IBM Tivoli Advanced Audit for DFSMShsm

Transcription

1 IBM Tivoli Advanced Audit for DFSMShsm User s Guide Version 2 Release 1 SC

2

3 IBM Tivoli Advanced Audit for DFSMShsm User s Guide Version 2 Release 1 SC

4 Note: Before using this information and the product it supports, read the information in Chapter 11, Notices, on page 129. This edition applies to Version 2 Release 1 of IBM Tivoli Advanced Audit for DFSMShsm (product number 5698-B12) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright Rocket Software Inc., 2007

5 Contents About this information v Who should read this book v Service updates and support information v How to look up message explanations v Searching an information center v Using a Web search vi Using LookAt vi How to send your comments vi Figures vii Tables ix Chapter 1. Introduction to Advanced Audit for DFSMShsm What does Advanced Audit for DFSMShsm do? Advanced Audit for DFSMShsm components Prerequisites Accessibility features Chapter 2. Advanced Audit for DFSMShsm Configuration Configuration Summary Step 1: Run AKDCRRUN Step 2: Run AKDINIMG Step 3: Update AKDINI Step 4: Run AKDJCLBD Step 5: Run AKDSYMBL Step 6: Run AKDPLANS Step 7: Modify Product JCL Library Members Step 8: Modify Product SAKDCLST Library Step 9: Create User JOB Card Member Step 10: APF Authorize SAKDLOAD Library Step 11: Add AKD07735 to the Authorized Programs List Step 12: Ensure RACF ALTER Authority for User ID Step 13: Configure the Display of EBCDIC Characters Chapter 3. Getting Started About the Interface Starting the Advanced Audit for DFSMShsm Interface The Advanced Audit for DFSMShsm Master Panel Viewing Messages Exiting Advanced Audit for DFSMShsm Filtering Pattern Masks Chapter 4. Performing an Audit Running an Audit Procedure Including and Excluding Catalogs Audit Procedures for Control Data Sets AKDAUDAL Audit Procedure AKDAUDBD Audit Procedure AKDAUDCT Audit Procedure AKDAUDMD Audit Procedure AKDAUDOD Audit Procedure AKDAUDRM Audit Procedure iii

6 AKDAUDTP Audit Procedure AKDAUDZR Audit Procedure Audit Procedures for DFSMShsm-Owned Tapes AKDAUDFD Audit Procedure AKDAUDFL Audit Procedure AKDAUDFT Audit Procedure OPTION Keyword Chapter 5. Correcting Errors Automatic Error Correction Error Threshold Monitoring Automatic Error Correction Quick Reference Analyzing and Correcting Errors Manually Browsing Audit Results Modifying Audit Results Using SDSF to Monitor Automatic Fixes Chapter 6. Messages and Codes for Advanced Audit for DFSMShsm Product Error Messages Audit Diagnostic Messages Chapter 7. AKDINI Configuration Values PRODUCT_INFO CUSTOMER_ENVIRON AKD_DATASETS PRODUCT_DATASETS DEFAULT_ALLOC_PARMS DEFAULT_JOB_PARMS Chapter 8. Snap Dump Utility Chapter 9. Advanced Audit for DFSMShsm and HSM Equivalents Advanced Audit for DFSMShsm and HSM Audit Equivalents Advanced Audit for DFSMShsm and HSM Diagnostic Error Equivalents Chapter 10. The Query Language Feature Query Language Guidelines CREATE FROM FROMKEY JOIN ORDER BY SELECT TOKEY USING WHERE Boolean Operators Extended Boolean Operators Argument Literals Chapter 11. Notices Trademarks Glossary iv User s Guide

7 About this information Who should read this book This user s guide provides instructions for using IBM Tivoli Advanced Audit for DFSMShsm. To use the procedures in this user s guide, you must have already installed Advanced Audit using the SMP/E installation process that came with the product. This document provides instructions for installing, configuring, and using IBM Tivoli Advanced Audit for DFSMShsm. This information is designed to help system administrators and system programmers perform the following tasks: v Plan for and install Advanced Audit for DFSMShsm v Configure Advanced Audit for DFSMShsm v Use Advanced Audit for DFSMShsm This book is intended for Storage Administrators, System Programmers, and Technical Managers responsible for maintaining DFSMShsm Control Data Sets and the associated records within them. The authors of this book assume that most readers are data processing professionals. Service updates and support information To find service updates and support information, including software fix packs, PTFs, Frequently Asked Question (FAQs), technical notes, troubleshooting information, and downloads, refer to the following Web page: The IBM Tivoli Advanced Audit for DFSMShsm Library Web page provides current product documentation that you can view, print, and download. To locate publications with the most up-to-date information, refer to the following Web page: How to look up message explanations You can use any of the following methods to search for messages and codes: Searching an information center In the search box that is located in the top left toolbar of any Eclipse help system, such as the IBM Information Management Software for z/os Solutions Information Center, enter the number of the message that you want to locate. For example, you can enter DFS1065A in the search field. Use the following tips to help you improve your message searches: v You can search for information on codes by entering the code; for example, enter v Enter the complete or partial message number. You can use wild cards (* or?) in the message number to broaden your search; for example, DFS20??I. v

8 The information center contains the latest message information for all of the information management products that are included in the information center. Using a Web search You can use any of the popular search engines that are available on the Web to search for message explanations. When you type the specific message number or code into the search engine, you will be presented with links to the message information in IBM information centers. Using LookAt LookAt is an online facility that you can use to look up explanations for most of the IBM messages you encounter, as well as for some system abends and codes. Using LookAt to find information is faster than a conventional search because in most cases LookAt goes directly to the message explanation. You can use LookAt from the following locations to find IBM message explanations for z/os elements and features, z/vm, VSE/ESA, and Clusters for AIX and Linux : v The Internet. You can access IBM message explanations directly from the LookAt Web site at v Your z/os TSO/E host system. You can install code on your z/os or z/ose systems to access IBM message explanations, using LookAt from a TSO/E command line (for example, TSO/E prompt, ISPF, or z/os UNIX System Services running OMVS). v Your Microsoft Windows workstation. You can install code to access IBM message explanations on the z/os Collection (SK3T-4269) using LookAt from a Microsoft Windows command prompt (also known as the DOS command line). v Your wireless handheld device. You can use the LookAt Mobile Edition with a handheld device that has wireless access and an Internet browser (for example, Internet Explorer for Pocket PCs, Blazer, or Eudora for Palm OS, or Opera for Linux handheld devices). Link to the LookAt Mobile Edition from the LookAt Web site. You can obtain code to install LookAt on your host system or Microsoft Windows workstation from a disk on your z/os Collection (SK3T-4269) or from the LookAt Web site (click Download, and select the platform, release, collection, and location that suit your needs). More information is available in the LOOKAT.ME files available during the download process. How to send your comments Your feedback is important in helping to provide the most accurate and high-quality information. If you have any comments about this book or any other IBM Tools documentation, use either of the following options: v Use the online reader comment form, which is located at: v Send your comments by to comments@us.ibm.com. Be sure to include the name of the book, the part number of the book, the version of Advanced Audit and, if applicable, the specific location of the text you are commenting on (for example, a page number or table number). vi User s Guide

9 Figures vii

10 viii User s Guide

11 Tables 1. Configuration Steps Filtering Pattern Masks SAKDCNTL Members Referred to by the SELECTS DD Statement Additional Records Displayed Advanced Audit for DFSMShsm and HSM Audit Equivalent Advanced Audit for DFSMShsm and HSM Audit Error Equivalents Boolean Operators Extended Boolean Operators Argument Literals ix

12 x User s Guide

13 Chapter 1. Introduction to Advanced Audit for DFSMShsm These topics introduce you to the functionality that is provided with IBM Tivoli Advanced Audit for DFSMShsm, including its major components and some of the key benefits of using it. What does Advanced Audit for DFSMShsm do? IBM Tivoli Advanced Audit for DFSMShsm delivers a set of auditing commands that help support the health of the control data sets. Without fast, accurate, and reliable audits, you risk losing access not only to your z/os data, but also all your HSM migrated data. To avoid serious outages, you need a powerful data interrogation solution that keeps your z/os environment trouble-free with high-speed, accurate, and flexible audits. Advanced Audit for DFSMShsm helps you keep your z/os environment trouble-free with fast, accurate, and flexible audits. With Advanced Audit for DFSMShsm, storage administrators can maintain healthy metadata environments and prevent temporary or permanent loss of data access. Advanced Audit for DFSMShsm provides extremely fast and accurate audits and diagnostics, as well as automatic corrective actions to resolve error conditions Advanced Audit for DFSMShsm provides: v Non-disruptive audits for the metadata structures in your environment: catalogs, DASD VTOC records, DFSMShsm, and tape management systems. v Easy-to-use online selection and submission of audits, diagnostic aids, and corrective actions. v Easy online viewing of audit results. v Flexibility to create, save, and reuse your own customized diagnostic aids and corrective actions. v Complete control over which meta data structures are audited. v Complete control over which diagnostic aid or corrective action is implemented for your unique environment. v Flexibility to edit JCL and corrective action commands to apply fix control statements to only the records you want to fix. v Automatic application of fixes to reported errors. v Capability to turn ON or OFF individual error correction actions. v Automatic halting of audits if a high threshold of errors is reported. v Ability to apply automatic fixes to specific high-level qualifiers. v Support for both DFSMShsm standard TTOC and extended TTOC. Advanced Audit for DFSMShsm components Advanced Audit for DFSMShsm consists of two audit components: the auditing of HSM control data sets and DFSMShsm-owned tapes. Advanced Audit for DFSMShsm evaluates the migration control data set (MCDS), backup control data set (BCDS), and the offline control data set (OCDS) to help resolve structural and logical discrepancies that can prevent migrated data from 1

14 being recalled, or backup data from being restored. It correlates entries with the ICF catalog environment to help maintain consistency. Advanced Audit for DFSMShsm helps you audit and correct errors with your DFSMShsm migration and backup tapes. It works outside of the DFSMShsm environment to correct errors that it finds and has customer-documented benchmark speeds faster than the traditional DFSMShsm AUDITMEDIACONTROLS command. Prerequisites Advanced Audit for DFSMShsm requires the following software levels. v z/os release V1R6, V1R7 or V1R8 v DFSMShsm running on z/osmvs/esa 4.1 or higher Accessibility features Accessibility features help a user who has a physical disability, such as restricted mobility or limited vision, to use a software product successfully. The major accessibility features in Advanced Audit for DFSMShsm enable users to: v Use assistive technologies such as screen readers and screen magnifier software. Consult the assistive technology documentation for specific information when using it to access z/os interfaces. v Customize display attributes such as color, contrast, and font size. v Operate specific or equivalent features by using only the keyboard. Refer to the following publications for information about accessing ISPF interfaces: z/os ISPF User s Guide, Volume 1 z/os TSO/E Primer z/os TSO/E User s Guide These guides describe how to use ISPF, including the use of keyboard shortcuts or function keys (PF keys), include the default settings for the PF keys, and explain how to modify their functions. 2 User s Guide

15 Chapter 2. Advanced Audit for DFSMShsm Configuration After you install Advanced Audit for DFSMShsm using the installation instructions provided in the IBM Tivoli Advanced Audit for DFSMShsm Program Directory, that is included with the product, you must configure Advanced Audit for DFSMShsm for your environment. Configuration Summary The following table summarizes the steps that are required to configure Advanced Audit for DFSMShsm. Some of these steps are optional or might not apply to your environment. Table 1. Configuration Steps Step Description 1 Run AKDCRRUN. 2 Run AKDINIMG. 3 Update AKDINI. 4 Run AKDJCLBD. 5 Run AKDSYMBL. 6 Run AKDPLANS. 7 Modify product SAKDJCL library members. 8 Modify product SAKDCLST library. 9 Create user JOB card member JOBCARD. 10 APF authorize product SAKDLOAD library. 11 Add AKD07735 to the authorized programs list. 12 Ensure RACF ALTER authority for user ID. 13 Configure the display of EBCDIC characters. Step 1: Run AKDCRRUN AKDCRRUN creates a set of runtime libraries using the target libraries as the source. 1. Copy the JCL AKDCRRUN from the SAKDJCL target library and place it in a personal PDS. 2. Modify the parameter TGTHLQ to reflect the high level qualifier of the target libraries. 3. Modify the PPFX to reflect the high level qualifer of the runtime libraries that this job creates. 4. Submit the job using a valid jobcard. You can continue with the configuration using these newly created runtime libraries. 3

16 Step 2: Run AKDINIMG Step 3: Update AKDINI Step 4: Run AKDJCLBD Step 5: Run AKDSYMBL Run the AKDINIMG member of the ppfx.sakdjcl library to create a new AKDINI SAKDPARM member. AKDINIMG was created by submitting INSTJCL during the install process. Note: Do not alter the contents of the AKDINI# member. 1. Provide a valid job card statement. 2. Change the STEPLIB data set name to the ppfx.sakdload library. 3. Change the INI DD statement to point to ppfx.sakdparm as the data set name and specify AKDINI# as the member name. 4. Change the MSCINI DD statement to point to the ppfx.sakdparm data set, and ensure that the member name remains as AKDINI#. 5. Change the UPDATE DD statement to point to the ppfx.sakdparm data set, and ensure that the member name remains as AKDINI. 6. Submit the job, and ensure it executes and completes with a completion code 0 before proceeding to the next configuration step. If the job terminates with a non-zero completion code, first check to see if any error messages indicate a situation that is easily correctable. You can run AKDINIMG multiple times. If the situation does not appear to be easily correctable, please contact Technical Support before proceeding to the next configuration step. Modify the values in the AKDINI member of the SAKDPARM library, which controls many product functions. 1. Use ISPF Edit to update the values. Be sure to review all of the tokens in the AKDINI member and set appropriate values for your installation. Pay particular attention to the RLS token of the CUSTOMER_ENVIRON section. 2. After you have made all your edits, save your updated AKDINI. After you have customized the AKDINI member, the SAKDPARM data set should be read-only. Run the AKDJCLBD member of the SAKDJCL library to substitute variables coded in the AKDINI into the SAKDJCL members. 1. Modify the AKDJCLBD job as indicated by the comments at the beginning of the member. 2. Be sure that the AKDINI values are set as desired before running AKDJCLBD. You can run AKDJCLBD multiple times. 3. Submit the AKDJCLBD job. Run the member AKDSYMBL to update the SYMBOLIC member of the ppfxx.sakdcntl library. 4 User s Guide

17 Step 6: Run AKDPLANS This step retrieves information you have established in AKDINI and inserts it with the proper format into member SYMBOLIC. Add the proper JOBCARD information and submit the job. Run the member AKDPLANS of the SAKDJCL library to create a PLANS library. The PLANS library contains PLANS and FIXES used by Advanced Audit for DFSMShsm. Step 7: Modify Product JCL Library Members Modify the following ppfx.sakdjcl library members for your installation. These jobs are not intended to be submitted directly by you, but are used internally by Advanced Audit for DFSMShsm processes. Please note that some fields will still be blank after you have completed this step. The rest of the JCL will be generated by the Advanced Audit for DFSMShsm audit process at execution time. 1. Modify the SYSPROC statement in member AKDBTTSO so that ppfx is the product prefix assigned to Advanced Audit for DFSMShsm by your installation. 2. Change the ZARACAT and the ZARAVLT data set names in member AKDBTZRA to match the ZARA data sets installed in your system. If your installation does not use ZARA TMS, then ignore this step. 3. Change the SYSPROC statement in member AKDBDTTC of ppfx.sakdjcl to the SAKDCLST library as installed. The DSN= and SPACE= statements must remain blank so when the fix create process is run, these two statements are filled in with the appropriate parameters. Note: Use of the SMS construct to release unused space after a data set is closed can cause problems when running Advanced Audit for DFSMShsm fixes. HSM closes and opens the data set specified by ODS in the control statements frequently. This causes space to be released when it may still be required. It is recommended that you use a MGMTCLAS statement with a class that does not release unused space. 4. Modify member AKDBATCH in the ppfx.sakdjcl library, to identify the MCDS, BCDS, and OCDS DSNames for your environment. The names of the production SAKDLOAD library and SAKDPARM need to be provided as well. This set of JCL is used to verify CDS records and display them in a dump format. The Snap Dump utility will also display HSM records and display them in a dump format. If you use multi-cluster CDSs, you must include the names of all the CDS splits in the AKDBATCH member in the ppfx.sakdjcl library. 5. Change the AUDIT statement in member AKDTMSBQ, to the CA1 AUDIT data set name installed in your system. In a typical TMS installation, there is no need to specify the AUDIT DSName. If your installation does not use CA1 TMS, then ignore this step. 6. After running AKDJCLBD, make the following changes to the batch cataloged procedures AKDAUDxx: a. Change the JOB control statement to suit your environment. b. Choose a JOB CLASS that allows about five minutes of processing time (it takes a while to capture and analyze all of the information in an entire installation). Chapter 2. Advanced Audit for DFSMShsm Configuration 5

18 Step 8: Modify Product SAKDCLST Library Modify the ppfx.sakdclst library for your installation. 1. Update the member AKDAUDIT in the SAKDCLST library with the values for ppfx, pfx, and &SYSUID. a. Change all the ppfx (no ampersand in front) to the product prefix assigned to the product components during installation. b. Change all the pfx (no ampersand in front) to the runtime prefix assigned in the cataloged procedures. c. (Optional) Change the &SYSUID statement to a prefix that is acceptable if your installation does not allow allocations by user ID. In most installations there is no need to change the &SYSUID value. When editing &SYSUID, follow the instructions in the commented section in the CLIST AKDAUDIT. Note: Advanced Audit for DFSMShsm CLISTs are in a variable blocked format, but none of the code extends past column 72, so you can safely copy them to a fixed block format SAKDCLST library if you want. 2. Modify FSTPLB in the AKDMONTR member of the SAKDCLST library with the installation s SAKDLOAD library. Replace the????????.load with the name of the SAKDLOAD library installed for Advanced Audit for DFSMShsm. Step 9: Create User JOB Card Member Each person executing corrective actions or diagnostic aids must have a unique member in ppfx.sakdcntl containing their JOB card information. The unique job card member is referenced on the JOBCARD DD statement as &USERID.J of &ppfx.sakdcntl. The member name is based on the TSO userid of the user and is suffixed by the letter J (for JOB card). For example, you would create a job card member DDAVENJ for user ID DDAVEN. In some environments, security groups are utilized to provide sufficient authority to the user ID executing programs in batch; others accomplish this with the use of a GROUP parameter on your JOB card. For example, GROUP=ARCCATGP. To implement this, your security administrator must add your user ID to the GROUP specified in the parameter. Using this parameter on the JOB card provides the proper security authority to READ ICF catalogs required for some of the audit procedures. Although the audit procedure only reads ICF catalogs, ALTER access may be required. Security software and procedures vary so consult your security administrator for the proper procedures to follow in your environment. Step 10: APF Authorize SAKDLOAD Library The Advanced Audit for DFSMShsm product SAKDLOAD library requires explicit APF authorization, even if it appears in the system link list with the LINKAUTH=LNKLST option. If the contents of the product SAKDLOAD library are copied to another SAKDLOAD library, it must be APF authorized. Although SMS managed load libraries can be assigned APF authorization, most installations prefer to have all authorized libraries reside on specific non-sms system volumes. 6 User s Guide

19 Step 11: Add AKD07735 to the Authorized Programs List You must add the program AKD07735 to the AUTHPGM NAMES list of SYS1.PARMLIB member IKJTSO00. The program AKD07735 is used by the automatic fix process to interrogate the HSM address space to determine how many commands may be safely submitted at any one time Step 12: Ensure RACF ALTER Authority for User ID Ensure that your user ID has the appropriate RACF ALTER authority. Many of the Advanced Audit for DFSMShsm procedures read system catalogs. Although they only read and do not update any catalogs, because of an IBM requirement, the user submitting the job must have RACF ALTER authority. Step 13: Configure the Display of EBCDIC Characters If the code tables used by your installation are different, then you must enter the EBCDIC character peculiar to your code tables that results in the binary value for the EBCDIC character specified in the product manuals. Advanced Audit for DFSMShsm uses the U.S.A. EBCDIC code set for specification and display of EBCDIC characters and for the extended ACS masking characters used for filtering. v Data supplied as input to batch programs For product code shipped in binary, when specifying input where the product takes special action based on specific characters, you must enter the EBCDIC character peculiar to your code tables that results in the binary value for the EBCDIC character specified in the product manuals, according to the U.S.A. EBCDIC code set. For example, if an exclamation mark (! ) is called for, and your code tables do not translate the! character to a hexadecimal 5A, you must enter the character that your code table will translate to a 5A. v Product output Depictions of product output shown in the product manuals are based on the U.S.A. EBCDIC code set. Actual output may vary if your EBCDIC code tables are different. v Extended ACS masking characters Your installation may need to specify different masking characters to achieve the desired result if your code tables are different from the U.S.A. EBCDIC code set. Chapter 2. Advanced Audit for DFSMShsm Configuration 7

20 8 User s Guide

21 Chapter 3. Getting Started About the Interface This chapter helps you start using Advanced Audit for DFSMShsm and describes other general topics about its use. Advanced Audit for DFSMShsm provides an ISPF-based interface that allows you to easily do the following tasks: v Analyze and correct errors. v View Advanced Audit for DFSMShsm messages. Starting the Advanced Audit for DFSMShsm Interface To access theadvanced Audit for DFSMShsm Master panel, type EX ppfx.sakdclst(akdaudit) ppfx is the product prefix assigned at installation time. If the AKDAUDIT CLIST has been copied to a system CLIST library, you can issue %AKDAUDIT. The Advanced Audit for DFSMShsm Master Panel This topic describes the options that are available from the Advanced Audit for DFSMShsm Master (AKD710) panel. 1 MCDS Type 1 to access the audit results from the audit procedures AKDAUDMD, AKDAUDCT, AKDAUDAL. 2 BCDS Type 2 to access the audit results from the audit procedure AKDAUDBD. 3 OCDS Type 3 to access the audit results from the audit procedure AKDAUDOD. 4 HSMTAPE Type 4 to access the audit results from the audit procedures AKDAUDTP, AKDAUDZR, AKDAUDRM. 5 MEDCTL Type 5 to access the audit results from the audit procedures AKDAUDFD, AKDAUDFL, AKDAUDFT. Viewing Messages You can view the Advanced Audit for DFSMShsm messages by placing your cursor on the Messages pull-down menu at the top of the panel and press Enter. The SAKDMSGS member is displayed in an ISPF browse panel. You can use the FIND command to find a specific message. For example, you can type F msgid 1 to locate a specific message with the specified msgid. Exiting Advanced Audit for DFSMShsm To exit Advanced Audit for DFSMShsm, either type END on the command line or press PF3 from the Master panel. 9

22 Filtering Pattern Masks Many commands allow you to specify powerful filtering masks using extended ACS masking characters, as shown in the following table. Note: Your installation may need to specify different masking characters to achieve the desired result if your code tables are different from the U.S.A. EBCDIC code set. Table 2. Filtering Pattern Masks Mask Hex Description * (Single) 5C Represents 0-n characters. You can specify this wildcard character before an item, after an item, or both to designate a wildcard position. You can not use an * in the middle of a single item (except for data set names) Use the % character instead. For example, *PROD will select an item if the last four characters are PROD regardless of the starting characters. Using the * character before and after an item (for example, *ZREM*) means that item is to be selected if any character string matches ZREM in its name. % 6C Denotes a single character placeholder value, which can be alpha-numeric or any special character. The % character can be used in any position order. For example, CRM%%ER6 will select an item if it is 8-characters in length, the first three characters are CRM, the last three characters are ER6. The two middle placeholder values can be any characters. < 4C Denotes a placeholder value for only alpha characters. The < character can be used in any position order. For example, CR<<ER* will select an item if the first two characters are CR, the first and third characters are alpha, the fifth and sixth characters are ER, and the rest are any remaining characters. 10 User s Guide

23 Table 2. Filtering Pattern Masks (continued) Mask Hex Description > 6E Denotes a placeholder value for only numeric characters. The > character can be used in any position order. For example, CR>>ER* will select an item if the first two characters are CR, the third and fourth characters are numeric, the fifth and sixth characters are ER, and the rest are any remaining character. ** (Double) 5C5C Allows compatibility with standard ACS and DFSMSdss filtering masks. This mask is used only for partially qualified data set names. The * or ** characters can be used in any qualifier position to denote a wildcard node. For example, CRFM*.*VER.** will select a data set entry if it has at least two qualifiers and the first qualifier starts with CRFM, the second qualifier must end with VER, and any remaining qualifiers. Note: As with common data set name masking, any combination of *, **, %, < and/or > characters can be used for the item mask value.! 5A Denotes a placeholder value for only national characters (based on the U.S.A. EBCDIC code set. The! character can be used in any position order. National characters, based on the U.S.A. EBCDIC code set, # $. Chapter 3. Getting Started 11

24 12 User s Guide

25 Chapter 4. Performing an Audit Running an Audit Procedure This chapter describes how to setup and run the audit procedures provided with Advanced Audit for DFSMShsm. This topic describes the steps for running an audit procedure to obtain audit results. This procedure assumes you already have a job card member defined for running the audit procedures. See Step 9: Create User JOB Card Member on page 6 for more information. 1. Determine which audit procedure you want to run. 2. Display the audit procedure JCL in an edit session. 3. Optionally, update the audit procedure JCL to include or exclude specific catalogs from the audit. 4. Type SUBMIT to run the audit procedure. Make sure the audit procedure JCL finished successfully before viewing or correcting any auditing errors. Note: It is suggested that all data sets allocated by the audit procedures run under SMS control. There are several programs in the audit procedures which create a data set, close it, and then another module is linked which looks up the catalog for the data set just created. If the data set is not cataloged the system issues a NOT CAT message. Data sets under SMS control must be cataloged upon creation time thus circumventing this issue. Including and Excluding Catalogs The audit procedures AKDAUDAL and AKDAUDCT allow you to include or exclude catalogs from the audit. The exclude member for each audit procedure is in the ppfx.sakdcntl library. For the audit procedure AKDAUDAL, the exclude member is AKDZXCAL and for the audit procedure AKDAUDCT the exclude member is AKDZXCCT. To include or exclude specific catalogs from these audits: 1. Modify the statement //EXCLUDE DD DSN=&ppfx.SAKDCNTL(AKDZXCxx)in the audit procedure so it refers to the proper exclude member. 2. Modify member AKDZXCxx in ppfx.sakdcntl with one of the following: v a list of catalogs to exclude after the EXCLUDES FOLLOW statement v a list of catalogs to include after the INCLUDES FOLLOW statement See AKDAUDCT Audit Procedure on page 14 or AKDAUDAL Audit Procedure on page 14 for additional information on what to include or exclude for each audit procedure. Note: Includes and excludes are mutually exclusive and cannot be used in combination. Catalog names must start in column 1. The following shows an example list of included catalogs for an audit procedure: 13

26 INCLUDES FOLLOW USERCAT.UCAT1 FACUCAT.FORTY.FOUR.BYTE.CATALOG.NAME.X FACUCAT.FORTY.FOUR.BYTE.CATALOG.NAME.X The following shows an example list of excluded catalogs for an audit procedure: EXCLUDES FOLLOW ICF.ZAPP02 CRTUCAT.EH.REORG01 If you use multi-cluster CDSs, you must: v Include the names of all CDS splits in the JCL for each catalog procedure. v Include the names of all splits in the AKDBATCH member of the ppfx.sakdjcl library. Audit Procedures for Control Data Sets Advanced Audit for DFSMShsm provides the following audit functions for various types of control data sets. AKDAUDAL Audit Procedure AKDAUDAL audits all the MCDS migration components and the catalog entries that are cataloged to VOLSER MIGRAT. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.mcds.errsum MCDS - Audit Errors Summary v pfx.audit.mcds.errors MCDS - Audit Errors Detail You can include and exclude specific catalogs. It is recommended that you exclude all master catalogs on the complex. You should check what you are excluding before running any procedures involving catalog extraction. It is also recommended that you do not exclude user catalogs. When a data set is found that is cataloged to an excluded user catalog, it is reported as if the data set were cataloged to the master catalog. Additionally, this will cause the product to run considerably longer. See Including and Excluding Catalogs on page 13 for more information. Authorization The user submitting this job must have RACF ALTER authority. AKDAUDBD Audit Procedure AKDAUDBD audits the BCDS backup components. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.bcds.errsum - BCDS Audit Errors Summary v pfx.audit.bcds.errors - BCDS Audit Errors Detail Note: You must stop the EXPIREBV and the FREEVOL BACKUPVOL processes before running this audit procedure. AKDAUDCT Audit Procedure AKDAUDCT audits all the MCDS true name entries (MCD and MCO) against catalog entries with VOLSER MIGRAT. 14 User s Guide

27 The MCDS error analysis will only contain errors related to the catalog extraction. For a full MCDS analysis, run AKDAUDAL or AKDAUDMD. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.mcds.errsum MCDS - Audit Errors Summary v pfx.audit.mcds.errors MCDS - Audit Errors Detail If you include certain catalogs instead of excluding them, only those entries in DFSMShsm that qualify for that catalog will be audited. It is recommended that you exclude all master catalogs on the complex. You should check what you are excluding before running any procedures involving catalog extraction. See Including and Excluding Catalogs on page 13 for information. Authorization The user ID submitting this job must have RACF ALTER authority. AKDAUDMD Audit Procedure AKDAUDMD audits all the MCDS components; excluding the catalog. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.mcds.errsum - MCDS Audit Errors Summary v pfx.audit.mcds.errors - MCDS Audit Errors Detail AKDAUDOD Audit Procedure AKDAUDOD audits the DFSMShsm OCDS volume pointer chains forward and backward. This audit is necessary to ensure that the tapes in the OCDS inventory can recycle properly. This audit not only examines the correct pointers, but it also verifies each data set in the pointer conflict to determine the correct pointer and provides the appropriate fixes. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.ocds.errsum - TTOC Audit Errors Summary v pfx.audit.ocds.errors - TTOC Audit Errors Detail AKDAUDRM Audit Procedure AKDAUDRM audits the DFSMShsm tape inventory OCDS against the IBM Removable Media Manager (RMM). If DFSMShsm manages the tapes directly, this procedure can still be run; however, the diagnostic messages relating to the RMM tape inventory will have little value. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.tape.errsum - Tape Audit Errors Summary v pfx.audit.tape.errors - Tape Audit Errors Detail AKDAUDTP Audit Procedure AKDAUDTP audits the DFSMShsm tape inventory OCDS against the CA1 TMS system. Chapter 4. Performing an Audit 15

28 AKDAUDZR Audit Procedure This procedure is useful if your installation has installed the DFSMShsm exit to allow CA1 to manage the tapes. If DFSMShsm manages the tapes directly, this procedure can still be run; however, the diagnostic messages relating to the CA1 tape inventory will have little value. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.tape.errsum - Tape Audit Errors Summary v pfx.audit.tape.errors - Tape Audit Errors Detail AKDAUDZR audits the DFSMShsm tape inventory OCDS against the ZARA tape management system. This procedure is useful if your installation has installed the DFSMShsm exit to allow ZARA to manage the tapes. If DFSMShsm manages the tapes directly, this procedure can still be run; however, the diagnostic messages relating to the ZARA tape inventory will have little value. This procedure creates two data sets that are used in error analysis and correction. v pfx.audit.tape.errsum - Tape Audit Errors Summary v pfx.audit.tape.errors - Tape Audit Errors Detail Audit Procedures for DFSMShsm-Owned Tapes Advanced Audit for DFSMShsm provides the following audit functions to execute outside of the DFSMShsm started task environment. AKDAUDFD Audit Procedure AKDAUDFD is the equivalent of the IBM AUDIT DIRECTORYCONTROLS VOLUMES(volser) command and produces diagnostics that are useful in determining the health and contents of a tape before it is mounted and read. The TTOC information for the tape is extracted. If the tape is an DFSMShsm ML2 volume, the MCDS is read and any MCD (migration control data set record) references to the volume are captured. If the tape is a DFSMShsm backup volume, all MCC (backup control data set backup version record) references found in the BCDS are captured. No automatic corrections or TTOC rebuild statements are created in this procedure. After examining the results of this audit, execute audit procedure AKDAUDFL and make sure to code the same TAPEVOL parameter. AKDAUDFL Audit Procedure AKDAUDFL depends on the successful completion of procedure AKDAUDFD for the same tape volume because it uses the data sets created by AKDAUDFD and runs additional diagnostics after reading the physical tape. The second part of the audit requires the tape to be mounted and read. After reading the contents of the tape, further auditing is performed, and diagnostics messages are produced. In addition, automatic error corrections for the MCD and MCC records are created and contained in the output data set &pfx.mediactl.vtttttt.fixes. All TTOC rebuilds and corrections are created and contained in the output data set &pfx.mediactl.vtttttt.fixttoc. 16 User s Guide

29 Repairing or recreating the entire TTOC for a volume may require thousands of FIXCDS T statements. To avoid flooding the DFSMShsm QUEUE, a monitor is provided. Even with the monitor, a QLIMIT parameter is provided. The default value of QLIMIT is 3,000,000, which is typically enough to successfully rebuild the TTOC. The OUTDATASET space allocation also uses the QLIMIT value to allocate enough space to contain all the resultant fix processes. Although you may lower the QLIMIT value, more than one job and set of control statements will be built, requiring separate job submission and monitoring. To control how to process the tape, AKDAUDFL supports the processing options FAST, THOROUGH, and INTENSE on the OPTION keyword. AKDAUDFT Audit Procedure AKDAUDFT is the equivalent of the IBM AUDIT MEDIACONTROLS VOLUMES command and combines the functions of the AKDAUDFD and AKDAUDFL procedures in a single audit procedure. AKDAUDFT is useful to reclaim volumes in failed create or failed recycle status when the TTOC has been damaged or deleted. It is also useful to rebuild the entire TTOC for tapes that have been inadvertently scratched and are no longer under DFSMShsm control. This is possible as long as the tapes have not been written over. To control how to process the tape, AKDAUDFT supports the processing options FAST, THOROUGH, and INTENSE on the OPTION keyword. If you specify FAST or THOROUGH and the audit detects errors on the tape, the program will automatically invoke the INTENSE processing option. OPTION Keyword The OPTION keyword of the AKDAUDFL and AKDAUDFT audit procedures control how to process the tape. FAST Option Use the FAST option when auditing tapes that are in failed create status. Typically, a tape is in failed create status if it was being written to when the system or DFSMShsm abnormally terminated or when DFSMShsm is cancelled or FORCE CANCELLED. For performance reasons, DFSMShsm retains information in memory and writes the information to the TTOC about every 20 minutes. If the system abnormally terminates, or is brought down, before the information in memory can be written to the TTOC, the information is lost. The only resolution to recover the records required to access all data on the tape is to execute the AUDIT MEDIACONTROLS VOLUMES command provided in the AKDAUDFL audit procedure. When the FAST option is specified, the audit procedure requests the tape to be mounted and positions the tape to a location determined by the last known block that has a valid MCD/MCC entry and a matching TTOC entry. The remainder of the tape is read until the end of the tape is encountered. TTOC entries for additional data found on the tape are created by FIXCDS T statements. All entries on the tape that physically exist prior to the starting point are presumed to be accurate and are not audited. Chapter 4. Performing an Audit 17

30 THOROUGH Option Use the THOROUGH option when the true data set names of one or more data sets are not found in the MCDS or BCDS. It is useful to use this option when auditing tapes that are in a failed recycle status. Occasionally, you might want to reestablish the pointers to an entry on the tape to initiate an DFSMShsm RECALL or RECOVER command. The TTOC contains alias names assigned by DFSMShsm when a data set is migrated or backed up. When a data set name is deleted from the MCDS or BCDS, the references to the true name are deleted. The TTOC alias names are retained and the data on the tape is still there until the tape is recycled and returned to the scratch pool; however, there is no way to determine the true name without physically reading the tape. When the THOROUGH option is specified, the audit procedure positions the tape to the beginning and uses the contents of the TTOC to skip through the tape to the position where the CDD (common data set descriptor) records are supposed to be. The skip and compare technique is a fast method of determining the entire contents of the tape. Each CDD entry encountered is audited against the TTOC and MCDS/BCDS extractions. Fixes are automatically generated to correct mismatches in the corresponding records. In addition, you may create new migration and backup records to RECALL or RECOVER entries from the tapes. INTENSE Option Use the INTENSE option when the TTOC of a tape is damaged or no longer exists. For example, if an ML2 tape has been recycled and returned to the scratch pool, and this is not desired, the INTENSE option is useful to completely rebuild the TTOC of the tape so it can be utilized again for RECALL. The THOROUGH option is not useful in this scenario because the TTOC for the scratched tape no longer exists. If you code the THOROUGH option and the procedure finds that the TTOC information is inaccurate or missing, the INTENSE option is automatically initiated. Informational messages are written to the console to notify you when this occurs. The INTENSE option reads every record on the tape and counts blocks between the CDD true name entries. The INTENSE option execution can take seven to ten hours to complete, depending on the tape media used, the number of data sets, and the tape subsystem resources available. This process recreates all the TTOC extents and every entry in the extent. The automatically generated FIX commands for the MCD and MCC records are placed in output data set &pfx.mediactl.vtttttt.fixes. All TTOC rebuilds and corrections are created and contained in the output data set &pfx.mediactl.vtttttt.fixttoc. These FIX commands can be subsequently executed to correct the errors on the tape. 18 User s Guide

31 Chapter 5. Correcting Errors Automatic Error Correction This chapter provides information on how to setup your audit procedures to correct errors automatically or to use Advanced Audit for DFSMShsm to analyze and correct errors manually. Advanced Audit for DFSMShsm allows you select the fixes that most appropriately satisfy your environment, make it the default, and then apply them automatically. All of the audit procedures have a member in the &ppfx.sakdcntl library. These are the generic plans and automatic fix routines for each diagnostic error that can be repaired. The recommended fixes must be defined by the customer where appropriate. You should review the automatic fixes member and select the fixes that most appropriately satisfy your environment so only those fixes are applied when the audit procedure is run. A plan for each diagnostic error is distributed with the product and resides in the &ppfx.plans library. The naming convention of each plan member is the five-digit diagnostic error preceded by a P. The naming convention of the preferred fix for that plan is a five-digit diagnostic error preceded by an F. The contents of a sample automatic fixes member is shown below. Note: This is an example of the AKDZAFxx member in the &ppfx.sakdcntl library. ***************************** Top of Data ****************************** * LIST OF AUTOMATIC FIXES FOR THE xxxx AUDIT (AKDAUDxx) * COLUMN 1 IS PLAN MEMBER TO EXECUTE, COLUMN 10 IS PREFERRED FIX Pxxxxx Fxxxxx Column 1 contains the start of the plan member name and column 10 contains the start of the fix to apply. If you do not want to apply a fix automatically, specify NONE for both the plan member to execute (starting in column 1) and the preferred fix (starting in column 10). To apply the fixes automatically, you must make the following changes to your audit procedure: 1. Change the data set name in the //FORMAT statement to direct the JCL and control statement to the internal reader. For example: //FORMAT DD SYSOUT=(*,INTRDR) 2. Modify the //SELECTS DD NAME statement to include the automatic fixes member. Error Threshold Monitoring You can bypass automatic error correction if the number of errors exceeds a predefined threshold or based on filtering by high-level qualifier or group of high-level qualifiers. The following example shows the default plan for diagnostic xxxx, where xxxx would be the diagnostic error. 19

32 ****** ***************************** Top of Data ****************************** PLAN PLAN * * SELECT * FROM (datset) USING dataset(member) CREATE dataset WHERE DIAGNOSTIC = xxxx AND ERR-COUNT GT END PLAN PLAN PLAN02 COND EQ 0 PLAN * SAMPLE PLAN TO TEST A COPY OF ARGUMENTS SELECT * FROM (dataset) USING dataset(member) USE error dataset FROMKEY ERRNUM = xxxx TOKEY ERRNUM = xxxx WHERE ERRNUM = xxxx * ANY COPY MEMBER STATEMENTS FOR ENHANCED PLANS WOULD GO HERE * COPY TESTLIST END PLAN02 PLAN01 determines if any diagnostics have been detected with the logic in lines 8 and 10. If the answer is zero, the COND example in PLAN02 determines whether the second part of the plan should run. The syntax allows more than one condition to be tested before a condition is true. All conditions must be satisfied before the result is set to true. In this case, if some diagnostics are detected, PLAN02 captures and spools the error detail to the error dataset. If you do not want to run fixes when the error count exceeds a predefined threshold, you can add a statement in the example after line 10 similar to the following: WHERE DIAGNOSTIC = xxxx AND ERR-COUNT GT 0 AND ERR-COUNT LT Lines 21 and 22 of the example plan show a comment about copying a member for more conditional setting. This is where you can enter data set name filter patterns to distinguish test from production data or any other criteria. You can add the statements directly into the plan or place them in a separate member in the PLANS library. An example of what you might specify for line 21 to test true on a specific DSN is shown below: AND TDSN AE DCD.** OR TDSN AE EDP.** OR TDSN AE DANR.** The AE operation means ACS PATTERN EQUAL to the filter pattern presented in the argument. You can use the corresponding operation of AN (ACS PATTERN NOT EQUAL) for an exclusion test. See Chapter 10, The Query Language Feature, on page 115 for more information. If the same list of data sets are needed from plan to plan, you can create a member in the PLANS data set with these arguments in it and use the COPY statement to employ the member in each plan where needed. In the above example, COPY TESTLIST on line 22 is commented out. Create the member name and change the 20 User s Guide