How to: Use encryption for your PDS V2 data sets

Edit online

Learn how to use z/OS® data set encryption for your PDS V2 data sets.

Before you begin

Use of z/OS data set encryption for your PDS V2 data sets requires z/OS 2.2 with APAR OA50569 or later.

Attention: PTF UJ08510 for APAR OA62995 introduces support for z/OS® data set encryption for PDS V2. With the installation of PTF UJ08510, PDS V2 in general (regardless of the use of z/OS data set encryption) also requires z/OS 2.2 with OA50569 or later. After PTF UJ08510 is installed, if your system is not running z/OS 2.2 with OA50569 or later and you attempt to start the monitoring server or monitoring agent, PDS V2 initialization will fail and history data will be lost.
Note: The OMEGAMON® persistent data store V2 (PDS V2) component does not perform any encryption or decryption of data. All encryption and decryption of data is done by z/OS. For more information, see z/OS® data set encryption.

About this task

You can protect your sensitive historical data by using encrypted data sets for PDS V2. In general, to create an encrypted data set, a key label must be assigned to the data set when it is newly allocated. For PDS V2, the data sets are allocated automatically from within the monitoring server or monitoring agent by using the SMS data class that is specified in parameter RTE_PDS2_SMS_DATACLAS.

To use encryption for PDS V2, choose an SMS data class that has a key label (KEYLABEL) in its definition, and specify this class name in the RTE_PDS2_SMS_DATACLAS parameter.

After the monitoring server or monitoring agent is recycled, it will allocate new PDS V2 data sets if they do not exist and make them encrypted. If the PDS V2 data sets already exist, the monitoring server or monitoring agent will gradually make them encrypted, one by one (that is, one data set for each subsequent data set switch). Each time a data set switch occurs and a new reserved data set is allocated, the newly allocated data set will be created as encrypted.

Procedure

  1. Create an SMS data class that contains a key label (KEYLABEL). You can do this using the Data Set Key Label field on the ISMF DEFINE/ALTER panel.
    For more information, see Create an encrypted data set in Setting up z/OS data set encryption.
  2. Update your PDS V2 configuration, as follows:
    • Using PARMGEN: Set the RTE_PDS2_SMS_DATACLAS parameter value to an SMS data class that contains a key label (as defined in step 1), and then run $PARSE.
    • Using Configuration Manager: Set the RTE_PDS2_SMS_DATACLAS parameter value to an SMS data class that contains a key label (as defined in step 1), and then run the GENERATE action.
  3. Recycle the monitoring server or monitoring agent started task.