Rui Miguel Feio

RACF Profiles

Rui Miguel Feio — Mon, 07 May 2012 19:16:39 +0000

In RACF, a profile describes the security characteristics of a user, a group of users, or one or more mainframe resources.

Profile Type	Description
User profiles	A user profile is a description of a RACF-defined user. The information in the profile includes the user ID, the user name, the user’s password, the profile owner, user attributes, and other data.
Group profiles	A group profile defines a group of users. The information in the profile includes the group name, the profile owner, and the users in the group.
Data set profiles	A data set profile provides RACF protection for one or more data sets. The information in the profile includes the data set profile name, the profile owner, the universal access authority, the access list, and other data. Data set profiles can be generic or discrete: A generic profile protects several resources with similar names and identical security requirements. A discrete profile protects a single resource.
General resource profiles	A general resource profile provides RACF protection for mainframe resources, other than data sets. The information in the profile includes the general resource profile name, the profile owner, the universal access authority, the access list, and other data. General resources with similar characteristics belong to the same class. Like a generic profile, a resource group profile protects several resources with identical security requirements. However, the resources do not have to have similar names. Resource group profiles with similar characteristics belong to the same resource grouping class. Resource profiles can be generic or discrete: A generic profile protects several resources with similar names and identical security requirements. A discrete profile protects a single resource.

RACF – Group Authorities

Rui Miguel Feio — Mon, 07 May 2012 19:03:36 +0000

Each user in a group requires a level of group authority for that group. If a user is connected to several groups, the user has a level of group authority for each group.

Authority	Description
USE	Allows the user to access resources to which the group is authorized.
CREATE	Allows the user to create RACF data set profiles for the group.
CONNECT	Allows the user to connect other users to the group.
JOIN	Allows the user to add new subgroups or users to the group, as well as assign group authorities to the new members.

RACF – User Attributes

Rui Miguel Feio — Mon, 07 May 2012 18:54:37 +0000

User attributes are extraordinary capabilities, limitations, or environments that can be assigned to a user either all of the time or when the user is connected to a specific group or groups.

Attribute	Description
SPECIAL	A user who has the SPECIAL attribute at the system level can issue all RACF commands. This attribute gives the user full control over all of the RACF profiles in the RACF database. You can assign the SPECIAL attribute at the group level. When you do, the group-SPECIAL user has full control over all of the profiles within the scope of the group.
AUDITOR	The AUDITOR attribute is given to users who are responsible for auditing RACF security controls and functions. You can assign the AUDITOR attribute at the group level. When you do, the group-AUDITOR user’s authority is limited to profiles that are within the scope of that group.
OPERATIONS	A user who has the system wide OPERATIONS attribute has full access authorization to all RACF-protected resources in the classes DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE, and VMRDR classes. You can assign the OPERATIONS attribute at the group level. When you do, the group-OPERATIONS user’s authority is limited to resources within the scope of that group.
CLAUTH	If a user has the CLAUTH attribute in a class, RACF allows the user to define profiles in that class. You cannot assign the CLAUTH attribute at the user or group level.
GRPACC	When a user with the GRPACC attribute creates a data set profile for a group data set, RACF gives UPDATE access authority to other users in the group.
ADSP	The ADSP attribute establishes an environment in which all permanent DASD data sets created by this user are automatically defined to RACF and protected with a discrete profile.
REVOKE	The REVOKE attribute prevents the RACF-defined user from entering the system. REVOKE can be assigned at the group level, in which case the user cannot enter the system and connect to that group.
RESTRICTED	You can prevent RACF users from gaining access to protected resources they are not specifically authorized to access by assigning the RESTRICTED attribute on the ADDUSER or ALTUSER command.
PROTECTED	This attribute is used mainly for started tasks to prevent a user ID from being revoked due to multiple unsuccessful logon attempts. This attribute is assigned implicitly by default. So, if you specify PASSWORD operand with ALU command, it will be removed.
WHEN	Specifies days of the week and hours of the day during which the user has access to the system.

RACF – Access Authority

Rui Miguel Feio — Mon, 07 May 2012 18:36:18 +0000

NONE	Does not allow users to access the data set.
EXECUTE	Allows users to load and execute, but not to read or copy, programs in the library.
READ	Allows users to access the data set for reading only.
UPDATE	Allows users to read from, copy from, or write to the data set. UPDATE does not authorize a user to delete, rename, move, or scratch the data set.
CONTROL	Allows users to retrieve, update, insert, or delete records in the specified data set.
ALTER	Allows users to read, update, delete, rename, move, or scratch the data set.

Disaster Recovery (DR) Tiers

Rui Miguel Feio — Fri, 06 Apr 2012 19:24:10 +0000

Disaster Recovery tiers have been defined in the early 1990s by the Automatic Remote Site Recovery project at SHARE and are as follows:

Tier 0	No Disaster Recovery plan. All data is lost and recovery is not possible.
Tier 1	Pickup Truck Access Method (PTAM) – the system, the subsystem, and the application infrastructure, along with application data, is dumped to tape and transported to a secure facility. All backup data, such as image copies and archived logs that are still onsite will be lost in the event of a disaster (typically up to 24-48 hours of data). Recovery from a disaster involves securing a DR site, installing IT equipment, transporting backup tapes from the secure facility to the DR site, restoring the system, the subsystem, and application infrastructure along with related data, and restarting the workload (typically taking a number of days). Cost factors include securing a site to perform the recovery, creating the backup copy of data, backup tape transportation, and backup tape storage.
Tier 2	PTAM and Hot Site – same as Tier 1 except the enterprise has secured a DR facility in advance. Data loss will be up to 24-48 hours, and recovery will take 24-48 hours. Cost factors include owning a second IT facility or a DR facility subscription fee, in addition to the Tier 1 cost factors.
Tier 3	Electronic vaulting – same as Tier 2 except that the enterprise dumps the backup data to a remotely-attached tape library subsystem. Data loss will be up to 24 hours or less (depending upon when the last backup was created) and the recovery duration will typically be 24 hours or less. Cost factors include telecommunication lines to transmit the backup data and a dedicated tape library subsystem at the remote site, in addition to the Tier 2 cost factors.
Tier 4	Active Secondary Site (electronic remote journaling) – same as Tier 3 except that transaction managers (TM) and Data Base Management System (DBMS) updates are remotely journaled to the DR site. The amount of data loss will be minutes to hours, and the recovery time will be 24 hours or less (the recovery time could be reduced to 2 hours or less if updates are continuously applied to a shadow secondary DBMS image). Cost factors include a staffed, running system in the DR site to receive the updates and disk to store the updates, in addition to the Tier 3 cost factors.
Tier 5	Two-Site Two-Phase Commit – same as Tier 4, with applications performing two-phase commit processing between two sites. Data loss will be seconds and the recovery time will be 2 hours or less. Cost factors include modifying and maintaining the application to add the two-phase commit logic, in addition to the Tier 4 cost factors.
Tier 6	Zero Data Loss (remote copy) – the system, the subsystem, and application infrastructure along with application data is mirrored (copied) from the production site to a DR site. There will be small to zero data loss if using synchronous remote copy, and seconds to minutes if using asynchronous remote copy. The recovery window will be the time required to restart the environment using the secondary disks if they are data consistent (typically less than 2 hours); however, experience has shown that DBMS data at the remote site is unusable in the case of a disaster when using any form of synchronous remote copy. Cost factors include the cost of the telecommunications lines to shadow all of the data updates in real time, in addition to the Tier 4 cost factors.
Tier 7	Geographically Dispersed Parallel Sysplex (GDPS) – GDPS is beyond the SHARE-defined DR tiers because it provides total IT business recovery through the management of processors, systems, and storage resources across multiple sites. GDPS manages not just the physical resources, but also the application environment and the consistency of the data, providing full data integrity (across volumes, subsystems, operating system platforms, and sites), while providing the ability to perform a normal restart in the event of a site switch, thus keeping to a minimum the duration of the recovery window.

Useful Operator Commands

Rui Miguel Feio — Wed, 04 Apr 2012 10:18:50 +0000

MVS Commands
d a,l	All active Address spaces
d a,xy*	Active jobs starting with “XY”
d parmlib	PARMLIB concatenation
d prog,lnklst	Programs defined to Link List
d asm,page=all	Page data sets & utilization of page space
d etr	Sysplex timer
d grs,c	Global resource serialization – contention
d iplinfo	IPL time & bootstrap parms
d m=cpu	Status of logical processors in the LPAR image
d m	Matrix of entire image configuration
d m=stor	Number of bytes of storage the system owns
d m=dev	Status for devices
d wlm,ird	Status of IRD features used
d wlm,systems	Systems in Goal Mode
d wlm,applenv=*	Which Application Environments are active
d j,all	All jobs running on the system
d logger,l	Logger Log Streams
d parmlib	PARMLIB data sets used for this IPL
d omvs,a=all	zOS UNIX address space processes
d omvs,f	HFS file systems currently in use or mounted
d omvs,o	zOS Unix current configuration setting
d omvs,p	PFS (physical file system) configuration information
d omvs,waiters	What Unix threads are waiting on
d omvs,sockets	UNIX Sockets
d a,bpxas	All spwaned and forked initiator BPXAS address spaces
d opdata	Operator Command Prefixes (subsystem’s recognition characters)
d r,l	Outstanding WTORs (Write To Operator withReplys)
d smf	SMF recording dataset status
d symbols	System symbolics
d tcpip,,n,portl	TCP/IP ports being listened on
d tcpip,,n,routes	TCP/IP routes
d tcpip,,n,home	TCP/IP Home
v tcpip,,o,sys1.tcpparms(profilex)	Refresh TCP/IP Profile parms
d prog,apf	List all authorized programs
d trace	All trace settings
d u	Track device allocations
d u,dasd,online,,99	Online DASD devices
d xcf,cpl	XCF parameters and coupled data sets
d xcf,str	All structures in coupling facility and their type
d xcf,cf,cfnm=all	All connections to coupling facility
d xcf,policy,type=cfrm	Coupling Facility Policy
JES2 Displays
$dspl	JES2 Spool utilization (note the “$” prefix for JES2 commands)
$t spooldef	JES2 spool characteristics
$d perfdata	JES2 statistics
$d a	All active JES Jobs
$d srvclass	JES2 targets how many initiators are started in each service class

ISPF – List Last 25 COMMAND LINE Commands

Rui Miguel Feio — Mon, 02 Apr 2012 15:05:09 +0000

Here’s a useful command to be used within ISPF. If you ever want to check the 25 last COMMAND LINE commands you’ve issued just use the command RETP. This will open the “ISPF Retrieve Panel” and will show you the commands you’ve issued.

This is an easy way to not only check what you’ve been doing but also to re-run a command without having to type it all over again.

REXX Standard Error Codes Description

Rui Miguel Feio — Sat, 31 Mar 2012 21:21:04 +0000

The following table contains the description of REXX error codes. Error numbers between 51 and 99 are implementation-dependent. Bear in mind that additional error information may be obtained by requesting the condition built-in function’s optional description value.

Error Code	Description
1	Reserved
2	Reserved
3	Program is unreadable
4	Program interrupted
5	Machine storage exhausted
6	Unmatched “/*” or quote
7	WHEN or OTHERWISE expected
8	Unexpected THEN or ELSE
9	Unexpected WHEN or OTHERWISE
10	Unexpected or unmatched END
11	Control stack full
12	Clause too long
13	Invalid character in program
14	Incomplete DO/SELECT/IF
15	Invalid hexadecimal or binary string
16	Label not found
17	Unexpected PROCEDURE
18	THEN expected
19	String or symbol expected
20	Symbol expected
21	Invalid data on end of clause
22	Invalid character string
23	Invalid SBCS/DBCS mixed string
24	Invalid TRACE request
25	Invalid sub-keyword found
26	Invalid whole number
27	Invalid DO syntax
28	Invalid LEAVE or ITERATE
29	Environment name too long
30	Name or string > 250 characters
31	Name starts with number or “.”
32	Invalid use of stem
33	Invalid expression result
34	Logical value not 0 or 1
35	Invalid expression
36	Unmatched “(” in expression
37	Unexpected “,” or “)”
38	Invalid template or pattern
39	Evaluation stack overflow
40	Incorrect call to routine
41	Bad arithmetic conversion
42	Arithmetic overflow/underflow
43	Routine not found
44	Function did not return data
45	No data specified on function RETURN
46	Invalid variable reference
47	Unexpected label
48	Failure in system service
49	Interpreter failure
50	Reserved

ISPF – Search for a Member in Multiple PDS

Rui Miguel Feio — Fri, 30 Mar 2012 12:03:12 +0000

I’m sure everyone has come across the need of locating a PDS member, but not remembering exactly on which data set the member is. Well, there is a very simple way of doing this using ISPF option 3.4:

On ISPF select option 3.4
Enter the HLQ (High Level Qualifier) of the datasets you want to list to search for the member (ex: TSOUSR or COMP.DAILY)
In the Command Line enter M member_name (ex: let’s suppose the member you want to locate is TESTMEM. In this case you would issue M TESTMEM)
The system will go through all the data sets you’ve selected and try to locate the member name you’ve indicated.
Once it locates the member, the system issues message “Member(s) Found” and at the Message area it will indicate the member name(ex: Member: TESTMEM)

How to Backup/Restore Outlook Email Signatures on MS Office 2010

Rui Miguel Feio — Mon, 26 Mar 2012 19:35:19 +0000

If you’re like me and have more then one PC with MS Outlook and you require to use the same email signature in all of them then these are the steps you need to follow in order to backup/restore your signatures on MS Office 2010:

Backup:

On MS Outlook select File > Options
Select tab Mail on the left side of the “Outlook options” window
Press CTRL key on your keyboard and click on the Signatures button
A Windows Explorer window will be opened showing all the files on the Signatures folder
Select all the files and folders and copy them to where you want your backup to be

Restore:

Select all the files and folders being part of the Signatures from your backup and press CTRL + C to copy them
On MS Outlook select File > Options
Select tab Mail on the left side of the “Outlook options” window
Press CTRL key on your keyboard and click on the Signatures button
A Windows Explorer window will be opened showing the Signatures folder
Press CTRL + V on your keyboard to paste your backup into the Signatures folder