1. IBM Tivoli Workload Scheduler for Host 8
IBM Tivoli Workload Scheduler for Host 8.2 PK Z/OS V1R7 COMPATIBILITY FOR TWS
PK TO IMPROVE SERVICEABILITY AND ERROR HANDLING IN AN END-TO-END ENVIRONMENT
Steve Viola – Level 2 support

2. PK06227 – Compatibility for z/OS 1.7
Modification for EXIT7 (OPCAXIT7)
New EXIT51 (TWSXIT51)
Minor enhancements
Access Register Initialization
Console Initialization Change for EQQINIT
9/22/2018

3. PK06227 – Compatibility for z/OS 1.7
PTFS for 8.1:
UK05574 and UK05582
PTFS for 8.2:
UK05575 and UK05583
9/22/2018

4. PK06227 – Compatibility for z/OS 1.7
For z/OS 1.7, JES2 EXIT7 for TWS will not assemble without PK06227 being applied
For z/OS 1.7, JES2 EXIT7 is not called for input phase processing. EXIT51 is used instead
EXIT51 is needed for tracking of STCs and handling of JES input errors (example: bad JECL)
9/22/2018

5. PK06227 – Compatibility for z/OS 1.7
Installation Steps:
Apply PTFs
Run EQQJOBS for new SEQQSAMP members
Assemble and link EXIT7 (all z/OS) and EXIT51(z/OS 1.7 only)
SMPE: EQQJES2U and EQQJES2V
Non-SMPE: EQQJES2 and EQQJES21
Define EXIT51 to JES2 (z/OS 1.7 only)
Ensure subsystem modules are loaded at IPL
9/22/2018

6. PK06227 – Compatibility for z/OS 1.7
Define EXIT51 to JES2 (load module TWSXIT51)
LOAD(TWSXIT51) EXIT(51) ROUTINES=TWSENT51,STATUS=ENABLED
Ensure that TWSXIT51 is in LNKLST or LPALIB so that JES2 can load it
Subsystem modules modified by PK06227 must be loaded after IPL:
8.1 EQQSSCME and EQQINITE
8.2 EQQSSCMF and EQQINITF
9/22/2018

7. PK06227 – Compatibility for z/OS 1.7
WARNING: The PTFs for PK06227 may be applied at ANY level of z/OS, however EXIT51 can ONLY be defined at z/OS 1.7 level or higher
If PK06227 is installed on z/OS 1.7 and EXIT7 is reassembled but EXIT51 is NOT defined, most TWS functions will work except for tracking of STCs and invalid JECL statements. Example:
/*ROUTE PRINX TSO
9/22/2018

8. PK06227 – Compatibility for z/OS 1.7
Error messages if EXIT51 used on pre-z/OS 1.7:
$HASP466 PARMLIB STMT LOAD(TWSXIT51)
$HASP003 RC=(31),LOAD(TWSXIT51) - MODULE COULD NOT BE LOADED
*01 $HASP469 REPLY PARAMETER STATEMENT, CANCEL, OR END
REPLY: END
9/22/2018

9. PK06227 – Compatibility for z/OS 1.7
Error messages if EXIT51 used on pre-z/OS 1.7:
*$HASP451 ERROR ON JES2 PARAMETER LIBRARY
*02 $HASP441 REPLY 'Y' TO CONTINUE INITIALIZATION OR 'N' TO TERMINATE
REPLY : Y
9/22/2018

10. PK06227 – Compatibility for z/OS 1.7
Error messages if EXIT51 used on pre-z/OS 1.7:
$HASP857 WARNING - EXIT051 NOT DEFINED WITHIN CURRENTLY LOADED JES2 MODULES
$HASP858 EXIT ROUTINE TWSENT51 (EXIT051) NOT FOUND
*$HASP859 REQUESTED EXIT ROUTINE(S) NOT FOUND
*03 $HASP441 REPLY 'Y' TO CONTINUE INITIALIZATION OR 'N' TO TERMINATE
REPLY : Y
9/22/2018

11. z/OS 1.7 compatibility: subsystem name table
At z/OS 1.7 level, JES2 R4 mode is no longer supported (JES2 is always ACTIVATED in Z2 mode).
This means any pre-TWS subsystem definitions for controllers or trackers will cause S0C1 abends in JES2 (OPC 2.3 or lower)
Before IPLing on z/OS 1.7, make sure all TWS subsystems use EQQINITE or EQQINITF
9/22/2018

12. z/OS 1.7 compatibility: subsystem name table
You CANNOT use BUILDSSX and SSCMNAME parameters to change a pre-TWS subsystem definition to a TWS 8.1 or 8.2 subsystem definition if JES2 is in Z2 mode.
Even if no controller or tracker is started for a pre-TWS subsystem, JES2 will still abend S0C1 if JES2 is in Z2 mode.
9/22/2018

13. QUESTIONS
&
ANSWERS
9/22/2018

14. PK01415 : Serviceability and Error Handling for E2E
The following slides are based on a presentation given by TWS level 3:
Paolo Falsi
Silvia Fama’
Annarita Carnevale
PK01415 is for TWS 8.2 only
9/22/2018

15. PK01415 : Serviceability and Error Handling for E2E
Additional APARS: Some problems discovered after PK01415 have been corrected by these APARS:
PK11095
PK11182
PK11351
9/22/2018

16. Problems addressed by this PK01415
CEEDUMP and SYSMDUMP are collected.
USS files corruptions and/or contentions when multiple AS are generated for the server.
Policy for process restart when an abend occurs.
Lack of Problem Determination information and messages during the daily planning phase.
Lack of Problem Determination information when a file corruption occurs.
Wrong definitions of server and daily planning batch job users and groups.
9/22/2018

17. CEEDUMP and SYSMDUMP are collected
9/22/2018

18. CEEDUMP and SYSMDUMP are collected
Prior to PK01415, when a server started task abends in the C/C++ code, a CEEDUMP (LE Dump) of the original abend and a SYSMDUMP with completion code U4039 are taken. The CEEDUMP contains just partial data related to the address space and it's not enough for a complete error analysis.
with PK01415
The SYSMDUMP of the original abend is now collected containing also the LEDATA and CEEDUMP information.
9/22/2018

19. Documentation changes
Diagnosis Guide and Reference
Applied the following changes:
• In Chapter 2. Initial Problem Analysis, section “Problem-Type Keywords”, delete the following sentence from the description of the ABEND keyword:
If you are using the end-to-end feature, you could find the CEEDUMP.* dump file in USS in the /tmp or /homedir directory of the user to which the server started-task is associated (using the STC option).
• In Chapter 3. Problem Analysis Procedures, section “Information Needed for All Problems”, delete item 8c from the list:
Collect the CEEDUMP file if it exists
9/22/2018

20. USS file corruption and/or contention when multiple AS (address space) are generated for the server.
9/22/2018

21. USS file corruption and/or contention when multiple address spaces are generated for the server
Customer experienced event files corruption and/or contention when the TWS server generated processes with parent process id (ppid) equal to 1 (for instance Batchman process). The reason for this problem was the cancel of the server started task when multiple address spaces have been generated (only one Address Space must be generated for all the server tasks/processes/threads).
with PK01415
To avoid the generation of multiple address spaces we made the following changes:
Rework of the environmental variables handling; in particular the _BPX_SHAREAS variable is now always set to YES for all the processes and threads.
Batchman, mailman and writers processes have the same PGID of the netman process.
9/22/2018

22. Environment variable checks (1 of 3)
The putenv() function adds a new environment variable or changes the value of an existing one
Before z/os 1.2, the system copied the string inserted in the putenv call into system allocated storage. Now each setting of envvar requires memory allocation to be executed by the caller program.
9/22/2018

23. Environment variable checks (2 of 3)
PK01415
Allocate storage for each environment variable before calling putenv() function
A check on each putenv return code has been added in order to check if a putenv of an environment variable gets an error
9/22/2018

24. Environment variable checks (3 of 3)
The following error messages are printed in the server MLOG if the putenv() return code is not equal to zero:
EQQ3129E module_name PUTENV environment_variable_string FAILED
EQQPT68E PUTENV() environment_variable FAILED ERRNO=error_number: error_message, REASON=reason
9/22/2018

25. _BPX_SHAREAS environment variable
By setting _BPX_SHAREAS to YES, the z/OS will run foreground processes in the same address space that the parent process is running in.
The environment variables that affect spawn processing are the ones that are passed into the spawn syscall.
The putenv() call, with _BPX_SHAREAS equal to YES, is present more that one time in the code. This situation could produce errors in setting this environment variable
with PK01415
This value is set in the USS environment variable only in the Starter process and should be inherited by the child processes because are provided in the spawn syscall
9/22/2018

26. Netman and all the processes started by it now have the same PGID
Process PGID
Mailman, batchman and writer processes have a PGID different from netman
Netman and all the processes started by it now have the same PGID
PK01415
9/22/2018

27. PGID (process group id)
Each process in a process group shares a process group ID (PGID), which is the same as the PID of the first process in the process group. This ID is used for signaling related processes, for example a KILL signal (SIGKILL).
D OMVS,A=ALL output shows PID and PPID but not the PGID. To see PGID values, use TSO OMVS command: ps –ef –o pid,ppid,pgid,comm (see output on next slide)
9/22/2018

28. Ps –ef display 1 PID PPID PGID COMMAND 1 0 1 BPXPINPR 2 1 2 EZBTCPIP
/bin/ps
EZBTTSSL
EZBTMCTL
EZACFALG
EZASASUB
EZBTTMST
9/22/2018

29. Ps –ef display 2 (grep for TWS)
Ps –ef –o pid,ppid,pgid,comm | grep TWS
/u/tws82bin/netman
/u/tws82bin/translator
/u/tws82bin/mailman
/u/tws82bin/writer
/u/tws82bin/starter
/u/tws82bin/batchman
9/22/2018

30. Process display showing relationships
PID PPID PGID CMD
EQQPHTOP
starter
netman
translator
writer
mailman
batchman
9/22/2018

31. Policy for process restart when an abend occurs
9/22/2018

32. Policy for process restart when an abend occurs
Before PK01415: In case of fatal errors (abends), the Starter process restarts his children indefinitely.
with PK01415
NEW translator and netman process policy
NEW mailman and batchman process policy
9/22/2018

33. NEW translator and netman process policy
The restart process has been changed in the following way:
=> If translator goes down then starter tries to restart it after no more than 5 minutes.
=> If netman goes down, then mailman, batchman and writers go down. Because translator is strictly related to batchman and mailman, translator goes down also. Also in this case starter tries to restart netman and translator after no more than 5 minutes.
Starter tries to restart translator and netman just once; anyway if an abend occurs after more than 2 hours since the last process restart, a new restart is attempted. If the problem persists then message EQQPT63E is logged and starter closes.
9/22/2018

34. PK01415 Message flow related to the process policy
START TIME
the following msgs related to processes will be written in MLOG
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/starter" has been started, pid is
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/translator" has been started, pid
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/netman" has been started, pid is
the following msg related to netman process will be written in xxx_NETMAN.log
AWSEDW075I Netman (pid= pgid= ) was started by the starter process (pid= pgid= )
the following msgs related to mailman/batchman/writer processes will be written in xxx_TWSMERGE.log
AWSBCV138I Mailman (pid= pgid= ) was started by netman (pid= pgid= )
AWSBCW056I Writer (pid= pgid= ) was started by netman (pid= pgid= )
AWSBCV108I Started Batchman, pin 763 (old message)
9/22/2018

35. PK01415 Translator policy example (1 of 2)
TRANSLATOR DOWN (kill command issued)
the following msgs will be written in MLOG
EQQPT11I The Translator process (pid=xxxxxxxx) has been killed by signal SIGKILL
TRANSLATOR RESTART
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/translator" has been started, pid is
EQQPT20I Input Translator waiting for Batchman and Mailman are started
EQQPT21I Input Translator finished waiting for Batchman and Mailman
the following msgs related to mailman/batchman/writer processes will be written in xxx_TWSMERGE.log
AWSBCV138I Mailman (pid=xxxx pgid=xxxx) was started by netman (pid=xxxx pgid=xxxx)
AWSBCW056I Writer (pid=xxxx pgid=xxxx) was started by netman (pid=xxxx pgid=xxxx)
AWSBCV108I Started Batchman, pin xxxx (old message)
9/22/2018

36. PK01415 Translator policy example (2 of 2)
TRANSLATOR DOWN (kill command issued after 2 mins)
the following msgs will be written in MLOG
EQQPT16E The Translator process ended abnormally for twice. Starter and his child processes beginning to shut down
EQQPT11I The Translator process (pid= ) has been killed by signal SIGKILL
EQQPT12I The Netman process ended successfully
EQQPT10I All Starter's sons ended
TRANSLATOR DOWN (kill command issued after 3 hours)
EQQPT11I The Translator process (pid=xxxxxxxx) has been killed by signal SIGKILL
TRANSLATOR RESTART
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/translator" has been started, pid is xxxxxxx
EQQPT20I Input Translator waiting for Batchman and Mailman are started
EQQPT21I Input Translator finished waiting for Batchman and Mailman
9/22/2018

37. PK01415 Netman policy example
NETMAN DOWN (kill command issued)
the following msgs will be written in MLOG
EQQPT11I The Netman process (pid=xxxxxx) has been killed by signal SIGKILL
EQQPT09E The Mailman and/or Batchman process (pid=Unknown) ended abnormally
EQQPT33E Mailman or Batchman ended abnormally. Translator beginning to shut down
EQQPT40I Output Translator thread is shutting down
EQQPT53I Output Translator thread has terminated
EQQPT40I Input Translator thread is shutting down
EQQPT53I Input Translator thread has terminated
EQQPT40I Input Writer thread is shutting down
EQQPT53I Input Writer thread has terminated
EQQPT12I The Translator process ended successfully
NETMAN RESTART
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/translator" has been started, pid is
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/netman" has been started, pid is
EQQPT20I Input Translator waiting for Batchman and Mailman are started
EQQPT21I Input Translator finished waiting for Batchman and Mailman
9/22/2018

38. PK01415 mailman and batchman process policy
In case of error (abend) in the mailman or batchman processes the following message will be printed in the MLOG
EQQPT33E MAILMAN OR BATCHMAN ENDED ABNORMALLY. TRANSLATOR BEGINNING TO SHUT DOWN
After that also translator goes down and then its restart policy applies.
9/22/2018

39. Batchman policy example
BATCHMAN DOWN (kill command issued after 2 mins)
the following msgs will be written in MLOG
EQQPT09E The Mailman and/or Batchman process (pid=Unknown) ended abnormally
EQQPT33E Mailman or Batchman ended abnormally. Translator beginning to shut dow
EQQPT40I Output Translator thread is shutting down
EQQPT53I Output Translator thread has terminated
EQQPT40I Input Translator thread is shutting down
EQQPT53I Input Translator thread has terminated
EQQPT40I Input Writer thread is shutting down
EQQPT53I Input Writer thread has terminated
EQQPT12I The Translator process ended successfully
BATCHMAN RESTART
EQQPT01I Program "/usr/lpp/TWS/TWS820anna/bin/translator" has been started, pid is
EQQPT20I Input Translator waiting for Batchman and Mailman are started
EQQPT21I Input Translator finished waiting for Batchman and Mailman
9/22/2018

40. Documentation changes
Messages and Codes
The following msgs have been added:
EQQPT16E THE PROC PROCESS ENDED ABNORMALLY TWICE. STARTER AND CHILD PROCESSES BEGINNING TO SHUT DOWN
EQQPT33E MAILMAN OR BATCHMAN ENDED ABNORMALLY. TRANSLATOR BEGINNING TO SHUT DOWN
Tivoli Workload Scheduler Administration and Troubleshooting
AWSBCV138I Mailman (pid = xxx, pgid= xxx) was started by netman (pid= xxx, pgid = xxx).
AWSBCW056I Writer (pid = xxx, pgid= xxx) was started by netman (pid= xxx, pgid= xxx).
AWSEDW075I Netman (pid = xxx, pgid = xxx) was started by the starter process (pid = xxx, pgid = xxx).
9/22/2018

41. Lack of Problem Determination information and messages during the daily planning phase.
9/22/2018

42. Lack of Problem Determination information and messages during the daily planning phase.
Added new MLOG messages for DP Batch, Controller and Server
during the daily planning phase.
Added new TWSworkdir/stdlist/logs/xxxxxxxx_E2EMERGE.log Server messages
during the CPUs stopping.
during the translator checkpoint file change
9/22/2018

43. New messages for MLOG during a DP extend(underlined) (1 of4)
BATCH
CONTROLLER
SERVER
EQQ3131I WAITING FOR A CP BACKUP
EQQN121I START OF DAILY PLANNING ACTIVITY
EQQN051I A CURRENT PLAN BACKUP PROCESS HAS STARTED
EQQN012I OPC JOB TRACKING EVENTS ARE NOW BEING……………..
EQQN090I THE JOB TRACKING LOG DATA SET…………………..
EQQN115I WAITING FOR NCP
EQQ3132I CREATING A NEW NCP
EQQ3105I A NEW NCP HAS BEEN CREATED
EQQ3133I INITIALIZING OF NEW SYMPHONY FILE (RUN NUMBER = &RUNNUMB)
EQQ3106I Waiting for SCP
EQQN116I A NEW NCP HAS BEEN CREATED
(EQQN122I START OF SYMPHONY RENEW ACTIVITY)
EQQN117I SYNCRONIZATION BETWEEN CONTROLLER AND SERVER STARTED
(send the SYNC S event to Server)
9/22/2018

44. New messages for MLOG during a DP extend(underlined) (2 of4)
EQQPT30I Starting switching Symphony
EQQPT75I Syncronization between Server and Controller started
EQQPT39I Stopping Mailman and Batchman processes
EQQPT12I The Mailman process (pid=xxx) ended successfully
EQQPT12I The Batchman process (pid=xxx) ended successfully
EQQPT39I Stopping Input Translator Thread activities
EQQPT24I Syncronization between Server and Controller ended
EQQPT22I Input Translator thread stopped until new Symphony will be available
(send the SYNC E to Controller)
EQQZ195I SYNCRONIZATION BETWEEN CONTROLLER AND SERVER ENDED
(EQQ3091E OPC FAILED TO SYNCHRONIZE WITH THE END-TO-END DISTRIBUTED ENVIRONMENT )
EQQPT39I Sstopping all FTWs
EQQPT70I The stop command has been sent to all the reachable FTWs
EQQPT71I Waiting for new SCP
9/22/2018

45. New messages for MLOG during a DP extend(underlined) (3 of4)
EQQN051I A CURRENT PLAN BACKUP PROCESS HAS STARTED
EQQN012I OPC JOB TRACKING EVENTS ARE NOW BEING……………..
EQQN118I NEW SCP HAS BEEN CREATED
(send SYNC Y event to Server)
EQQ3107I SCP is ready: Start jobs addition to Symphony file
EQQ3108I JOBS ADDITION TO SYMPHONY FILE COMPLETED
EQQ3087I SYMNEW FILE HAS BEEN CREATED
EQQN090I THE JOB TRACKING LOG DATA SET………………….
EQQPT72I Current plan is executing again
EQQN111I A new Symphony file has been created
(send SYNC R event to Server)
EQQPT73I New Symphony file (run numbers=xxx) is ready
EQQPT74I Starting Mailman and Batchman processes
9/22/2018

46. New messages for MLOG during a DP extend(underlined) (4 of4)
EQQPT74I Starting Input Translator activities
EQQPT31I Symphony successfully switched
(send SYNC X event to Controller)
EQQW090I The new Symphony file has been successfully switched
EQQPT20I Input Translator waiting for Batchman and Mailman are started
EQQPT21I Input Translator finished waiting for Batchman and Mailman
EQQPT23I Input Translator thread is running
9/22/2018

47. New messages for TWSworkdir/stdlist/logs/xxxxxxxx_E2EMERGE.log
EQQPT64I
STOP COMMAND SENT TO FAULT TOLERANT WORKSTATION CPUNAME
EQQPT65I
STOP COMMAND SENT TO OPCMASTER
EQQPT69I
SENDING STOP COMMAND TO FAULT TOLERANT WORKSTATION CPUNAME
EQQPT66I
Value contained in the Server checkpoint file: key = value
9/22/2018

48. EQQPT66I message description
EQQPT66I = Value contained in the Server checkpoint file: key = value
EQQPT66I message prints some Translator Checkpoint file useful variables values at server startup and when these variables are changed.
The variables (key) values can be the following:
FirstValidSymRun: The First Valid Symphony Run Number used by the server.
CPAvailable: Is the SCP (copy of the active Current Plan) available or not
SymAvailable: Is a new Symphony available to the server
SymRunNumber: Current Symphony Run Number
CPRunNumber: The Symphony Run Number in relation to the active current plan.
SpecialSynchStart: Is a “special” synchronization in progress
9/22/2018

49. Lack of Problem Determination information when a file corruption occurs
9/22/2018

50. New trace mechanism to get useful information to be used during problem determination
API are provided to the developers to instrument the code
Implemented for every USS Server process
It is a “wrapping trace”
Two trace types are available for every process:
Short trace
with record length = 3*fullword = 48 byte
with records number = header record
Long trace
with record length = 13*fullword = 208 byte
with records number = header record
9/22/2018

51. Actual instrumentations using the trace in memory
Written a record for every write/open, in order to do checks to understand a file corruption reasons and the corruption author
A dump will be taken when an error occur accessing an event file showing one of the following messages:
EQQPT67E Dump was taken for Problem Determination purpose
AWSDDW008E A memory dump was taken to assist in determining the problem
9/22/2018

52. Wrong definition of server and daily planning batch job users and groups
9/22/2018

53. Wrong definitions of server and Daily planning batch job users and groups (1 of 3)
Wrong definition of users or groups may introduce serious errors in an E2E environment. Multiple checks have been introduced to prevent these errors and to signal wrong definitions to user.
Using E2E, user assigned to Server or DP batch must have a correct definition on RACF database:
·         user must have defined an OMVS segment (UID)
·         his default group must have defined an OMVS segment (GID)
Every user defined on RACF database with the same UID of user assigned to Server or DP batch must belong to a group with a defined GID.
9/22/2018

54. Wrong definitions of server and Daily planning batch job users and groups (2 of 3)
Checks added:
At start Server and DP batch checks if user assigned has a valid definition; then checks if users with the same UID, belong to a group with a GID defined.
Server makes the same checks every five minutes.
Every user or group checked, that doesn’t have an OMVS segment assigned, is reported in EQQMLOG with an error message.If there is a RACF access error, the problem is reported with a warning message in EQQMLOG.
If DP batch finds an error it stops with return code 12, except for Symphony Renew that stops with return code 8.
if Server finds an error it doesn't stop, but issues an error message.
9/22/2018

55. Wrong definitions of server and Daily planning batch job users and groups (3 of 3)
Note: besides the security items checked with PK01415, every userid that runs a DP batch job and the controller and E2E server userids must belong to group eqqGID (specified in job EQQPCS05). However, this is NOT being checked even with PK01415 applied.
Error messages if userid does NOT belong to group eqqGID are shown in the next slide:
9/22/2018

56. Errors if userid does not belong to eqqGID
ICH408I USER(USER7 ) GROUP(OMVS ) NAME(TEST USER) /var/TWS820/inst/Symphony CL(DIRSRCH ) FID(01D9F0F1F9F1C5000F B0000) INSUFFICIENT AUTHORITY TO OPEN ACCESS INTENT(--X) ACCESS ALLOWED(OTHER ) EFFECTIVE UID( ) EFFECTIVE GID(
EQQ3088E THE SYMPHONY FILE HAS NOT BEEN CREATED
9/22/2018

57. Enhancement request to add eqqGID checking:MR
9/22/2018

58. Additional APARs which correct problems after PK01415
PK01195 : MESSAGE EQQZ404W TEXT CONTAINS THE LITERAL &UUID BUT IT SHOULD HAVE THE VALUE OF THE USERID INSTEAD
PTF: UK06934 is available
9/22/2018

59. Additional APARs which correct problems after PK01415
PK11182 : MESSAGE EQQZ404W (ADDED BY APAR PK01415 ) MAY BE ISSUED INCORRECTLY. BPX_DEFAULT_USER IS NOT CHECKED
APAR is currently open, but an APARFIX is available from level 2 support
More information on the security considerations corrected by PK11182 later in this presentation
9/22/2018

60. Additional APARs which correct problems after PK01415
PK11351: AFTER PK01415 IS APPLIED, A SYMPHONY RENEW JOB ENDS WITH RC=12 (should be RC=08)
PTF: UK07035 is still open, but an APARFIX is available from level 2 support
9/22/2018

61. Security issues resolved by PK11182
After applying PK01415, security problems resulted for the following environments:
If BPX_DEFAULT_USER is set up so that ANY user without an explicit OMVS segment inherits the OMVS segment from the default user
If IRRIRA00 has been executed so that STAGE 3 is in effect (see z/OS Security Server RACF System Programmer's Guide)
9/22/2018

62. BPX_DEFAULT_USER
If the default user is set up with a valid shell (for example: PROGRAM('/bin/sh') ) then any userid is allowed OMVS access. However, the checking done by PK01415 expects an EXPLICIT OMVS segment to be defined. If a user that picks up the default segment attempts to run a CP batch job, these messages are issued:
EQQZ401E USER BPXDEF HAS NO VALID UID
EQQZ400E A USER ID DEFINITION ON RACF CLASS UNIXMAP IS WRONG
EQQZ400I CORRECT THE PROBLEM AND RESTART
9/22/2018

63. BPX_DEFAULT_USER
If the default BPX user is set up with an invalid shell program, like PROGRAM= /bin/echo , then any user without an explicit OMVS segment is FAILED if they attempt OMVS access. In this case, PK01415 does not present any new problem.
9/22/2018

64. BPX_DEFAULT_USER
To display the BPX default user information, use command:
rlist facility bpx.default.user
This will include this information:
APPLICATION DATA
OEDFLTU/OEDFLTG
(default user/default group)
9/22/2018

65. BPX_DEFAULT_USER
Next, do an LU (list user) on the default user id,for example:
LU OEDFLTU OMVS NORACF
Resulting display:
OMVS INFORMATION
UID=
HOME= /
PROGRAM= /bin/echo .
9/22/2018

66. IRRIRA00 (Stage 3)
Any RACF database created at OS/ or later will be at Stage 3. However, if a RACF database was migrated, it could still be a stage 0, 1, or 2
Only stage 3 creates problems if PK01415 is applied, since at stage 3 RACF does not use mapping profiles for UID, GID, SNAME, and UNAME associations. Commands such as ADDUSER no longer maintain the old mapping profiles.
9/22/2018

67. IRRIRA00 continued
The following JCL may be executed to determine what stage the RACF database is in:
//TEST EXEC PGM=IRRIRA00
//SYSPRINT DD SYSOUT=*
Sample output:
IRR66017I The system is currently operating in stage 3.
9/22/2018

68. IRRIRA00 continued
The problem caused is an incorrect message EQQZ404W at E2E server startup and when CP batch jobs are run:
EQQZ404W RACF ACCESS ERROR WHILE CHECKING USERS WITH UID U0
EQQZ404I SAF RC: 0004; RACF RC: 0008; RACF REASON CODE: 0000
However, the E2E server and CP batch jobs continue to run correctly
9/22/2018

69. PK01415 and related APARS – documentation
After the PTFs for PK01415 is applied, the documentation changes are in SEQQMISC member EQQPDFST
Download the SEQQMISC member to a PC with extension .pdf in binary mode, and use Adobe Acrobat to read the documentation
9/22/2018

70. PK01415 and related APARS – PTF availability
PK PTFS UK04908, UK04925, UK04927
USS Fix Pack7 is prereq for PK USS Fix Pack8 supercedes PK01415
PK PTF UK07035 currrently OPEN
PK11095 – PTF UK06934
PK11182 – APAR is OPEN
9/22/2018

71. TWS 8.2 – recent USS fix packs
APAR PQ PTFs UQ96309 and UQ96295
fix pack7 :
APAR PK04260 – PTFs UK02459 and UK02460
fix pack8 :
APAR PK10713 – PTFs UK06627 and UK06629
9/22/2018

72. QUESTIONS
&
ANSWERS
9/22/2018