IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

zSecure alert and C2PCUST data sets and C2PCUTIL

  • 1.  zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Thu May 01, 2025 11:11 AM

    Greetings,

    I am trying to change from using separate C2PCUST data sets per LPAR, to using a single C2PCUST for a sysplex. I have been trying to use C2PCUTIL to export and import the necessary definitions from the old C2PCUST datasets to a new one. I am confused about what options i need to set on the EXPORT and IMPORT statements. I have used the following EXPORT,

           ISPSTART CMD(%C2PESETP EXPORT SET(YSYS5) MEMBER(*) DD(TRANSPRT))

    and this for IMPORT,
           ISPSTART CMD(%C2PESETP IMPORT SET(*) ADD(*) DD(TRANSPRT)) 

    But I seem to be missing many members of the YSYS5 configuration.
    The documentation seems to assume I know which members I need, but this is far from true!
    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------


  • 2.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Fri May 02, 2025 03:32 AM

    Hi Lennie

    When you use EXPORT SET(YSYS5), all custom alerts from the set including the skeleton members required for these custom alerts will be exported.  In addition, the activation status, destinations, configuration fields for all alerts in the set (standard and custom) are exported. Note, the content of the skeletons is not further analysed, so if the skeleton imbeds other members, you must specify these in the MEMBER( ) keyword.

    If you have specified lists of PCI or SENSITIVE values (data set names, user IDs, etc), these can be exported by adding the PCI or SENS keywords.  By default, these are not exported.

    The IMPORT ADD(*) keyword requests an import of any NEW members into your destination C2PCUST.  So if you already have empty PCI or SENS members in your destination, or skeletons with the same name, these will not be replaced by the ones you exported.  Specify IMPORT ADD(*) REP(MEMBER) if you have name clashes.

    You could use the COMPARE(*) function to see how the transport file and the destination C2PCUST compare, see the manual.

    You mention that you actually know that some members are missing.  What are those?  Skeletons?  SENSREAD?



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 3.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Fri May 02, 2025 04:28 AM

    Hi Lennie,

    I think you should also specify the member selection on the import. 

    Thanks and regards,

    Paul. 



    ------------------------------
    PAUL HORN -IBM - Software Architect / Developer
    ------------------------------



  • 4.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Sun May 04, 2025 05:57 AM

    Hi Paul

    The IMPORT code in C2PESETP checks for every member in the transport file if the P_MEMBER value is empty, i.e., no MEMBER( ) parameter was specified, or P_MEMBER matches the member name in the transport file.  So, no, I do not think you have to specify the member names on IMPORT, unless you want to suppress some members.  You DO have to code REP(... MEMBER) or REP(*) if you intend to replace existing members in the target C2PCUST.

    If your testing shows that MEMBER(name) must be coded on IMPORT, you've found a "not working as designed" condition, because the previous paragraph is from my design, 5 years ago.  You have a point though, the documentation states that * is the default value for SET( ), ALERT( ), but this is not documented for MEMBER( ).



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 5.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Sun May 04, 2025 06:39 AM

    Hi Rob, I assume you're right. Thanks and regards, Paul. 



    ------------------------------
    PAUL HORN -IBM - Software Architect / Developer
    ------------------------------



  • 6.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Tue May 06, 2025 10:16 AM
    Rob and Paul,
    Thanks for responding. I only work Tuesdays to Thursdays on this project so apologies for the delay in response.
     
    I misled you a little on my previous post. I copied in an example using MEMBER(*) on the EXPORT. This does process everything. However if I code,
    ISPSTART CMD(%C2PESETP EXPORT SET(YSYS5) DD(TRANSPRT)) 
     
     
    I expected to get all the members associated with the YSYS5 config. 
    I enclose the reports from EXPORT and IMPORT.
     
    I ended up with only these members in the target C2PCUST.
     
     Name   
    $MSS4105
    $MSS4106
    $MSS4107
    $MSS4108
    $MSS4114
    $MSS4203
    $MSS4205
    $MSS4206
    $MSS4215
    $MSS4305
    $MSS4402
    $MSS4403
    $MSS4411
    C2PIUACF
    C2PIUEMF
    C2PXPARM
    MSS4000 
    **End** 
     
    Is this what you would expect?
     
    (Member C2PXPARM had already been copied into the newly initialised C2PCUST just after creation as documented in SCKRSAMP(C2PZAIN1).
    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------

    Attachment(s)

    txt
    Import.txt   1 KB 1 version
    txt
    Export.txt   1 KB 1 version


  • 7.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Tue May 06, 2025 11:09 AM

    Hi Lennie,

    Yes, the EXPORT function copies the skeletons that are associated with the installation defined (aka Custom) alerts, and I see you started their names with $MSS and MSS.

    C2PIUACF and C2PIUEMF are NOT exported, these already existed in the target C2PCUST, or if you started out with an empty C2PCUST, the IMPORT function creates these members from scratch, just like SE.A.A would do if you start it the first time.  These tables are extended by the alert definitions and parameters during IMPORT.

    The EXPORT function allows to to specify more member names.  There are 3 categories: PCI-DSS members (add the PCI keyword), SENSITIVE RESOURCE AND USER/GROUP info (add the SENS keyword) and NAMED members (write them in the MEMBER( ) keyword).  You only have to use MEMBER( ) if your custom alert skeletons used the )IM command to pull in further skeletons.  You only use the PCI and SENS options if your alerts (IBM and custom) rely on SENS or PCI definitions.

    What type of members had your EXPECTED to be transported?






  • 8.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 07, 2025 08:25 AM

    Rob,
    Thanks for help as always.
    The C2PCUST library contains 191 members, most of which are associated with configurations I don't want. The current configuration is names YSYS5 and this is the one I wanted exported and imported. In the original library there are many members (191 in total), including the following, which start with YSYS5. I expected some of these to be transported.

    It would really help to have a definitive list of the potential members of C2PCUST with details of their use, and when they are created and so on. Have I missed that in the documentation?

    Lennie


    YSYS5   
    YSYS5A   
    YSYS5E   
    YSYS5P   
    YSYS5S   
    YSYS5TA   
    YSYS5TE   
    YSYS5TP   
    YSYS5TS   
    YSYS5TV   
    YSYS5TVA   
    YSYS5TVE   
    YSYS5TVO   
    YSYS5TVP   
    YSYS5TVS   
    YSYS5TV1   
    YSYS5T1   
    YSYS5V   
    YSYS5VA   
    YSYS5VE   
    YSYS5VO   
    YSYS5VP
    YSYS5VS
    YSYS5V1
    YSYS51



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------



  • 9.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 07, 2025 08:53 AM

    The members you listed all start with the SET name and have a suffix that describes their purpose.  I see you have had 2 sets, YSYS5 and YSYS5T.  No, those suffixes are not documented.

    The null suffix identifies the CARLa code running in C2POLICE for the alert set.

    These members are generated by the Verify action (that's the V in the position right after the SET name) and the Refresh action (the others).  Those members must not be exported, but instead generated in the target C2PCUST using the Verify and Refresh line commands, or the comparable batch job.

    There are potentially also SENSxxxx and PCIxxxx members in C2PCUST, set through SE.A.S and SE.A.P.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 10.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 07, 2025 09:51 AM

    Rob,

    This isn't a C2PCUST I created, rather one I have inherited. And, according to the SE.A.A panel, there is no YSYS5T configuration, although there is YSYS5C configuration. I fear this library is corrupt in some way, and I maybe better off re-building from scratch.
    Your reply that the YSYS5 members should NOT be transported was a BIG surprise. So just where is the YSYS5 config held? I assume it must be in the C2PIUACF and C2PIUEMF members.

    That list of members and their use would be so helpful.
    Lennie







    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------



  • 11.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 07, 2025 10:51 AM

    The old C2PCUST is not really corrupt, it has some obsolete members, that is all.

    Once you DELETE a set from SE.A.A, the set is deleted from the internal tables, but the work files are not.  This was decided, once, because you could delete the set but still keep the C2POLICE started task running with the members from that set.  So members starting with YSYS5T were from a set that was deleted.

    The information that you see in SE.A.A is actually stored in member C2PIUACF.  The EXPORT function copies (selected) table records from this member to the transport file.

    C2PIUEMF holds the mail distribution list definitions.





  • 12.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 07, 2025 04:33 PM

    > Once you DELETE a set from SE.A.A, the set is deleted from the internal tables, but the work files are not.
    I think that was changed last year. You now have the option (slash on a popup) to delete all the members for the configuration.



    ------------------------------
    Guus Bonnes
    ------------------------------



  • 13.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Thu May 08, 2025 06:57 AM

    Rob and Guus,

    Thanks for that information. Explains more.

    I am not seeing a slash option on a popup when I attempt a DELETE, but maybe that is a zSecure maintenance level issue.

    Rob,

    We have decided that the custom alerts that have been defined are no longer required. However, we would like to keep all the definitions in case we change our minds later on. So is there a method of excluding them from the EXPORT or IMPORT functions?
    Regards, Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------



  • 14.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Thu May 08, 2025 08:58 AM

    Custom alerts start with a 4, standard alerts for RACF systems start with 1, so an export command that only looks at the standard alerts would work:

    EXPORT SET(YSYS5) ALERT(1*)







  • 15.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Tue May 13, 2025 05:20 AM

    Rob,

    Thanks. Works fine.
    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------



  • 16.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Tue May 13, 2025 07:48 AM

    Rob,

    I nevertheless have a problem now. The configuration I exported and then imported was SET(YSYS5) ALERT(1*). However, I then end up without the YSYS5P member in the target C2PCUST data set. This member is needed for the started task. Should I also copy this member? You stated above that my YSYS5 members MUST NOT be exported. 
    Please explain what I need to do?

    Thanks

    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------



  • 17.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Tue May 13, 2025 09:13 AM

    After the IMPORT, you can run SE.A.A with the updated C2PCUST, execute the V line command on the set, and next execute the F line command.

    You can also run a single C2PJUPGR batch job to execute these two actions, see https://www.ibm.com/docs/en/szs/3.1.0?topic=reporting-upgrade-alert-configuration

    Either of these approaches generates the YSYS5P (parm member) and the CARLa scripts indicated from these parms.







  • 18.  RE: zSecure alert and C2PCUST data sets and C2PCUTIL

    Posted Wed May 14, 2025 08:29 AM

    Thanks Rob,

    The penny has dropped and I see the necessary sequence of operations now. I now have it working with a shared C2PCUST config.

    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------