Discussion:
racf and tso
fausap72
2005-02-08 19:04:38 UTC
Permalink
Hello all,

i have a strange problem with RACF and TSO, running z/OS v1.4
I created a user in RACF with some TSO parameters setup. I also
created a new account number, but when I try to submit a JCL job with
that user I am not authorized.

The strange thing is that if I run account from IBMUSER TSO session
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?

So I tried to add a new TSO user with the ADD command giving him the
JCL OPER ACCNT grants, but when I logon with this user I have still no
auth to submit jobs or run OPER command.

Please, what's the problem?

thanks a lot...






------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Enrico Sorichetti
2005-02-08 19:54:54 UTC
Permalink
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER TSO session
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to use the uads to
store the userids, but use the racf database
if I remeber well the TSO account command works on the "sys1.uads"
which should contain only some emergency userids to be used when
the RACF datasets are not available

with racf active account oper jcl are governed by facility profiles
and data in the TSO segment ( from reminiscences of os 2.9 )

where is the doc on how to define new userids not necessarily tso
related
depends on Your os disrtibution and installation material/methodology







------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-08 21:22:18 UTC
Permalink
Hi Enrico,

thanks for the reply.
I supposed such disjoining between TSO and RACF, but how can I setup a
user in RACF that has JCL OPER ACCT grants in TSO?
I also checked in TSO part of RACF, but there's no mention about those
grants.

regards,
fausto
Post by Enrico Sorichetti
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER TSO session
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to use the uads to
store the userids, but use the racf database
if I remeber well the TSO account command works on the "sys1.uads"
which should contain only some emergency userids to be used when
the RACF datasets are not available
with racf active account oper jcl are governed by facility profiles
and data in the TSO segment ( from reminiscences of os 2.9 )
where is the doc on how to define new userids not necessarily tso
related
depends on Your os disrtibution and installation material/methodology
------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
STYMA, ROBERT E (ROBERT)
2005-02-08 22:02:47 UTC
Permalink
Here is the JCL I use for adding users to our RACF system.
Hope this provides some useful information.

//QC22505A JOB (),'DEFINE USER',
// NOTIFY=&SYSUID,
// MSGLEVEL=1,
// MSGCLASS=Y,
// CLASS=K
//*
//*--------------------------------------------------------------------
//* Define User to RACF
//* (Note: Be careful when updating this JCL)
//* (Note: Some of the text needs to be in lower case)
//*
//* Change "USERID" to the new userid
//* Change "UserName" to the name of the user
//* The initial password will be "password"
//*
//*--------------------------------------------------------------------
//STEP1 EXEC PGM=IKJEFT01,DYNAMNBR=75
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTERM DD DUMMY
//SYSUADS DD DSN=SYS1.UADS,DISP=SHR
//SYSLBC DD DSN=SYS1.BRODCAST,DISP=SHR
//SYSTSIN DD *
ADDUSER USERID NAME('UserName') +
PASSWORD(PASSWORD) +
DFLTGRP(PD) UACC(READ) +
UACC(READ) +
TSO(ACCTNUM(ACCT#) PROC(D400FAST) JOBCLASS(A) MSGCLASS(X) +
HOLDCLASS(X) SYSOUTCLASS(X) SIZE(4048) MAXSIZE(0)) +
OMVS(PROGRAM(/bin/sh) UID(100)
PERMIT ACCT# CLASS(ACCTNUM) ID(USERID)
PERMIT ISPFPROC CLASS(TSOPROC) ID(USERID)
PERMIT JCL CLASS(TSOAUTH) ID(USERID)
PERMIT RECOVER CLASS(TSOAUTH) ID(USERID)

SETROPTS REFRESH RACLIST(TSOPROC ACCTNUM TSOAUTH)
LISTUSER USERID
//*
//*
//*
//ALIAS EXEC PGM=IDCAMS
//*--------------------------------------------------------------------
//* Define Alias to user catalog
//*--------------------------------------------------------------------
//SYSPRINT DD SYSOUT=*
//SYSIN DD *

DEFINE ALIAS( -
NAME ( USERID ) -
RELATE( ICFCAT.USR01 ))
//*
//*
//PROFILE EXEC PGM=IEFBR14,REGION=1M
//*--------------------------------------------------------------------
//* Create an ISPF Profile Data Set
//*--------------------------------------------------------------------
//DD1 DD DSN=USERID.ISPF.ISPFPROF,DISP=(NEW,CATLG),
// VOL=SER=COS001,UNIT=3390,DCB=(LRECL=80,RECFM=FB,BLKSIZE=0),
// SPACE=(CYL,(1,1,25))
-----Original Message-----
Sent: Tuesday, February 08, 2005 2:22 PM
Subject: [H390-MVS] Re: racf and tso
Hi Enrico,
thanks for the reply.
I supposed such disjoining between TSO and RACF, but how can I setup a
user in RACF that has JCL OPER ACCT grants in TSO?
I also checked in TSO part of RACF, but there's no mention about those
grants.
regards,
fausto
Post by Enrico Sorichetti
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER
TSO session
Post by Enrico Sorichetti
Post by fausap72
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to use the uads to
store the userids, but use the racf database
if I remeber well the TSO account command works on the "sys1.uads"
which should contain only some emergency userids to be used when
the RACF datasets are not available
with racf active account oper jcl are governed by facility profiles
and data in the TSO segment ( from reminiscences of os 2.9 )
where is the doc on how to define new userids not necessarily tso
related
depends on Your os disrtibution and installation
material/methodology
------------------------ Yahoo! Groups Sponsor
--------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-08 22:22:46 UTC
Permalink
Hello,

thanks a lot for this JCL. I found the missing step... PERMIT JCL
command :-)
I also noticed it's not needed to run SETROPTS REFRESH on TSOAUTH, is
it correct, or is a fault of my system?

Do you know where can I find some RACF introductory information?

thanks again and regards,
Fausto
Post by STYMA, ROBERT E (ROBERT)
Here is the JCL I use for adding users to our RACF system.
Hope this provides some useful information.
//QC22505A JOB (),'DEFINE USER',
// NOTIFY=&SYSUID,
// MSGLEVEL=1,
// MSGCLASS=Y,
// CLASS=K
//*
//*--------------------------------------------------------------------
//* Define User to RACF
//* (Note: Be careful when updating this JCL)
//* (Note: Some of the text needs to be in lower case)
//*
//* Change "USERID" to the new userid
//* Change "UserName" to the name of the user
//* The initial password will be "password"
//*
//*--------------------------------------------------------------------
//STEP1 EXEC PGM=IKJEFT01,DYNAMNBR=75
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTERM DD DUMMY
//SYSUADS DD DSN=SYS1.UADS,DISP=SHR
//SYSLBC DD DSN=SYS1.BRODCAST,DISP=SHR
//SYSTSIN DD *
ADDUSER USERID NAME('UserName') +
PASSWORD(PASSWORD) +
DFLTGRP(PD) UACC(READ) +
UACC(READ) +
TSO(ACCTNUM(ACCT#) PROC(D400FAST) JOBCLASS(A) MSGCLASS(X) +
HOLDCLASS(X) SYSOUTCLASS(X) SIZE(4048) MAXSIZE(0)) +
OMVS(PROGRAM(/bin/sh) UID(100)
PERMIT ACCT# CLASS(ACCTNUM) ID(USERID)
PERMIT ISPFPROC CLASS(TSOPROC) ID(USERID)
PERMIT JCL CLASS(TSOAUTH) ID(USERID)
PERMIT RECOVER CLASS(TSOAUTH) ID(USERID)
SETROPTS REFRESH RACLIST(TSOPROC ACCTNUM TSOAUTH)
LISTUSER USERID
//*
//*
//*
//ALIAS EXEC PGM=IDCAMS
//*--------------------------------------------------------------------
//* Define Alias to user catalog
//*--------------------------------------------------------------------
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
DEFINE ALIAS( -
NAME ( USERID ) -
RELATE( ICFCAT.USR01 ))
//*
//*
//PROFILE EXEC PGM=IEFBR14,REGION=1M
//*--------------------------------------------------------------------
//* Create an ISPF Profile Data Set
//*--------------------------------------------------------------------
//DD1 DD DSN=USERID.ISPF.ISPFPROF,DISP=(NEW,CATLG),
// VOL=SER=COS001,UNIT=3390,DCB=(LRECL=80,RECFM=FB,BLKSIZE=0),
// SPACE=(CYL,(1,1,25))
-----Original Message-----
Sent: Tuesday, February 08, 2005 2:22 PM
Subject: [H390-MVS] Re: racf and tso
Hi Enrico,
thanks for the reply.
I supposed such disjoining between TSO and RACF, but how can I setup a
user in RACF that has JCL OPER ACCT grants in TSO?
I also checked in TSO part of RACF, but there's no mention about those
grants.
regards,
fausto
Post by Enrico Sorichetti
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER
TSO session
Post by Enrico Sorichetti
Post by fausap72
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to use the uads to
store the userids, but use the racf database
if I remeber well the TSO account command works on the "sys1.uads"
which should contain only some emergency userids to be used when
the RACF datasets are not available
with racf active account oper jcl are governed by facility profiles
and data in the TSO segment ( from reminiscences of os 2.9 )
where is the doc on how to define new userids not necessarily tso
related
depends on Your os disrtibution and installation
material/methodology
------------------------ Yahoo! Groups Sponsor
--------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Enrico Sorichetti
2005-02-08 22:33:22 UTC
Permalink
Post by fausap72
Hello,
Do you know where can I find some RACF introductory information?
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/Cases
is a good starting point
( not introductory but the full blown reference library for all you
need to know )

also You might try the redbooks collection
"ABC of system programming"

5 volumes all published for os/390
10 volumes planned

abc-s390-vol01 sg245597.pdf
abc-s390-vol02 sg245652.pdf
abc-s390-vol03 sg245653.pdf
abc-s390-vol04 sg245654.pdf
abc-s390-vol05 sg245655.pdf

abc-z-os-vol01 sg246981.pdf
abc-z-os-vol02 sg246982.pdf
abc-z-os-vol03 sg246983.pdf
abc-z-os-vol09 sg246989.pdf
abc-z-os-vol10 sg246990.pdf







------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-08 23:00:40 UTC
Permalink
Thanks a lot Enrico.
I knew the ABC books ... but unfortunately only few are out and the
z/OS RACF description is in the vol numb. 6 or 7, that is still
unavailable :-)

By the way, is it possible to simulate with Hercules two LPARs running
two z/OS? A sort of cluster... is it called SYSPLEX, isn't it? I'm
quite newbie in these things...

thanks.
Post by Enrico Sorichetti
Post by fausap72
Hello,
Do you know where can I find some RACF introductory information?
http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/Cases
is a good starting point
( not introductory but the full blown reference library for all you
need to know )
also You might try the redbooks collection
"ABC of system programming"
5 volumes all published for os/390
10 volumes planned
abc-s390-vol01 sg245597.pdf
abc-s390-vol02 sg245652.pdf
abc-s390-vol03 sg245653.pdf
abc-s390-vol04 sg245654.pdf
abc-s390-vol05 sg245655.pdf
abc-z-os-vol01 sg246981.pdf
abc-z-os-vol02 sg246982.pdf
abc-z-os-vol03 sg246983.pdf
abc-z-os-vol09 sg246989.pdf
abc-z-os-vol10 sg246990.pdf
------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Enrico Sorichetti
2005-02-08 23:15:35 UTC
Permalink
Post by fausap72
Thanks a lot Enrico.
I knew the ABC books ... but unfortunately only few are out and the
z/OS RACF description is in the vol numb. 6 or 7, that is still
unavailable :-)
as an introduction the volume 4 of the first series is more than
enough. after You can look at the reference manuals for differences
and additional classes





------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Ivan Warren
2005-02-08 23:20:02 UTC
Permalink
Post by fausap72
By the way, is it possible to simulate with Hercules two LPARs running
two z/OS? A sort of cluster... is it called SYSPLEX, isn't it? I'm
quite newbie in these things...
thanks.
(besides any licensing constraints...)

- The statement below is a somewhat educated guess / especially all the CF
stuff since I never actually did work with a CF capable machine / this also
means that corrections to the statement below are more than welcome ! -

Nah.. (this is not really LPAR related per-se)..

But hercules doesn't provide any CF (Coupling Facility) to provide SYSPLEX
capabilities.

Furthermore, CTC support is currently too rudimentary to support generic
payloads and therefore to support Basic Sysplexing.

..

On a side note :

There seem to be a small confusion. SYSPLEXing is *NOT* related to LPAR..
However, on some hardware, PR/SM (The LPAR supervision code) can have
multiple LPARs participate in a SYSPLEX by having a CF LPAR (This is then
called an ICF : Integrated Coupling Facility).

The ICF hardware capability is also required if you intend to perform
virtual SYSPLEXing between z/VM virtual machines (as the CF virtual machines
need to have access to the CF LIC).

..

Because hercules doesn't provide any CF LIC, it cannot be a CF, it cannot
emulate an ICF and cannot host z/VM Virtual CFs. Furthermore, the necessary
CF features (opcodes & such) are not provided as they would be pointless
without the proper LIC.

--Ivan



------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-09 14:15:11 UTC
Permalink
Hello Ivan,

thanks for your clarification, even if I don't have the needed
background to understand all you wrote :-)
Basically, what I understood is that Hercules in this moment is
missing the CF (coupling facility) functionality, but even if this CF
was available the CTC support is too rudimentary to be usable in that
context.

regards,
fausto
Post by Ivan Warren
Post by fausap72
By the way, is it possible to simulate with Hercules two LPARs running
two z/OS? A sort of cluster... is it called SYSPLEX, isn't it? I'm
quite newbie in these things...
thanks.
(besides any licensing constraints...)
- The statement below is a somewhat educated guess / especially all the CF
stuff since I never actually did work with a CF capable machine / this also
means that corrections to the statement below are more than welcome ! -
Nah.. (this is not really LPAR related per-se)..
But hercules doesn't provide any CF (Coupling Facility) to provide SYSPLEX
capabilities.
Furthermore, CTC support is currently too rudimentary to support generic
payloads and therefore to support Basic Sysplexing.
..
There seem to be a small confusion. SYSPLEXing is *NOT* related to LPAR..
However, on some hardware, PR/SM (The LPAR supervision code) can have
multiple LPARs participate in a SYSPLEX by having a CF LPAR (This is then
called an ICF : Integrated Coupling Facility).
The ICF hardware capability is also required if you intend to perform
virtual SYSPLEXing between z/VM virtual machines (as the CF virtual machines
need to have access to the CF LIC).
..
Because hercules doesn't provide any CF LIC, it cannot be a CF, it cannot
emulate an ICF and cannot host z/VM Virtual CFs. Furthermore, the necessary
CF features (opcodes & such) are not provided as they would be pointless
without the proper LIC.
--Ivan
------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Ivan Warren
2005-02-09 14:27:59 UTC
Permalink
Post by fausap72
Hello Ivan,
thanks for your clarification, even if I don't have the needed
background to understand all you wrote :-)
Basically, what I understood is that Hercules in this moment is
missing the CF (coupling facility) functionality, but even if this CF
was available the CTC support is too rudimentary to be usable in that
context.
regards,
fausto
Close, but not exactly !

SYSPLEX comes in 2 shapes :

The normal (for a lack of better term - but there probably is one)
SYSPLEXing is performed using the CF (Coupling Facility).

The BASIC SYSPLEXING is obtained by linking 2 machines through a CTC..

..

The 1st, cannot be done because of the lack of CF.

The 2nd cannot be done *as of yet* because of the lack of a proper CTC
emulation.

..

I do hope we'll manage to finally have a proper, full blown, CTC emulation
in hercules soon (but the problem is a little complex - since a CTC is a
piece of hardware sitting between 2 machines - and hercules communication
device handlers tend to be built by assembling 2 halves together - which
cannot work for CTC)..

--Ivan



------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-09 14:46:03 UTC
Permalink
Ok... now it's still more clear.

So just to add another word :-) if I understood the SYSPLEXing done
via CF uses two (or more than two) LPARs, because we're talking of the
same piece of hardware.

Instead the second version of SYSPLEXing is more or less the same
notion of clustering we have between two non-mainframe servers,
connected through the network.

So, at the moment, the CF is not available and the CTC simulation is
too much simple to support this feature. I understood the difficulties
about CTC, but what's about CF emulation?

fausto
Post by Ivan Warren
Post by fausap72
Hello Ivan,
thanks for your clarification, even if I don't have the needed
background to understand all you wrote :-)
Basically, what I understood is that Hercules in this moment is
missing the CF (coupling facility) functionality, but even if this CF
was available the CTC support is too rudimentary to be usable in that
context.
regards,
fausto
Close, but not exactly !
The normal (for a lack of better term - but there probably is one)
SYSPLEXing is performed using the CF (Coupling Facility).
The BASIC SYSPLEXING is obtained by linking 2 machines through a CTC..
..
The 1st, cannot be done because of the lack of CF.
The 2nd cannot be done *as of yet* because of the lack of a proper CTC
emulation.
..
I do hope we'll manage to finally have a proper, full blown, CTC emulation
in hercules soon (but the problem is a little complex - since a CTC is a
piece of hardware sitting between 2 machines - and hercules
communication
Post by Ivan Warren
device handlers tend to be built by assembling 2 halves together - which
cannot work for CTC)..
--Ivan
------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Ivan Warren
2005-02-09 15:15:34 UTC
Permalink
Post by fausap72
Ok... now it's still more clear.
So just to add another word :-) if I understood the SYSPLEXing done
via CF uses two (or more than two) LPARs, because we're talking of the
same piece of hardware.
Not exactly (but almost there !).. The SYSPLEXing is done through a CF
which is a piece of hardware in itself. It is, in its original form, a
complete processor complex running a specialized OS (the CF LIC). In this
form of SYSPLEXing, 2 to n machines connect to 1 or more CFs that
coordinate the various participating machines to form the SYSPLEX. If you
look at the various IBM machines annoucement, you will surely notice some
'-CF' models.. These are the dedicate Coupling Facility machines.

On some PR/SM (LPAR Capable) machines, this 'CF' machine can also be an
LPAR - allowing multiple partitions to participate in a SYSPLEX under the
control of the CF LPAR.. This capability is called the "ICF" because the
'CF' machines becomes integrated. On such machines, z/VM virtual machines
can also simulate a 'CF' machine, as z/VM will grant access to the CF LIC
to authorized virtual machines - thus allowing to build a SYSPLEX amongst
z/VM virtual machines.. This was obviously designed to provide a SYSPLEX
testbed.
Post by fausap72
Instead the second version of SYSPLEXing is more or less the same
notion of clustering we have between two non-mainframe servers,
connected through the network.
The second version (BASIC SYSPLEX) uses a simple communication channel (a
CTC : Channel To Channel adapter) for 2 machines to cooperate. There is no
'dedicated' CF machine (or ICF LPAR - or whatever) in this case. I don't
know if multiple machines can participate by networking the CTCs between
the participating systems.
Post by fausap72
So, at the moment, the CF is not available and the CTC simulation is
too much simple to support this feature. I understood the difficulties
about CTC, but what's about CF emulation?
Implementing the CF is another issue altogether - and it's an even more
complicated than it seems. Besides any technical difficulties, the main
hurdle is a legal one. The CF LIC just cannot be run on hercules. LIC
stands for 'Licensed Internal Code', and such code is licensed to be run
*EXCLUSIVELLY* on the machines for which it was designed...

The CF LIC code in dedicated CF machines is an integral part of the
hardware.

ICF Capable machines also have a CF LIC present, so that an LPAR or z/VM
machines can run the LIC to simulate a CF machine.

...

The bottom line is : Forget about CF.. It's a dead end (at least in any
forseable future)..
However, CTC emulation will eventually become capable enough to achieve
things such as BASIC SYSPLEXing.

--Ivan
Enrico Sorichetti
2005-02-09 16:05:03 UTC
Permalink
Post by fausap72
Ok... now it's still more clear.
So just to add another word :-) if I understood the SYSPLEXing done
via CF uses two (or more than two) LPARs, because we're talking of the
same piece of hardware.
SYSPLEX is a very large and foggy category of things

for example from a certain release od os/390 the system will/must come
up in MONOPLEX mode ( sysplex with only one CPC )

even in os/390 2.9 a prerequisite for the installation of the cics TS
was the system logger which had as a prerequisite the base sysplex
functions... yes even for a monoplex a couple dataset was needed

Let' make a little ouline of what is the hardware involved and the use
of it

CTC ( channel to channel adapter )
used for vtam and GRS ( ring )
( no shared spool for jes2 from 2.something)

SYSPLEX timer
the name tells it... clock sync for all the cpc' s
( central processing complexes - from a logical point of view )
( hardware and cables )
needed for JES2 MAS

two LPARS which emulate from a logical point of view two cpc' s
may use an internal feature I do not remember the name
( only from a certain model upwards )

then it comes the queen of the dance

the CF or coupling facility,
(I do not remember if it used special cables )
it' really a true cpu with central storage and microcode...

its a CPC with a microcoded operating system the "LIC"

the CF contains the control structures wich is a more sophisticated
name for "data buffers"

GRS ( star )

here just for chatting.... is an unnamed reference
********************************************************************
excerpt fom one of the Cheryl Watson Bulletins
********************************************************************
A reader (who prefers to remain anonymous) sent
in the following results of his conversion from GRS
Ring to GRS Star (requires a coupling facility). The
results were pretty impressive:
"Thought you might like to see some numbers from
converting a five member GRS ring (with RESMIL
5) to a GRS star using a 9674-C05 processors.
"Running a program that did a STCK, ENQ, STCK,
DEQ, STCK on a unique QNAME-RNAME as a
batch job I saw the following numbers:
"In a ring: Mean ENQ time 55.1 milliseconds, mean
DEQ time 51.8 ms, min ENQ time 38.2 ms, min
DEQ time 31.7 ms, max ENQ time 73.3 ms, max
DEQ time 112.2 ms.
"In a star: Mean ENQ time .9 milliseconds, mean
DEQ time .6 ms, min ENQ time .5 ms, min DEQ
time .3 ms, max ENQ time 2.2 ms, max DEQ time
.96 ms.
"Average ENQ improvement 59 to 1, average DEQ
improvement 90 to 1
*******************************************************

in a data sharing environment the db2 buffers are kept in CF
structures

same thing for example if you want vsam data sharing with integrity
you have to use vsam buffers in CF structures

for optimum performance of JES2 MAS the checkpoint buffers should
be in CF structures

same thing for the catalog buffers for the CAS

The terminology in not very accurate, since a lot of time has passed
since I was involved in SYSPLEX activity

but should be enough to give an idea ( trhu examples ) of the
functions of the components involved

regards

enrico sorichetti

P.S. it's a pity ...
I have the teeths but I do not have the bread ( a Z/OS to play with )







------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-11 14:47:59 UTC
Permalink
Post by Enrico Sorichetti
in a data sharing environment the db2 buffers are kept in CF
structures
same thing for example if you want vsam data sharing with integrity
you have to use vsam buffers in CF structures
for optimum performance of JES2 MAS the checkpoint buffers should
be in CF structures
same thing for the catalog buffers for the CAS
so the CF it's a very complex piece of hardware. I'm really impressed :-)
Post by Enrico Sorichetti
P.S. it's a pity ...
I have the teeths but I do not have the bread ( a Z/OS to play with )
not only a z/OS :-) you should have also the right hardware...
Hercules at the moment cannot give you the feeling of a SYSPLEX :-)






------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Tony Harminc
2005-02-09 16:48:05 UTC
Permalink
Post by Ivan Warren
The second version (BASIC SYSPLEX) uses a simple communication channel (a
CTC : Channel To Channel adapter) for 2 machines to cooperate. There is no
'dedicated' CF machine (or ICF LPAR - or whatever) in this case. I don't
know if multiple machines can participate by networking the CTCs between
the participating systems.
Yes, multiple machines can participate with the CTCs linked in a ring
structure. The version of SYSPLEX that uses the CF(s) is called
Parallel Sysplex, btw.
Post by Ivan Warren
Implementing the CF is another issue altogether - and it's an even more
complicated than it seems. Besides any technical difficulties, the main
hurdle is a legal one. The CF LIC just cannot be run on hercules. LIC
stands for 'Licensed Internal Code', and such code is licensed to be run
*EXCLUSIVELLY* on the machines for which it was designed...
Of course the legal hurdle is exactly the same one as that of running
IBM licensed OSs such as z/OS under Herc... Either you have a licence
or you choose to obtain the code somehow and run without one.
Post by Ivan Warren
The CF LIC code in dedicated CF machines is an integral part of the
hardware.
That's true, but there is nothing (except perhaps patents) to stop
anyone from writing their own code from scratch to run in a CF of
their own designing, as long as the interfaces it provides match those
the MVSs are expecting. Amdahl, for example, did this, though they may
well have licensed a bunch of stuff from IBM. In particular, there's
nothing that requires the CF to be a 390 emulator.

Tony H.


------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Ivan Warren
2005-02-09 17:04:26 UTC
Permalink
<snip />
Post by Tony Harminc
Yes, multiple machines can participate with the CTCs linked in a ring
structure. The version of SYSPLEX that uses the CF(s) is called
Parallel Sysplex, btw.
Ah.. Thanks !
Post by Tony Harminc
Post by Ivan Warren
Implementing the CF is another issue altogether - and it's
an even more
Post by Ivan Warren
complicated than it seems. Besides any technical
difficulties, the main
Post by Ivan Warren
hurdle is a legal one. The CF LIC just cannot be run on
hercules. LIC
Post by Ivan Warren
stands for 'Licensed Internal Code', and such code is
licensed to be run
Post by Ivan Warren
*EXCLUSIVELLY* on the machines for which it was designed...
Of course the legal hurdle is exactly the same one as that of running
IBM licensed OSs such as z/OS under Herc... Either you have a licence
or you choose to obtain the code somehow and run without one.
Not exactly... LPPs (Licensed Program Products) can be licensed on non-IBM
hardware (as long as you are willing to show some green).. LICs on the other
side aren't for sale or rent.. You cannot go to your IBM representative and
pay some money to run some LIC code on FooBar hardware. (note : This is
probably Off Topic !)
Post by Tony Harminc
Post by Ivan Warren
The CF LIC code in dedicated CF machines is an integral part of the
hardware.
That's true, but there is nothing (except perhaps patents) to stop
anyone from writing their own code from scratch to run in a CF of
their own designing, as long as the interfaces it provides match those
the MVSs are expecting. Amdahl, for example, did this, though they may
well have licensed a bunch of stuff from IBM. In particular, there's
nothing that requires the CF to be a 390 emulator.
Tony H.
I agree... What's important is the interface, not the implementation.. But I
just have no real idea what it would involve.. This may be just as
complicated as rewriting a whole operating system from scratch.. (my *guess*
is that it might reach the same level of complexity as emulating an PU Type
4 - same thing - no obligation to emulate a 37xx, *just* need to behave as a
37xx with NCP loaded !)

--Ivan



------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Kevin Leonard
2005-02-13 04:23:37 UTC
Permalink
Post by Ivan Warren
However, CTC emulation will eventually become capable enough to
achieve things such as BASIC SYSPLEXing.
JES3 Release 3, the version shipped with MVS 3.8 (which we
have a copy of), uses CTCs to communicate between members
of a JES3 complex, and between the JES3 global and ASP
main procesors. I've built a working JES3 global/local
complex under VM R6 using virtual CTCs, just to see if
it would work, so when we get full Hercules CTC support
we do have a product it will work with. Don't have ASP
quite working yet, I don't have any documentation on it.
--
Kevin





------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Gerhard Postpischil
2005-02-09 04:35:12 UTC
Permalink
----- Original Message -----
Post by STYMA, ROBERT E (ROBERT)
Here is the JCL I use for adding users to our RACF system.
Hope this provides some useful information.
I found that on my OS/390 2.5 having only the RACF definition limits the
functionality of SDSF (i.e., I can't look at my own output). Don't know
whether that's corrected in later versions. I had to get around this by
using TSO ACCOUNT to add the user id with all privileges (JCL ACCT OPER);
don't remember whether MOUNT was required (I doubt it).

Gerhard Postpischil
Bradford, VT




------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
STYMA, ROBERT E (ROBERT)
2005-02-08 22:26:56 UTC
Permalink
The SETROPTS is just there for the benefit of the
LISTUSER. It makes the output more interesting.
I have found some introductory information on the
IBM web site as PDF documents, but no good cookbooks.
I am somewhat of a novice at RACF having spent
most of my time on an ACF2 system.
-----Original Message-----
Sent: Tuesday, February 08, 2005 3:23 PM
Subject: [H390-MVS] Re: racf and tso
Hello,
thanks a lot for this JCL. I found the missing step... PERMIT JCL
command :-)
I also noticed it's not needed to run SETROPTS REFRESH on TSOAUTH, is
it correct, or is a fault of my system?
Do you know where can I find some RACF introductory information?
thanks again and regards,
Fausto
Post by STYMA, ROBERT E (ROBERT)
Here is the JCL I use for adding users to our RACF system.
Hope this provides some useful information.
//QC22505A JOB (),'DEFINE USER',
// NOTIFY=&SYSUID,
// MSGLEVEL=1,
// MSGCLASS=Y,
// CLASS=K
//*
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Define User to RACF
//* (Note: Be careful when updating this JCL)
//* (Note: Some of the text needs to be in lower case)
//*
//* Change "USERID" to the new userid
//* Change "UserName" to the name of the user
//* The initial password will be "password"
//*
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//STEP1 EXEC PGM=IKJEFT01,DYNAMNBR=75
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTERM DD DUMMY
//SYSUADS DD DSN=SYS1.UADS,DISP=SHR
//SYSLBC DD DSN=SYS1.BRODCAST,DISP=SHR
//SYSTSIN DD *
ADDUSER USERID NAME('UserName')
+
Post by STYMA, ROBERT E (ROBERT)
PASSWORD(PASSWORD)
+
Post by STYMA, ROBERT E (ROBERT)
DFLTGRP(PD) UACC(READ)
+
Post by STYMA, ROBERT E (ROBERT)
UACC(READ)
+
Post by STYMA, ROBERT E (ROBERT)
TSO(ACCTNUM(ACCT#) PROC(D400FAST) JOBCLASS(A)
MSGCLASS(X) +
Post by STYMA, ROBERT E (ROBERT)
HOLDCLASS(X) SYSOUTCLASS(X) SIZE(4048)
MAXSIZE(0)) +
Post by STYMA, ROBERT E (ROBERT)
OMVS(PROGRAM(/bin/sh) UID(100)
PERMIT ACCT# CLASS(ACCTNUM) ID(USERID)
PERMIT ISPFPROC CLASS(TSOPROC) ID(USERID)
PERMIT JCL CLASS(TSOAUTH) ID(USERID)
PERMIT RECOVER CLASS(TSOAUTH) ID(USERID)
SETROPTS REFRESH RACLIST(TSOPROC ACCTNUM TSOAUTH)
LISTUSER USERID
//*
//*
//*
//ALIAS EXEC PGM=IDCAMS
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Define Alias to user catalog
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
DEFINE ALIAS( -
NAME ( USERID ) -
RELATE( ICFCAT.USR01 ))
//*
//*
//PROFILE EXEC PGM=IEFBR14,REGION=1M
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Create an ISPF Profile Data Set
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//DD1 DD DSN=USERID.ISPF.ISPFPROF,DISP=(NEW,CATLG),
//
VOL=SER=COS001,UNIT=3390,DCB=(LRECL=80,RECFM=FB,BLKSIZE=0),
Post by STYMA, ROBERT E (ROBERT)
// SPACE=(CYL,(1,1,25))
-----Original Message-----
Sent: Tuesday, February 08, 2005 2:22 PM
Subject: [H390-MVS] Re: racf and tso
Hi Enrico,
thanks for the reply.
I supposed such disjoining between TSO and RACF, but how
can I setup a
Post by STYMA, ROBERT E (ROBERT)
user in RACF that has JCL OPER ACCT grants in TSO?
I also checked in TSO part of RACF, but there's no
mention about those
Post by STYMA, ROBERT E (ROBERT)
grants.
regards,
fausto
Post by Enrico Sorichetti
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER
TSO session
Post by Enrico Sorichetti
Post by fausap72
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to
use the uads to
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
store the userids, but use the racf database
if I remeber well the TSO account command works on the
"sys1.uads"
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
which should contain only some emergency userids to be used when
the RACF datasets are not available
with racf active account oper jcl are governed by
facility profiles
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
and data in the TSO segment ( from reminiscences of os 2.9 )
where is the doc on how to define new userids not
necessarily tso
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
related
depends on Your os disrtibution and installation
material/methodology
------------------------ Yahoo! Groups Sponsor
--------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor
--------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor --------------------~-->
Has someone you know been affected by illness or disease?
Network for Good is THE place to support health awareness efforts!
http://us.click.yahoo.com/RzSHvD/UOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
fausap72
2005-02-08 22:57:07 UTC
Permalink
ok ... I understood now.
Yes I heard ACF2, CA product if I remember well, is a very good
product. Are there many differences between RACF and ACF2?
Post by STYMA, ROBERT E (ROBERT)
The SETROPTS is just there for the benefit of the
LISTUSER. It makes the output more interesting.
I have found some introductory information on the
IBM web site as PDF documents, but no good cookbooks.
I am somewhat of a novice at RACF having spent
most of my time on an ACF2 system.
-----Original Message-----
Sent: Tuesday, February 08, 2005 3:23 PM
Subject: [H390-MVS] Re: racf and tso
Hello,
thanks a lot for this JCL. I found the missing step... PERMIT JCL
command :-)
I also noticed it's not needed to run SETROPTS REFRESH on TSOAUTH, is
it correct, or is a fault of my system?
Do you know where can I find some RACF introductory information?
thanks again and regards,
Fausto
Post by STYMA, ROBERT E (ROBERT)
Here is the JCL I use for adding users to our RACF system.
Hope this provides some useful information.
//QC22505A JOB (),'DEFINE USER',
// NOTIFY=&SYSUID,
// MSGLEVEL=1,
// MSGCLASS=Y,
// CLASS=K
//*
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Define User to RACF
//* (Note: Be careful when updating this JCL)
//* (Note: Some of the text needs to be in lower case)
//*
//* Change "USERID" to the new userid
//* Change "UserName" to the name of the user
//* The initial password will be "password"
//*
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//STEP1 EXEC PGM=IKJEFT01,DYNAMNBR=75
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTERM DD DUMMY
//SYSUADS DD DSN=SYS1.UADS,DISP=SHR
//SYSLBC DD DSN=SYS1.BRODCAST,DISP=SHR
//SYSTSIN DD *
ADDUSER USERID NAME('UserName')
+
Post by STYMA, ROBERT E (ROBERT)
PASSWORD(PASSWORD)
+
Post by STYMA, ROBERT E (ROBERT)
DFLTGRP(PD) UACC(READ)
+
Post by STYMA, ROBERT E (ROBERT)
UACC(READ)
+
Post by STYMA, ROBERT E (ROBERT)
TSO(ACCTNUM(ACCT#) PROC(D400FAST) JOBCLASS(A)
MSGCLASS(X) +
Post by STYMA, ROBERT E (ROBERT)
HOLDCLASS(X) SYSOUTCLASS(X) SIZE(4048)
MAXSIZE(0)) +
Post by STYMA, ROBERT E (ROBERT)
OMVS(PROGRAM(/bin/sh) UID(100)
PERMIT ACCT# CLASS(ACCTNUM) ID(USERID)
PERMIT ISPFPROC CLASS(TSOPROC) ID(USERID)
PERMIT JCL CLASS(TSOAUTH) ID(USERID)
PERMIT RECOVER CLASS(TSOAUTH) ID(USERID)
SETROPTS REFRESH RACLIST(TSOPROC ACCTNUM TSOAUTH)
LISTUSER USERID
//*
//*
//*
//ALIAS EXEC PGM=IDCAMS
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Define Alias to user catalog
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
DEFINE ALIAS( -
NAME ( USERID ) -
RELATE( ICFCAT.USR01 ))
//*
//*
//PROFILE EXEC PGM=IEFBR14,REGION=1M
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//* Create an ISPF Profile Data Set
//*-----------------------------------------------------------
---------
Post by STYMA, ROBERT E (ROBERT)
//DD1 DD DSN=USERID.ISPF.ISPFPROF,DISP=(NEW,CATLG),
//
VOL=SER=COS001,UNIT=3390,DCB=(LRECL=80,RECFM=FB,BLKSIZE=0),
Post by STYMA, ROBERT E (ROBERT)
// SPACE=(CYL,(1,1,25))
-----Original Message-----
Sent: Tuesday, February 08, 2005 2:22 PM
Subject: [H390-MVS] Re: racf and tso
Hi Enrico,
thanks for the reply.
I supposed such disjoining between TSO and RACF, but how
can I setup a
Post by STYMA, ROBERT E (ROBERT)
user in RACF that has JCL OPER ACCT grants in TSO?
I also checked in TSO part of RACF, but there's no
mention about those
Post by STYMA, ROBERT E (ROBERT)
grants.
regards,
fausto
Post by Enrico Sorichetti
Post by fausap72
Hello all,
The strange thing is that if I run account from IBMUSER
TSO session
Post by Enrico Sorichetti
Post by fausap72
and I run LIST ( * ) I see only IBMUSER user, not the new one.
How is it possible?
from some release of os390/zos the default is not to
use the uads to
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
store the userids, but use the racf database
if I remeber well the TSO account command works on the
"sys1.uads"
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
which should contain only some emergency userids to be used when
the RACF datasets are not available
with racf active account oper jcl are governed by
facility profiles
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
and data in the TSO segment ( from reminiscences of os 2.9 )
where is the doc on how to define new userids not
necessarily tso
Post by STYMA, ROBERT E (ROBERT)
Post by Enrico Sorichetti
related
depends on Your os disrtibution and installation
material/methodology
------------------------ Yahoo! Groups Sponsor
--------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor
--------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
------------------------ Yahoo! Groups Sponsor --------------------~-->
What would our lives be like without music, dance, and theater?
Donate or volunteer in the arts today at Network for Good!
http://us.click.yahoo.com/TzSHvD/SOnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Hall, Ken (IDS DCS PE)
2005-02-09 16:57:52 UTC
Permalink
A few items to fill in what's been said before:

1) Basic SYSPLEX

Shared DASD (supporting reserve/release), Point-to-point CTC connections between all systems, and "common time base". A common time base may either be one or more Sysplex timers (a dedicated clock), or emulation of same if all members run on the same physical processor in LPARs. As of early versions of OS/390, you need a BASIC SYSPLEX to share the JES2 spool. Earlier versions only needed shared DASD. A component called "XCF" provides communication services between members of the Sysplex.

2) Parallel SYSPLEX

Basic SYSPLEX, plus coupling facility. At one time there was a dedicated box that was sold as a CF, or you could use "Integrated Coupling Facility", which was an LPAR on a normal box. Nowadays, IBM just sells generic boxes configured however you need them. Our current Couplers are z890's with no normal channels. Either way, the CF runs CFCC ("Coupling Facility Control Code"). You define a CF LPAR in your IOCP (which defines what devices are where, and what LPARs there are), and when you activate the LPAR, the CFCC is automatically loaded. From that point on, it's a black box, and normally needs no attention, except monitoring to make sure you don't fill the storage. If that happens, the whole works usually comes down.

OS images communicate with Coupling Facility via Coupling Links. These are special channels that use either high-speed fiber, or for very short distances (<200 feet, IIRC), you can use ICB links, which are parallel copper cables. Coupling links are defined as a special channel type, but otherwise look like just another I/O device. All systems in the plex need to be connected to the CF.

The coupling facility contains "structures", which are basically data elements shared between the systems in the plex. You define the structures in a parmlib member, they're built at IPL time, both in the CF and in a shared dataset, and filled when used. Common uses for CF structures are:

1) DB2 data
2) GRS (inter-system enqueue/locking) data when you're running in GRS "Star" mode.
3) Shared Master catalog (recent innovation)
4) MQ Series Queues.
5) JES2 checkpoint (I think)

The point of this is to provide a sort of big shared RAM disk that can be accessed very quickly, and will survive the loss of one or more OS images. A normal configuration duplicates everything, so there will be two CF's connected to all images. You can duplex structures between CFs, or use commands to move them back and forth at will. If a CF fails, but at least one OS image is still active, it can usually reconstruct the lost structures in the backup CF.

One more note on CTC's:

The old parallel (bus/tag) CTC was a hardware device, but nobody uses those anymore. ESCON and (newer) FICON CTC's are just a fiber patch cable connected between channels, or through a switching device. The magic is handled in the channel microcode. Basically one side pretends to be a controller (CHPID Type CTC), while the other side acts as a channel (CHPID type CNC). So any emulation of this would have to include emulation of the controller behavior, which I don't believe is very well documented outside of IBM (although it has been available to OEM CPU vendors).

Final disclaimer:

ALL of this depends on a level of software support that's beyond what we can legally run on Hercules (which is a shame). I think the only LEGAL use of real CTC support might be VTAM-to-VTAM connection, or JES NJE. CF support is right out, unless someone can reverse engineer the coupling link protocol and CFCC behavior, but even then there's no OS we can legally use to talk to it. The ONLY OS that currently supports CF is zOS.

One way to collect data about how the old bus/tag CTC works might be to run two copies of MVS under VMR6 with a VTAM-to-VTAM CTC connection between them. I don't recall if the version of VTAM we have supports this, or if VMR6 does either, but I believe VM has some tracing facilities that might tell us something.

-----Original Message-----
From: Enrico Sorichetti [mailto:e.sorichetti-nc/***@public.gmane.org]
Sent: Wednesday, February 09, 2005 11:05 AM
To: H390-MVS-***@public.gmane.org
Subject: [H390-MVS] SYSPLEX and LPAR Re: racf and tso
Post by fausap72
Ok... now it's still more clear.
So just to add another word :-) if I understood the SYSPLEXing
done
Post by fausap72
via CF uses two (or more than two) LPARs, because we're talking of
the
Post by fausap72
same piece of hardware.
SYSPLEX is a very large and foggy category of things

for example from a certain release od os/390 the system will/must come
up in MONOPLEX mode ( sysplex with only one CPC )

even in os/390 2.9 a prerequisite for the installation of the cics TS
was the system logger which had as a prerequisite the base sysplex
functions... yes even for a monoplex a couple dataset was needed

Let' make a little ouline of what is the hardware involved and the use
of it

CTC ( channel to channel adapter )
used for vtam and GRS ( ring )
( no shared spool for jes2 from 2.something)

SYSPLEX timer
the name tells it... clock sync for all the cpc' s
( central processing complexes - from a logical point of view )
( hardware and cables )
needed for JES2 MAS

two LPARS which emulate from a logical point of view two cpc' s
may use an internal feature I do not remember the name
( only from a certain model upwards )

then it comes the queen of the dance

the CF or coupling facility,
(I do not remember if it used special cables )
it' really a true cpu with central storage and microcode...

its a CPC with a microcoded operating system the "LIC"

the CF contains the control structures wich is a more sophisticated
name for "data buffers"

GRS ( star )

here just for chatting.... is an unnamed reference
********************************************************************
excerpt fom one of the Cheryl Watson Bulletins
********************************************************************
A reader (who prefers to remain anonymous) sent
in the following results of his conversion from GRS
Ring to GRS Star (requires a coupling facility). The
results were pretty impressive:
"Thought you might like to see some numbers from
converting a five member GRS ring (with RESMIL
5) to a GRS star using a 9674-C05 processors.
"Running a program that did a STCK, ENQ, STCK,
DEQ, STCK on a unique QNAME-RNAME as a
batch job I saw the following numbers:
"In a ring: Mean ENQ time 55.1 milliseconds, mean
DEQ time 51.8 ms, min ENQ time 38.2 ms, min
DEQ time 31.7 ms, max ENQ time 73.3 ms, max
DEQ time 112.2 ms.
"In a star: Mean ENQ time .9 milliseconds, mean
DEQ time .6 ms, min ENQ time .5 ms, min DEQ
time .3 ms, max ENQ time 2.2 ms, max DEQ time
.96 ms.
"Average ENQ improvement 59 to 1, average DEQ
improvement 90 to 1
*******************************************************

in a data sharing environment the db2 buffers are kept in CF
structures

same thing for example if you want vsam data sharing with integrity
you have to use vsam buffers in CF structures

for optimum performance of JES2 MAS the checkpoint buffers should
be in CF structures

same thing for the catalog buffers for the CAS

The terminology in not very accurate, since a lot of time has passed
since I was involved in SYSPLEX activity

but should be enough to give an idea ( trhu examples ) of the
functions of the components involved

regards

enrico sorichetti

P.S. it's a pity ...
I have the teeths but I do not have the bread ( a Z/OS to play with )









Yahoo! Groups Links



--------------------------------------------------------

If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/
--------------------------------------------------------


------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Ivan Warren
2005-02-09 17:15:53 UTC
Permalink
Post by Hall, Ken (IDS DCS PE)
The old parallel (bus/tag) CTC was a hardware device, but
nobody uses those anymore. ESCON and (newer) FICON CTC's are
just a fiber patch cable connected between channels, or
through a switching device. The magic is handled in the
channel microcode. Basically one side pretends to be a
controller (CHPID Type CTC), while the other side acts as a
channel (CHPID type CNC). So any emulation of this would
have to include emulation of the controller behavior, which I
don't believe is very well documented outside of IBM
(although it has been available to OEM CPU vendors).
There is no real need to emulate the "implementation" of a modern ESCON CTC
- all I am looking at right now is mimicing the "interface" as stated in the
relevant documentation. On the other hand, I'm pretty much intending to
follow the same sort of route (as ESCON CTCs)

The current idea that I am working on is that 2 hercules instances you want
to connect via CTCs will connect through some data channel (probably a TCP
connection).. And a primary/secondary will be negociated to handle the
command depedency contention. Proprietary protocol (which may eventually
evolve to a ESCON-Like protocol).

All that is needed is to read the CTC documentation (which is actually not
that hard to understand).. and go from there.. It's all very well
documented.
Post by Hall, Ken (IDS DCS PE)
One way to collect data about how the old bus/tag CTC works
might be to run two copies of MVS under VMR6 with a
VTAM-to-VTAM CTC connection between them. I don't recall if
the version of VTAM we have supports this, or if VMR6 does
either, but I believe VM has some tracing facilities that
might tell us something.
I don't think there is any need to *hack* the protocol.. Besides, various
programs may very well interact with the devices very differently (some may
use 'prepare' to wait for a command from the remote side.. others may rely
on an ATTENTION being posted, etc..)

My belief is that we should have an operational CTC emulation if the
documentation is strictly followed.

--Ivan



------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Hall, Ken (IDS DCS PE)
2005-02-10 13:31:10 UTC
Permalink
Weeeellll...

I think it might depend on how closely you want to emulate the behavior of the CTC, particularly the ESCON CTC. The implementation has some quirks.

For example, the CTC side of the link will ALWAYS go online even if there's nothing connected to it, but the CNC won't unless there's a system to talk to (i.e. light detected on the fiber). The FICON CTC's have similar behavior, and it bites us regularly.

Of course there's no reason why you need to duplicate the behavior EXACTLY, but I don't know what other subtleties are hiding in there.

The 3088, being a physical box that acted as a controller, didn't have this problem.

Once, long ago, we had an OEM controller that connected a parallel channel to Ethernet. This was before IBM had any product to do this. The 3172 came out a year or two later.

That box was defined as a CTC to the system, as was the Cisco CIP, which performs a similar function. I asked one of the tech guys why they chose that device, and he said it was because the CTC had the simplest, most generic low-level protocol, so it was the easiest to "hijack".
-----Original Message-----
Sent: Wednesday, February 09, 2005 12:16 PM
Subject: RE: [H390-MVS] SYSPLEX and LPAR Re: racf and tso
Post by Hall, Ken (IDS DCS PE)
The old parallel (bus/tag) CTC was a hardware device, but
nobody uses those anymore. ESCON and (newer) FICON CTC's are
just a fiber patch cable connected between channels, or
through a switching device. The magic is handled in the
channel microcode. Basically one side pretends to be a
controller (CHPID Type CTC), while the other side acts as a
channel (CHPID type CNC). So any emulation of this would
have to include emulation of the controller behavior, which I
don't believe is very well documented outside of IBM
(although it has been available to OEM CPU vendors).
There is no real need to emulate the "implementation" of a
modern ESCON CTC
- all I am looking at right now is mimicing the "interface"
as stated in the
relevant documentation. On the other hand, I'm pretty much
intending to
follow the same sort of route (as ESCON CTCs)
The current idea that I am working on is that 2 hercules
instances you want
to connect via CTCs will connect through some data channel
(probably a TCP
connection).. And a primary/secondary will be negociated to handle the
command depedency contention. Proprietary protocol (which may
eventually
evolve to a ESCON-Like protocol).
All that is needed is to read the CTC documentation (which is
actually not
that hard to understand).. and go from there.. It's all very well
documented.
Post by Hall, Ken (IDS DCS PE)
One way to collect data about how the old bus/tag CTC works
might be to run two copies of MVS under VMR6 with a
VTAM-to-VTAM CTC connection between them. I don't recall if
the version of VTAM we have supports this, or if VMR6 does
either, but I believe VM has some tracing facilities that
might tell us something.
I don't think there is any need to *hack* the protocol..
Besides, various
programs may very well interact with the devices very
differently (some may
use 'prepare' to wait for a command from the remote side..
others may rely
on an ATTENTION being posted, etc..)
My belief is that we should have an operational CTC emulation if the
documentation is strictly followed.
--Ivan
------------------------ Yahoo! Groups Sponsor
--------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------
------~->
Yahoo! Groups Links
--------------------------------------------------------

If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/
--------------------------------------------------------


------------------------ Yahoo! Groups Sponsor --------------------~-->
In low income neighborhoods, 84% do not own computers.
At Network for Good, help bridge the Digital Divide!
http://us.click.yahoo.com/EA3HyD/3MnJAA/79vVAA/sVPplB/TM
--------------------------------------------------------------------~->


Yahoo! Groups Links

<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/H390-MVS/

<*> To unsubscribe from this group, send an email to:
H390-MVS-unsubscribe-***@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
Loading...