Process types on z/OS

For the Liberty runtime environment on the z/OS® platform, there are two types of process: the server process and the angel process.

Server process (bbgzsrv)

The server process is a Java™ virtual machine (JVM) running the Liberty code in much the same way as it does on any other operating system. You can start the server process either from the MVS™ operator console (see Administering Liberty manually) or from the shell. How a user identity is associated and validated depends on how you start the server:

• If you start the server from an operator console, the identity that is associated with the STARTED profile created by using a z/OS security product such as RACF® is used to control server access: start bbgzsrv,parms='defaultServer'
• If you start the server from the shell, you must also stop the server from the shell. The identity of the shell is used for the server:
  • server start
  • server stop

The JVM start options for the server process can come from various sources. For more information, see Administering Liberty on z/OS.

Angel process (bbgzangl)

The angel process runs in an authorized key and provides facilities to server process to load and access system services in a way that protects the integrity of the operating system. You start the angel process from the MVS console by using a proc.

The angel exists independently of the server.

All Liberty servers that are running on a z/OS image can share a single angel, regardless of the level of code that the servers are running.

Use this MODIFY command to give a list of all the servers that are using a particular angel process.

MODIFY [jobname.]identifier,display,servers

Use the following MODIFY command to give a list of all the angel processes that are running on the system.

MODIFY [jobname.]identifier,display,angels

Use the following MODIFY command to get the version of the angel process that is running on the system.

MODIFY [jobname.]identifier,version

The following table provides a list of angel version numbers and the product level in which each angel first occurred.

Angel version	Product level
1	8.5.0.1
2	8.5.5.2
3	8.5.5.9
4	16.0.0.2
5	16.0.0.4
6	17.0.0.1
7	17.0.0.2
8	18.0.0.2
9	18.0.0.3
10	18.0.0.4
11	19.0.0.3
12	19.0.0.9
13	19.0.0.10
14	20.0.0.5
15	20.0.0.9
16	21.0.0.2
17	21.0.0.6
18	22.0.0.5
19	22.0.0.8
20	22.0.0.9
21	23.0.0.6
22	24.0.0.3

If no z/OS system authorized services are enabled for any server on a system, the angel does not need to be active. The angel process is not required for the command processing services (the command processing services uses unauthorized z/OS services for command support).

If the server is configured to attempt to use authorized services but either the angel is not available, or if the effective owner of the process is not authorized to use the angel, the authorized service is not available to be used on that server. In some cases, an unauthorized service might be used instead. See Unauthorized services used by the SAF registry.

You can prevent Liberty from starting in the absence of an angel process by adding the following statement to the ${server.config.dir}/bootstrap.properties file of your server:

com.ibm.ws.zos.core.angelRequired=true

With the com.ibm.ws.zos.core.angelRequired property set to true, Liberty aborts startup on detecting that it has not connected to an angel process. Similarly, when an angel process is running and connects to a Liberty process during Liberty startup, that Liberty process continues to start as usual. In this case, the property has no effect.

The com.ibm.ws.zos.core.angelRequiredServices property specifies a list of required services. Only these services, when properly specified, are the ones used by the server. Lack of access to the angel process itself or any of these listed required services causes a server startup failure. The value for this property must be a comma-separated list of valid angel process services. Angel process services can be found in Enabling z/OS authorized services on Liberty for z/OS. All service names must be 8 characters or less and symbols are not valid. This property must be specified with com.ibm.ws.zos.core.angelRequired property set to true.

You can configure Liberty to register to the angel process with specific services by adding the following statements to the ${server.config.dir}/bootstrap.properties file of your server:

com.ibm.ws.zos.core.angelRequiredServices=SAFCRED,ZOSWLM,TXRRS,ZOSDUMP
com.ibm.ws.zos.core.angelRequired=true

For more information, see Administering Liberty on z/OS.