IBM BRMS for i

 View Only
Back to discussions
Expand all | Collapse all

BRMS - Functional Usage information

  • 1.  BRMS - Functional Usage information

    Posted Mon March 03, 2025 05:03 AM

    All,

    I just performed a full system recovery with BRMS, and afterwards it looks like I'm missing all BRMS functional usage information. All users have no access anymore to BRMS controlgroups. Every BRMS activity is failing due access denied ... 

    Currently, I solve this issue by performing a SETUSRBRM for the user with *ADMIN rights, but I was wondering what went wrong in the restore process ?

    • At the beginning of the recovery - after restoring the BRMS libraries - the INZBRM *SETAUT was done & QSECOFR was defined with ADMIN rights. And afterwards,  SAVSECDTA was fully restored, and RSTAUT and RSTAUTBRM was executed at the end.  Should this Functional info not be restored?
    • I have the impression that with the INZBRM *SETAUT  (everything is reset ... and by default DENIED). 

    How can I solve this issue ...

    Can I verify on the old system (only via console available) these functional usage settings ?  

    Thanks,

    Jos



    ------------------------------
    Jos (Jozef) Thijs
    Kyndryl Belgium
    ------------------------------


  • 2.  RE: BRMS - Functional Usage information

    Posted Mon March 03, 2025 06:16 AM

    Hello Jos

    Functional usage might be available on your old system with FUNCTIONAL_AUTHORITY_INFO SQL service. Checkout https://fortradocs.atlassian.net/wiki/spaces/IWT/pages/2328854529/QUSRBRM.FUNCTIONAL_AUTHORITY_INFO+View.



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 3.  RE: BRMS - Functional Usage information

    Posted Mon March 03, 2025 08:25 AM

    job logs are important....have you looked at them for any clues as to what may have gone wrong ? 

    Assuming a 7.4 system - have you look at this to see if the steps you took match what's documented here -> Using the Recovering Your Entire System Report - IBM Documentation



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 4.  RE: BRMS - Functional Usage information

    Posted Tue March 04, 2025 03:01 AM

    Marc,

    Rich,

    Thanks for the feedback.

    All was well restored, but I get the impression - this lpar is running OS 7.5 - access to every BRMS functions was 'DENIED' after the restore. Reason .... INZBRM *SETAUT ????

    For instance,  on the P9-server where I took the full save, the backup operations were executed by the user QLPAR ...but for QLPAR no functional usage definitions are made. No entry defined for QLPAR, and all access & executions of backups ran fine.

    Restoring this whole system on a P10 lpar .... with the first backup execution by QLPAR ... Access denied; and by using & giving QLPAR *ADMIN rights with the setusrbrm command, the backup operations are running fine now with QLPAR.

    So, the question stays ... why I have to add QLPAR on the P10 server into the functional usage info, while on the P9-server (also in OS7.5 - sometime ago well upgraded from 7.4 to 7.5) no functional usage info definition was required ? 

    Kind regards,

    Jos



    ------------------------------
    Jos (Jozef) Thijs
    Kyndryl Belgium
    ------------------------------

    Original Message


  • 5.  RE: BRMS - Functional Usage information

    Posted Tue March 04, 2025 08:41 AM

    Hi Jos -  I know in 7.5 BRMS default is *DENIED for functional usage authority. Take a look at this document for details. Maybe this explains why it didn't work for you. Also - did you go from BR1 to BR2 as part of this..if so, that prob explains a lot of it as well.
    7.5 BRMS Functional Usage - IBM Partnership -



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 6.  RE: BRMS - Functional Usage information

    Posted Wed March 12, 2025 11:02 AM

    I'm hoping you opened a case with this.  This way IBM (or their assignees) can fix this for the next of us who rely upon the BRMS recovery reports.



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 7.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    It took some time to verify the whole restore operation with IBM Support...

    The restore operation was fine, but you have to consider that the functional usage information (from OS 7.5 onwards) gets rebuilt - during a restore operation - and will change the default authority setting from ALLOWED to DENIED.

    Upgrading to OS7.5 or moving on from 5770-BR1 to BR2, the default authority settings will be changed to 'DENIED'.

    https://fortradocs.atlassian.net/wiki/spaces/IWT/pages/2291466241/7.5+BRMS+Functional+Usage 

    After an OS upgrade (for instance from OS 7.4 to 7.5), maybe it will not be noticed immediately, as the default authority for the BRMS functions is not changed for the existing function entries (ALLOWED default auth is kept). Only in case you create a new controlgroup or media policy, ...   you may face an BRMS security issue as this new control/media policy/ ... will be registered - functional usage - with a 'DENIED' default authority setting. 

    Now - in case of a 'full system' restore operation (with OS 7.5  BR1/BR2) , and using the BRMS recovery reports ... 

    You will restore QBRM / QUSRBRM ... and execute some INZBRM *SETAUT, INZBRM *DEVICE ... In fact, although the restore operation of your BRMS env, all BRMS functions will be registered again (for all controlgroups/policies/ ...), and as result the default authority for all BRMS functions will be changed to DENIED. Specific user settings are kept (as restored), but the default authority setting is changed to DENIED for every function definition. 

    Please remind this in case of a system restore operation... use the SETUSRBRM command, or redefine the BRMS functional usage settings (via NAV or WRKFCNUSG). 



    ------------------------------
    Jos (Jozef) Thijs
    Kyndryl Belgium
    ------------------------------

    Original Message


  • 8.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Hello Jos

    If I understand fine, there is nothing in the BRMS recovery report about this particular topic regarding BRMS functional usage information.

    If this is the case, IMHO this is a huge design issue. They should save this information when saving QUSRBRM, then provide a way to restore it at the end of the recovery point. Don't forget that the R in BRMS stands for Recovery and the S Services!

    Maybe time for submitting an idea.

    My 2c.



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 9.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    BRMS Recovery reports

    ****************************************************************************************************
    __ STEP 006 : Initialize BRMS Functional Authority Information
    Start date/time __________________ Stop date/time __________________ Duration _________________
    You must perform this step to initialize BRMS functional authorities.
    Register all BRMS resources which use functional authority.
    To do so, type the following command and press "Enter".
    INZBRM OPTION(*SETAUT)
    Assign the QSECOFR user profile administrative functional authority
    to the BRMS resources.
    To do so, type the following command and press "Enter".
    SETUSRBRM USER(QSECOFR) USAGE(*ADMIN)
    ****************************************************************************************************



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 10.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Jos said he has followed the recovery report and specifically ran the step 6. But he also writes that authority is set back to DENIED, despite what was the status at save time. So this is not an exact restore operation IMHO. And he also writes that you have to use either SETUSRBRM, WRKFCNUSG command or GUI operations to update them as they were at save time. This action does not seem to be included in the Recovery report.

    But, how and where do you find those authorities if the source system is no longer available?



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 11.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Actually if you read the OP's replies he said he tried to do the restore as QLPAR and not QSECOFR.  I understand the recovery reports may not clearly say this but I think it is generally best practices to do a full system restore under QSECOFR and not QLPAR.  This may be why STEP 6 didn't work right for him as he was not logged in as QSECOFR.

    Now, is the restore of function usages part of the processes after step 6?  Step 6 is prior to the restore of user profiles, configuration data, etc.  Did the OP try to fix all users at the time of step 6, or just QLPAR?  If he did just QLPAR, were the function usages of the rest of the user profiles later successfully restored?



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 12.  RE: BRMS - Functional Usage information

    Posted 4 days ago
    Edited by Robert Berendt 4 days ago

    https://www.ibm.com/support/pages/how-registration-information-and-functional-usage-information-are-saved-and-restored

    Isn't that part of step 13?

    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 13.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Yes, this document provides important information. But, IMHO it is not reated to step 13, which does only tape device configuration within BRMS.

    To me the important topic is below:

    ---- Quote ------------------------------------

    Note: The default usage information for a function is stored in internal objects that are saved during a SAVSECDTA and restored during a RSTUSRPRF USRPRF(*ALL). If the internal object already exists on the system, the default authority will be what was originally on the object (the authority from the saved object will not be restored). The *ALLOBJ special authority indicator will be changed to what was on the saved object.

    ---- Quote ------------------------------------

    Therefore, my interpretation is the following:

    • BRMS step 6, INZBRM OPTION(*SETAUT) registers the exit points and functions whith DENIED default value, because they do not yet exist on the system
    • BRMS step 9 RSTUSRPRF *ALL or step 26, RSTAUT, restores authorities to function usages, except for those already existing as stated above in the note, including BRMS function usage authoity

    The question is: does QUSRSYS/QUSEXRGOBJ *EXITRG object restore (which is done in step 12) restore function usage authority as well? I am not sure of that, because:

    ---- Quote ------------------------------------

    The function registration information can be restored by restoring the QUSEXRGOBJ *EXITRG object into QUSRSYS. This restores all of the registered functions and may require functional usage information to use the product Exit Points.

    ---- Quote ------------------------------------

    Again, those are my 2c.



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 14.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    All good points.  My only question is a question of why your step 13 is different than my step 13

    __ STEP 013 : Recover Required System Libraries
    Start date/time __________________ Stop date/time __________________ Duration _________________
    You must restore specific system libraries before you can use BRMS to
    perform other recovery steps.
    If the "Select Recovery Items" display is not shown and you are
    performing a complete system restore, run the following command.
    STRRCYBRM OPTION(*RESUME)
    Otherwise, run the following command.
    STRRCYBRM OPTION(*SYSTEM) ACTION(*RESTORE)
    Type the command choice and press "Enter".
    Select the saved item(s) listed below from the "Select Recovery Items"
    display and press "Enter" to recover these saved items. Recovery of
    these saved items will require the volumes listed on the report or
    duplicate volumes.
    --- Objects ---
    Saved Save ----- ASP ------ Save Save Not Sequence Control Volume
    Item Type Name Number Date Time Saved Saved Number Group Identifier Encrypted
    ---------- ------- ---------- ----- -------- -------- -------- ------ --------- ---------- ---------------------------- ---------
    __ QSYS2 *FULL *SYSBAS 00001 3/08/25 8:37:28 613 0 145 DTFULL I70604
    __ QGPL *FULL *SYSBAS 00001 3/08/25 8:37:15 1406 0 262 DTFULL I70606
    __ QGPL *FULL *SYSBAS 00001 4/01/25 19:30:04 219 0 2 JRNRCV I70607
    __ QUSRSYS *FULL *SYSBAS 00001 3/08/25 8:37:43 2439 0 150 DTFULL I70604



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 15.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Gnnnn?

    Some magic trouble here?

    I have been looking at all V7 documentation pages from https://www.ibm.com/docs/en/i/7.1.0?topic=system-using-recovering-your-entire-report to https://www.ibm.com/docs/en/i/7.6.0?topic=ssw_ibm_i_76/rzai8/rzai8_rcysys_steps.html (wow, IBM has again decided to no longer follow the good practices they have prior to provide documentatio, i.e. just change the version to get the same information) and I have

    STEP 012 : Recover required system libraries

    STEP 013 : Reset BRMS device and media library information



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 16.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Um, if you noticed a discrepancy between the documentation and your actual recovery reports, did you click on the feedback button on that page to tell them it needs updating?

    We do a STRRCYBRM OPTION(*SYSTEM) ACTION(*REPORT) directly to PDF on a daily basis.  Then we distribute that report to two different PC based servers located in different countries.  I just tend to look at those instead of the documentation.



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 17.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Well, I don't have access to any system, and therefore, I was only looking at online documentation. I thought you were doing the same, reason for my surprise :-).



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 18.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    My understanding of the OP posts is not the same as yours.

    I understand that Save operation was done with QLPAR profile (if I remember fine QLPAR is used PowerHA tool Full System Flash Copy). Furthermore, I understand that he became aware of the issue once the recovery report was completed, when regular backups with QLPAR profile did fail.

    Only Jos can confirm but, as I was knowing him, I am pretty sure that he exactly followed the recovery report, step after step. I am pretty sure as well, that he restored using QSECOFR profile as this is suggested here (https://www.ibm.com/docs/en/i/7.5.0?topic=system-task-3-selecting-initial-program-load-options) when restoring LIC, then IBM i OS (BRMS does not do any action in those steps, it just provides what to do).



    ------------------------------
    Marc Rauzier
    ------------------------------

    Original Message


  • 19.  RE: BRMS - Functional Usage information

    Posted 4 days ago

    Ok, getting back on track here, leaving whether or not he used QSECOFR or QLPAR off the table and all that, let's concentrate on the process.  The link I posted leads me to believe that function usage information is restored in step 13.

    The only INZBRM at that step, or after, is INZBRM OPTION(*DEVICE) and I'm doubting that would clobber the function information restored in step 13.

    Would be nice if someone did a create table as (... see function usage service...) to save the function usages immediately after the QUSRSYS restore in step 13 to see if they are restored correctly, and are later modified.  After all, are there not a bazillion system migrations going on to get ready for the IBM i 7.6 release with the presentation starting in 2 minutes at https://www.ibm.com/support/pages/ibm-i-guided-tours



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 20.  RE: BRMS - Functional Usage information

    Posted 3 days ago

    Marc,

    Robert, 

    This functional usage change to DENIED ... I think you should consider as moving on to a more secure BRMS environment. Before this BR1/BR2 OS 7/5 BRMS change, everybody could access the BRMS environment, as an 'ALLOWED' default authority was in place.

    Now, with this change, and after a full system restore operation, all functional usage entries are available (also the customized entries), but for all entries the default authority setting is changed from ALLOWED to DENIED.

    (And for instance, my first FlashCopy operation of the IASP - after the full restore operation on a P10 Server - encountered this functional usage issue. QLPAR was on my old P9 server not defined for functional usage, and after the restore, this user had no access anymore to the BRMS env due to this DENIED default authority change.).

    Based on the information, I shared with IBM support, the functional usage information is changed / rebuilt in following steps ....(based on the GR-audit entries):

    -within Step 006 : Initialize BRMS functional authority information (inzbrm *setaut / setusrbrm qsecofr *admin / inzbrm *device (step 009)

    -within Step 013 / 014 : Reset BRMS devices (after restoring Userprofiles & restoring system libraries QUSRSYS / QGPL  (and integrate the 'new?' devices, used for the restore operation, into BRMS with functional usage info. 

    -and Step ... (? - depends) : RSTAUT operation.

    During these steps, the CHGUSAGE process was executed (based on the Audit info).

    In which step exactly, the default authority is changed to DENIED ... IBM did not provide me that answer, but I assume it is in the initial setup (step 06). When you see in the BRMS logging, the message BRM4008 (.xxx was registered as a function of BRMS) ... I think at that moment the base functional template with default authority (DENIED) is defined for every BRMS object & function, and later on - with the RSTAUT - the user specific functional usage info is defined. 

    The whole restore process was done by the QSECOFR profile, and the BRMS recovery report was well followed. 

    Final feedback from IBM within my case : 

    The BRMS development team confirmed that, when restoring a system at 5770-BR2 and above or 5770-BR1 7.5 and above, the default authority for all BRMS functional usage will revert back to *DENIED. Once a RSTAUT is run, all individual user authority previously updated will be restored.

     



    ------------------------------
    Jos (Jozef) Thijs
    Kyndryl Belgium
    ------------------------------

    Original Message


Related Content