Tag: User Catalog

Getting the z/OS standard image to work.

I had a lot of challenges getting the zD&T replacement (the standard image) to work. I do not know if this is the same image that every one else gets, or if mine was “a special” one. Some things did not work, somethings were not best practice.

I also wanted to use the data from my previous systems, my PDS, my Unix file systems, my keyrings etc. I also wanted to future proof migrating to the next code drop from IBM.

Summary of actions

Below is a list of the things I did to get the system up and working as I expected it to look.

I’ve grouped them by area. In the main body of the document, they are in the approximate order of execution

Problems

Customising

Before you start using it

Missing download and setting the IBMUSER password

The files on the IBM Passport Advantage site are incomplete. The documentation tells you do download the ZDTDPY volume, edit it to set the password, and boot the system. This download was not on the download site.

I had an old z/OS system I could use and so could reset the password. See Help, I cannot logon to my z/OS system

It is not difficult to write a C program to prompt for a password on the z/OS console – and have the value not displayed. See How do I enter a password on the z/OS console for my program?

I needed to configure my laptop

The IP address of z/OS is 172.26.1.2. I configured my startup script to have

#  define route from my laptop to my server
sudo ip route add 10.1.1.0/24 via 10.1.0.3

# define route from my laptop to z/OS on the server
sudo ip route add 172.26.1.0/24 via 10.1.0.3

# connect to the server 
ssh -X colin@10.1.0.3

The sample devmap is wrong, it does not provide 3270’s

The system would not IPL with a console, the output came out printer like.

I edited the devmap file:

  • add the 3270port 3270. Without this you do not get any 3270’s defined, and you get a line printer like console.
  • Change the processors to match what your server has. My dongle has support for 3 CPUs – but I can define 3-1 ZIIPs
  • Check the memory to match you configuration
  • I removed the IPL and put it in my shell script.

The top of my devmap is

[system]
processors  5 cp cp cp ziip ziip  # number of processors
memory 10G
system_name     VS01

3270port    3270            # port number for TN3270 connections

First IPL

The IPL parameters are configured to start up lots of subsystems I didn’t want to use I used

ipl DE27 parm DE28AU

Logon with userid IBMUSER and the password you configured.

Configure parmlib

The sys0.iplparm points to loadxx members. You need a load member with USER.PARMLIB in it (such as LOADAU)

  • Copy LOADAU to LOADCP
  • In LOADCP change SYSPARM to SYSPARM AU,CP
  • In user.parmlib create IEASYSCP (CP matching the CP above)
  • add your parameters, such as OMVS=(CP) for IP(V6) support

You can IPL with this

ipl DE27 parm DE28CP

If this fails to IPL, to back to parm DE28AU

Add userids

The userid IBMUSER is all powerful. I prefer using a less powerful userid.

I wanted to save my userids from the previous system. I wrote code makeRACF. With this you run a program on your old system, and specify a userid or dataset prefix. The program then generates the RACF commands to recreate the userid or resource.

Because the TSO configuration is different from the previous zD&T systems I had to configure the definitions

TSO (ACCTNUM ('ACCT001') - 
  COMMAND ('ex ''colin.zlogon.clist''') - 
  PROC (PROC001 ) - 
  SIZE (2096128) - 
  MAXSIZE (2096128) - 
  USERDATA (0000) - 
  UNIT (3390))

I created some definitions to my userid COLIN access to resources on the new system

ALTUSER COLIN SPECIAL AUDITOR OPERATIONS                             
ALTUSER COLIN DFLTGRP(SYS1)                                          
ALTUSER COLIN tso( ACCTNUM('ACCT001')    -                           
     CoMMAND('ISPF') PROC(PROC001  ) -                               
     SIZE(2096128) MAXSIZE(2096128) USERDATA(0000) UNIT(SYSDA))      
permit ACCT001 class(ACCTNUM) id(COLIN    ) access(READ     )        
permit ACCT#   class(ACCTNUM) id(COLIN    ) access(READ     )        
permit JCL     class(TSOAUTH)id(COLIN) access(REAd)                  
permit CONSOLE class(TSOAUTH)id(COLIN) access(REAd)                  
permit PROC001 class(TSOPROC)id(COLIN) access(REAd)                  
permit ISPFPROC  class(TSOPROC)id(COLIN) access(REAd)                
setropts raclist(TSOAUTH) refresh                                    
setropts raclist(ACCTNUM) refresh                                    
setropts raclist(TSOPROC) refresh                                    
PERMIT  *.**  CLASS(JESSPOOL) ID(COLIN) ACCESS(ALTER)                
SETR RACLIST(JESSPOOL) REFRESH

I created JCL for these definitions, so for system refreshes, I just rerun the jobs.

I did not use the UNIX facility to allocate a (random) UID. I specified the UID I had before.

On the ZFS with my files, I needed the uid of the file owner to be the same as my users uid. If z/OS allocated me a uid, I would not be able to access my files. I would then have to go through and change the owner of them.

I recreated userids COLIN and START1.

You need to see what groups the userids belonged to, and you may need to recreate the groups, or just us what are already defined.

Import user catalogs

I have user catalogs for all of my data sets. These catalogs need to be imported into the master catalog

//IBMUSERT JOB 1,MSGCLASS=H                                           
//S1  EXEC PGM=IDCAMS,REGION=0M                                       
//SYSPRINT DD SYSOUT=*                                                
//SYSIN DD *                                      
   IMPORT CONNECT -                                                   
      OBJECTS -                                                       
        (('A4USR1.ICFCAT' VOLUME(A4USR1) DEVICETYPE(3390)  -          
        ))                                                            
/*

How do you find out what user catalogs you have?

On the old system.

//IBMUSERT JOB 1,MSGCLASS=H                               
//S1  EXEC PGM=IDCAMS,REGION=0M                           
//SYSPRINT DD SYSOUT=*                                    
//DD1  DD DISP=SHR,VOL=SER=D5SYS1,UNIT=3390
//SYSIN DD *                                             
 LISTCAT CATALOG(CATALOG.Z31B.MASTER) USERCATALOG ALL FILE(DD1)                                           
/*

or 

//IBMUSERT JOB 1,MSGCLASS=H                               
//S1  EXEC PGM=IDCAMS,REGION=0M                           
//SYSPRINT DD SYSOUT=*                                    
//SYSIN DD *                                              
  LISTCAT     USERCATALOG  ALL                            
/*

The ALL Parameter also lists the Aliases using the user catalog.

Define aliases to map high level qualifier to a user catalog.

Once you have imported the catalogs you can define the data set aliases

//IBMUSERT JOB 1,MSGCLASS=H                                     
//S1  EXEC PGM=IDCAMS,REGION=0M                                 
//SYSPRINT DD SYSOUT=*                                          
//SYSIN DD *                                                    
   DEFINE ALIAS (NAME(BACKUP) RELATE('A4USR1.ICFCAT') )         
   DEFINE ALIAS (NAME(COLIN ) RELATE('A4USR1.ICFCAT') )         
/*

What aliases do I have?

//IBMUSERT JOB 1,MSGCLASS=H                                         
//S1  EXEC PGM=IDCAMS,REGION=0M                                     
//SYSPRINT DD SYSOUT=*    
//SYSIN DD *                                                        
 LISTCAT  ALIAS                                                     
/*

Define user directories

For each file system, and each user, they need a directory defined. The standard image uses automount to create a ZFS for each entry in /u. If my RACF profile says my home directory is /u/colin, it will create a ZFS for this. If /u/colin already existed, it will not be used.

I created entries in /usr. If you try to make a directory, it may fail because /usr is mounted read only.

From userid IBMUSER to into Unix ( TSO OMVS)

  • mkdir /usr/colin
  • If this fails use
    • chmount -w /usr … do your work … chmount -r /usr
  • mkdir /usr/tmp
  • mkdir /usr/tmp/zowet
  • mkdir /usr/tmp/zowet/colin Userid COLIN has HOME= /usr/tmp/zowet/colin
  • You may need to change the ownership of the directory
    • chown -R colin:sys1 mkdir /usr/tmp/zowet/colin
  • If you need to…
    • chmount -r /usr

Mount the ZFS

Once I had imported the catalogs, and defined the aliases I could try to mount my ZFS

I created USER.PARMLIB(BPXPRMUS) and added

MOUNT FILESYSTEM('COLIN.ZFS.ZOWE.TEMP') TYPE(ZFS) 
    MOUNTPOINT('/usr/tmp/zowet') MODE(RDWR) 
    PARM('AGGRGROW') AUTOMOVE 
                                                               
MOUNT FILESYSTEM('COLIN.ZOPEN.ZFS') TYPE(ZFS) 
   MOUNTPOINT('/usr/zopen') MODE(RDWR) 
   PARM('AGGRGROW') AUTOMOVE

The activate using the operator command

T OMVS=(US)

I was then able to logon to my newly created userid COLIN, and go into z/OS Unix.

Configure VTAM to give you greater than 80 *24 screen size

VTAM configuration

  • Edit SYS1.VTAMLST(EXLOCAL). You have to edit this because NET does not have USER.VTAMLST configured.
  • Create EXLOCALO from it (for backup)
  • change DLOGMOD to have value D4B32XX3,
  • create an entry for CUADDR=061,

Clean up

  • Edit SYS1.VTAMLST(ATCCON00). Remove IVPLCLI,IVPLCLT because the devices they reference do not exist.

If your changes to EXLOCAL do not work, use

V NET,ACT,ID=EXLOCALO

TCPIP

The provided TCPIP procedure creates certificates etc and does other work. It creates a new CA certificate, I need to export it, and sent it to my machines which connect in, and to all my keyrings.

I want to use the set up I have, so my TCPIP V6 Procedure is

USER.PROCLIB(TCPIP)

//TCPIP    PROC PARMS='CTRACE(CTIEZB00)' 
//TCPIP    EXEC PGM=EZBTCPIP,PARM='&PARMS',REGION=0M,TIME=1440 
//SYSPRINT DD  SYSOUT=* 
//SYSERR   DD  SYSOUT=* 
//SYSERROR DD  SYSOUT=* 
//ERRORFIL DD  SYSOUT=* 
//SYSDEBUG DD  SYSOUT=* 
//PROFILE  DD  DISP=SHR,DSN=USER.TCPPARMS(PROFILE) 
//SYSTCPD  DD  DISP=SHR,DSN=TCPIP.TCPPARMS(TCPDATA)

Support TCPIP V6

The TCPIP as shipped does not support IP V6. You need to create a BPXPRMxx member and activate it

You need a BPXPRMv6 member in user.parmlib

FILESYSTYPE TYPE(CINET) 
     ENTRYPOINT(BPXTCINT) 
SUBFILESYSTYPE NAME(TCPIP) 
       TYPE(CINET) 
    ENTRYPOINT(EZBPFINI) 
    DEFAULT 
NETWORK DOMAINNAME(AF_INET6) 
        DOMAINNUMBER(19) 
        MAXSOCKETS(50000) 
        TYPE(CINET)

In USER.PARMLIB(IEASYSXX) use BPX=(V6).

In USER.TCPPARMS(PROFILE) I have

...
DATASETPREFIX TCPIP 
                                    
TCPCONFIG TTLS 
INCLUDE USER.TCPPARMS(IPV6) 
                                    
...

and the IPV6 member has

IPCONFIG6 MULTIPATH

TCPIP Resolver

See Why is the wrong TCPIP Resolver proc being used?

Create USER.PROCLIB(RESOLVER)

//* TCPIP RESOLVER - COLINS 
//* 
//RESOLVER PROC PARMS=CTRACE(CTIRES00) 
//* 
//EZBREINI EXEC PGM=EZBREINI,REGION=0M,TIME=1440, 
// PARM=('&PARMS', 
// 'ENVAR("RESOLVER_TRACE=/var/log/resolver"/')
//SETUP DD DISP=SHR,DSN=COLIN.TCPPARMS(GBLRESOL),FREE=CLOSE 
//SYSTCPT   DD SYSOUT=* 
//SYSPRINT  DD SYSOUT=* 
//SYSOUT     DD SYSOUT=* 
//*

Create COLIN.TCPPARMS(GBLRESOL) with

Copy

  DEFAULTTCPIPDATA('COLIN.TCPPARMS(GBLTDATA)') 
  GLOBALTCPIPDATA('COLIN.TCPPARMS(RESOLVE)') 
# GLOBALTCPIPDATA(/etc/resolv.conf) 
; 
# ----------------------------------------------------------------- 
# Default zPDT Linux Base to z/OS Tunnel (Stand-Alone) 
# ----------------------------------------------------------------- 
; 
# GLOBALIPNODES(/etc/hosts) 
  GLOBALIPNODES('COLIN.TCPPARMS(HOSTS)') 
....

Change the operator console PFKeys (to add the shutdown command)

See How do I change the PFKeys on the console?

Copy SYS1.PARMLIB(PFKTAB00) to USER.PARMLIB

  • Change PF12 to be PFK(12) CMD(“%NETV SHUTSYS”) CON(Y)
  • Change any other keys you fancy.

Fix SMF

Message HSF0066W

I was getting

HSF0066W Required exit IEFU86 for SMF subsystem SYS not enabled. Some data may be missing in SDSF event log.

Copy SYS1.PARMLIB(SMFPRM00) to USER.PARMLIB(SMFPRM00) add IEFU86

SYS(EXITS(IEFACTRT,IEFUJI,IEFU83,IEFU84,IEFU85,IEFUJV,IEFU86)), 
SUBSYS(STC,EXITS(IEFU83,IEFU84,IEFU85,IEFU29,IEFU86),
INTERVAL(SMF,SYNC))

Message IEE391A

IEE391A SMF ENTER DUMP FOR DATA SET ON VOLSER OPEVS1 DSN=SYS1.VS01.MAN1

Create in USER.PROCLIUB(SMFCLEAR)

//SMFCLEAR PROC MAN='SYS1.VS01.MAN1' 
//* 
//* CLEAR SMF DATASET - 
//* SMF MAN DATASET DUMPED REQUIRED MESSAGE RECIEVED 
//* OR ISSUE SWITCH, I SMF, THEN THAT FILE WILL BE CLEARED 
//* 
//* 
//DUMP1   EXEC PGM=IFASMFDP,REGION=1M 
//INDD1    DD  DSN=&MAN,DISP=SHR 
//DUMPOUT  DD  DUMMY 
//SYSPRINT DD  SYSOUT=D 
//SYSIN    DD  * 
    INDD(INDD1,OPTIONS(CLEAR))

Then you can use either of

S SMFCLEAR
S SMFCLEAR,MAN='SYS1.VS01.MAN2'

SETSMF command not enabled

I could not issue

setsmf recording(logstream)
setsmf recording(dataset)

setsmf recording(logstream)

commands, to be able to change the SMF LOGSTREAM.

I created USER.PARMLIB(SMFPRM00) from SYS1.PARMLIB and added AUTHSETSMF – it defaults to NONE.

...
DEFAULTLSNAME(IFASMF.VS01.DATA) 
AUTHSETSMF 
NOPROMPT, 
REC(PERM), 
,,,

Configure SYSLOGD

Define the started task

//IBMUSERT JOB 1,MSGCLASS=H 
//S1  EXEC PGM=IKJEFT01,REGION=0M 
//SYSPRINT DD SYSOUT=* 
//SYSTSPRT DD SYSOUT=* 
//SYSTSIN  DD * 
  RDEFINE STARTED SYSLOGD.* STDATA(USER(IBMUSER)) 
  SETR RACLIST(STARTED) REFRESH

SYSLOGD is used by many Unix processes for recording errors and other information.

Create USER.PROCLIB(SYSLOGD)

//SYSLOGD PROC 
//*     Licensed Materials - Property of IBM                          * 
//*     "Restricted Materials of IBM"                                 * 
//*     5650-ZOS                                                      * 
//*     Copyright IBM Corp. 1992, 2013                                * 
//* Read parms from /etc/syslog.conf 
//CONFHFS EXEC PGM=SYSLOGD,REGION=4096K,TIME=NOLIMIT, 
//         PARM='ENVAR(''CEE_ENVFILE_S=DD:STDENV'')/-c -i       ' 
//STDENV   DD DISP=SHR,DSN=USER.PROCLIB(SYSLOGDD) 
//SYSPRINT DD SYSOUT=* 
//SYSIN    DD DUMMY 
//SYSERR   DD SYSOUT=* 
//SYSOUT   DD SYSOUT=* 
//CEEDUMP  DD SYSOUT=*

Create USER.PROCLIB(SYSLOGDD)

I have

*.INETD*.*.*       /var/log/inetd.log 
auth.* /var/log/auth.log 
mail.* /var/log//mail -F 640 -D 770 
local1.err       /var/log/local1.log 
*.err            /var/log/errors.log 
# *.CPAGENT.*.*       /var/log/CPAGENT.log 
*.CPATTLS.*.*       /var/log/CPATTLS 
*.TTLS*.*.*          /var/log/TTLS.log 
*.Pagent.*.*        /var/log/Pagent.log 
*.TCPIP.*.debug     /var/log/TCPIPdebug.log 
*.TCPIP.*.warning   /var/log/TCPIP.log 
*.TCPIP.*.err       /var/log/TCPIPerr.log 
*.TCPIP.*.info      /var/log/TCPIPinfo.log 
*.SYSLOGD*.*.*      /var/log/syslogd.log 
*.TN3270*.*.*       /var/log/tn3270.log 
*.SSHD*.*.*         /var/log/SSHD.log 
*.FTPD*.*.*         /var/log/FTPD.log 
daemon.debug        /var/log/SSHDdebug.log 
*.TCPIP.*.none; 
*.err            /var/log/errors 
*.CPAGENT.*.*       /var/log/CPAGENT.log 
*.TRMD1.*.info      /var/log/TRMD1I.log 
*.DMD.*.*           /var/log/DMD.log

You can use this as a basis and change it as needed.

Configure SSHD

The SSHD procedure in SYS1.PROCLIB, invokes a shell script which then spawns the SSHD code with a name like SSHD.

I use

//SSHD    PROC 
//SSHD    EXEC PGM=BPXBATCH,REGION=0M,TIME=NOLIMIT, 
//             PARM='PGM /usr/sbin/sshd -f /etc/ssh/sshd_config ' 
//*            PARM='PGM /bin/sh -c /etc/ssh/sshd.sh' 
//* STDIN AND STDOUT ARE BOTH DEFAULTED TO /dev/null 
//STDERR DD PATH='/tmp/sshd.stderr',PATHOPTS=(OWRONLY,OCREAT,OAPPEND), 
//         PATHMODE=(SIRWXU) 
//STDOUT DD PATH='/tmp/sshd.stdout',PATHOPTS=(OWRONLY,OCREAT,OAPPEND), 
//         PATHMODE=(SIRWXU)

Note that SSHD uses the /etc/ssh/sshd_config directory. You should back this up regulary. When IBM replaces the image this would be replace

After thought, I could always use -f /usr/colin/ssh/

Edit the configuration file and add either userids or groups.

# Allow specific user IDs 
AllowUsers IBMUSER  COLIN 
AllowGroups SYS1 IZUADMIN

If you add groups and not userids, you need to connect the userid to a group.

RACF changes

You can issue some racf commands on the z/OS console for example

<RVARY

To change this character (<) copy SYS1.PARMLIB(IEFSSN00) to USER.PARMLIB(IEFSSN01) and change the entry for RACF.

Define IXGLOGR as a started task to eliminate security messages

//IBMIXL  JOB 1,MSGCLASS=H 
//STEPNAME EXEC PGM=IKJEFT01 
//SYSPRINT DD SYSOUT=* 
//SYSTSPRT DD SYSOUT=* 
//SYSTSIN DD  * 
* IXGLOGR  EXISTS AS A GROUP - IT REALLY SHOULD BE A USERID 
ADDUSER IXGLUSER 
CONNECT  IXGLUSER GROUP(IXGLOGR) 
RDEFINE STARTED IXGLOGR.* STDATA(USER(IXGLUSER) + 
     PRIVILEGED(YES) TRUSTED(YES) GROUP(IXGLOGR )) 
SETROPTS RACLIST(STARTED) REFRESH 
/*

Add missing groups

To protect datasets such as SYS1.*, the high level qualifier should be defined as a group. I have JCL ADDGROUP

//IBMKEY2 JOB 1,MSGCLASS=H 
//STEPNAME EXEC PGM=IKJEFT01 
//SYSTSIN DD  * 
ADDGROUP SYS1 
ADDGROUP ADCD 
ADDGROUP AOK 
ADDGROUP AOP 
ADDGROUP AZD 
ADDGROUP BBL 
ADDGROUP CATALOG 
ADDGROUP CBC 
ADDGROUP CEE 
ADDGROUP CFZ 
ADDGROUP CNJ 
ADDGROUP COUPLE 
ADDGROUP CSD 
ADDGROUP CSF 
ADDGROUP CSQARC1 
ADDGROUP CSQARC2 
ADDGROUP EUVF 
ADDGROUP FEU 
ADDGROUP FEU1 
ADDGROUP FFST 
ADDGROUP GDDM 
ADDGROUP GIM 
ADDGROUP GLD 
ADDGROUP GSK 
ADDGROUP GTFNO 
ADDGROUP GTFRACF 
ADDGROUP HAP 
ADDGROUP HLA 
*DDGROUP IBMUSER 
ADDGROUP ICQ 
ADDGROUP IOE 
ADDGROUP ISF
ADDGROUP ISP 
ADDGROUP IXGLOGR 
ADDGROUP IZU 
ADDGROUP IZUSVR 
ADDGROUP NETVIEW 
ADDGROUP NFS 
ADDGROUP SMPE 
ADDGROUP STCJMON 
ADDGROUP SYT1 
ADDGROUP TCPIP 
ADDGROUP USER 
ADDGROUP ZFS 
//SYSPRINT DD SYSOUT=* 
//SYSTSPRT DD SYSOUT=* g

Protect system data sets

You should define profiles for all datasets. I had a a member ADDSD.

//IBMKEY2 JOB 1,MSGCLASS=H 
//STEPNAME EXEC PGM=IKJEFT01 
//SYSTSIN DD  * 
ADDSD 'SYS1.**' GENERIC UACC(READ)  WARNING 
PERMIT 'SYS1.**' ACCESS(ALTER) ID(SYS1) 
ADDSD 'ADCD.**' GENERIC UACC(READ)  WARNING 
ADDSD 'AOK.**' GENERIC UACC(READ)  WARNING 
ADDSD 'AOP.**' GENERIC UACC(READ)  WARNING 
ADDSD 'AZD.**' GENERIC UACC(READ)  WARNING 
ADDSD 'BBL.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CATALOG.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CBC.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CEE.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CFZ.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CNJ.**' GENERIC UACC(READ)  WARNING 
ADDSD 'COUPLE.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CSD.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CSF.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CSQARC1.**' GENERIC UACC(READ)  WARNING 
ADDSD 'CSQARC2.**' GENERIC UACC(READ)  WARNING 
ADDSD 'EUVF.**' GENERIC UACC(READ)  WARNING 
ADDSD 'FEU.**' GENERIC UACC(READ)  WARNING 
ADDSD 'FEU1.**' GENERIC UACC(READ)  WARNING 
ADDSD 'FFST.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GDDM.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GIM.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GLD.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GSK.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GTFNO.**' GENERIC UACC(READ)  WARNING 
ADDSD 'GTFRACF.**' GENERIC UACC(READ)  WARNING 
ADDSD 'HAP.**' GENERIC UACC(READ)  WARNING 
ADDSD 'HLA.**' GENERIC UACC(READ)  WARNING 
ADDSD 'IBMUSER.**' GENERIC UACC(READ)  WARNING 
ADDSD 'ICQ.**' GENERIC UACC(READ)  WARNING 
ADDSD 'IOE.**' GENERIC UACC(READ)  WARNING 
ADDSD 'ISF.**' GENERIC UACC(READ)  WARNING 
ADDSD 'ISP.**' GENERIC UACC(READ)  WARNING 
ADDSD 'IXGLOGR.**' GENERIC UACC(READ)  WARNING 
ADDSD 'IZU.**' GENERIC UACC(READ)  WARNING 
ADDSD 'IZUSVR.**' GENERIC UACC(READ)  WARNING 
ADDSD 'NETVIEW.**' GENERIC UACC(READ)  WARNING 
ADDSD 'NFS.**' GENERIC UACC(READ)  WARNING 
ADDSD 'SMPE.**' GENERIC UACC(READ)  WARNING 
ADDSD 'STCJMON.**' GENERIC UACC(READ)  WARNING 
ADDSD 'SYT1.**' GENERIC UACC(READ)  WARNING 
ADDSD 'TCPIP.**' GENERIC UACC(READ)  WARNING 
ADDSD 'USER.**' GENERIC UACC(READ)  WARNING 
ADDSD 'ZFS.**' GENERIC UACC(READ)  WARNING 
PERMIT 'ADCD.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'AOK.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'AOP.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'AZD.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'BBL.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CATALOG.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CBC.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CEE.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CFZ.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CNJ.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'COUPLE.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CSD.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CSF.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CSQARC1.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'CSQARC2.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'EUVF.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'FEU.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'FEU1.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'FFST.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GDDM.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GIM.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GLD.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GSK.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GTFNO.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'GTFRACF.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'HAP.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'HLA.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'IBMUSER.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'ICQ.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'IOE.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'ISF.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'ISP.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'IXGLOGR.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'IZU.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'IZUSVR.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'NETVIEW.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'NFS.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'SMPE.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'STCJMON.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'SYT1.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'TCPIP.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'USER.**' ACCESS(ALTER) ID(SYS1) 
PERMIT 'ZFS.**' ACCESS(ALTER) ID(SYS1) 
//SYSPRINT DD SYSOUT=* 
//SYSTSPRT DD SYSOUT=*

You should have started tasks defined

Started tasks should be defined, so end users cannot just create a Started Task, and run it as an authorised task.

Define a default

//IBMKEY2 JOB 1,MSGCLASS=H 
//STEPNAME EXEC PGM=IKJEFT01 
//SYSTSIN DD  * 
RDEFINE STARTED *.* OWNER(IBMUSER) + 
   DATA('GENERIC DEFINITION - COLIN')  + 
   STDATA( USER(=MEMBER) 
SETROPTS RACLIST(STARTED) REFRESH

Export certificates and keyrings

I have member EXPRING. this runs the LRING Rexx which creates a data set containing certificates used by the userid. They are stored in &USERID..CERTS.START1

//IBMKEYR JOB 1,MSGCLASS=H 
//STEPNAME EXEC PGM=IKJEFT01,PARM='LRING START1',REGION=0M 
//SYSPRINT DD SYSOUT=* 
//SYSEXEC DD DISP=SHR,DSN=USER.Z31B.CLIST 
//SYSTSPRT DD SYSOUT=* 
//SYSTSIN DD  DUMMY

Import certificates and keyrings

Use the Rexx program to export certificates from your old system, and import them into the new system.

Import

//IBMKEYR JOB 1,MSGCLASS=H
//STEPNAME EXEC PGM=IKJEFT01,PARM='IRING COLIN.CERTS.START1',
// REGION=0M
//SYSPRINT DD SYSOUT=*
//SYSEXEC DD DISP=SHR,DSN=USER.Z31B.CLIST,UNIT=3390,VOL=SER=B3CFG1
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD DUMMY

RRS Error messages

At the start up of RRS I got

ATR132I RRS LOGSTREAM CONNECT HAS FAILED FOR
– OPTIONAL LOGSTREAM ATR.VS01.ARCHIVE.
– RC=00000008, RSN=0000080B

See here

Issue the operator command

SETRRS ARCHIVELOGGING,DISABLE

ICSF

ICSF

I have my own (I)CSF data sets, containing my keys. My Started Task JCL is the same as the default, but with a different member

//CSF  PROC PRM=CP 
//CSF  EXEC PGM=CSFINIT,PARM=&PRM,REGION=0M,TIME=1440,MEMLIMIT=NOLIMIT

You could use the provided JCL, then stop and restart CSF

P CSF
S CSF,PRM=CP

The PARM=CP points to a member CSFPRMCP in USER.PARMLIB. Mine has

CKDSN(COLIN.SCSFCKDS) 
PKDSN(COLIN.SCSFPKDS) 
TKDSN(COLIN.SCSFTKDS) qq
DOMAIN(0) 
SSM(YES) 
KEYARCHMSG(YES)

If this member does not exist you get an abend

IEF764I CSF CSF IEFPARM CSFMIOPD HCR77F0 PARMLIB READ FAILED - MEMBER CSFPRMCP NOT FOUND.        
CSFO0016 ERROR OCCURRED OPENING OPTIONS FILE. MEMBER CSFPRMCP IN DDNAME IEFPARM RC=12 RS=1.      
...                                                          
DUMP TITLE=COMPON=CSF...ABEND=S018F,REASON=0000001B

Logrec EREP

When LOGREC fills up, you get a retained message on the console.

You can print the contents of the EREP file using

//PRINTLOG JOB (ACCT),'PRINT LOGREC',CLASS=A,MSGCLASS=H           
//STEP     EXEC PGM=IFCEREP1,PARM='CARD' 
//SERLOG   DD DISP=SHR,DSN=VSPROV.VS01.LOGREC 
//DIRECTWK DD UNIT=SYSDA,SPACE=(CYL,10,,CONTIG) 
//EREPPT   DD SYSOUT=A,DCB=BLKSIZE=133 
//TOURIST  DD SYSOUT=A,DCB=BLKSIZE=133 
//ZERLOG   DD SYSOUT=A,DCB=BLKSIZE=133 
//SYSIN DD * 
PRINT=PS 
ACC=N 
ZERO=Y 
ENDPARM 
/*

and clear it using a procedure in USER.PROCLIB(CLLOGREC)

//CLLOGREC  PROC 
//STEP1     EXEC PGM=IFCDIP00 
//SERERDS   DD DISP=OLD,DSN=VSPROV.VS01.LOGREC, 
//          UNIT=3390,VOL=SER=OPEVS1

and the started task definition in STLOGREC

//IBMUSERT JOB 1,MSGCLASS=H 
//S1  EXEC PGM=IKJEFT01,REGION=0M 
//SYSPRINT DD SYSOUT=* 
//SYSTSPRT DD SYSOUT=* 
//SYSTSIN  DD * 
  RDEFINE STARTED CLLOGREC.* STDATA(USER(IBMUSER))
  RDEFINE STARTED PRLOGREC.* STDATA(USER(IBMUSER))  
  SETR RACLIST(STARTED) REFRESH

JAVA message and SMFLIM

I was getting messages

JVMJ9VM015W Initialization error for library j9shr29(11): JVMJ9VM009E J9VMDllMain failed
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.

See JVMJ9VM015W Initialization error for library j9shr29(11): JVMJ9VM009E J9VMDllMain failed

I created USER.PARMLIB(SMFLIM00) with

REGION JOBNAME(JCACHER) JOBMSG(ISSUE) MAXSHARE(80000)

SMF logstream data sets are too small

Im getting message allocating data sets like IXGLOGR.IFASMF.VS01.DATA… every couple of minutes.

The log stream is define with

LOGSTREAM NAME(IFASMF.VS01.DATA) STRUCTNAME() LS_DATACLAS()
LS_MGMTCLAS() LS_STORCLAS() HLQ(IXGLOGR) MODEL(NO) LS_SIZE(500)
STG_MGMTCLAS() STG_STORCLAS() STG_DATACLAS() STG_SIZE(500)
LOWOFFLOAD(0) HIGHOFFLOAD(80) STG_DUPLEX(YES) DUPLEXMODE(UNCOND)
RMNAME() DESCRIPTION() RETPD(2) AUTODELETE(YES) OFFLOADRECALL(YES)
DASDONLY(YES) DIAG(NO) LOGGERDUPLEX() EHLQ(NO_EHLQ) GROUP()
MAXBUFSIZE(65532)

Where LS_SIZE(500) is 45 tracks.

I used JCL

//IBMLOG JOB 1,MSGCLASS=H                                   
//LOGDEF EXEC PGM=IXCMIAPU,REGION=4M                        
//SYSPRINT DD SYSOUT=*                                      
//SYSIN DD *                                                
DATA TYPE(LOGR) REPORT(YES)                                 
UPDATE LOGSTREAM NAME(IFASMF.VS01.DATA)                     
                   LS_SIZE(15000)                           
/*

I could not run this, because the log stream was in use.

I had to create an USER.PARMLIB(SMFPRMNO) with

ACTIVE, 
DSNAME(SYS1.VS01.MAN1, 
       SYS1.VS01.MAN2), 
RECORDING(DATASET) 
DEFAULTLSNAME(IFASMF.VS01.DATA) 
...

Then use

T SMF=NO

The run the command to update the logstream

and then switch back

T SMF=00

What’s next?

That’s as far as I’ve got. As I do more I’ll update this document.

Keeping people out of the master catalog.

I had written Here’s another nice mess I’ve gotten into! My master catalog is full of junk which describes what I did once I found my master catalog was full of stuff which should not be there.

I’ve now got round to finding out how to stop people from putting rubbish there in the first place!

See One minute mvs: catalogs and datasets for an introduction to master and user catalogs.

The master catalog should have some system datasets, aliases, and not much else.

An alias says for this high level qualifier (COLIN) go to the usercatalog(‘USER.COLIN.CATALOG).

A catalog is a dataset, and you can use a RACF profile to protect it, so only authorised people can update it. Typically, when you define a userid or a high level qualifier, you should also define an alias for that userid (or HLQ), pointing to a user catalog.

To keep user data out of the master catalog you need

  • one or more user catalogs – for example do you give each user their own catalog, have one per deparment, or one for all users. These catalogs are typically defined by storage administrators (or automation set up by storage administrators).
  • an alias for each userid and the name of the catalog that userid should use. These aliases are set up by people (or automation) which defines userids.
  • an alias for each dataset High Level Qualifier (HLQ) and the name of the catalog that the HLQ should use. These aliases are set up by people (or automation) which defines the high level qualifiers. An example HLQ is CEE, or DB2.

If you migrate to a system with a new master catalog (for example with zPDT or zD&T), you will need to import the usercatalogs into the master catalog, and redefine the aliases.

Import a user catalog

When I tried to import a user catalog into the master catalog, I got

 ICH408I USER(COLIN   ) GROUP(TEST    ) NAME(CCPAICE             ) 
   CATALOG.Z31B.MASTER CL(DATASET ) VOL(B3SYS1)                    
   INSUFFICIENT ACCESS AUTHORITY                                   
   FROM CATALOG.Z31B.* (G)                                         
   ACCESS INTENT(UPDATE )  ACCESS ALLOWED(READ   )

so any userid importing or exporting a catalog needs update access to the catalog.

Defining and deleting an alias

Having set up RACF profiles, and given my userid COLIN only READ access to the master catalog, I found my userid could still define and delete aliases. It took a couple of days to find out why.

  • If a userid has ALTER access to CLASS(FACILITY) STGADMIN.IGG.DEFDEL.UALIAS the userid can define and delete ALIAS profiles. This overrides dataset access checks.
  • If a userid does not have ALTER access to the profile, then normal dataset checks are made.

What I learned…

  • My userid had “special”. As the documentation says The RACF SPECIAL attribute allows you to update any profile in the RACF database. This meant I could display and update any profile.
  • There is a profile class(facility) STGADMIN.IGG.DEFDEL.UALIAS which allows you to define and delete user aliases in the (master) catalog
  • If my userid had SPECIAL, or the userid was in group SYS1 I could issue the command

rlist facility STGADMIN.IGG.DEFDEL.UALIAS

and it gave

CLASS      NAME
-----      ----
FACILITY   STGADMIN.IGG.* (G)
LEVEL  OWNER      UNIVERSAL ACCESS  YOUR ACCESS  WARNING
-----  --------   ----------------  -----------  -------
 00    IBMUSER         NONE              ALTER    NO
 
USER      ACCESS
----      ------
SYS1      ALTER
IBMUSER   ALTER

If my userid did not have special and was not in SYS1, I got 

ICH13002I NOT AUTHORIZED TO LIST STGADMIN.IGG.*

When my userid was connected to the group SYS1, it got the ALTER access to the profile, and overrode the RACF profiles for the catalog data set.

Which is my master catalog?

At IPL, it reports

IEA370I MASTER CATALOG SELECTED IS CATALOG.Z31B.MASTER

You can use the operator command D IPLINFO

SYSTEM IPLED AT 07.26.58 ON 01/02/2026                                              
RELEASE z/OS 03.01.00    LICENSE = z/OS                                             
USED LOADCP IN SYS1.IPLPARM ON 00ADF

My load parm member, SYS1.IPLPARM(LOADCP) has

IODF     99 SYS1 
INITSQA  0000M 0008M 
SYSCAT   B3SYS1113CCATALOG.Z31B.MASTER 
SYSPARM  CP 
IEASYM   (00,CP)

The catalog is called CATALOG.Z31B.MASTER and is on volume B3SYS1

Does a RACF profile exist?

See What RACF profile is used for a data set?

tso listdsd dataset(‘CATALOG.Z31B.MASTER’)
tso listdsd dataset(‘CATALOG.Z31B.MASTER’) generic

Showed there was no profile defined.

Create the profile

* DELDSD  'CATALOG.Z31B.*'                                   
ADDSD  'CATALOG.Z31B.*' UACC(READ)                         
PERMIT 'CATALOG.Z31B.*' ID(IBMUSER ) ACCESS(CONTROL)       
PERMIT 'CATALOG.Z31B.*' ID(COLIN   ) ACCESS(READ   )

When I tried to use the master catalog from a general userid the request failed.

DELETE TEST  ALIAS                                                                                                 
IDC3018I SECURITY VERIFICATION FAILED+                                                                               
IDC3009I ** VSAM CATALOG RETURN CODE IS 56 - REASON CODE IS IGG0CLFT-6                                               
IDC0551I ** ENTRY COLIN.TEST NOT DELETED                                                                             
IDC0014I LASTCC=8

Hmm that’s strange

With userid COLIN, I could still issue commands, such as DELETE TEST ALIAS, even though I had given it only read access.
If I displayed the profile from userid COLIN it had

 INFORMATION FOR DATASET CATALOG.Z31B.* (G)
  
 LEVEL  OWNER    UNIVERSAL ACCESS   WARNING   ERASE
 -----  -------- ----------------   -------   -----
  00    COLIN           READ          NO      NO
 YOUR ACCESS  CREATION GROUP  DATASET TYPE
 -----------  --------------  ------------
     READ        SYS1           NON-VSAM

This had me confused for several hours. That’s when I found out about the presence of the STGADMIN.IGG.DEFDEL.UALIAS profile.

Summary

You want users (non system) datasets to be in a user catalog, rather than the master catalog. This makes migrating to a new master catalog much easier, You just have to import the catalogs, and redefine the aliases.

You need to set up

  • one (or more) user catalogs
  • aliases to connect the userid (and High Level Qualifiers) to a catalog
  • give authorised used alter access to class(facility) STGADMIN.IGG.DEFDEL.UALIAS to allow them to maintain aliases.
  • define a RACF profile for the master catalog and make the UACC(READ).
  • for those people who need to need to define, import or export catalogs, they need update access to the master catalog dataset.