IBM Security Z Security

 View Only
  • 1.  Extract ACCESS records for one class

    Posted Thu October 08, 2020 09:58 AM

    I am working on a project to remove ID(*) and UACC from a particular class in one of our systems.  We have monthly consolidation files and a 3-year file.  I am working with the 3-year file but it is slow to read all the records just when I am looking at one class.  I assumed I should be able to extract the records I want to a new ACCESS file.

    If I run:
    ALLOC TYPE=ACCESS DSN=<my-3-year-access-file> 
    ALLOC DSN=<my-new-file> DD=C2PACMON TYPE=OUTPUT
    NEWLIST TYPE=ACCESS
      SELECT CLASS=<anyclass>
      UNLOAD DD=C2PACMON

    I get message
    CKR2404 12 TYPE=ACCESS UNLOAD does not support SELECT/EXCLUDE, use LIST RECORD

    I cannot work out what to do next and I can't seem to find samples in the manuals, or in this forum.  A helpful pointer to the next steps would be appreciated.

    Thanks,



    ------------------------------
    Andrew Cameron-Heffer
    ------------------------------


  • 2.  RE: Extract ACCESS records for one class

    Posted Thu October 08, 2020 10:10 AM
    Edited by Jeroen Tiggelman Thu October 08, 2020 11:00 AM
    Hi Andrew,

    I interpret the message as telling you to do:

    ALLOC TYPE=ACCESS DSN=<my-3-year-access-file> 
    ALLOC DSN=<my-new-file> DD=C2PACMON TYPE=OUTPUT
    NEWLIST TYPE=ACCESS DD=C2PACMON
      SELECT CLASS=<anyclass>
      LIST RECORD(0)

    Edit: Added DD= on the NEWLIST statement to direct the report output to the destination.

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------



  • 3.  RE: Extract ACCESS records for one class

    Posted Thu October 08, 2020 11:54 AM
    Edited by Andrew Cameron-Heffer Thu October 08, 2020 11:54 AM
    Jeroen,

    Thanks for the code.  You have got me closer to the result but...

    The output file has page headers so I added NOPAGE to the NEWLIST.  However that is not quite enough.  The new file looks similar to the properly created ones but it fails with many CKR1476 16 Unsupported ACCESS record type 1A at CKR4AM00 line xxxmessages.

    The real AM file has zSecure AM 1A 1 at the top and zSecure EOF 9 99999 at the end of the file.  Once I had manually added them then it worked.  To save me manually adding that text lines could you provide the CARLa to do it that automatically, please.

    ------------------------------
    Andrew Cameron-Heffer
    ------------------------------



  • 4.  RE: Extract ACCESS records for one class
    Best Answer

    Posted Thu October 08, 2020 12:22 PM
    Hi Andrew,

    The LIST command writes records immediately when it encounters them, for each query in the input.

    Therefore, printing a line at the top should be a matter of putting a report earlier in the query that writes to the same output file and prints the line.

    I would say
    NEWLIST TYPE=ACCESS DD=C2PACMON NOPAGE OUTLIM=1
    LIST 'zSecure AM 1A 1'

    Since it is the same report type, the output should be in the order in which you put the reports. You could probably also use TYPE=SYSTEM, as I believe that runs relatively early. (SYSTEM is not sensitive to scope processing as much as some other report types; but if you are not running restricted, you do not need to worry about that.)

    To print something at the bottom, you could use a report with SORTLIST, which executes later than LIST.

    NEWLIST TYPE=ACCESS DD=C2PACMON NOPAGE OUTLIM=1
    SORTLIST 'zSecure EOF 9 99999'

    Regards,

    --Jeroen

    P.S. If you used SORTLIST in all queries, then the output would appear more directly naturally in the order in which you specify the queries. However, using SORTLIST means that all records will be read and stored in memory before any output takes place [while LIST just writes the record when encountered and moves on]. Also, to disable actual sorting, you would need to prefix RECORD with non-display columns to preserve the record order.  With one input file that is just RECNO(ND), with multiple ones you would also need something like DDNAME(ND) and you would need to ensure the order of the DDNAMEs was appropriate..

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------