The penny has dropped and I see the necessary sequence of operations now. I now have it working with a shared C2PCUST config.
Original Message:
Sent: Tue May 13, 2025 09:12 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
After the IMPORT, you can run SE.A.A with the updated C2PCUST, execute the V line command on the set, and next execute the F line command.
You can also run a single C2PJUPGR batch job to execute these two actions, see https://www.ibm.com/docs/en/szs/3.1.0?topic=reporting-upgrade-alert-configuration
Either of these approaches generates the YSYS5P (parm member) and the CARLa scripts indicated from these parms.
Original Message:
Sent: 5/13/2025 7:48:00 AM
From: Lennie Dymoke-Bradshaw
Subject: RE: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob,
I nevertheless have a problem now. The configuration I exported and then imported was SET(YSYS5) ALERT(1*). However, I then end up without the YSYS5P member in the target C2PCUST data set. This member is needed for the started task. Should I also copy this member? You stated above that my YSYS5 members MUST NOT be exported.
Please explain what I need to do?
Thanks
Lennie
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Tue May 13, 2025 05:20 AM
From: Lennie Dymoke-Bradshaw
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob,
Thanks. Works fine.
Lennie
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Thu May 08, 2025 08:58 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Custom alerts start with a 4, standard alerts for RACF systems start with 1, so an export command that only looks at the standard alerts would work:
EXPORT SET(YSYS5) ALERT(1*)
Original Message:
Sent: 5/8/2025 6:57:00 AM
From: Lennie Dymoke-Bradshaw
Subject: RE: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob and Guus,
Thanks for that information. Explains more.
I am not seeing a slash option on a popup when I attempt a DELETE, but maybe that is a zSecure maintenance level issue.
Rob,
We have decided that the custom alerts that have been defined are no longer required. However, we would like to keep all the definitions in case we change our minds later on. So is there a method of excluding them from the EXPORT or IMPORT functions?
Regards, Lennie
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Wed May 07, 2025 04:32 PM
From: Guus Bonnes
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
> Once you DELETE a set from SE.A.A, the set is deleted from the internal tables, but the work files are not.
I think that was changed last year. You now have the option (slash on a popup) to delete all the members for the configuration.
------------------------------
Guus Bonnes
Original Message:
Sent: Wed May 07, 2025 10:50 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
The old C2PCUST is not really corrupt, it has some obsolete members, that is all.
Once you DELETE a set from SE.A.A, the set is deleted from the internal tables, but the work files are not. This was decided, once, because you could delete the set but still keep the C2POLICE started task running with the members from that set. So members starting with YSYS5T were from a set that was deleted.
The information that you see in SE.A.A is actually stored in member C2PIUACF. The EXPORT function copies (selected) table records from this member to the transport file.
C2PIUEMF holds the mail distribution list definitions.
Original Message:
Sent: 5/7/2025 9:51:00 AM
From: Lennie Dymoke-Bradshaw
Subject: RE: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob,
This isn't a C2PCUST I created, rather one I have inherited. And, according to the SE.A.A panel, there is no YSYS5T configuration, although there is YSYS5C configuration. I fear this library is corrupt in some way, and I maybe better off re-building from scratch.
Your reply that the YSYS5 members should NOT be transported was a BIG surprise. So just where is the YSYS5 config held? I assume it must be in the C2PIUACF and C2PIUEMF members.
That list of members and their use would be so helpful.
Lennie
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Wed May 07, 2025 08:52 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
The members you listed all start with the SET name and have a suffix that describes their purpose. I see you have had 2 sets, YSYS5 and YSYS5T. No, those suffixes are not documented.
The null suffix identifies the CARLa code running in C2POLICE for the alert set.
These members are generated by the Verify action (that's the V in the position right after the SET name) and the Refresh action (the others). Those members must not be exported, but instead generated in the target C2PCUST using the Verify and Refresh line commands, or the comparable batch job.
There are potentially also SENSxxxx and PCIxxxx members in C2PCUST, set through SE.A.S and SE.A.P.
------------------------------
Rob van Hoboken
Original Message:
Sent: Wed May 07, 2025 08:24 AM
From: Lennie Dymoke-Bradshaw
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob,
Thanks for help as always.
The C2PCUST library contains 191 members, most of which are associated with configurations I don't want. The current configuration is names YSYS5 and this is the one I wanted exported and imported. In the original library there are many members (191 in total), including the following, which start with YSYS5. I expected some of these to be transported.
It would really help to have a definitive list of the potential members of C2PCUST with details of their use, and when they are created and so on. Have I missed that in the documentation?
Lennie
YSYS5
YSYS5A
YSYS5E
YSYS5P
YSYS5S
YSYS5TA
YSYS5TE
YSYS5TP
YSYS5TS
YSYS5TV
YSYS5TVA
YSYS5TVE
YSYS5TVO
YSYS5TVP
YSYS5TVS
YSYS5TV1
YSYS5T1
YSYS5V
YSYS5VA
YSYS5VE
YSYS5VO
YSYS5VP
YSYS5VS
YSYS5V1
YSYS51
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Tue May 06, 2025 11:08 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Hi Lennie,
Yes, the EXPORT function copies the skeletons that are associated with the installation defined (aka Custom) alerts, and I see you started their names with $MSS and MSS.
C2PIUACF and C2PIUEMF are NOT exported, these already existed in the target C2PCUST, or if you started out with an empty C2PCUST, the IMPORT function creates these members from scratch, just like SE.A.A would do if you start it the first time. These tables are extended by the alert definitions and parameters during IMPORT.
The EXPORT function allows to to specify more member names. There are 3 categories: PCI-DSS members (add the PCI keyword), SENSITIVE RESOURCE AND USER/GROUP info (add the SENS keyword) and NAMED members (write them in the MEMBER( ) keyword). You only have to use MEMBER( ) if your custom alert skeletons used the )IM command to pull in further skeletons. You only use the PCI and SENS options if your alerts (IBM and custom) rely on SENS or PCI definitions.
What type of members had your EXPECTED to be transported?
Original Message:
Sent: 5/6/2025 10:16:00 AM
From: Lennie Dymoke-Bradshaw
Subject: RE: zSecure alert and C2PCUST data sets and C2PCUTIL
Rob and Paul,
Thanks for responding. I only work Tuesdays to Thursdays on this project so apologies for the delay in response.
I misled you a little on my previous post. I copied in an example using MEMBER(*) on the EXPORT. This does process everything. However if I code,
ISPSTART CMD(%C2PESETP EXPORT SET(YSYS5) DD(TRANSPRT))
I expected to get all the members associated with the YSYS5 config.
I enclose the reports from EXPORT and IMPORT.
I ended up with only these members in the target C2PCUST.
Name
$MSS4105
$MSS4106
$MSS4107
$MSS4108
$MSS4114
$MSS4203
$MSS4205
$MSS4206
$MSS4215
$MSS4305
$MSS4402
$MSS4403
$MSS4411
C2PIUACF
C2PIUEMF
C2PXPARM
MSS4000
**End**
Is this what you would expect?
(Member C2PXPARM had already been copied into the newly initialised C2PCUST just after creation as documented in SCKRSAMP(C2PZAIN1).
Lennie
------------------------------
Lennie Dymoke-Bradshaw
Original Message:
Sent: Sun May 04, 2025 06:38 AM
From: PAUL HORN
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Hi Rob, I assume you're right. Thanks and regards, Paul.
------------------------------
PAUL HORN -IBM - Software Architect / Developer
Original Message:
Sent: Sun May 04, 2025 05:57 AM
From: Rob van Hoboken
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Hi Paul
The IMPORT code in C2PESETP checks for every member in the transport file if the P_MEMBER value is empty, i.e., no MEMBER( ) parameter was specified, or P_MEMBER matches the member name in the transport file. So, no, I do not think you have to specify the member names on IMPORT, unless you want to suppress some members. You DO have to code REP(... MEMBER) or REP(*) if you intend to replace existing members in the target C2PCUST.
If your testing shows that MEMBER(name) must be coded on IMPORT, you've found a "not working as designed" condition, because the previous paragraph is from my design, 5 years ago. You have a point though, the documentation states that * is the default value for SET( ), ALERT( ), but this is not documented for MEMBER( ).
------------------------------
Rob van Hoboken
Original Message:
Sent: Fri May 02, 2025 04:28 AM
From: PAUL HORN
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Hi Lennie,
I think you should also specify the member selection on the import.
Thanks and regards,
Paul.
------------------------------
PAUL HORN -IBM - Software Architect / Developer
Original Message:
Sent: Thu May 01, 2025 11:10 AM
From: Lennie Dymoke-Bradshaw
Subject: zSecure alert and C2PCUST data sets and C2PCUTIL
Greetings,
I am trying to change from using separate C2PCUST data sets per LPAR, to using a single C2PCUST for a sysplex. I have been trying to use C2PCUTIL to export and import the necessary definitions from the old C2PCUST datasets to a new one. I am confused about what options i need to set on the EXPORT and IMPORT statements. I have used the following EXPORT,
ISPSTART CMD(%C2PESETP EXPORT SET(YSYS5) MEMBER(*) DD(TRANSPRT))
and this for IMPORT,
ISPSTART CMD(%C2PESETP IMPORT SET(*) ADD(*) DD(TRANSPRT))
But I seem to be missing many members of the YSYS5 configuration.
The documentation seems to assume I know which members I need, but this is far from true!
Lennie
------------------------------
Lennie Dymoke-Bradshaw
------------------------------