Steps for installing PFA

Use the following steps to set up PFA with RACF® and z/OS® UNIX:

Define additional DASD storage for PFA. The recommended /etc/PFA/ini file system is zFS. Requirements for the total space for the PFA file system for each LPAR is 300 cylinders primary; 50 cylinders secondary on a 3390 device.
Create a PFA user ID and connect it to an existing or new RACF group.
Guideline: This documentation uses pfauser as the generic term for the PFA user ID. You must define authority as follows:
- If /etc/PFA/ini does not exist, you must define READ authority to the file you are copying (/usr/lpp/bcp/samples/PFA/ini or a check dir ini file) in order to copy it. If you are doing this manually, you also need READ authority. If this is happening at PFA startup, the PFA user needs READ authority.
- If /etc/PFA/ini does not exist, you need READ and WRITE authority to /etc/PFA to create and use the /etc/PFA/ini file. If you are doing this manually, you also need READ and WRITE authority to /etc/PFA. If this is happening at PFA startup, the PFA user needs READ and WRITE authority.
- If /etc/PFA/ini already exists, the PFA user needs READ authority to it to run PFA.
- If the /etc/PFA/ini file needs updating, you need WRITE authority.
Note: Certain installation tasks require UID of 0.
If you are using PFA in a sysplex that shares file systems for z/OS UNIX, use a unique directory for each LPAR. The event data that PFA writes to the file system is stored separately for each system. For details, see Installing PFA in a z/OS UNIX shared file system environment.
1. Create a new user ID to own the PFA. For example, pfauser. The PFA user ID must be unique; do not use the same user ID that is assigned to the IBM® Health Checker for z/OS.
2. Ensure /etc/PFA has the same security settings as pfauser or pfauser owns /etc/PFA.
3. Define the PFA started task by creating a RACF profile for the pfauser with the following items:
  - OMVS segment with a UID parameter (for example, omvs(uid(7)))
  - PROGRAM pathname of /bin/sh (for example, program(/bin/sh))
Examples:
- This example shows how you can define and connect a new user to RACF. Ensure that you replace the parameters with the correct settings for your installation.
```
ADDUSER pfauser
			OMVS(UID(7) PROGRAM(/bin/sh)) PASSWORD(sys1)
ADDGROUP OMVSGRP OMVS(GID(46)) 
CONNECT pfauser GROUP(OMVSGRP)
```
- This example shows how you can change the information in a user's RACF profile:
```
altuser pfauser omvs(uid(7) shared program(/bin/sh))
```
- For information about Security Server RACF, see the ADDUSER (Add user profile) and ADDGROUP (Add group profile) topics in z/OS Security Server RACF Command Language Reference.
- For information about defining z/OS UNIX users to RACF, see the topic on Steps for defining z/OS UNIX users to RACF in z/OS UNIX System Services Planning.
Add the PFA task to the STARTED class table in RACF and refresh, if necessary. For example:
```
SETROPTS GENERIC(STARTED)
RDEFINE STARTED PFA.* STDATA(USER(pfauser) GROUP(OMVSGRP))
SETROPTS CLASSACT(STARTED)
SETROPTS RACLIST(STARTED)
```
If you have already activated RACLIST in the STARTED class, the last statement is:
```
SETROPTS RACLIST(STARTED) REFRESH
```
For more information, see the following information:
- z/OS UNIX System Services Planning and z/OS Security Server RACF Security Administrator's Guide.
- The RDEFINE (Define general resource profile) and SETROPTS (Set RACF options) sections in z/OS Security Server RACF Command Language Reference.
Copy the sample PFA procedure, AIRPROC, from SYS1.SAMPLIB to the PFA member of SYS1.PROCLIB data set. If SMP/E does not write the executable code in the z/OS UNIX file system to PARM='path=(/usr/lpp/bcp)', change the PARM value in AIRPROC to the path in which you store the executable code.
Update Java configuration. If the path to the JDK for your installation is not the same as the path in the ini file in /etc/PFA/ or if you installed the PFA Java™ code in a location other than the default path, you must update /etc/PFA/ini before starting PFA. For more information, see Updating the Java path.
Note: Read the topic on Configure supervised learning to decide whether you need to use the EXCLUDED_JOBS and INCLUDED_JOBS files.
Optionally override Language Environment (LE) runtime options in file /etc/PFA/ceeopts. Specify the LE runtime options as the environment variable in the following format
```
_CEE_RUNOPTS=value
```
where value is a null terminated character string of LE runtime options. PFA uses the LE runtime options specified each time the Java virtual machine (JVM) is launched.
For the LE runtime options, see z/OS Language Environment Programming Reference
Allow the appropriate people access to the PFA results in SDSF and the z/OS UNIX file system. (Both systems use standard security controls.)
Verify that common storage tracking (CSA Tracker) is active and the SMF exits (in SMFPRMxx) are defined.
To use the PFA_COMMON_STORAGE_USAGE check, you must ensure that your system is using the following DIAGxx parmlib member options: VSM TRACK CSA(ON) SQA(ON).
- For more information about using DIAGxx, see z/OS MVS Initialization and Tuning Reference and z/OS MVS Initialization and Tuning Guide.
- For information about activating and reviewing data provided by CSA Tracker, see the topic about Using the common storage tracking function in z/OS MVS Initialization and Tuning Guide.
To use the PFA_SMF_ARRIVAL_RATE check, you must define the SMF exits, IEFU83, IEFU84, and IEFU85.
- For information about defining SMF exits, see the topic about SMFPRMxx in z/OS MVS Initialization and Tuning Reference.
Update the COMMNDxx parmlib member, and any system automation your installation has defined, with the PFA procedure to ensure that PFA restarts on IPL as shown here:
```
START pfa_procname
```
Make sure that you define the IBM Health Checker for z/OS procedure in COMMNDxx. See IBM Health Checker for z/OS User's Guide.
Important: When updating your COMMNDxx parmlib member, remember to update any system automation your installation uses to start and restart major system address spaces.
Update your WLM Service Class policy for PFA to be the same priority that your installation uses for monitoring products like RMF™. For more information about defining service classes, see Defining service classes and performance goals in z/OS MVS Planning: Workload Management.
Increase the MAXFILEPROC settings in BPXPRMxx if your current settings are too low. The MAXFILEPROC sets the maximum number of file descriptors that a single process can have open concurrently, such as all open files, directories, sockets, and pipes. By limiting the number of open files that a process can have, you limit the amount of system resources a single process can use at one time. You can also dynamically change the MAXFILEPROC setting using the SETOMVS command. For example:
```
SETOMVS PID=123,MAXFILEPROC=value
```
References:
- See the topic on Steps for changing the process limits for an active process in z/OS UNIX System Services Planning.
- To determine if the MAXFILEPROC value is set too low, the IBM Health Checker for z/OS provides a check, USS_MAXSOCKETS_MAXFILEPROC. For details, see the check USS_MAXSOCKETS_MAXFILEPROC in IBM Health Checker for z/OS User's Guide.
Customize your system settings for PFA:
1. Update your system automation to look for PFA exception messages. For complete details, see the topic about Approaches to automation with IBM Health Checker for z/OS in IBM Health Checker for z/OS User's Guide.
2. Follow the guidelines for correcting problems by reviewing the check-specific best practice.
3. After the checks have been running for a while, you might decide that the default parameters are not appropriate in your environment. You can customize the PFA checks using the check-specific parameters. For details, see the check-specific parameters.