z Systems interfaces
Although the DS CLI can be used for devices attached to a z Systems operating system, there are also operating system specific interfaces available. This chapter describes the z Systems interfaces available to manage DS8000 Copy Services functions. It includes the following topics:
All of these interfaces have the advantage that you do not have to run their commands in the DS8000 Hardware Management Console (HMC). You can instead directly send these commands directly over a Fibre Channel connection (FICON) channel between the DS8000 and the z Systems operating system. Sending channel commands directly allows for a quick command transfer that does not depend on any additional software stacks.
|
Attention: With the DS8000 licensing scheme change to simplify copy services into a single license, it is recommended that RACF facility classes, where available, are created to protect these copy services commands, even in environments where there is no intention to use the commands. RACF facility classes provide protection only if they are defined. If the facility class does not exist (that is, was not created), there is nothing in the operating system to prevent usage of commands by unauthorized users. On pre-DS8880 control units, if you have a FlashCopy license but not a Peer-to-Peer Remote Copy (PPRC) license, you can use FlashCopy only because there is no ability to use PPRC without a license. Therefore, there is no need to create the RACF facility class to protect the PPRC commands. However, with the DS8880 license simplification, to a single copy services license, all commands become eligible for use.
|
5.1 z Systems command alternatives
From an operating system point of view, these interfaces break out as follows:
•z/OS
– TSO commands
– ICKDSF commands
– ANTRQST application programming interface (API)
•z/VM:
– ICKDSF commands
– Native CP FLASHCopy command.
•z/VSE
– ICKDSF commands
– Native IXFP SNAP used to start FlashCopy
•z/TPF
– ICKDSF commands
– Native ZXCPY command to start FlashCopy, Global Copy, or Metro Mirror
5.2 TSO commands for z/OS
TSO commands are used in z/OS environments to manage many operations. TSO commands might be generated by REXX or CLIST procedures. They might also be generated out of other software tools. Then, you can run the TSO commands from procedures that are similar to the scripting approach in Open Systems environments.
Often, TSO commands are the quickest and simplest mechanism to correct a problem, clean up after a job or script fails, or to collect query data. For true management of a copy services environment, the ANTRQST API or the ANTTREXX API typically would prove to be more useful.
For more information about TSO commands to manage Copy Services, see z/OS DFSMS Advanced Copy Services, SC23-6847.
5.2.1 Protecting TSO Copy Services commands
You can protect copy services commands using one of the following methods:
•Define resource profiles in the RACF facility class and restrict access to those profiles.
•Put the commands in a library that is protected by RACF.
TSO commands RACF protection
TSO commands can be protected using RACF facility classes. There are two facility classes each for FlashCopy, the PPRC family (Metro Mirror, Global Copy, Global Mirror), and z/OS Global Mirror, previously known as extended remote copy (XRC).
For each set of commands, there is a facility class for the query commands and a second facility class for the active commands (commands that change a status or result in data movement). A user with access to the active commands automatically inherits access to the query commands.
A good practice is to define all of the facility classes for Copy Services interfaces, even if you are not planning on using them in the installation. Example 5-1 shows a sample procedure to create the RACF Facility Classes to protect TSO, ANTRQST, and ANTTREXX invocations.
Example 5-1 Creating RACF Facility Class to Protect Copy Services Commands
Examples: The following RACF command examples activate the RACF FACILITY
class, define the profile for the FlashCopy commands, and give user STGADMIN
authority to use this profile:
1. Activate the RACF FACILITY class:
a. SETROPTS CLASSACT(FACILITY)
2. Define the profile for FlashCopy commands, and authorize user STGADMIN to use this profile:
a. RDEFINE FACILITY STGADMIN.ANT.ESFC.COMMANDS UACC(NONE)
b. PERMIT STGADMIN.ANT.ESFC.COMMANDS CLASS(FACILITY) ID(STGADMIN) ACCESS(READ)
TSO Commands authorized library protection
As an alternative to, or in addition to the RACF Facility classes, you can protect your TSO copy services commands from unauthorized use by placing them in an authorized TSO command library.
Use the following procedure:
1. Issue the following RDEFINE command for each PPRC command and for each command abbreviation that you want defined to RACF:
RDEFINE PROGRAM cmdname ADDMEM('SYS1.CMDLIB')/volser/NOPADCHK) UACC(NONE)
The following terms apply to this example:
cmdname Defines the PPRC TSO command name or an abbreviation of a command. Issue a separate RDEFINE command for each command and any command abbreviations you plan to use. RACF can perform checking only on commands and abbreviations that are defined to it.
volser Defines the name of the volume that contains the SYS1.CMDLIB data set.
2. Issue the PERMIT command for all commands and authorized PPRC TSO command users as follows:
PERMIT cmdname CLASS(PROGRAM) ID(name) ACCESS(READ)
The following terms apply to this example:
cmdname Defines the PPRC TSO command name or an abbreviation of a command.
name Defines the user ID that will receive RACF access authority for that command name.
3. Issue the SETROPTS command from a user ID that has the appropriate authority:
SETROPTS CLASSACT(PROGRAM) WHEN(PROGRAM) REFRESH
An alternative to this procedure with the same result is to add the commands that you want to protect by adding the command names to the AUTHCMD PARM parameter of the IKJTSOxx member of PARMLIB. After they are added, issue the PARMLIB(UPDATE(xx) TSO command to activate the new IKJTSOxx member.
5.3 ICKDSF commands for z/OS, z/VM, z/VSE
The z Systems ICKDSF utility offers a means of control for Copy Services functions. You can use the ICKDSF utility to start Copy Services in all z Systems environments, including z/OS, z/VM, z/VSE, and z/TPF.
The ICKDSF utility typically runs as a batch program, and so can be automatically run from batch scheduling products (for example, IBM Tivoli® Workload Scheduler).
5.3.1 Protecting ICKDSF Copy Services commands
Like the TSO commands, ICKDSF commands can also be protected using RACF FACILITY classes. The RACF FACILITY classes are listed in Table 5-1.
|
Defining FACILITY classes: Note that you should define all the FACILITY classes for Copy Services interfaces, even if you are not planning on using them in the installation.
|
You can protect certain ICKDSF commands by defining FACILITY class resource profiles and restricting access to those profiles. Table 5-1 shows these commands and their associated RACF class profiles. Protection of an ICKDSF command occurs when the following conditions are met:
•The RACF FACILITY class is active.
•The FACILITY class profile is defined.
When a FACILITY class is active and one of the profiles shown in Table 5-1 is defined, you need read access authority to that profile in order to use the associated command. If the facility class is not defined, the command is not protected (that is, can be issued by any user).
Table 5-1 ICKDSF FACF FACILITY classes
|
ICKDSF command
|
RACF FACILITY class profile name
|
|
ANALYZE
|
STGADMIN.ICK.ANALYZE
|
|
CONTROL
|
STGADMIN.ICK.CONTROL
|
|
CPVOLUME
|
STGADMIN.ICK.CPVOLUME
|
|
FLASHCPY
|
STGADMIN.ICK.FLASHCPY
|
|
PPRCOPY
|
STGADMIN.ICK.PPRCOPY
|
For more information about the ICKDSF utility, see Device Support Facilities User’s Guide and Reference, GC35-0033.
5.4 DFSMSdss copy commands with fast replication
You can use the DFSMSdss commands to manage Copy Services relationships. For more information, see DFSMSdss Storage Administration, SC23-6868.
5.5 The ANTRQST API
The ANTRQST executable macro provides an application program call to the z/OS system data mover (SDM) component AP). This is one of two APIs offered by DFSMS in support of Copy Services. ANTRQST is in the form of an executable assembler macro. The other API, ANTTREXX, is described in 5.6, “The ANTTREXX API and samples” on page 31.
You can use this interface to manage the following Copy Services environments:
•Metro Mirror
•Global Mirror
•Global Copy
•Metro/Global Copy
•z/OS Global Mirror
•Metro/Global Mirror
•Multi-Target PPRC
•Concurrent copy function
•FlashCopy
5.5.1 Protecting ANTRQST API Functions
ANTRQST functions are protected using the same RACF facility classes and the TSO commands. So, there are two facility classes each for FlashCopy, the PPRC family (Metro Mirror, Global Copy, and Global Mirror), and z/OS Global Mirror (XRC).
For each set of commands, there is a facility class for the query commands and a second facility class for the active commands (commands that change a status or result in data movement). A user with access to the active commands automatically inherits access to the query commands. It is recommended that the facility classes be defined, even if the commands are not going to be used by your installation.
For more information, see z/OS DFSMS Advanced Copy Services, SC23-6847.
5.6 The ANTTREXX API and samples
The ANTTREXX is a REXX programming layer on top of the ANTRQST assembler API. You can use this interface to perform the same functions available via the ANTRQST API; however, the REXX version is more user friendly than using assembler, in many cases.
5.6.1 Protecting ANTTREXX API Functions
Because ANTTREXX is a layer on top of ANTRQST, the ANTTREXX functions are protected using the same RACF FACILITY classes as the ANTRQST functions. So, there are two FACILITY classes each for FlashCopy, the PPRC family (Metro Mirror, Global Copy, Global Mirror), and z/OS Global Mirror (XRC).
For each set of commands, there is a FACILITY class for the query commands and a second FACILITY class for the active commands (commands that change a status or result in data movement). A user with access to the active commands automatically inherits access to the query commands. Define the FACILITY classes, even if the commands are not going to be used by the installation.
5.6.2 Sample REXX Programs in DGTCLIB
For users who chose to write their own software management procedures, ANTTREXX provides the simplest approach using REXX. The parameters passed into ANTTREXX closely resemble the keywords used by the ANTRQST API.
For users who want to use REXX rather than TSO but who do not want to start from scratch, sample programs are provided in hlq.DGTCLIB, which is in most users’ log on library concatenation. These sample programs can be invoked via TSO command line or TSO batch. Refer to Table 5-2.
Table 5-2 ANTTREXX sample programs
|
Sample program
|
Copy Services function
|
|
ANTFREXX
|
FlashCopy
|
|
ANTPREXX
|
PPRC (Metro Mirror, Global Copy)
|
|
ANTRREXX
|
Global Mirror
|
|
ANTXREXX
|
zGM (XRC)
|
When using the REXX examples, unformatted query data is returned in dump format, which can be mapped by their associated DSECT macros, as shown in Table 5-3.
Table 5-3 Query DSECT mapping
|
Query command
|
Mapping DSECT
|
|
FCQUERY
|
ANTFQMAP
|
|
PQUERY
|
ANTPQMAP
|
|
RQUERY
|
ANTRQMAP
|
|
STAT4ALSS
STAT4AESS
STAT4ACGRP
|
ANTRQMAP TYPE=STAT4A
|
|
STAT4BLSS
STAT4BESS
|
ANTRQMAP TYPE=STAT4B
|
|
STAT4C
|
ANTRQMAP TYPE=STAT4C
|
|
STAT51
|
ANTRQMAP TYPE=STAT51
|
5.7 Native z/VM commands for FlashCopy
You can start a FlashCopy by using the native z/VM CP FLASHCopy command. Additionally, you can use the ICKDSF Copy Services commands to manage z/VM CP volumes.
5.8 Native z/VSE commands for FlashCopy
You can start FlashCopy by using native IXFP SNAP commands. Additionally, you can use the ICKDSF Copy Services commands to manage a z/VSE replication environment.
5.9 Native z/TPF commands
You can run Copy Services commands by using native z/TPF commands. You can use the ZXCPY command to initiate a FlashCopy, Global Copy (XD), or Metro Mirror (SYNC). You can find information about using z/TPF to control Copy Services in IBM Knowledge Center:
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.