IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  CKNSERVE network with nodes occasionally unavailable

    Posted 06/11/25 09:29 AM

    Greetings all,
    I am looking for advice as to how to manage a network of systems that use CKNSERVE.
    There might be many nodes in use in the network, and often it is best to see query results from all nodes. Hence the list of nodes specified in SE.1 will include all nodes. 
    However, on occasion a node may not be available. This may be due to errors, an unscheduled IPL, TCP/IP being down, or some other event, that the zSecure user is not aware of.

    In such a situation a request to that node will cause the entire request to hang, sometimes for a long time. It seems in such a situation we need to identify the problem node(s) and then submit the request with the node(s) in question having been unselected in SE.1. Sometimes that process is simple, but not always.

    Is there a way to determine which nodes are up?
    What do you do in such a situation?
    Is there a recommended approach to handle these situations?

    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------


  • 2.  RE: CKNSERVE network with nodes occasionally unavailable

    Posted 06/11/25 04:05 PM

    Hey Lennie

    I do not know about the time-out issue, haven't seen those for ages, but there is a trick for running with unreliable network nodes.

    When you specify the dsname in SE.1, the ALLOC statement uses DSN=dsname which fails when the dsname doesn't exist or isn't available.

    When you use DSNPREF=dsname, the query will quietly continue without the dsname.  That may not be good for all reports, especially the quiet part, so use with caution.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 3.  RE: CKNSERVE network with nodes occasionally unavailable

    Posted 06/12/25 04:30 AM

    Rob,

    Thanks for the reply. I agree that approach might need some caution. But If I have understood correctly I will simply get no results from a query to the "dead" system. I will at least get a response from the others.

    However, I think I need same clarification on how to set this up.
    For most nodes the data sets allocated simply use a "Type"  of ACT.BACK so there is neither DSN= nor DSNPREF= used. The active RACF backup is used.
    If I have understood you correctly I would need to replace this with DSNPREF="Real name of RACF backup on remote node" and have "Type" set to COPY.RACF
    I have tried this and cannot get this to work. It fails with a CKR2160 (I have changed values in CKR2353 and CKR1353 below to obscure names).

    CKR2353 00 Adding ALLOC TYPE=CKFREEZE ZSECNODE=ZZZZ      ZSECSYS=SSSS     ACTIVE COMPLEX=ZZZZ
    CKR1353 00 ALLOC DSNPREF=SYS1.RACF.BACKUP adds DSN=SYS1.RACF.BACKUP
    CKR2160 12 No systems found matching zsecnode= zsecsys= in ALLOC command

    Or is there some other point I have missed?



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------

    Original Message


  • 4.  RE: CKNSERVE network with nodes occasionally unavailable

    Posted 06/12/25 09:58 AM

    I assume you use ZSECNODE and ZSECSYS on the ALLOC TYPE=RACF.COPY command too.

    Instead of specifying ZSECNODE and ZSECSYS explicitly, you could specify ZSECSYS as *, this means something close to "any available" (from https://www.ibm.com/docs/en/szs/3.1.0?topic=allocate-explicit-allocation-mode-parameters):

    The special value period (.) specifies that the local system's data will be retrieved. The special value asterisk (*) specifies that all active systems will be used to access the data. If the system is inactive, zSecure issues message CKR2163 or CKR2164 and the system's data will be excluded from the report.




    Original Message


  • 5.  RE: CKNSERVE network with nodes occasionally unavailable

    Posted 06/12/25 11:21 AM

    I have now tried with the following specified, (I can't get this Web interface to allow me to use a fixed-space font).

    Description . . . .,CKNSERVE for ssssssss ssss - Failsafe
    Complex . . . . . .,ssss     , ,Version  . . . . ,    ,
     
    Data set attributes
    Data set name . . .,DSNPREF=SYS1.RACF.BACKUP
    Unit  . . . . . . .,        ,
    Volume  . . . . . .,      ,
    Type  . . . . . . .,COPY.RACF  ,
    RRSF node . . . . .,        , ,Local node for RRSF
    NJE node  . . . . .,        , ,/*XEQ parameter
    System name . . . .,        , ,/*SYSTEM parameter
    zSecure Node name .,ssss     , ,Name of remote zSecure Node
    zSecure System  . .,*       , ,Name of remote zSecure System


    I still get the same messages,
    CKR1353 00 ALLOC DSNPREF=SYS1.RACF.BACKUP adds DSN=SYS1.RACF.BACKUP
    CKR2160 12 No systems found matching zsecnode= zsecsys= in ALLOC command
    The specification works when I simply put ACT.BACK  rather than the DSNPREF setup you have suggested.
    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------

    Original Message


Related Content