IBM Security zSecure, Version 2.3.0

Making the software available for batch processes

To run programs in batch or as a started task, use the zSecure™-supplied JCL procedures described in the User Reference Manual. These procedures allocate the data sets where the software is installed. Allocation is done using the CPREFIX parameter in either the configuration member C2R$PARM or a custom copy of that member.

You can run programs in batch using any of the following methods.
  • Run the procedures directly from the zSecure-shipped SCKRPROC data set.
  • Embed the SCKRPROC data set in your system procilib concatenation.
  • Copy the procedures to your system procilib concatenation.

The system proclib provides an advantage because you must update only one place to apply changes for all JCL. However, the disadvantage is that only one version of a procedure can be effective at a time. For example, when using a shared proclib, you cannot upgrade your images one at a time.

For batch jobs, make the zSecure-supplied procedures available through the JCLLIB statement. Typically, your JCLLIB statement first specifies the data set that contains your configurations followed by the zSecure-supplied SCKRPROC data set. See Assignment of configurations to batch jobs and started tasks.

However, for started procedures (unlike started jobs), z/OS® does not support JCLLIB. As a result, you must copy some members from SCKRPROC to a data set that is part of your JES proclib concatenation.
  • Do not include most procedures, and especially the ones that use C2RC, in your proclib concatenation:
    • C2RC requires the following members. These members might be customized and are dependent on the parameters you specify:
      • C2RI0CMD
      • C2RI0IOC
      • C2RI0SMF
      • C2RI0UNL
      • C2RI1CMD
      • C2RI1IOC
      • C2RI1SMF
      • C2RI1UNL
      Normally these customized members are included from your configuration data set, rather than from SCKRPROC.
    • You might have multiple zSecure configuration data sets, each with its own versions of these customized members, while the standard JES proclib concatenation can have only one version effective.
  • zSecure Alert and the Access Monitor for zSecure Admin must run as started tasks. If you use either of these components, copy the following procedures:
    • C2POLICE and C2PCOLL for Alert
    • C2PACMON for Access Monitor

    Procedure C2PRECI is also part of zSecure Alert, but this procedure is normally run as batch job. Do not run this procedure as a started task because it internally uses procedure C2RC.

  • The zSecure Server is usually operated as a started task, although it is not required. If you use this component, copy procedure CKNSERVE.
  • zSecure Visual is usually operated as a started task, although it is not required. If you use this component, copy procedures C2RSERVE, C2RSLOG, and C2RSTOP.

When copying procedures to your system proclib, you can also modify the procedures if required. For example, you might want to change the CONFIG=C2R$PARM value, which zSecure ships as a default, to the value that represents your own configuration member. In particular, when using a shared proclib among z/OS images, consider using a system symbol as the configuration member name or part of the configuration member name. You can then share the procedures and still support having a different configuration for each image.

In addition, the zSecure configurations that are to be used by started procedures or that you want to make available without JCLLIB must reside in a data set that is part of your JES procedure concatenation. See Assignment of configurations to batch jobs and started tasks.

Note: Copying members from SCKRPROC implies that you need to review and possibly update your copies when upgrading zSecure.
Parent topic: Activation of the product and customization of the configuration data sets

Feedback