the client certificate, or even to know whether the interaction is encrypted (HTTPS) instead of not (HTTP). Does SSLSERV even support client certificates? Does it support HTTPS instead o f HTTP? Given this, I think I have to keep using the SSL support in z/Web server. If I understand this correctly, to get certificate(s) for SSLSERV, I have to do this: 1. Create 'label X509INFO' file. 2. Create the certificate request: ssladmin request label keysize fm 3. Send the certificate request to the CA. 4. Receive server certificate and CA certificates from CA. 5. Receive the certificate into CMS file(s) with a file type of X509CERT. 6. Store any separate CA certificates in the certificates in the certificate database: ssladmin store fn ca label 7. Store the server certificate: ssladmin store fn server I believe the 'request' command stores a 'request' item in the database, and then the 'store fn server' commands associates the server certificate item with the request item. It's this 'association' that is the problem. Is there any way to install a 'request' item from somewhere else into the SSLSERV database? z/Web server has an identical process, except that it uses a web page instead of commands. (The underlying commands do exist, though.) Alan Ackerman Alan (dot) Ackerman (at) Bank of America (dot) com
Re: DASD Problems
Thanks to all for your suggestions and comments on our recent DASD problem. The problem turned out to be just as Hitachi had originally said, a definition screw up on my part. ( What? You're surprised? ;) ) In defining the control units in the IOCP I had: CTL70CNTLUNIT CUNUMBR=7001,PATH=(70,71),UNITADD=((00,256)),* CUADD=0,UNIT=2105 CTL71CNTLUNIT CUNUMBR=7101,PATH=(72,73),UNITADD=((00,256)),* CUADD=1,UNIT=2105 When I should have had: CTL70CNTLUNIT CUNUMBR=7001,PATH=(70,71),UNITADD=((00,256)),* CUADD=0,UNIT=2105 CTL71CNTLUNIT CUNUMBR=7101,PATH=(72,73),UNITADD=((00,256)),* CUADD=0,UNIT=2105 Small mistake, big consequences. A BIG, BIG thank you to Raymond Noal and Sergio (Ed) Castro of Hitachi for their help in chasing down the cause of the problem, and finding a resolution for us. Now if we can only get our Quality Assurance people to okay production use... Peter The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review retransmission dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient or delegate is strictly prohibited. If you received this in error please contact the sender and delete the material from any computer. The integrity and security of this message cannot by guaranteed on the Internet. The Sender accepts no liability for the content of this e-mail or for the consequences of any actions taken on basis of the information provided. The recipient should check this e-mail and any attachments for the presence of viruses. The sender accepts no liability for any damage caused by any virus transmitted by this e-mail. This disclaimer is the property of the TTC and must not be altered or circumvented in any manner.
Re: Multiple Certificates on One VM System
On Thursday, 09/13/2007 at 03:58 EDT, Alan Ackerman [EMAIL PROTECTED] wrote: Is there any way to share server certificates between SSLSERV and other applications on the same VM system? (In my case the other application is Illustro z/Web Server for VM.) Do I have to order a separate certificate for each? (Costs $$$.) If you define port 443 (https) as SECURE in PROFILE TCPIP, then you can use the SSL server certificates. The trick is to get z/Web to listen on 80 and 443 at the same time, treating 443 exactly as it does 80. All encryption would be handled by the SSL server. But, no, there's no way to share the SSL server's certificate database with other guests. Essentially, a certificate just certifies a particular domain, so why should I need two of them? Ummm, you don't. I could use the SSLSERV to provide SSL services to the z/Web server, but since the SSLSERV encryption is transparent to the application, there does not appear to be any way for an application (CGI) running on the web server to obtain information on the client certificate, or even to know whether the interaction is encrypted (HTTPS) instead of not (HTTP). Does SSLSERV even support client certificates? Does it support HTTPS instead of HTTP? The SSL server does not request a client certificate. You're correct that the CGI cannot directly observe that (a) the connection is encrypted [hey, it's transparent TLS], or (b) the client certificate (if we requested it). Indirectly, the CGI could get creative with NETSTAT CONN to discover whether its connection is encrypted. See the Usage Note for NETSTAT CONN re: two connections per secure session. If I understand this correctly, to get certificate(s) for SSLSERV, I have to do this: The exact steps are listed in the TCP/IP manual. Don't skip any. :-) I believe the 'request' command stores a 'request' item in the database, and then the 'store fn server' commands associates the server certificate item with the request item. The request generates a certificate based on the X509INFO file AND it creates a public/private keypair. The REQUEST file contains the certificate, signed with your private key. The CA signs it (the certificate with your signature) with their private key and sends it back to you. The store command verifies that the provided cert is valid and associates the now-CA-signed cert with the certificate label. It's this 'association' that is the problem. Is there any way to install a 'request' item from somewhere else into the SSLSERV database? No. We are aware of the requirement to be able to import certificates keys into the database without having to first do a Request. If you want to copy the files to another Linux guest, that's ok, too, but I don't know if the SSL server can handle generic (e.g. *.endicott.ibm.com) certificates. z/Web server has an identical process, except that it uses a web page instead of commands. (The underlying commands do exist, though.) Aren't web servers great? :-) Alan Altmark z/VM Development IBM Endicott
Re: Ghost users on z/VM 5.2
On Tue, 11 Sep 2007 10:56:21 -0400, Hooker, Don [EMAIL PROTECTED] wrote: And Alan, I guess I'm glad to know we're not alone. I will look up VM64184. It is for z/VM 5.2? Both z/VM 5.2 and 5.3. APAR Identifier .. VM64184 Last Changed 07/08/30 HUNG USER AFTER VARY ON COMMAND ISSUED TO PAV DASD Symptom .. WS WAIT Status ... CLOSED PER Severity ... 3 Date Closed . 07/08/29 Component .. 568411202 Duplicate of Reported Release . 520 Fixed Release 999 Component Name VM CPSpecial Notice HIPER Current Target Date ..07/08/15 Flags RESTART/BOOT/IPL SCP ... Platform Status Detail: SHIPMENT - Packaged solution is available for shipment. PE PTF List: PTF List: Release 520 : UM32093 available 07/08/30 (1000 ) Release 530 : UM32096 available 07/08/30 (1000 ) Parent APAR: Child APAR list: ERROR DESCRIPTION: At a certain time, some DASDs that were PAV Alias devices were reconfigured as PAV Base devices. This DASD reconfiguration occurred while the current IPL was active and z/VM retained the old PAV Alias indications for the devices that were switched to PAV Bases and hence were set as both PAV Bases and Aliases. These indications are defined to be mutually exclusive and since they were both set, this caused the I/O scheduler problems with locks and hanged the VARY command. LOCAL FIX: . PROBLEM SUMMARY: * USERS AFFECTED: All z/VM users of Parallel Access Volumes* * ( PAV ). * * PROBLEM DESCRIPTION: * * RECOMMENDATION: APPLY PTF* At one time on a D/T2105 controller devices 2200-22FF were defined as D/T3390 Model 9 DASD and devices 2200-2219 and 2280-2299 were configured as PAV Bases and 221A-227F and 229A-22FF were configured as PAV Aliases. The devices were all offline to z/VM, but the associated RDEVs were marked as PAV Aliases or PAV Bases as appropriate. . Subsequently the devices were reconfigured as D/T3390 Model 3 DASDs and devices 2200-2235 and 2280-22B5 were defined as PAV Bases and 2236-227F and 22B6-22FF were defined as PAV Aliases. . For a device that switches from being a PAV Alias to a PAV Base (Device 221A for example), the RDEV retains its old PAV Alias setting (RDEVPVAL) and also gets marked as a PAV Base (RDEVPVBA) when it goes through device initialization because of a VARY ON command. These indications are defined to be mutually exclusive and since they are both set, this causes the I/O scheduler (HCPIQM) to get into a deadlock situation with the RDEV lock for the device and the VARY command hangs. PROBLEM CONCLUSION: Device initialization code was modified to clear a PAV device's old state when it doesn't match the new state. Specifically, if device initialization determines that a device is a PAV Alias device, then it will now check to see if the RDEV is currently marked as a PAV Base device. If so, then the device's old life (PAV Base) will be reset before indicating in the RDEV that the device is a PAV Alias. If device initialization determines that the device is NOT a PAV Alias device, but it is currently marked that way in the RDEV, then the device's old life (PAV Alias) will be reset. If device initialization determines that a device is a PAV Base device, then it will now check to see if the RDEV is currently marked as a PAV Alias device. If so, then the device's old life (PAV Alias) will be reset before indicating in the RDEV that the device is a PAV Base. TEMPORARY FIX: * * HIPER * * FOR RELEASE VM/ESA CP/ESA R520 : PREREQ: VM63855 VM64128 CO-REQ: NONE IF-REQ: NONE FOR RELEASE VM/ESA CP/ESA R530 : PREREQ: VM64222 CO-REQ: NONE IF-REQ: NONE COMMENTS: MODULES/MACROS: HCPRDI HCPSDV HCPVPA SRLS: NONE RTN CODES: CIRCUMVENTION: MESSAGE TO SUBMITTER:
Re: Multiple Certificates on One VM System
On Thu, 13 Sep 2007 15:16:25 -0500, Thomas Kern [EMAIL PROTECTED] wrote: I have used SSLSERV to transparently protect HTTP, FTP and POP servers. The applications in each of those servers know nothing about the protection that surrounds them. All were using the same certificate as the TN3270 service. I think I could have generated separate certificate requests and certificates for each service if my bosses had wanted to pay for them. In the TCPIP PROFILE, I just added the 'SECURE certname' to each port definition in t hw same manner as adding to INTCLIENT for TN3270 support. A query from an OpenSSL command on a linux/x86 system to each of the protected ports returns the same certificate. /Tom Kern /U.S. Department of Energy /301-903-2211 Thanks! But of course, I do want my web server to know something about what the protection is, and in some cases we want the client certificate inforamtion. If you define port 443 (https) as SECURE in PROFILE TCPIP, then you can use the SSL server certificates. The trick is to get z/Web to listen on 80 and 443 at the same time, treating 443 exactly as it does 80. All encryption would be handled by the SSL server. I will try that. But, no, there's no way to share the SSL server's certificate database with other guests. I don't want to share the database, I just want to put the same certificate into 2 different databases. But I don't think it can be done. (I have also asked Illustro.)
Re: Printing HTML source
On Tue, 4 Sep 2007 17:54:35 -0600, Roger Bolan [EMAIL PROTECTED] wrote: Sorry to be late noticing your post. Could the answer to your original question have been the H2S package available on the http://www.vm.ibm.com/download/packages/ site? --Roger The IBM z/VM Operating System IBMVM@LISTSERV.UARK.EDU wrote on 08/28/2007 02:06:50 AM: A short while ago I asked if there was any VM tool to convert HTML source into print format. = Charlotte can format HTML for a 3270 screen. Charlotte is avaialble from the VM Download page http://www.vm.ibm.com/download/packages/descript.cg i? CHARLOTT. Note that there is no E in CHARLOTT. I imagine the code could be modified to format for print.
Re: Multiple Certificates on One VM System
On Thursday, 09/13/2007 at 07:19 EDT, Alan Ackerman [EMAIL PROTECTED] wrote: Thanks! But of course, I do want my web server to know something about what the protection is, and in some cases we want the client certificate inforamtion. If you define port 443 (https) as SECURE in PROFILE TCPIP, then you can use the SSL server certificates. The trick is to get z/Web to listen on 80 and 443 at the same time, treating 443 exactly as it does 80. All encryption would be handled by the SSL server. I will try that. If you need to obtain information from the client certificate, then you can't use the VM SSL server. I don't want to share the database, I just want to put the same certificate into 2 different databases. But I don't think it can be done. The VM SSL server lets multiple servers use the same certificate (label). You cannot have the same certificate in multiple SSL servers unless you do a wholesale copy of the Linux disk that contains the database other files. Alan Altmark z/VM Development IBM Endicott
