z/OS 2.3 Migration Story

Discussion:

(too old to reply)

Shashi Kumar

2018-11-20 13:41:06 UTC

Hello Mates,

I'm unable to figure out root cause of the below issues after z/OS 2.3
Migration, as Described below

1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product), One
of the batch job got failed due to security issue with batch ID, where as
a batch code with TSO SUMMIT command within the batch job, and it failed
with very first instance after migration, How ever I had reached security
team to provide the required access, security team had code batch ID with
JCL attribute then it got completed successfully, but this batch was
successfully completing in z/OS 2.1 without JCL attribute, must wanted to
know does any new security rules come along with z/OS 2,3 (hoe ever I had
applied all CA z/OS 2.3 compatibility fixes as well), now current problem
is If I move onto production Lpar to migrate, what if all batch ID's fail's
(Which has TSO summit command coded on it), it will be a disaster, can some
tell me, these issue had reported in your system and what action you have
taken to mitigate this issue

Hence I need your suggestion to mitigate this issue before the next
migration.

2. the batch ID had problem with another batch job, where as it was trying
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as
Batch ID previous used to write user catalogue but after migration it tried
to write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.

Need your suggestion find out the root cause of this issue as well.

Thanks and regards,
Shashi

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

Lizette Koehler

2018-11-20 14:02:36 UTC

Permalink

Can you provide the error message that was received? Masking any company specific details.

When you say fails - what specifically fails? What access was needed. What access was available?

Did you go through the V2.3 Migration guide to see if there were any entries that might relate to this issue?

Are there any system exits involved? If so, which ones? Were they reassembled for V2.3?

Are you JES2 or JES3?

Are all LPARs involved at V2.3?

Did you contact CA ACF2 to see if they have any current PTFs or Guidance for your issue?

Thanks

Lizette

-----Original Message-----
Shashi Kumar
Sent: Tuesday, November 20, 2018 6:41 AM
Subject: z/OS 2.3 Migration Story
Hello Mates,
I'm unable to figure out root cause of the below issues after z/OS 2.3
Migration, as Described below
1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product), One of
the batch job got failed due to security issue with batch ID, where as a
batch code with TSO SUMMIT command within the batch job, and it failed with
very first instance after migration, How ever I had reached security team to
provide the required access, security team had code batch ID with JCL
attribute then it got completed successfully, but this batch was successfully
completing in z/OS 2.1 without JCL attribute, must wanted to know does any
new security rules come along with z/OS 2,3 (hoe ever I had applied all CA
z/OS 2.3 compatibility fixes as well), now current problem is If I move onto
production Lpar to migrate, what if all batch ID's fail's (Which has TSO
summit command coded on it), it will be a disaster, can some tell me, these
issue had reported in your system and what action you have taken to mitigate
this issue
Hence I need your suggestion to mitigate this issue before the next
migration.
2. the batch ID had problem with another batch job, where as it was trying
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as Batch
ID previous used to write user catalogue but after migration it tried to
write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.
Need your suggestion find out the root cause of this issue as well.
Thanks and regards,
Shashi

Tom Sims

2018-11-20 14:15:47 UTC

Permalink

Point of clarification, are you migrating from zOS 2.1 with ACF2 R16
already in place, or are you migrating from ACF2 R(e.g.)15 to R16 as well?

TIA
Tom Sims

Carmen Vitullo

2018-11-20 14:45:19 UTC

Permalink

I upgraded ACF2 back in preporeation for Y2K and as I recall, when I installed toleration I had to restore and reapply my usermods, some of those usermods dealt with TSO submit exit processing and CICS signon processing, did you have to reject/restore any usermods and if so did you reapply ?

Carmen Vitullo

----- Original Message -----

From: "Shashi Kumar" <***@GMAIL.COM>
To: IBM-***@LISTSERV.UA.EDU
Sent: Tuesday, November 20, 2018 7:41:25 AM
Subject: z/OS 2.3 Migration Story

Hello Mates,

I'm unable to figure out root cause of the below issues after z/OS 2.3
Migration, as Described below

1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product), One
of the batch job got failed due to security issue with batch ID, where as
a batch code with TSO SUMMIT command within the batch job, and it failed
with very first instance after migration, How ever I had reached security
team to provide the required access, security team had code batch ID with
JCL attribute then it got completed successfully, but this batch was
successfully completing in z/OS 2.1 without JCL attribute, must wanted to
know does any new security rules come along with z/OS 2,3 (hoe ever I had
applied all CA z/OS 2.3 compatibility fixes as well), now current problem
is If I move onto production Lpar to migrate, what if all batch ID's fail's
(Which has TSO summit command coded on it), it will be a disaster, can some
tell me, these issue had reported in your system and what action you have
taken to mitigate this issue

Hence I need your suggestion to mitigate this issue before the next
migration.

2. the batch ID had problem with another batch job, where as it was trying
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as
Batch ID previous used to write user catalogue but after migration it tried
to write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.

Need your suggestion find out the root cause of this issue as well.

Thanks and regards,
Shashi

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

Shashi Kumar

2018-11-20 14:58:54 UTC

Permalink

Hi Mate,

yes, when Applied compatible fixes, I had re-applied One of userexist for
TSO as well.

Hope you got my error screenshot in previous email, thing is its failing
only with TSO SUMMIT command coded internally, But at this moment I'm
unable bypass this. Thanks

Post by Carmen Vitullo
I upgraded ACF2 back in preporeation for Y2K and as I recall, when I
installed toleration I had to restore and reapply my usermods, some of
those usermods dealt with TSO submit exit processing and CICS signon
processing, did you have to reject/restore any usermods and if so did you
reapply ?
Carmen Vitullo
----- Original Message -----
Sent: Tuesday, November 20, 2018 7:41:25 AM
Subject: z/OS 2.3 Migration Story
Hello Mates,
I'm unable to figure out root cause of the below issues after z/OS 2.3
Migration, as Described below
1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product), One
of the batch job got failed due to security issue with batch ID, where as
a batch code with TSO SUMMIT command within the batch job, and it failed
with very first instance after migration, How ever I had reached security
team to provide the required access, security team had code batch ID with
JCL attribute then it got completed successfully, but this batch was
successfully completing in z/OS 2.1 without JCL attribute, must wanted to
know does any new security rules come along with z/OS 2,3 (hoe ever I had
applied all CA z/OS 2.3 compatibility fixes as well), now current problem
is If I move onto production Lpar to migrate, what if all batch ID's fail's
(Which has TSO summit command coded on it), it will be a disaster, can some
tell me, these issue had reported in your system and what action you have
taken to mitigate this issue
Hence I need your suggestion to mitigate this issue before the next
migration.
2. the batch ID had problem with another batch job, where as it was trying
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as
Batch ID previous used to write user catalogue but after migration it tried
to write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.
Need your suggestion find out the root cause of this issue as well.
Thanks and regards,
Shashi
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

Carmen Vitullo

2018-11-20 15:00:57 UTC

Permalink

this listgroup does not support images unfortunately, but knowing you re applied the usermods helps

Carmen Vitullo

----- Original Message -----

From: "Shashi Kumar" <***@GMAIL.COM>
To: IBM-***@LISTSERV.UA.EDU
Sent: Tuesday, November 20, 2018 8:59:13 AM
Subject: Re: z/OS 2.3 Migration Story

Hi Mate,

yes, when Applied compatible fixes, I had re-applied One of userexist for
TSO as well.

Hope you got my error screenshot in previous email, thing is its failing
only with TSO SUMMIT command coded internally, But at this moment I'm
unable bypass this. Thanks

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

Mike Schwab

2018-11-20 15:24:33 UTC

Permalink

If you are try to update the Master Catalog you don't have an alias to
send those entries to a user catalog. Probably a mistake when you
tried to create the new master catalog or fall back to the old
catalog.

Post by Shashi Kumar
Hello Mates,
I'm unable to figure out root cause of the below issues after z/OS 2.3
Migration, as Described below
1. Once we migrated from z/OS 2.3 (With CA ACF2 V16 security product), One
of the batch job got failed due to security issue with batch ID, where as
a batch code with TSO SUMMIT command within the batch job, and it failed
with very first instance after migration, How ever I had reached security
team to provide the required access, security team had code batch ID with
JCL attribute then it got completed successfully, but this batch was
successfully completing in z/OS 2.1 without JCL attribute, must wanted to
know does any new security rules come along with z/OS 2,3 (hoe ever I had
applied all CA z/OS 2.3 compatibility fixes as well), now current problem
is If I move onto production Lpar to migrate, what if all batch ID's fail's
(Which has TSO summit command coded on it), it will be a disaster, can some
tell me, these issue had reported in your system and what action you have
taken to mitigate this issue
Hence I need your suggestion to mitigate this issue before the next
migration.
2. the batch ID had problem with another batch job, where as it was trying
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as
Batch ID previous used to write user catalogue but after migration it tried
to write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.
Need your suggestion find out the root cause of this issue as well.
Thanks and regards,
Shashi
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

--
Mike A Schwab, Springfield IL USA
Where do Forest Rangers go to get away from it all?

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

Shashi Kumar

2018-11-21 12:39:04 UTC

Permalink

Hello Mate,

Please find my response below.

Can you provide the error message that was received? Masking any company
specific details. - Attached

When you say fails - what specifically fails? What access was needed.
What access was available? - CA Endevor batch job got failed due to it has
been coded with TSO SUMMIT within the job, after migration it failed, We
had coded batch ID with JCL attribute.

Did you go through the V2.3 Migration guide to see if there were any
entries that might relate to this issue? - I haven't find any relevant
solution for this root cause, we had fixed during issue, but unaware what
had changed with z/OS 2.3

Are there any system exits involved? If so, which ones? Were they
reassembled for V2.3? - there was system exit involved, and I had assembled
accordingly to my environment, but still this issue occurred

Are you JES2 or JES3? - JES2

Are all LPARs involved at V2.3? - Test and Development

Did you contact CA ACF2 to see if they have any current PTFs or Guidance
for your issue? - I had applied all z/OS 2.3 compatible fixes before z/OS
migration, Yes, I had reported this issue with CA, but they denied and told
to contact IBM support to check the z/OS internal security. no help or root
cause solution came from them

I'm already running CA ACF2 Version 16 before the z/OS 2.3 Migration.

MCAT Error, which I got after z/OS upgrade as below

13.02.58 JOB03405 ---- TUESDAY, 18 SEP 2018 ----

13.02.58 JOB03405 £HASP373 N1VRELD1 STARTED - INIT 24 - CLASS C -
SYS FRED

13.02.58 JOB03405 ACF9CCCD USERID N1V00000 IS ASSIGNED TO THIS JOB -
N1VRELD1

13.02.58 JOB03405 IEF403I N1VRELD1 - STARTED - TIME=13.02.58

13.03.22 JOB03405 GSDMV20I JOBNAME- --STEP-- -PSTEP-- CCODE ELAPSED-TIME
-CPU-TIME-

13.03.22 JOB03405 GSDMV21I N1VRELD1 S01LIST 0
00:00:23 0.14S

13.03.37 JOB03405 ACF99913 ACF2
VIOLATION-04,05,N1V00000,,SYS1.MCATV2R1.VMG3MC1,N/A

13.03.38 JOB03405 GSDMV21I N1VRELD1 S02ANAL 990
00:00:16 0.16S

13.03.39 JOB03405 GSDMV21I N1VRELD1 S03LIST FLUSH
00:00:00 0.00S

13.03.39 JOB03405 GSDMV21I N1VRELD1 S04ANAL FLUSH
00:00:00 0.00S

13.03.40 JOB03405 GSDMV21I N1VRELD1 S99MAIL 0
00:00:01 0.00S

13.03.40 JOB03405 IEF404I N1VRELD1 - ENDED - TIME=13.03.40

13.03.40 JOB03405 GSDMV22I -N1VRELD1 ENDED. NAME-ENDEVOR SUPPORT
TOTAL CPU TIME= .00 TOTAL ELAPSED TIME= .70

13.03.40 JOB03405 £HASP395 N1VRELD1 ENDED - RC=0990

PROCESS FIRST OCCURRENCES OF ELEMENT AND TYPE

RETURN CODE 0000 REASON CODE 0000 RECORDS SELECTED 00005102 RECORDS
RETURNED 00005102

1ACF0C038 ACF2 LOGONID ATTRIBUTES HAVE REPLACED DEFAULT USER ATTRIBUTES

ENTRY (A) NEV.P.TEMP.D180918.T130327.ELEMENT DELETED

INVALID DATA SET NAME, NEV.P.C4069785.P£££££££.ELEMENT.TABLE

ISPF system data set allocation error - press Enter to continue.

Temporary control card data set cannot be allocated.

DAIR RC = 12 dec, DARC = 970C hex.

ISPF102 No work file -/-Work file not open.

READY

END

Thanks and Regards,
Shashi

Post by Mike Schwab
If you are try to update the Master Catalog you don't have an alias to
send those entries to a user catalog. Probably a mistake when you
tried to create the new master catalog or fall back to the old
catalog.

One

Post by Shashi Kumar
of the batch job got failed due to security issue with batch ID, where as
a batch code with TSO SUMMIT command within the batch job, and it failed
with very first instance after migration, How ever I had reached security
team to provide the required access, security team had code batch ID with
JCL attribute then it got completed successfully, but this batch was
successfully completing in z/OS 2.1 without JCL attribute, must wanted to
know does any new security rules come along with z/OS 2,3 (hoe ever I had
applied all CA z/OS 2.3 compatibility fixes as well), now current problem
is If I move onto production Lpar to migrate, what if all batch ID's

fail's

Post by Shashi Kumar
(Which has TSO summit command coded on it), it will be a disaster, can

some

Post by Shashi Kumar
tell me, these issue had reported in your system and what action you have
taken to mitigate this issue
Hence I need your suggestion to mitigate this issue before the next
migration.
2. the batch ID had problem with another batch job, where as it was

trying

Post by Shashi Kumar
to write to master catalogue (however I had try to create a new master
catalogue during migration unfortunately it didn't work out), where as
Batch ID previous used to write user catalogue but after migration it

tried

Post by Shashi Kumar
to write on master catalogue directly, and previously it didn't had write
access, only it had read access to master catalogue.
Need your suggestion find out the root cause of this issue as well.
Thanks and regards,
Shashi
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

--
Mike A Schwab, Springfield IL USA
Where do Forest Rangers go to get away from it all?
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,