Use of Commands Cross System

All operator commands that are provided by the product supply a TARGET parameter that you can use to run the command on a remote system.

SA z/OS is limited to just a small number of systems in the sysplex by default. The INGESAF member contains a definition that explicitly allows the communication between those systems.

However, if you want to limit this capability or completely prevent that commands can be issued on one system but run on another system then more profiles and permission statements are required. The profiles are defined in the SYSAUTO general resource class and constructed according to the following pattern:

AGT.sysplexname.saxcfgroup.TARGET.FROMDOM.fromdom.TODOM.todom

The variables have the following meanings:

sysplexname

This variable denotes the name of the physical sysplex.

saxcfgroup

This variable denotes the XCF group name for this particular system. The name always starts with the prefix INGXSG, followed by the value that is specified in the <sa_xcf_grpid_suffix> variable in the Configuration Options file.

fromdom

This variable denotes the NetView domain on which commands with the TARGET parameter can be issued.

todom

This variable denotes the NetView domain on which commands with the TARGET parameter can be run.

You can use wildcards in the profile, when the class SYSAUTO has generics enabled. To enable generics, with RACF® you can use the following command:

SETR GENERIC(SYSAUTO)

The following profile can be defined to prevent execution of commands on the IPUFA domain. Using RACF, for example, the command looks like the example here:

RDEFINE SYSAUTO AGT.*.*.TARGET.FROMDOM.*.TODOM.IPUFA UACC(NONE)

In order to allow BOB to run commands on domain IPUFA, the following permission statement can be used:

PERMIT AGT.*.*.TARGET.FROMDOM.*.TODOM.IPUFA CLASS(SYSAUTO) ID(BOB) ACC(READ)