z/OS Console Authority Requirements - ironstream_for_servicenow_discovery_1

General

If OPERCMDS is active in RACF (or equivalent third-party security product), then the Ironstream agent user must be given access to issue certain commands. The table below details the resource class permissions required for the console to perform discovery commands.

An additional level of command security for the agent command console is available through the use of the FILTER CMD parameter card. For more information, see Updating Ironstream Parameter Cards.

Some discovery functionality scripts use REXX commands to perform discovery functions. If the REXX program issues z/OS commands it will create a console with the name EVRXCNyy, where yy is the value in the system symbol &SYSCLONE.

The Ironstream agent issues display and modify commands and needs to receive the responses. If you have automation software or MPF (Message Processing Facility) exits that intercept or suppress messages, then the functionality of Ironstream will be impaired. In this situation, you must amend your environment to allow the expected information to come back to the agent.

Extended Console Definitions in RACF

If RACF security (or equivalent security package) is active, the Ironstream agent console as defined in the CMD parameter must be defined to process commands on this extended console. Additionally, if the EVORXCON Rexx function will be used, the EVRXCN&SYSCLONE name must also be defined to RACF.

Define the console names as users in RACF with an OMVS segment set to a non-zero UID, and define an OPERPARM segment with AUTH=SYSTEM and CMDSYS=LocalSystemName.

Use the RACF panels in TSO, a batch job, or these commands to define the console names:

ADDUSER name DFLTGRP(xxxxx) OPERPARM(AUTH(SYS)) OMVS(UID(n))

ADDUSER EVRXCNyy DFLTGRP(xxxxx) OPERPARM(AUTH(SYS)) OMVS(UID(n))

Where:

name	The name of the console defined on the Ironstream CMD parameter card.
xxxxx	The group name to hold EV Ironstream consoles. This name can also be used in the GR() parameter when defining the consoles to CICS. A commonly used name is “EVOGRP”.
yy	The &SYSCLONE. system symbolic, which is concatenated to “EVRXCN” to create a console name used by the Ironstream Rexx programs. Use the system console command “D SYMBOLS” to find the value of the &SYSCLONE. symbol.
n	A non-zero OMVS UID.

If CICS discovery is to be attempted, the CMD console name and EVRXCNyy names must also be defined as terminals in CICS.

RACF Permissions

Resource class permissions required for the REXX command consoles.

Commands Issued	RACF General Resource	Native or RACF Security Configuration Requirements
`D M=CPU`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.M with Authority READ
`D SYMBOLS`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.SYMBOLS with Authority READ
`D SSI`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.SSI with Authority READ
`D NET,MAJNODES`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.NET with Authority READ
`D ASM`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.ASM with Authority READ
`D PROD,STATE`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.PROD with Authority READ
`D PROD,REGISTERED`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.PROD with Authority READ
`D XCF,GRP`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.XCF with Authority READ
`D XCF,GRP,GroupName,ALL`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.XCF with Authority READ
`D TCPIP,JobName,NETSTAT,CONN D TCPIP,JobName,NETSTAT,ROUTE D TCPIP,JobName,NETSTAT,DEV D TCPIP,JobName,NETSTAT,ARP`	OPERCMDS	Class = OPERCMDS Profile = MVS.DISPLAY.TCPIP with Authority READ

z/OS Console Authority Requirements - ironstream_for_servicenow_discovery_1 - 7.5

Ironstream™ Software for ServiceNow® Discovery for IBM Z® Installation

General

RACF Permissions