zOS V2R4 Upgrade Workflow from zOS V2R2
Description :zOS V2R4 Upgrade Workflow from zOS V2R2
  • Status: In Progress
  • Owner: IBMUSER
  • System: SYS1.PLEX1
  • Version: HSMA247;PH25395P;2020-07-30T23:13:19
  • Steps complete: 0 of 275
  • Export time: 2020-10-21 20:52:29

Filters :


Contents

< Note: Page numbers might not be accurate. >

Step 1 : Discover z/OS features in use


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

In this step, you execute a JCL job to generate an output property file that will reflect the current status of a priced feature on your system.

Instructions:

This step of the workflow will determine which z/OS priced features are currently enabled on the running system. Using this information (which you control with your IFAPRDxx parmlib member), associated steps with DISABLED features will be marked as Skipped. The objective of this step is to automatically reduce the number of non-applicable upgrade steps that you need to review.

Review the output of this step to see which priced features were determined to be disabled on this system, and to see which steps have had their state changed.

If you determine that you later want to perform those steps that were marked as Skipped, you can change the status and perform those steps, after they have been assigned.


Step 2 : Upgrading your z/OS system: An introduction


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This level of the z/OS Upgrade Workflow corresponds to z/OS V2R4.

Introducing the z/OS V2R4 Upgrade Workflow

Using a z/OSMF workflow, you can perform a z/OS V2R4 upgrade as an interactive, step-by-step process. The z/OS V2R4 Upgrade Workflow uses the latest functions in z/OSMF to provide a smooth upgrade experience.

The z/OS V2R4 Upgrade Workflow is available as two z/OS Management Facility (z/OSMF) workflows. Depending on whether you are migrating from z/OS V2R2 or z/OS V2R3, you select the files that apply to your migration path and download them to your system to create the workflow.

IBM no longer provides the z/OS Migration publication. Since z/OS V2R2, the preferred method for learning about migration actions has been the z/OS Workflow. Discovering, performing, and verifying many migration actions through the workflow instead of a traditional book allows for a tailored and specific migration path that is associated with a particular system.

Accompanying the change of format—a workflow instead of a book—is a change in terminology: upgrade instead of migrate. In our industry, the process of replacing software with a newer level is most often referred to as upgrading the software. In contrast, the phrase migrating the software can be taken to mean moving software from one server to another. When you perform the actions that are described in the workflow, you are upgrading z/OS to a newer level of function than the prior release. Thus, upgrade is the appropriate term for what these workflows do.

The z/OS Upgrade Workflow is provided in the following git repository for IBM/IBM-Z-zOS, which already hosts the z/OS workflows for previous releases:

https://github.com/IBM/IBM-Z-zOS

Usage tips

  • Enhanced discovery functions are available. Follow the instructions in the first step "Discover z/OS features in use" to allow z/OSMF to skip as many inapplicable steps as possible, thus reducing the number of steps for you to perform. The additional discovery includes the option to skip steps that are empty (which have actions that are shown as "None"). In addition, discovery is enhanced to skip over the hardware server levels that you have already upgraded to.

  • Some upgrade actions have associated health checks. For those steps, the health check is invoked to determine whether the upgrade action is applicable for your system. Read the instructions carefully on the Perform tab before running the health check for important information about each check.

  • For the individual upgrade actions and for the entire upgrade effort, you can optionally provide your feedback to IBM. Follow the instructions that are shown in the workflow. You do not need to provide feedback to complete each step of the workflow.

Summary of changes for z/OS V2R4 Upgrade Workflow, Version 2.3 (October 29 2020)

New information

The following upgrade actions are new:

  • Prepare for the removal of the internal battery feature
  • Prepare for the removal of support for TLS 1.0 and TLS 1.1 for SE, HMC, and OSC
  • BCP: The ASCB and WEB are backed in 64-bit real storage by default
  • DFSMS: Change DFSMSrmm Web Services to use the HTTPS protocol
  • ISPF: Accommodate the ISPF Gateway access change from HTTP to HTTPS
  • z/OSMF: Ensure that workflow users are authorized to read workflow files
  • z/OSMF: Use the Diagnostic Assistant to collect diagnostic data about z/OSMF
  • z/OSMF: Remove STGADMIN SAF authorization requirements for Software Management

Changed information

The following upgrade actions are changed:

  • Verify that virtual storage limits are set properly
  • BCP: Accommodate the new DSLIMITNUM default
  • CIM: Accommodate the default change from HTTP to HTTPS
  • DFSMSrmm: Remove the CIM provider registration and its associated files
  • IP Services: Plan to upgrade the FTP server to AT-TLS security
  • RMF: Configure AT-TLS to enable secure communication with the RMF distributed data server
  • Security Server: Check for duplicate class names

Summary of changes for z/OS V2R4 Upgrade Workflow, Version 2.2 (August 13 2020)

New information

The following upgrade actions are new:

  • IP Services: Plan to upgrade the DCAS server to AT-TLS security
  • IP Services: Plan to upgrade the FTP server to AT-TLS security
  • IP Services: Plan to upgrade the TN3270E server to AT-TLS security
  • OpenSSH: Accommodate a new level of OpenSSH
  • z/OSMF: Remove references to z/OSMF mobile notification service

Changed information

The following upgrade actions are changed:

  • BCP: XCF/XES FUNCTIONS XTCSIZE is enabled by default
  • ICSF: Plan for the removal of sequential data sets from the CSFPARM DD statement
  • PKI Services: Ensure that users have CA root certificate for PKI and web pages use HTTPS
  • SNA services: Migrate from VTAM Common Management Information Protocol

Summary of changes for z/OS V2R4 Upgrade Workflow, Version 2.1 (July 31 2020)

This workflow replaces the previous level, Version 2.0, from September 2019. This workflow includes new and changed upgrade actions (listed below), and changes for terminology, maintenance, and editorial corrections.

New information

The following upgrade actions are new:

  • BCP: Plan for removal of support for the IEWTPORTS transport utility
  • Security Server: Plan for removal of support for RACF database sharing with z/VM.

Changed information

Throughout this workflow, links were corrected or removed to ensure consistent linking.

Changes in previous versions of this workflow

New information

New general upgrade actions:

  • "Plan for removed z/OS national language translations"

New BCP actions:

  • BCP: Recompile programs with the new IRARMCTZ macro in APAR OA55218
  • BCP: Ensure that TVSAMCOM or TVSMSG are not used as job statement symbols
  • BCP: Running z/OS as a guest requires z/VM V6R4 or later
  • BCP: Stop referencing the ETR parameters in CLOCKxx
  • BCP: Regenerate the Unicode conversion image
  • BCP: Prepare for the removal of service coefficients from WLM service definitions
  • BCP: Evaluate the changed default for system logger's use of IBM zHyperwrite

New BookManager® READ action:

  • Remove any dependencies on BookManager READ from your system

New Common Information Model (CIM) actions:

  • CIM: Accommodate the default change from HTTP to HTTPS

New Communications Server actions:

  • SNA services: Migrate from VTAM Common Management Information Protocol
  • TCP/IP: Prepare for the removal of native TLS/SSL support
  • TCP/IP: Prepare for the removal of Sysplex Distributor support for IBM DataPower Gateway products
  • IP services: Ensure storage availability for IWQ IPSec traffic
  • IP Services: Decide whether to accept the new FIXED CSM default
  • Determine the storage impact if QDIOSTG=126 is in effect

New Cryptographic Services actions:

  • ICSF: Plan for the removal of sequential data sets from the CSFPARM DD statement
  • ICSF: Plan for the removal of support for EIM, OCSF, OCEP, and PKITP
  • PKI Services: Ensure that users have the CA root certificate for the PKI web interfaces

New DFSMS actions:

  • DFSMSdfp: Review XRC parmlib members for use of default values
  • DFSMSdfp: Check for an out-of-synch condition in the OAM configuration
  • DFSMShsm: Accommodate the default change for SETSYS MIGRATIONAUTOCLOUD
  • DFSMSdfp: Increase storage for SMS ACDS data sets
  • DFSMSdfp: Accommodate code 4 for empty objects in the IDCAMS LISTCAT command
  • DFSMSdss: SHARE keyword isignored for COPY and RESTORE of PDSE
  • DFSMSdfp: Expect dumping of the catalog address space for VVDS manager error 050-020

New Distributed File Service action:

  • DFS/SMB: Use Network File System (NFS) instead of DFS/SMB

New HCD actions:

  • HCD withdraws support for out-of-service processor types
  • HCD: Accommodate the removal of switch functions from Tivoli System Automation

New HCM action:

  • HCM: Accommodate the removal of I/O Operations from Tivoli System Automation

New High Level Assembler (HLASM) action:

  • HLASM: Verify that the changed default of ILMA is acceptable

New IBM z/OS Management Facility action:

  • z/OSMF: Move the user directory from /var to /global
  • z/OSMF: Prepare for the removal of the policy data import function of NCA
  • z/OSMF: Accommodate the use of IBM z/OS Liberty Embedded
  • z/OSMF: Establish security for cross-site z/OSMF REST requests

New Infoprint Server actions:

  • Infoprint Central requires SSL connections by default
  • Edit the aopd.conf file

New ISPF action:

  • ISPF: Plan for the removal of Workstation Agent

New JES2 actions:

  • JES2: Activate z22 mode
  • JES2: Accommodate the changed default for the EXECUTABLE keyword on $GETMAIN
  • JES2: Checkpoint versions are moving to 64-bit storage
  • JES2: Accommodate changes in NJE input phase processing for multi-object job streams
  • JES2: Review changes applicable to exit routines and user modifications

New JES3 action:

  • JES3: Plan for migration to JES2 in a future release

New Library Server action:

  • Stop using Library Server

New OSA Support Facility (OSA/SF) action:

  • Stop using Open Systems Adapter/Support Facility (OSA/SF)

New RMF action:

  • RMF: Configure AT-TLS to enable secure communication with the RMF distributed data server

New Security Server actions:

  • RACF: Ensure that the ECC master key is activated in the CCA coprocessor
  • RACF: Check for programs affected by the increase of the maximum length of JESJOBS class profiles

New SMP/E action:

  • SMP/E: Accommodate the removal of Planning and Migration Assistant

New TSO/E action:

  • TSO/E: Check for programs that expect RC 0 for invalid command invocations

New z/OS UNIX actions:

  • z/OS UNIX: Optionally delete the FORKCOPY(COW) option of BPXPRMxx
  • z/OS UNIX: Optionally delete the KERNELSTACKS option of BPXPRMxx

These actions are applicable for customers who are migrating from either z/OS V2R3 or z/OS V2R2, and are thus included in both "Upgrading from z/OS V2R3 and "Upgrading from z/OS V2R2."

Changed information

The following information is changed:

  • Upgrade actions from earlier releases that apply to z/OS V2R4 are carried over from the z/OS Migration document.

  • Changed general action:

    • Migrate /etc, /global, and /var system control files
  • Changed BCP action:

    • BCP: Removal of support for user key common areas
  • Changed Infoprint Server action:

    • Upgrade web browser support for Infoprint Central
    • Prepare for dynamic configuration
    • Remount the Printer Inventory and copy files that were customized
  • Changed Security Server action:

    • Check for previously defined classes HBRADMIN, HBRCONN, or HBRCMD
  • Changed z/OS UNIX action:

    • z/OS UNIX: Migrate from HFS file systems to zFS file systems

Deleted information

Upgrade actions that were introduced in z/OS V2R2 and do not apply to the z/OS V2R4 path have been removed.


Step 2.1 : Typical upgrade steps


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

It is possible to make upgrade changes at the same time you make the changes necessary to exploit new functions in the new release. However, the more prudent approach is to do your upgrade first and then exploit new functions. The typical steps to accomplish this are:

  1. Learn about z/OS V2R4. Good sources of information include:
  2. Perform as many of the upgrade actions as you can on your existing ( old) system so that you have fewer actions to perform after you install z/OS V2R4. In this information, the actions you can perform on your existing system are identified by headings that say Actions to perform before installing z/OS V2R4. Note that not all of the actions are required. Some depend on your environment, configuration, and workload, and are identified accordingly. These actions should be made to, or copied (cloned) to, all existing systems that will be migrated to z/OS z/OS V2R4.

    Use IBM Health Checker for z/OS to assist with some upgrade actions. For more information, see the workflow step "Using IBM Health Checker for z/OS for migration checking."

  3. Order and install coexistence and fallback service for any system that will share resources with a z/OS V2R4 system. See the workflow step "Install coexistence and fallback PTFs." This service needs to be installed on all systems that will coexist with z/OS V2R2 and all systems that will be migrated to z/OS V2R4 (and which you might fall back to).
  4. Prepare the driving system. For driving system requirements, see the topic about preparing the driving system in z/OS Planning for Installation.
  5. Order z/OS V2R4 from ShopZ, then install it. If you use a ServerPac, refer to ServerPac: Installing Your Order for installation instructions. If you use a CBPDO, see z/OS Program Directory.
  6. Prepare target system hardware and software. During this step, perform the upgrade actions identified by headings that say Actions to perform before the first IPL of z/OS V2R4. (Again, not all of the actions are required. Some depend on your environment, configuration, and workload, and are identified accordingly.)
  7. IPL the new z/OS V2R4 system with your updated customization and configuration files.
  8. Perform any upgrade actions identified by headings that say Actions to perform after the first IPL of z/OS V2R4. (Again, not all of the actions are required. Some depend on your environment, configuration, and workload, and are identified accordingly.)

    Use IBM Health Checker for z/OS to assist with some upgrade actions. For more information, see the workflow step "Using IBM Health Checker for z/OS for migration checking."

  9. Deploy z/OS V2R4 to other systems within a sysplex, data center, and enterprise.

    The upgrade is now complete.

  10. When you are confident that a system, or in some cases all systems in a sysplex, are not going to fall back to z/OS V2R3 or z/OS V2R2, you can exploit the functions introduced in z/OS V2R4.
  11. Deploy this exploitation on other systems (again within a sysplex, data center, and eventually enterprise).

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 2.2 : Using IBM Health Checker for z/OS for migration checking


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Before you upgrade to a new z/OS release, you can use IBM Health Checker for z/OS to assist with planning. Migration checks can help you determine the applicability of various upgrade actions to your current system. As with other checks provided by IBM Health Checker for z/OS, no updates are made to the system. Migration checks report only on the applicability of specific upgrade actions on a system, and only on the currently active system.

IBM Health Checker for z/OS is started automatically during system initialization.

Migration checks are similar to the other checks provided by IBM Health Checker for z/OS. The only differences are:

  • Migration checks are inactive by default.
  • The names of migration checks begin with the characters ZOSMIG. Following this prefix is a value to help you plan the timing of the upgrade action, as follows:
    ZOSMIGVvRr_NEXT
    Upgrade action is recommended, but will become a required upgrade action in the release after VvRr.
    ZOSMIGVvRr_NEXT2
    Upgrade action is recommended, but will become a required upgrade action two releases after VvRr.
    ZOSMIGVvRr
    Upgrade action is required in the release indicated by VvRr.
    ZOSMIGVvRrPREV
    Upgrade action is required in the release indicated by VvRr and in prior releases, with the appropriate service.
    ZOSMIGREC
    Upgrade action is recommended for the foreseeable future. The upgrade action might never be required.
    ZOSMIGREQ
    Upgrade action that is recommended now, but will be required in a future release.
    Note:

    In previous releases, the names of migration checks followed a different set of naming conventions: one for ICSF, which used the convention ICSFMIGnnnn_component_program_name, and one for the rest of z/OS, which used the convention ZOSMIGVvvRrr_component_program_name.

On your current z/OS release, follow these steps:

  1. Install the latest migration checks. Review all the latest health checks for both best practices and migration by using the SMP/E FIXCAT IBM.Function.HealthChecker.

    You might want to install the PTFs during a regular service window, so that an IPL is scheduled afterward. Checks are often added by a function when it is started or restarted, so you might find that installing the PTFs before a scheduled IPL works best for you. More migration checks can be added at different times, so having all the latest checks installed before making your migration plans is recommended.

  2. Activate the migration checks that are appropriate to your upgrade path. Because the naming convention for migration checks indicates which release introduced the corresponding upgrade actions, you can activate only the checks that are appropriate for your upgrade path. Using SDSF (or another method for viewing checks, such as filters), you can view ahead of time which migration checks you have available on your system. For example, if you are upgrading from z/OS V2R2 to z/OS V2R4, you must activate the migration checks for changes that occurred in both z/OS V2R3 and z/OS V2R4. If you are upgrading from z/OS V2R3 to z/OS V2R4, you need to activate only the migration checks for changes that occurred in z/OS V2R4. There are many ways to make a check active, and many ways to use wild cards to include specific checks.

    Here are some examples of using the MODIFY command to make checks active:

    • F HZSPROC,ACTIVATE,CHECK=(IBM*,*MIG*)
    • F HZSPROC,ACTIVATE,CHECK=(IBM*,ICSFMIG*)
    • F HZSPROC,ACTIVATE,CHECK=(IBM*,ZOSMIG*)
  3. Review the migration check output and rerun checks. Any exceptions should be addressed in your migration plan. If you can complete the upgrade action before you move to the new z/OS release, you can rerun the check to verify that it was completed correctly on your current system. In some cases, the check might be available for running on the new z/OS release for verification after that release is IPLed.
  4. Deactivate the migration checks if you want. If you no longer desire to have the migration checks active, you can deactivate them similar to the way you activated them. For example:
    • F HZSPROC,DEACTIVATE,CHECK=(IBM*,*MIG*)
    • F HZSPROC,DEACTIVATE,CHECK=(IBM*,ICSFMIG*)
    • F HZSPROC,DEACTIVATE,CHECK=(IBM*,ZOSMIG*)

Within this document, the upgrade actions that have checks are clearly identified within the upgrade actions.

Not all upgrade actions in this document are addressed by checks; many upgrade actions do not lend themselves to programmatic checking. Therefore, use this document to prepare your migration plan and do not rely on checks only.

System REXX considerations

Several IBM Health Checker for z/OS migration health checks are written in compiled System REXX. These health checks rely on System REXX customization and runtime activities being completed. If System REXX and the security environment that System REXX requires has not been properly customized, the System REXX health checks will not run successfully. Also, the compiled REXX execs must have the proper runtime support from the Alternate Library for REXX (available in z/OS since V1R9) or from IBM Library for REXX on zSeries (5695-014).

Note:

To allow System REXX to use JES services, the AXRnn address spaces are started under the primary subsystem. Therefore, you must end the AXRnn address spaces before you shut down JES2. You do not have to stop the AXR address space; this action only affects the secondary AXRnn address spaces.

More information is available in the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 2.3 : Elements and features that do not have upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

For an upgrade from z/OS V2R2 to z/OS V2R4, the following z/OS elements and features do not have upgrade actions to perform:

  • Alternate Library for REXX
  • BDT
  • BDT File-to-File
  • BDT SNA NJE
  • Communications Server Security Level 3
  • DFSORT
  • EREP
  • FFST
  • GDDM
  • GDDM-PGF
  • GDDM-REXX
  • IBM HTTP Server
  • IBM Tivoli Directory Server
  • ICKDSF (Device Support Facility)
  • Metal C Runtime Library
  • MICR/OCR
  • NFS
  • Runtime Library Extensions
  • TIOC
  • z/OS Font Collection
  • z/OS Security Level 3
  • 3270 PC File Transfer Program

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3 : General upgrade actions for everyone migrating to z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This level of the z/OS Upgrade Workflow corresponds to z/OS V2R4.


Step 3.1 : Upgrade actions for everyone moving to z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes general upgrade actions that apply to everyone, regardless of which elements and features you use.


Step 3.1.1 : Upgrade actions for everyone before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes general upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 3.1.1.1 : Review PSP buckets


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Check the preventive service planning (PSP) buckets for important software and hardware installation and maintenance information that occurs too late in the development cycle to be included in the product publications. Included are PTFs for both service and small programming enhancements (SPEs).

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Identify which PSP buckets to review. For this task, you will need to know:
    • PSP bucket upgrade IDs (or upgrades). The most relevant upgrades are those related to z/OS V2R4 and its servers. The z/OS V2R4 upgrade is ZOSV2R4; the server upgrades are shown in Table 2.
    • FIXCAT values if you use the SMP/E REPORT MISSINGFIX command in conjunction with the FIXCAT type of HOLDDATA (as mentioned in the tip that follows). The FIXCAT values are shown in Table 2. Note:
      • The values shown are for the minimum support necessary for the servers. If you exploit additional functions on a server, the FIXCAT value will have additional qualifiers.
      • You must run z/OS V2R4 on a zEC12 or zBC12 or later. See the workflow step called "Ensure that you are using supported servers, storage controllers, and machine facilities."
  2. Obtain the PSP buckets at Preventive Service Planning buckets or from IBMLink.
  3. Review the PSP buckets and take whatever actions are prescribed.
Tip:

To simplify finding the appropriate PSP bucket and identifying which minimum PTFs listed in the PSP bucket need to be installed on your system, you can use SMP/E FIXCATs and the REPORT MISSINGFIX command. The FIXCAT values are shown in Table 2.

Table 2. Servers, upgrades, and FIXCAT values

Server

Upgrade

FIXCAT value

z14

3906DEVICE

IBM.Device.Server.z14-3906

z14 ZR1

3907DEVICE

IBM.Device.Server.z14ZR1-3907

z13®

2964DEVICE

IBM.Device.Server.z13-2964

z13s™

2965DEVICE

IBM.Device.Server.z13S-2965

zBC12

2828DEVICE

IBM.Device.Server.zBC12-2828

zEC12

2827DEVICE

IBM.Device.Server.zEC12-2827

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.2 : Install coexistence and fallback PTFs


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

By installing coexistence and fallback PTFs on your pre-z/OS V2R4 systems, you allow the systems to coexist with z/OS V2R4 systems during your migration. Installing coexistence and fallback PTFs also allows for fallback to the previous systems, if necessary. Coexistence and fallback are important because they allow you to migrate systems in a multisystem configuration to z/OS V2R4 using rolling IPLs (one system at a time), allowing for continuous application availability.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Install the appropriate PTFs.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Before you introduce z/OS V2R4 into your environment, install coexistence and fallback PTFs on all pre-z/OS V2R4 systems with which your z/OS V2R4 system will coexist.

Use the SMP/E REPORT MISSINGFIX command with the FIXCAT type of HOLDDATA as follows:

  1. Obtain and RECEIVE the latest HOLDDATA onto your pre-z/OS V2R4 systems. Use your normal service acquisition portals or download the HOLDDATA directly from Enhanced HOLDDATA for z/OS. Select the Full from the Download NOW column to receive the FIXCAT HOLDDATA; the other files do not contain FIXCATs.
  2. Run the SMP/E REPORT MISSINGFIX command on your pre-z/OS V2R4 systems and specify a Fix Category (FIXCAT) value of IBM.Coexistence.z/OS.V2R4. The report identifies the missing coexistence and fallback PTFs for that system. For more information about the REPORT MISSINGFIX command, see z/OS SMP/E Commands.
  3. Periodically, you might want to obtain the latest HOLDDATA and rerun the REPORT MISSINGFIX command to find out whether there are any new coexistence and fallback PTFs.

Reference information

For an explanation of the z/OS coexistence-migration-fallback policy, see the coexistence and fallback topic in z/OS Planning for Installation.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.3 : Use zSoftCap to identify the effect of capacity changes


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The zSoftware Migration Capacity Planning Aid (zSoftCap) is a PC-based tool that evaluates the effects of software release migrations.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended to help with assessing processor capacity and available resources when you are migrating to new software levels.

Target system hardware requirements:

This tool runs on your workstation. The requirements are:

  • A dual-core technology, or faster, processor.
  • An SVGA display 1024 x 768 or better.
  • Approximately 5 MB of hard disk space for the zSoftCap application and user's guide, plus 80 MB for the IBM Java 1.6 runtime environment.

Target system software requirements:

This tool runs on your workstation. Requirements are:

  • Windows 7 or later.
  • IBM Java™ 1.6, or later, runtime environment. This environment is available with the tool.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Download zSoftCap from the IBM Techdocs website IBM Techdocs. Search for Techdoc PRS268.
  2. Run zSoftCap to determine your expected increase in CPU utilization, if any.
Reference information

For more information, see zSoftCap User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.4 : Add or change volumes to keep your z/OS root file system in a single data set


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Because of release enhancements and service, the size of the z/OS root file system (or version root file system) continues to grow from release to release. The size of the z/OS root file system, whether HFS or zFS, is expected to closely approach, if not exceed, the limit of 3339 cylinders on a 3390-3 device.

It is advisable to have the z/OS root file system within a single data set for ease of management.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended for ease of management if your z/OS root file system resides on a 3390-3 volume (or another DASD volume that is close to the 3390-3 limit of 3339 cylinders).

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

Use IBM Health Checker for z/OS check CHECK(IBMUSS, ZOSMIGREC_ROOT_FS_SIZE) to determine whether a volume has enough space for the z/OS root file system.

Steps to take

To keep the z/OS root file system in a single data set, do one of the following:

  • Move your z/OS root file system to a larger DASD volume geometry
  • Use multiple volumes for the z/OS root file system data set.

If your z/OS root data set cannot fit on the volume or volumes you have defined for it, divide the z/OS root, with the smaller file systems being managed together.

Remember that all systems to which you deploy the z/OS root file system need sufficient DASD space to hold the z/OS root.

Tip:

File systems for subsystems and products other than the z/OS product itself might also increase in size. When examining the volume for how much space your z/OS file system is using, check other product file system sizes too.

Reference information

For more information, see z/OS DFSMS Implementing System-Managed Storage.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMUSS,ZOSMIGREC_ROOT_FS_SIZE.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 3.1.1.5 : Verify that you have enough XCF groups and XCF group members


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Over time, as various z/OS functions and applications exploit XCF services, you must ensure that there is enough space in the sysplex couple data set for all the XCF groups and members that are to be defined by the exploiters. It is possible that your sysplex couple data set could contain an inadequate number of XCF groups or members.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended to ensure that you have an adequate number of XCF groups and members formatted in your sysplex couple data sets.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

Use Health Checker for z/OS check IBMXCF,XCF_SYSPLEX_CDS_CAPACITY, which checks the adequacy of the number of groups, members, and systems for which a sysplex CDS is formatted.

Steps to take

Follow these steps:

  1. Issue the DISPLAY XCF,COUPLE command on your current system. Notice the values of MAXGROUP and PEAK for your sysplex couple data sets. These values show you the maximum number of XCF groups that the couple data sets can support, and the peak number of XCF groups ever in use in the sysplex. Also notice the values of MAXMEMBER and PEAK for your sysplex couple data sets. These values show you the maximum number of members that the couple data set can support in one group, and the greatest number of members ever in use in the largest group in the sysplex.
  2. If your peak member value is close to the maximum member value, you might want to reformat your sysplex couple data sets to support a larger maximum number of members to be used by any one group.
Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMXCF,XCF_SYSPLEX_CDS_CAPACITY.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 3.1.1.6 : Ensure that the CustomPac Installation Dialog is updated


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of May 22, 2016, you can no longer download orders from IBM download servers by using standard FTP.

To download your ServerPac or dump-by-data-set SystemPac order securely, you require a sufficient level of the RECEIVE job that is provided in the CustomPac Installation Dialog. The specific level that is required depends on the download method to be used, as follows:

FTP over SSL (FTPS)
To download your order securely by using FTP over SSL (FTPS), you require the updated RECEIVE job that is provided in the CustomPac Installation Dialog level 27.12.00 or higher.
HTTPS
HTTPS To download your order securely by using HTTPS, you require the updated RECEIVE job that is provided in the CustomPac Installation Dialog level 27.20.00 or higher.

To determine the current level of the CustomPac Installation Dialog in use on your system, check the primary panel CPPPPOLI.

To prepare for downloading an order, IBM recommends that you begin by visiting the Connectivity Test website to verify your system setup. No change is required for using Download Director with encryption; however, you can also verify Download Director with the Connectivity Test. The Connectivity Test can be found at Connectivity Test for SW Download Readiness.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Customized Offerings for z/OS

When change was introduced:

General upgrade action not tied to a specific release. See Washington Systems Center Flash 10863 at IBM Technical Support Flashes site.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if your existing CustomPac Installation Dialog is not at a sufficient level, such as 27.12.00 or 27.20.20.

Target system hardware requirements:

None.

Target system software requirements:

See Identifying driving system software requirements for installing z/OS using ServerPac or dump-by-data-set SystemPac in z/OS Planning for Installation.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Failure to update the CustomPac Installation Dialog to a sufficient level can result in the RECEIVE job failing or the inability to download your order securely.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • For ServerPac customers, see the topic on updating your dialogs in ServerPac: Using the Installation Dialog. Refer to the section for your order's delivery media (DVD or internet delivery) to determine the steps to take.
  • For CustomPac customers, see the topic on updating your dialogs in CustomPac: Installation Dialog Reference. Refer to the section for your order's delivery media (DVD or internet delivery) to determine the steps to take.

Reference information

For more information, see the following references:

  • For more information about the internet delivery method to choose for downloading your ServerPac or CustomPac (SystemPac, ProductPac, FunctionPac) Internet Delivery order, see "Choosing the Internet download method: direct or intermediate" in z/OS Planning for Installation.
  • For ServerPac customers who want more information about updating your CustomPac Installation Dialog, see the topic on updating your dialogs in ServerPac: Using the Installation Dialog. Refer to the section for your order's delivery media.
  • For ServerPac customers who want more information about receiving an order from a server by using the CustomPac Installation Dialog, see "Receiving an Order from a Server" in ServerPac: Using the Installation Dialog. Refer to the section for your order's delivery media.
  • For CustomPac customers who want more information about updating your CustomPac Installation Dialog, see the topic on updating your dialogs in CustomPac: Installation Dialog Reference.
  • For CustomPac customers who want more information about receiving an order from a server by using the CustomPac Installation Dialog, see "Receiving an Order from a Server" in CustomPac: Installation Dialog Reference.
  • See the README and Checklist documents on the Shopz download pages for your order.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.7 : Consider using the new JOB statement for the CustomPac installation dialog


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

A new default JOB statement with the LINES parameter is provided with CustomPac dialog level 27.20.00 or later. If you want to use the new default JOB statement, ensure that the CPP@JOB member is not present in data set userid.ISPF.ISPPROF before you start the installation dialog. However, if you want to continue to use your existing JOB statement for the RECEIVE job and installation jobs, do nothing.

The LINES parameter indicates the maximum amount of output, in thousands of lines, that a job can print to its SYSOUT data set. The LINES parameter also specifies the action that the system is to take if this maximum is exceeded. In CustomPac dialog level 27.20.00 or later, the LINES parameter in the default JOB statement is set to the following specification:

LINES=(999999,WARNING)

As a result, the CustomPac jobs can print up to 999999000 lines of output before the system issues a warning to the system operator.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Customized Offerings for z/OS

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you want to use the new default JOB statement.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Failure to remove your existing CPP@JOB member from the userid.ISPF.ISPPROF data set means that the existing JOB statement is used instead of the new default JOB statement.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. If your installation uses a customized JOB statement with the RECEIVE and installation jobs, determine whether to use the default JOB statement instead. The JOB statement is contained in the CPP@JOB member in data set userid.ISPF.ISPPROF.
  2. To use the new JOB statement, remove the CPP@JOB member from data set userid.ISPF.ISPPROF before you start the installation dialog. Otherwise, do nothing; the CustomPac jobs continue to use your existing JOB statement values.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.8 : Prepare for the discontinuation of tape delivery


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM has discontinued delivery of z/OS platform products and service on magnetic tape. IBM recommends downloading products and service. However, if you have a requirement for physical media, products and service are also available on DVD.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Customized Offerings for z/OS

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 217-085, "IBM z/OS Version 2 Release 3 - Engine for digital transformation," dated February 21, 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

IBM recommends downloading products and service. However, if you have a requirement for physical media, products and service are also available on DVD.

Reference information

For more information, see z/OS Planning for Installation.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.1.9 : Plan for removed z/OS national language translations


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, z/OS is provided only in U.S. English (ENU), Uppercase English (ENP), and Japanese (JPN).

The following optional language features are no longer shipped with z/OS V2R4:

  • Brazilian Portuguese
  • Canadian French
  • Danish
  • French
  • German
  • Italian
  • Korean
  • Netherlands Dutch
  • Norwegian
  • Simplified Chinese
  • Spanish
  • Swedish
  • Swiss German
  • Traditional Chinese

This change affects the subset of z/OS elements that provided translations in previous releases:

  • GDDM
  • ISPF
  • TSO/E
  • z/OS UNIX

Therefore, as of z/OS V2.4, the following translated elements and features are sent when you specify the language feature number in your order.

Language

Base elements

Japanese, which also includes Uppercase English support for ISPF only.

  • Alternate Library for REXX
  • BCP
  • DFSMSdfp
  • GDDM
  • HCD
  • IBM TDS
  • Integrated Security Services
  • ICKDSF
  • ISPF
  • JES2
  • Language Environment
  • NFS
  • Runtime Library Extensions
  • SMP/E
  • SSL component of Cryptographic Services
  • TSO/E
  • z/OS File System
  • z/OS UNIX

This change does not affect fonts. z/OS continues to provide double-byte fonts for China, Japan, Korea, and so on.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

GDDM, ISPF, TSO/E, z/OS UNIX

When change was introduced:

z/OS V2R3. Announced as a Statement of Direction in IBM Software Announcement Letter 217-246, dated July 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use any of the removed languages.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Stop using the removed languages from the affected elements.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2 : Upgrade actions for everyone before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes general upgrade actions that you can perform after you have installed z/OS V2R4 but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 3.1.2.1 : Set up an IPCS environment


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The interactive problem control system (IPCS) is a tool in the BCP that provides formatting and analysis support for dumps and traces. You must set up an IPCS environment so that you can process any dumps taken on the newly-built z/OS system.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if the target system cannot be used for native IPCS and usage of IPCS for information produced by the target system is necessary.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

The version and release level of IPCS must match the level of the system that produced the dump. You must use the z/OS MVS libraries of IPCS code, for example, to analyze a dump or trace produced by that level of the z/OS MVS system.

Tip:

If it is necessary to have unique IPCS data set names for your current system (because you already have the IPCS data sets with similar names on your earlier system), you can create a unique alias in your catalog that resolves to the current IPCS data sets. This will allow you to have duplicately-named IPCS data sets that are uniquely referenced.

When using unique aliases, you might have to update the security definition for the unique high-level qualifier used in the catalog.

Restrictions

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Set up an IPCS environment; for guidance, see the documents that are listed in "Reference information." During setup, ensure that your logon procedure points to the target system's level of IPCS data sets, which are shown in the following table.

DD name

Data set name

Notes

IATTABL

SYS1.SIATTBL0, if applicable

This is a JES3 data set.

IPCSPARM

Note:

This DD name is needed if one of the following is true:

  • The system on which the dump was taken has different BCP and JES levels than the system on which the dump will be examined using IPCS.
  • You have not specified these data sets in your system's parmlib concatenation.

SYS1.PARMLIB

This is the data set that contains all the shipped z/OS V2R4 parmlib IPCS members. If the copies of BLSCECT and all the other IPCS members are not at the z/OS V2R4 level, IPCS might fail when you attempt to use it.

IPCSPARM

SYS1.SHASPARM, if applicable

This is a JES2 data set.

IPCSPARM

SYS1.SIATPARM, if applicable

This is a JES3 data set.

ISPMLIB

SYS1.SBLSMSG0

 

ISPMLIB

SYS1.SIATMSG0, if applicable

This is a JES3 data set.

ISPPLIB

SYS1.SBLSPNL0

 

ISPPLIB

SYS1.SHASPNL0, if applicable

This is a JES2 data set.

ISPPLIB

SYS1.SIATPNL0, if applicable

This is a JES3 data set.

ISPSLIB

SYS1.SBLSKEL0

 

ISPTLIB

SYS1.SBLSTBL0

 

STEPLIB

Note:

This DD name is needed if the system on which the dump was taken has different BCP and JES levels than the system on which the dump will be examined using IPCS.

SYS1.MIGLIB

 

STEPLIB

SYS1.SIEAMIGE

This data set was added in z/OS V1R7. It is a PDSE data set that complements SYS1.MIGLIB. This data set is used along with SYS1.MIGLIB for IPCS.

STEPLIB

SYS1.SHASMIG, if applicable

This is a JES2 data set.

STEPLIB

SYS1.SIATMIG, if applicable

This is a JES3 data set.

SYSEXEC

SYS1.SIATCLI0, if applicable

This is a JES3 data set.

SYSPROC

SYS1.SBLSCLI0

 

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.2 : Use IBM-supplied parmlib and proclib members


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Ensure that all new and changed parmlib and proclib members that are shipped in z/OS V2R4 are updated in your parmlib and proclib concatenations.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • For parmlib, add the data set pointed to by the z/OS V2R4 PARMLIB DDDEF to your parmlib concatenation. Generally, the data set should be added last in the concatenation, and you should ensure that the other data sets in the concatenation do not have members with the same names as the IBM-supplied members. If you place the data set on the system residence volume and use an indirect catalog entry, future migrations will not require this particular migration step.
  • For proclib:
    1. Ensure that the default proclib members are copied to your default proclib to pick up the new and changed members.
    2. Update the individual sample members that are provided and ensure that they are accessible to the system, as shown in the table of proclib member updates in z/OS Program Directory.
    3. Ensure that the procedure libraries that are listed in the table of libraries to be added to the proclib concatenation in z/OS Program Directory in the z/OS Internet library are placed in the necessary procedure library concatenations and are available to the system.
Reference information

For the parmlib and proclib members that are shipped with z/OS, see z/OS Program Directory in the z/OS Internet library.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.3 : Migrate /etc, /global, and /var system control files


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The /etc, /global, and /var directories contain system control files. The /etc directory contains customization data that you maintain. The /global and /var directories contain customization data that IBM maintains.

The following elements and features use /etc:

  • BCP (Predictive Failure Analysis).
  • CIM.
  • Communications Server (IP Services component). See the workflow step called "IP Services: Update /etc configuration files."
  • Cryptographic Services (PKI Services and System SSL components).
  • DFSMSrmm.
  • IBM HTTP Server.
  • IBM Tivoli Directory Server (TDS). The LDAP server component uses /etc/ldap.
  • Infoprint Server. See the workflow step called "Remount the Printer Inventory and copy files that were customized."
  • Integrated Security Services. The Network Authentication Service component uses /etc/skrb.
  • z/OS UNIX.

The following elements and features use /global:

  • IBM Knowledge Center for z/OS
  • IBM z/OS Management Facility (z/OSMF).

The following elements and features use /var:

  • Cryptographic Services (OCSF component). See the workflow step called "OCSF: Migrate the directory structure."
  • DFSMSrmm.
  • IBM Tivoli Directory Server (TDS). The LDAP server component uses /var/ldap.
  • Infoprint Server. See the workflow step called "Remount the Printer Inventory and copy files that were customized."
  • Integrated Security Services. The Network Authentication Service component uses /var/skrb.

During installation, subdirectories of /etc, /global, and /var are created. If you install z/OS with ServerPac, some files are loaded into /etc, /global, and /var because of the customization that is performed in ServerPac. You must merge the files in /etc, /global, and /var with those on your previous system. If you install z/OS with CBPDO, copy the files from your old system to the z/OS V2R4 /etc, /global, and /var subdirectories.

After merging or copying the contents of /etc, /global, and /var, you must inspect and modify the files as necessary to reflect z/OS V2R4 requirements.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Copy files from your old system to the z/OS V2R4 /etc, /global, and /var subdirectories, and then modify the files as required for z/OS V2R4. If you have other files under your existing /var directory, you must merge the old and new files under /var. The easiest way to do this is to create a clone of your current /var file system and then copy the new /var files into the clone.

Many z/OS UNIX utilities are available for comparing and copying directory structures and files. Two that are especially helpful for /etc, /global, and /var migration work are:

  • diff (with the -r option, for recursion). This utility is useful for comparing the path structures and file contents, and has many options available. The dircmp utility has fewer options for directory comparisons, and the cmp utility stops after the first difference in a file comparison and has output that is more cumbersome.
  • pax . The -rw option works like a copy (instead of making or extracting from a single file archive) for directories, symbolic links, and files. Consider the -pe option for saving the attributes when doing the copy. The -k option prevents overwriting of existing files. The -c option causes pax to continue after encountering an error on the source file system. That is, pax prints an error message and returns a nonzero value after the command ends. Errors on the target file system (such as out of space or write errors) still cause the pax command to end as it always has.

To determine what you need to migrate, first compare the ServerPac /etc, /global, and /var file systems with your existing /etc, /global, and /var file systems. Mount a copy of your existing /etc, /global, and /var file systems to a location outside of the ServerPac file system. For instance, you might have your ServerPac file systems at /ServerPac/zOS_Rx/etc and /ServerPac/zOS_Rx/var, and your existing file systems at /Service/ImageX/etc and /Service/ImageX/var. You might have several file systems to mount that are copies of each of your image's /etc and /var file systems (ImageX, ImageY, and ImageZ, for instance). To compare the ServerPac and existing system's /etc and /var, you can run two z/OS UNIX commands, such as:

diff -r /ServerPac/zOS_Rx/etc /Service/ImageX/etc diff -r /ServerPac/zOS_Rx/var /Service/ImageX/var

These command results give you a list of the changes that your existing system's /etc and /var file systems are missing, including both the structure differences and the file content differences.

After you determine which directories, symbolic links, and files you are missing from your existing system, you can use one of several ways to propagate the ServerPac information forward:

  • You can use the pax command (with the -k option) to copy from the ServerPac /etc, /global, and /var file systems to each of your existing system's /etc, /global, and /var file systems. For example:
    cd /ServerPac/zOS_Rx/etc pax -rvwkC -pe * /Service/ImageX/etc

    Another example:

    cd /ServerPac/zOS_Rx/var pax -rvwkC -pe * /Service/ImageX/var

    The pax command is a good choice because it copies all files, directories, and symbolic links for each file system from the ServerPac system using a single command without overlaying any existing files.

  • You can rerun the product-supplied MKDIR jobs to recreate the directories and symbolic links on each of your existing system's /etc, /global, and /var file systems. A list of the MKDIR jobs is found in z/OS Program Directory in the z/OS Internet library and the other program directories for the products that were in your ServerPac order. MKDIR jobs can be run multiple times without damaging your existing file system. For the files under /var/ocsf, rerun the OCSF-supplied ocsf_install_crypto installation script. Or, you can combine these jobs and script them into a single batch job to make the execution more consolidated and repeatable.

After you make changes to a copy of your existing image's /etc, /global, and /var file systems, you can unmount them and use them for your deployment of the ServerPac system, as your schedule indicates. Remember, you are using copies of your existing /etc, /global, and /var file systems, and you are preserving what you had previously by modifying copies, so your customization for those specific existing images is not lost.

Reference information

For more information, see z/OS Program Directory in the z/OS Internet library.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.4 : Update automation and procedures for changed and deleted messages


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Every release, many messages change and some are deleted. If you use automation programs to handle messages, or you have operator or other procedures that deal with messages, you should update the programs or procedures.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use automation programs or other procedures to handle messages.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review the lists of changed and deleted messages in z/OS Release Upgrade Reference Summary. Update programs that automate on these messages and make other necessary accommodations.

Reference information

For a list of new, changed, and deleted messages, see z/OS Release Upgrade Reference Summary.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.5 : Rework and install user modifications


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

A user modification is a change that is constructed by a user to modify an existing function, add to an existing function, or add a user-defined function.

Common types of user modifications are:

  • User-written and vendor-written exit routines.
  • User-written and vendor-written SVCs.
  • User-written and vendor-written termination routines.
  • Modifications of IBM source code.
  • Unit information modules (UIMs) for non-IBM hardware.
  • User-written and vendor-written modules that are listed in a NUCLSTxx parmlib member.
  • Updates to default modules to set site defaults differently than the IBM-supplied defaults, such as for the following element and features:
    • DFSORT. Consider using ICEPRMxx parmlib members to eliminate the assembler language installation option modules.
    • HLASM.
    • ISPF configuration table.
    • SDSF. For more information, see the workflow step called "SDSF: Use dynamic statements for ISFPARMS to avoid reassembly."
    • z/OS XL C/C++.

If you made any user modifications, you must determine which ones need to be reworked and which ones need only to be reinstalled.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4

Is the upgrade action required?

Yes, if you made any user modifications.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine which user modifications need to be reworked and which need only to be reinstalled. You can use SMP/E LIST commands to retrieve information about installed products and features.

Note:

IBM recommends that you use exit routines for any user modifications where possible. You can install the exit routines by using SMP/E. With SMP/E, it is easier to bring forward modifications to the z/OS release you are installing.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.6 : Reconnect non-IBM products


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you use any independent software vendor (ISV) products, you must make them usable with the new system.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use any ISV products and need to reconnect them after performing a ServerPac installation.

Target system hardware requirements:

None.

Target system software requirements :

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check with your ISVs to make sure the product levels you are using support the new z/OS release, and then reconnect your ISV products to the new release of z/OS following the instructions provided by the ISVs. If any ISV products do not need to be installed in the same libraries and zones as z/OS, place them in their own sets of libraries and SMP/E zones. This means that, unless you have to change ISV product code, such as installing PTFs, or obtain a new level of the product, you will not need to reinstall it after you install a new ServerPac.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.7 : Reconnect subsystems


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you use subsystems, you need to make them usable with the new system.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use CICS®, DB2®, IMS, or NCP on your new system.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Ensure that any required target system PTFs are installed before you use the subsystem with the new z/OS system. This work includes any required SVCs, system modifications, parmlib setup, and proclib setup. Follow the instructions for the subsystem that you need to reconnect.

Tip: The required IBM PTFs for z/OS V2R4 are identified with the FIXCAT IBM.TargetSystem-RequiredService.z/OS.V2R4

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.8 : Update operational and other procedures


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Depending on which method you used to install (ServerPac, CBPDO, or another deliverable), and which functions you plan to exploit, you might need to update the operation, automation, administration, security, backup, and recovery procedures for your site.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review your operation, automation, administration, security, backup, and recovery procedures, and make any necessary changes depending on how you installed and which functions you plan to exploit. Some possible changes are:

  • Allowing applicable users access to new high-level qualifiers. The default new high-level qualifiers are shown in the workflow step called "Add references to new data sets and paths."
  • Updating and testing your backup and recovery procedures to accommodate the new target system.
  • Updating and testing any disaster recovery procedures.
  • Updating and testing any automation procedures to take advantage of new functions.
  • Updating security system definitions, such as defining new users and resources, permitting users to use new resources, and defining new profiles in the RACF® FACILITY class.
Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.9 : Verify that virtual storage limits are set properly


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Because virtual storage requirements can increase from release to release, it is recommended that you review your current settings for virtual storage limits.

Consider the following areas of potential concern:

  • Common areas (above and below the 16 MB line). An increase in virtual storage for the common areas reduces the virtual storage size of all address spaces.
  • Individual address spaces. An increase in virtual storage for individual address spaces impacts only the individual address spaces.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether your virtual storage limits are set properly, use the health check IBMRSM,RSM_MEMLIMIT. It checks the current setting for the MEMLIMIT parameter in SMFPRMxx, which affects the amount of virtual storage above the 2 GB bar that is available to jobs. This check verifies that a nonzero MEMLIMIT value is in use.

Steps to take

Determine how much virtual storage use above the 2 GB bar to allow. Though there is no practical limit to the number of virtual addresses an address space can request above the bar, the system can limit the amount of virtual storage above the bar that an address space can use.

The amount of virtual storage above the bar is determined as follows:

  • The MEMLIMIT parameter in parmlib member SMFPRMxx sets the default system-wide limit, which defaults to 2 GB.
  • MEMLIMIT can be overridden for particular jobs by specifying REGION=0M or MEMLIMIT on JOB or EXEC statements in JCL.

To set a limit on the use of virtual storage above the bar, use the SMF exit IEFUSI or the parmlib member SMFLIMxx. For more information, see the topic on limiting the use of memory objects in z/OS MVS Programming: Extended Addressability Guide.

If you want to control the use of virtual storage above the 2 GB bar, do one or more of the following:

  • If the MEMLIMIT default of 2 GB is acceptable to you, no change to SMFPRMxx is necessary.

  • You can specify MEMLIMIT explicitly in JCL to override the system default that was set (or allowed to default) in SMFPRMxx.

  • You can specify REGION=0M on the job statement in JCL to implicitly set MEMLIMIT to NOLIMIT, which also overrides the system default (from SMFPRMxx).

  • You can use IEFUSI or parmlib member SMFLIMxx to establish a system default MEMLIMIT for different classes of work (for example, JOB, TSO, STC) and limit the amount of virtual storage that can be used above the bar, if an explicit or implicit nonzero MEMLIMIT is in effect from JCL or SMFPRMxx. The keyword HONORIEFUSIREGION NOHONORIEFUSIREGION is available in SCHEDxx to identify if the region and MEMLIMIT settings that are specified through or otherwise affected by the IEFUSI exit are to take effect for a program. If you are overriding the attribute of HASJES20 (JES2) in SCHEDxx parmlib member, specify NOHONORIEFUSIREGION explicitly so the default of HONORIEFUSIREGION is not used for this program.

Note: When calculating the large frame area (LFAREA) for your system, be aware of the following considerations:

  • z/OS with JES2 requires a minumum of 2M of LFAREA
  • z/OS without JES2 requires a minimum of 1M of LFAREA.

Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMRSM,RSM_MEMLIMIT.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 3.1.2.10 : Back virtual storage with sufficient real and auxiliary storage


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As you use more virtual storage by defining additional address spaces or by exploiting memory objects, ensure that you have enough real and auxiliary storage defined.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Using an RMF report, determine whether more real or auxiliary storage is needed by checking the following real storage concentration indicators:

  • UIC and average available frames
  • Demand page rates
  • Percentage of auxiliary slots in use
Reference information

For more information about memory objects, see z/OS MVS Programming: Extended Addressability Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.11 : Update your check customization for modified IBM Health Checker for z/OS checks


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Changes that IBM makes to the checks provided by IBM Health Checker for z/OS can affect any updates that you might have made.

The following health checks are new in z/OS V2R4:

  • IBMCS,ZOSMIGV2R4_NEXT_CS_OSIMGMT
  • IBMCS,ZOSMIGV2R4PREV_CS_IWQSC_tcpipstackname
  • IBM_JES2, JES2_UPGRADE_CKPT_LEVEL_JES2
  • IBMICSF,ICSF_PKCS_PSS_SUPPORT
  • IBMINFOPRINT, INFOPRINT_CENTRAL_SECURE_MODE
  • IBMINFOPRINT, ZOSMIGV2R3_NEXT_INFOPRINT_IPCSSL
  • IBMISPF,ISPF_WSA
  • IBMVSM,ZOSMIGV2R3_NEXT_VSM_USERKEYCOMM

The following health checks are changed by IBM in z/OS V2R4:

  • IBMCS,CSVTAM_CSM_STG_LIMIT
  • IBMUSS,ZOSMIGV2R3_NEXT_USS_SMB_DETECTED

The following health checks were added in z/OS V2R3:

  • IBMISPF,ZOSMIGV2R3_Next_ISPF_GW_HTTPS

    The following health checks were deleted by IBM in z/OS V2R3:

    • IBMCNZ,CNZ_CONSOLE_OPERATING_MODE
    • IBMCS,CSAPP_FTPD_ANONYMOUS_JES
    • IBMCS,CSAPP_SMTPD_MAIL_RELAY
    • IBMCS,CSVTAM_VIT_OPT_STDOPTS.
    • IBMCS,ZOSMIGV2R2_NEXT_CS_LEGACYDEVICE
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILCLIEN
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILDAEMN
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILMSA
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILMTA
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SMTPDDAEMON
    • IBMCS,ZOSMIGV2R2_NEXT_CS_SMTPDMTA
    • IBMCS,ZOSMIGV2R2_NEXT_CS_TFTP
    • IBMIXGLOGR,ZOSMIGV2R2_NEXT_IXG_REMOVE_DRXRC
    • IBMRSM,RSM_REAL
    • IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL
    • IBMVSAM,VSAM_CA_RECLAIM

    Information about this upgrade action

    The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

    Element or feature:

    Multiple.

    When change was introduced:

    General upgrade action not tied to a specific release.

    Applies to upgrade from:

    z/OS V2R3 and z/OS V2R2.

    Timing:

    Before the first IPL of z/OS V2R4.

    Is the upgrade action required?

    No, but recommended to ensure that your checks continue to work as you intend them to work.

    Target system hardware requirements:

    None.

    Target system software requirements:

    None.

    Other system (coexistence or fallback) requirements:

    None.

    Restrictions:

    None.

    System impacts:

    None.

    Related IBM Health Checker for z/OS check:

    See "Steps to take."

    Steps to take

    Follow these steps:

    1. Refer to the updated checks in IBM Health Checker for z/OS User's Guide.
    2. Review changes you made for those checks, in HZSPRMxx parmlib members, for example.
    3. Make any further updates for the checks to ensure that they continue to work as intended.
    Reference information

    For information about updating the checks, see IBM Health Checker for z/OS User's Guide.

    Instructions:

    This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.12 : Remove deleted data sets, paths, and references


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Data sets and paths are routinely removed from z/OS for reasons such as consolidation of data sets and removal of elements and features. You must determine whether these changes affect your environment.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Using the following tables as a guide, remove data sets and paths that do not exist in the current release (z/OS V2R4). Also, remove references to them. You might find references in the following places:

  • Parmlib
  • Proclib
  • Logon procedures
  • Catalogs
  • Security definitions, including program control definitions
  • DFSMS ACS routines
  • /etc/profile
  • SMP/E DDDEF entry
  • Backup and recovery procedures, as well as any references to them

In the tables, the data sets are identified as distribution library (DLIB) data sets or target library data sets.

Note:

Do not remove any data sets, paths, or references that are needed by earlier-level systems until those systems no longer need them.

Table 1. Data sets and paths deleted from z/OS V2R4 (in alphabetic order by DDDEF name)

DDDEF

Data set name or path (high-level qualifiers are defaults)

DLIB or target

From element or feature

When deleted

Why deleted

ABPXMCHS

SYS1.ABPXMCHS

DLIB

BCP

z/OS V2R4

FMID was removed from z/OS

ABPXPCHS

SYS1.ABPXPCHS

DLIB

BCP

z/OS V2R4

FMID was removed from z/OS

ABPXTCHS

SYS1.ABPXTCHS

DLIB

BCP

z/OS V2R4

FMID was removed from z/OS

AMSGCHS

SYS1.AMSGCHS

DLIB

BCP

z/OS V2R4

FMID was removed from z/OS

APHELP

SYS1.APHELP

DLIB

BCP

z/OS V2R4

FMID was removed from z/OS

 

 

 

 

 

 

AEOXFONT

EOY.AEOXFONT

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOXIENU

EOY.AEOXIENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOXOENU

EOY.AEOXOENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOX1ENU

EOY.AEOX1ENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOX2ENU

EOY.AEOX2ENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOX3ENU

EOY.AEOX3ENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOX4ENU

EOY.AEOX4ENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXINLD

EOY.AEOXINLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOXONLD

EOY.AEOXONLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOX1NLD

EOY.AEOX1NLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOX2NLD

EOY.AEOX2NLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOX3NLD

EOY.AEOX3NLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOX4NLD

EOY.AEOX4NLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYBNLD

EOY.AEOYBNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYGNLD

EOY.AEOYGNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYLNLD

EOY.AEOYLNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYMNLD

EOY.AEOYMNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYPNLD

EOY.AEOYPNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYSNLD

EOY.AEOYSNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYTNLD

EOY.AEOYTNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

AEOYXNLD

EOY.AEOYXNLD

DLIB

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIFRA

EOY.AEOXIFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOXOFRA

EOY.AEOXOFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOX1FRA

EOY.AEOX1FRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOX2FRA

EOY.AEOX2FRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOX3FRA

EOY.AEOX3FRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOX4FRA

EOY.AEOX4FRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYBFRA

EOY.AEOYBFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYGFRA

EOY.AEOYGFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYLFRA

EOY.AEOYLFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYMFRA

EOY.AEOYMFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYPFRA

EOY.AEOYPFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYSFRA

EOY.AEOYSFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYTFRA

EOY.AEOYTFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

AEOYXFRA

EOY.AEOYXFRA

DLIB

BookManager READ French

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIDEU

EOY.AEOXIDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOXODEU

EOY.AEOXODEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOX1DEU

EOY.AEOX1DEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOX2DEU

EOY.AEOX2DEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOX3DEU

EOY.AEOX3DEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOX4DEU

EOY.AEOX4DEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYBDEU

EOY.AEOYBDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYGDEU

EOY.AEOYGDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYLDEU

EOY.AEOYLDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYMDEU

EOY.AEOYMDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYPDEU

EOY.AEOYPDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYSDEU

EOY.AEOYSDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYTDEU

EOY.AEOYTDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

AEOYXDEU

EOY.AEOYXDEU

DLIB

BookManager READ German

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIESP

EOY.AEOXIESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOXOESP

EOY.AEOXOESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOX1ESP

EOY.AEOX1ESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOX2ESP

EOY.AEOX2ESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOX3ESP

EOY.AEOX3ESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOX4ESP

EOY.AEOX4ESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYBESP

EOY.AEOYBESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYGESP

EOY.AEOYGESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYLESP

EOY.AEOYLESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYMESP

EOY.AEOYMESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYPESP

EOY.AEOYPESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYSESP

EOY.AEOYSESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYTESP

EOY.AEOYTESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

AEOYXESP

EOY.AEOYXESP

DLIB

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIITA

EOY.AEOXIITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOXOITA

EOY.AEOXOITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOX1ITA

EOY.AEOX1ITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOX2ITA

EOY.AEOX2ITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOX3ITA

EOY.AEOX3ITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOX4ITA

EOY.AEOX4ITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYBITA

EOY.AEOYBITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYGITA

EOY.AEOYGITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYLITA

EOY.AEOYLITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYMITA

EOY.AEOYMITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYPITA

EOY.AEOYPITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYSITA

EOY.AEOYSITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYTITA

EOY.AEOYTITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

AEOYXITA

EOY.AEOYXITA

DLIB

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIPTB

EOY.AEOXIPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOXOPTB

EOY.AEOXOPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYBPTB

EOY.AEOYBPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOX1PTB

EOY.AEOX1PTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOX2PTB

EOY.AEOX2PTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOX3PTB

EOY.AEOX3PTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOX4PTB

EOY.AEOX4PTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYGPTB

EOY.AEOYGPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYLPTB

EOY.AEOYLPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYMPTB

EOY.AEOYMPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYPPTB

EOY.AEOYPPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYSPTB

EOY.AEOYSPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYTPTB

EOY.AEOYTPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

AEOYXPTB

EOY.AEOYXPTB

DLIB

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIFRC

EOY.AEOXIFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOXOFRC

EOY.AEOXOFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOX1FRC

EOY.AEOX1FRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOX2FRC

EOY.AEOX2FRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOX3FRC

EOY.AEOX3FRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOX4FRC

EOY.AEOX4FRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYBFRC

EOY.AEOYBFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYGFRC

EOY.AEOYGFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYLFRC

EOY.AEOYLFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYMFRC

EOY.AEOYMFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYPFRC

EOY.AEOYPFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYSFRC

EOY.AEOYSFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYTFRC

EOY.AEOYTFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

AEOYXFRC

EOY.AEOYXFRC

DLIB

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOXIDAN

EOY.AEOXIDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOXODAN

EOY.AEOXODAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOX1DAN

EOY.AEOX1DAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOX2DAN

EOY.AEOX2DAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOX3DAN

EOY.AEOX3DAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOX4DAN

EOY.AEOX4DAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYBDAN

EOY.AEOYBDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYGDAN

EOY.AEOYGDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYLDAN

EOY.AEOYLDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYMDAN

EOY.AEOYMDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYPDAN

EOY.AEOYPDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYSDAN

EOY.AEOYSDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYTDAN

EOY.AEOYTDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

AEOYXDAN

EOY.AEOYXDAN

DLIB

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AEOYBENU

EOY.AEOYBENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYCLIB

EOY.AEOYCLIB

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYGENU

EOY.AEOYGENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYLENU

EOY.AEOYLENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYLEXS

EOY.AEOYLEXS

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYLOAD

EOY.AEOYLOAD

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYMENU

EOY.AEOYMENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYPENU

EOY.AEOYPENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYPROC

EOY.AEOYPROC

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYSAMP

EOY.AEOYSAMP

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYSENU

EOY.AEOYSENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYTENU

EOY.AEOYTENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEOYXENU

EOY.AEOYXENU

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHBOK1

EOX.AEPHBOK1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHCLB1

EOX.AEPHCLB1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHDAT1

EOX.AEPHDAT1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHLOD1

EOX.AEPHLOD1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHMSG1

EOX.AEPHMSG1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHPNL1

EOX.AEPHPNL1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHSAM1

EOX.AEPHSAM1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

AEPHTBL1

EOX.AEPHTBL1

DLIB

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AIOEHSAM

IOE.AIOEHSAM

DLIB

DFS/SMB

z/OS V2R4

Element was removed from z/OS

AIOEHSHL

IOE.AIOEHSHL

DLIB

DFS/SMB

z/OS V2R4

Element was removed from z/OS

AIOEHSRC

IOE.AIOEHSRC

DLIB

DFS/SMB

z/OS V2R4

Element was removed from z/OS

AIOEHJPN

IOE.AIOEHJPN

DLIB

DFS/SMB

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AISPGDES

ISP.AISPGDES

DLIB

ISPF Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

AISPMDES

ISP.AISPMDES

DLIB

ISPF Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

AISPPDES

ISP.AISPPDES

DLIB

ISPF Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

AISPSDES

ISP.AISPSDES

DLIB

ISPF Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

AISPTDES

ISP.AISPTDES

DLIB

ISPF Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

 

AISPGDEU

ISP.AISPGDEU

DLIB

ISPF German

z/OS V2R4

FMID was withdrawn from z/OS

AISPMDEU

ISP.AISPMDEU

DLIB

ISPF German

z/OS V2R4

FMID was withdrawn from z/OS

AISPPDEU

ISP.AISPPDEU

DLIB

ISPF German

z/OS V2R4

FMID was withdrawn from z/OS

AISPSDEU

ISP.AISPSDEU

DLIB

ISPF German

z/OS V2R4

FMID was withdrawn from z/OS

AISPTDEU

ISP.AISPTDEU

DLIB

ISPF German

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

 

AEPHBOOK

EPH.AEPHBOOK

DLIB

Library Server

z/OS V2R4

Element was removed from z/OS

AEPHCLIB

EPH.AEPHCLIB

DLIB

Library Server

z/OS V2R4

Element was removed from z/OS

AEPHLOAD

EPH.AEPHLOAD

DLIB

Library Server

z/OS V2R4

Element was removed from z/OS

AEPHSAMP

EPH.AEPHSAMP

DLIB

Library Server

z/OS V2R4

Element was removed from z/OS

AEPHTAB

EPH.AEPHTAB

DLIB

Library Server

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AIOAIBIN

IOA.AIOAIBIN

DLIB

OSA/SF

z/OS V2R4

Element was removed from z/OS

AIOALMOD

IOA.AIOALMOD

DLIB

OSA/SF

z/OS V2R4

Element was removed from z/OS

AIOAMMOD

IOA.AIOAMMOD

DLIB

OSA/SF

z/OS V2R4

Element was removed from z/OS

AIOASAMP

IOA.AIOASAMP

DLIB

OSA/SF

z/OS V2R4

Element was removed from z/OS

AIOAJAVA

IOA.AIOAJAVA

DLIB

OSA/SF

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

AICQPAB

SYS1.AICQPAB

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

AICQPILB

SYS1.AICQPILB

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

AICQPMA1

SYS1.AICQPMA1

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

AICQPMA3

SYS1.AICQPMA3

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

AICQPMA4

SYS1.AICQPMA4

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

AICQPMA5

SYS1.AICQPMA5

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

APLIB

SYS1.APLIB

DLIB

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

 

AGHELP

SYS1.AGHELP

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AGLIB

SYS1.AGLIB

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGAB

SYS1.AICQGAB

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGILB

SYS1.AICQGILB

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGMA1

SYS1.AICQGMA1

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGMA3

SYS1.AICQGMA3

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGMA4

SYS1.AICQGMA4

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AICQGMA5

SYS1.AICQGMA5

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

AMSGDEU

SYS1.AMSGDEU

DLIB

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

MSGCHS

SYS1.MSGCHS

Target

BCP

z/OS V2R4

FMID was removed from z/OS

PHELP

SYS1.PHELP

Target

BCP

z/OS V2R4

FMID was removed from z/OS

SBPXMCHS

SYS1.SBPXMCHS

Target

BCP

z/OS V2R4

FMID was removed from z/OS

SBPXPCHS

SYS1.SBPXPCHS

Target

BCP

z/OS V2R4

FMID was removed from z/OS

SBPXTCHS

SYS1.SBPXTCHS

Target

BCP

 

FMID was removed from z/OS

 

 

 

 

 

 

SEOXFONT

EOY.SEOXFONT

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOXIENU

EOY.SEOXIENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOXOENU

EOY.SEOXOENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOX1ENU

EOY.SEOX1ENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOX2ENU

EOY.SEOX2ENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOX3ENU

EOY.SEOX3ENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOX4ENU

EOY.SEOX4ENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYBENU

EOY.SEOYBENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYCLIB

EOY.SEOYCLIB

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYGENU

EOY.SEOYGENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYLENU

EOY.SEOYLENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYLEXS

EOY.SEOYLEXS

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYLOAD

EOY.SEOYLOAD

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYLPA

EOY.SEOYLPA

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYMENU

EOY.SEOYMENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYPENU

EOY.SEOYPENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYPROC

EOY.SEOYPROC

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYSAMP

EOY.SEOYSAMP

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYSENU

EOY.SEOYSENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYTENU

EOY.SEOYTENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEOYXENU

EOY.SEOYXENU

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHBOK1

EOX.SEPHBOK1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHCLB1

EOX.SEPHCLB1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHDAT1

EOX.SEPHDAT1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHLOD1

EOX.SEPHLOD1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHMSG1

EOX.SEPHMSG1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHPNL1

EOX.SEPHPNL1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHSAM1

EOX.SEPHSAM1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

SEPHTBL1

EOX.SEPHTBL1

Target

BookManager READ Base and English

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXINLD

EOY.SEOXINLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOXONLD

EOY.SEOXONLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOX1NLD

EOY.SEOX1NLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOX2NLD

EOY.SEOX2NLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOX3NLD

EOY.SEOX3NLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOX4NLD

EOY.SEOX4NLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYBNLD

EOY.SEOYBNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYGNLD

EOY.SEOYGNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYLNLD

EOY.SEOYLNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYMNLD

EOY.SEOYMNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYPNLD

EOY.SEOYPNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYSNLD

EOY.SEOYSNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYTNLD

EOY.SEOYTNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

SEOYXNLD

EOY.SEOYXNLD

Target

BookManager READ Dutch

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIFRA

EOY.SEOXIFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOXOFRA

EOY.SEOXOFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOX1FRA

EOY.SEOX1FRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOX2FRA

EOY.SEOX2FRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOX3FRA

EOY.SEOX3FRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOX4FRA

EOY.SEOX4FRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYBFRA

EOY.SEOYBFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYGFRA

EOY.SEOYGFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYLFRA

EOY.SEOYLFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYMFRA

EOY.SEOYMFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYPFRA

EOY.SEOYPFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYSFRA

EOY.SEOYSFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYTFRA

EOY.SEOYTFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

SEOYXFRA

EOY.SEOYXFRA

Target

BookManager READ French

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIDEU

EOY.SEOXIDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOXODEU

EOY.SEOXODEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOX1DEU

EOY.SEOX1DEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOX2DEU

EOY.SEOX2DEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOX3DEU

EOY.SEOX3DEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOX4DEU

EOY.SEOX4DEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYBDEU

EOY.SEOYBDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYGDEU

EOY.SEOYGDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYLDEU

EOY.SEOYLDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYMDEU

EOY.SEOYMDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYPDEU

EOY.SEOYPDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYSDEU

EOY.SEOYSDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYTDEU

EOY.SEOYTDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

SEOYXDEU

EOY.SEOYXDEU

Target

BookManager READ German

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIESP

EOY.SEOXIESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOXOESP

EOY.SEOXOESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOX1ESP

EOY.SEOX1ESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOX2ESP

EOY.SEOX2ESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOX3ESP

EOY.SEOX3ESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOX4ESP

EOY.SEOX4ESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYBESP

EOY.SEOYBESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYGESP

EOY.SEOYGESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYLESP

EOY.SEOYLESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYMESP

EOY.SEOYMESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYPESP

EOY.SEOYPESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYSESP

EOY.SEOYSESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYTESP

EOY.SEOYTESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

SEOYXESP

EOY.SEOYXESP

Target

BookManager READ Spanish

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIITA

EOY.SEOXIITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOXOITA

EOY.SEOXOITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOX1ITA

EOY.SEOX1ITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOX2ITA

EOY.SEOX2ITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOX3ITA

EOY.SEOX3ITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOX4ITA

EOY.SEOX4ITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYBITA

EOY.SEOYBITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYGITA

EOY.SEOYGITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYLITA

EOY.SEOYLITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYMITA

EOY.SEOYMITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYPITA

EOY.SEOYPITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYSITA

EOY.SEOYSITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYTITA

EOY.SEOYTITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

SEOYXITA

EOY.SEOYXITA

Target

BookManager READ Italian

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIPTB

EOY.SEOXIPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOXOPTB

EOY.SEOXOPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOX1PTB

EOY.SEOX1PTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOX2PTB

EOY.SEOX2PTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOX3PTB

EOY.SEOX3PTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOX4PTB

EOY.SEOX4PTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYBPTB

EOY.SEOYBPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYGPTB

EOY.SEOYGPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYLPTB

EOY.SEOYLPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYMPTB

EOY.SEOYMPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYPPTB

EOY.SEOYPPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYSPTB

EOY.SEOYSPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYTPTB

EOY.SEOYTPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

SEOYXPTB

EOY.SEOYXPTB

Target

BookManager READ Brazilian Portuguese

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIFRC

EOY.SEOXIFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOXOFRC

EOY.SEOXOFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOX1FRC

EOY.SEOX1FRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOX2FRC

EOY.SEOX2FRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOX3FRC

EOY.SEOX3FRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOX4FRC

EOY.SEOX4FRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYBFRC

EOY.SEOYBFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYGFRC

EOY.SEOYGFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYLFRC

EOY.SEOYLFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYMFRC

EOY.SEOYMFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYPFRC

EOY.SEOYPFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYSFRC

EOY.SEOYSFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYTFRC

EOY.SEOYTFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

SEOYXFRC

EOY.SEOYXFRC

Target

BookManager READ Canadian French

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SEOXIDAN

EOY.SEOXIDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOXODAN

EOY.SEOXODAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOX1DAN

EOY.SEOX1DAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOX2DAN

EOY.SEOX2DAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOX3DAN

EOY.SEOX3DAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOX4DAN

EOY.SEOX4DAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYBDAN

EOY.SEOYBDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYGDAN

EOY.SEOYGDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYLDAN

EOY.SEOYLDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYMDAN

EOY.SEOYMDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYPDAN

EOY.SEOYPDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYSDAN

EOY.SEOYSDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYTDAN

EOY.SEOYTDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

SEOYXDAN

EOY.SEOYXDAN

Target

BookManager READ Danish

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SIOEHJPN

IOE.SIOEHJPN - Japanese

Target

DFS/SMB

z/OS V2R4

Element was removed from z/OS

SIOEHLIB

usr/lpp/dfs/global/lib/IBM/

Target

DFS/SMB

z/OS V2R4

Element was removed from z/OS

SIOEHSAM

usr/lpp/dfs/global/examples/IBM/

Target

DFS/SMB

z/OS V2R4

Element was removed from z/OS

SIOEHSHL

usr/lpp/dfs/global/scripts/IBM/

Target

DFS/SMB

z/OS V2R4

Element was removed from z/OS

SIOEHSRC

usr/lpp/dfs/global/src/IBM/

Target

DFS/SMB

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SAOPICSE

/usr/lpp/Printsrv/InfoprintCentral/Scripts/nls/IBM/

Target

Infoprint Server

z/OS V2R4

Function was removed from the z/OS element.

SAOPICSJ

/usr/lpp/Printsrv/InfoprintCentral/Scripts/nls/ja/IBM/

Target

Infoprint Server

z/OS V2R4

Function was removed from the z/OS element.

SAOPICXC

/usr/lpp/Printsrv/InfoprintCentral/xsl/Controls/IBM/

Target

Infoprint Server

z/OS V2R4

Function was removed from the z/OS element.

SAOPICXP

/usr/lpp/Printsrv/InfoprintCentral/xsl/Page/IBM/

Target

Infoprint Server

z/OS V2R4

Function was removed from the z/OS element.

 

 

 

 

 

 

SISPGDES

ISP.SISPGDES

Target

ISPF - Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

SISPMDES

ISP.SISPMDES

Target

ISPF - Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

SISPPDES

ISP.SISPPDES

Target

ISPF - Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

SISPSDES

ISP.SISPSDES

Target

ISPF - Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

SISPTDES

ISP.SISPTDES

Target

ISPF - Swiss German

z/OS V2R4

FMID was withdrawn from z/OS

SISPGDEU

ISP.SISPGDEU

Target

ISPF - German

z/OS V2R4

FMID was withdrawn from z/OS

SISPMDEU

ISP.SISPMDEU

Target

ISPF - German

z/OS V2R4

FMID was withdrawn from z/OS

SISPPDEU

ISP.SISPPDEU

Target

ISPF - German

z/OS V2R4

FMID was withdrawn from z/OS

SISPSDEU

ISP.SISPSDEU

Target

ISPF - German

z/OS V2R4

FMID was withdrawn from z/OS

SISPTDEU

ISP.SISPTDEU

Target

ISPF - German

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

 

SEPHBOOK

/usr/lpp/booksrv/books/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHCASE

/usr/lpp/booksrv/cases/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHCLIB

EPH.SEPHCLIB

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHGIF

/usr/lpp/booksrv/public/bookmgr/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHLOAD

/usr/lpp/booksrv/cgi-bin/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHPLIB

/usr/lpp/booksrv/plugins/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHPUB

/usr/lpp/booksrv/public/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHSAMP

EPH.SEPHSAMP

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHSHLF

/usr/lpp/booksrv/public/bookmgr/shelves/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHSRVR

/usr/lpp/booksrv/public/bookmgr/libraryserver/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHTAB

EPH.SEPHTAB

Target

Library Server

z/OS V2R4

Element was removed from z/OS

SEPHTPLT

/usr/lpp/booksrv/public/bookmgr/templates/IBM/

Target

Library Server

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

SIOAIBIN

IOA.SIOAIBIN

Target

OSA/SF

z/OS V2R4

Element was removed from z/OS

SIOALMOD

IOA.SIOALMOD

Target

OSA/SF

z/OS V2R4

Element was removed from z/OS

SIOAMMOD

IOA.SIOAMMOD

Target

OSA/SF

z/OS V2R4

Element was removed from z/OS

SIOASAMP

IOA.SIOASAMP

Target

OSA/SF

z/OS V2R4

Element was removed from z/OS

SIOAJAVA

IOA.SIOAJAVA

Target

OSA/SF

z/OS V2R4

Element was removed from z/OS

 

 

 

 

 

 

CHSLIB

SYS1.CHSLIB

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPABTX

ICQ.ICQPABTX

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPCLIB

ICQ.ICQPCLIB

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPILIB

ICQ.ICQPILIB

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPMLIB

ICQ.ICQPMLIB

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPPLIB

ICQ.ICQPPLIB

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

ICQPTABL

ICQ.ICQPTABL

Target

TSO/E Chinese

z/OS V2R4

FMID was withdrawn from z/OS

GERLIB

SYS1.GERLIB

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

GHELP

SYS1.GHELP

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGABTX

ICQ.ICQGABTX

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGCLIB

ICQ.ICQGCLIB

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGILIB

ICQ.ICQGILIB

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGMLIB

ICQ.ICQGMLIB

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGPLIB

ICQ.ICQGPLIB

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

ICQGTABL

ICQ.ICQGTABL

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

MSGDEU

SYS1.MSGDEU

Target

TSO/E German

z/OS V2R4

FMID was withdrawn from z/OS

 

 

 

 

 

 

SFSUMCHS

/usr/lib/nls/msg/Zh_CN/IBM/

Target

z/OS UNIX

z/OS V2R4

FMID is withdrawn from z/OS

Table 2. Data sets and paths deleted from z/OS V2R3 (in alphabetic order by DDDEF name)

DDDEF

Data set name or path (high-level qualifiers are defaults)

DLIB or target

From element or feature

When deleted

Why deleted

/usr/lpp/bcp/mca

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/bin

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/bin/migration

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/lib

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/classes

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/classes/fb

 

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/classes/ARM

 

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/classes/ms

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/samples

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

/usr/lpp/bcp/mca/util

BCP

z/OS V2R3

Obsolete; GPMP component was removed.

ACBDEHFS

SYS1.ACBDEHFS

DLIB

HCD

z/OS V2R3

Remove the HFS parts

AISFLINK

ISF.AISFLINK

DLIB

SDSF

z/OS V2R3

Obsolete

CCSSLIB

N/A

Target

ICSF

z/OS V2R3

Remove the DDDEF

SCBDETCH

/usr/lpp/hcd/etc/IBM/

Target

HCD

z/OS V2R3

Remove the HFS parts

SCBDEXMP

/usr/lpp/hcd/examples/IBM/

Target

HCD

z/OS V2R3

Remove the HFS parts

SCBDHFSL

/usr/lpp/hcd/bin/IBM/

Target

HCD

z/OS V2R3

Remove the HFS parts

SCBDMLDP

/usr/lpp/hcd/msg/IBM/

Target

HCD

z/OS V2R3

Remove the HFS parts

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.13 : Add references to new data sets and paths


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

New data sets and paths are routinely added to z/OS for reasons such as consolidation of data sets and addition of new elements and features. You must determine whether these additions affect your environment.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Using the following tables as a guide, add references in the following places for data sets and paths that have been added to z/OS:

  • Parmlib
  • Proclib
  • Logon procedures
  • Catalogs
  • Security definitions, including program control definitions
  • DFSMS ACS routines
  • /etc/profile
  • SMP/E DDDEF entry
  • Backup and recovery procedures, as well as any references to them
Restriction:

Some of the data sets shipped with z/OS are PDSEs and are most likely in your LNKLST. If one or more are in your LNKLST and on your system residence volume, adhere to the following PDSE sharing rules to avoid data set corruption:

  • If you specified PDSESHARING(NORMAL), do not share PDSE data sets beyond the scope of the global resource serialization complex.
  • If you specified PDSESHARING(EXTENDED), do not share PDSE data sets beyond the scope of the sysplex.

In the tables, the data sets are identified as distribution library (DLIB) data sets or target library data sets.

Table 1. Data sets added to z/OS V2R4 (in alphabetic order by DDDEF name)

DDDEF

Data set name (high-level qualifiers are defaults) or path

DLIB or target

To element or feature

When added

Why added

AAZDFFS

AZD.AAZDFFS

DLIB

z/OS Container Extensions (zCX)

V2R4

Element was added to z/OS

SAZDFFS

/usr/lpp/zcx_zos/IBM/

Target

z/OS Container Extensions (zCX)

V2R4

Element was added to z/OS

/usr/include/zos

Target

BCP

V2R4

New C header path

Table 2. Data sets added to z/OS V2R3 (in alphabetic order by DDDEF name)

DDDEF

Data set name (high-level qualifiers are defaults) or path

DLIB or target

To element or feature

When added

Why added

ABBLEXEC

BBL.ABBLEXEC

DLIB

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

ABBLJCL

BBL.ABBLJCL

DLIB

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

ABBLLIB

BBL.ABBLLIB

DLIB

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

ACCNSR6

CBC.ACCNSR6

DLIB

z/OS XL C/C++

z/OS V2R3

New data set

ACCNSR7

CBC.ACCNSR7

DLIB

z/OS XL C/C++

z/OS V2R3

New data set

SBBLEXEC

BBL.SBBLEXEC

Target

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

SBBLJCL

BBL.SBBLJC

Target

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

SBBLLIB

/usr/lpp/liberty_zos/IBM

Target

IBM z/OS Liberty Embedded (new element)

z/OS V2R3

New data set

SCCNM12

CBC.SCCNM12

Target

z/OS XL C/C++

z/OS V2R3

New data set

SCCNN12

CBC.SCCNN12

Target

z/OS XL C/C++

z/OS V2R3

New data set

SCSFSTUB

CSF.SCSFSTUB

Target

ICSF

z/OS V2R3

New data set

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.2.14 : Accommodate new address spaces


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The MAXUSER value in parmlib member IEASYSxx specifies a value that the system uses to limit the number of jobs and started tasks that can run concurrently during a particular IPL. You might want to increase your MAXUSER value to take new address spaces into account.

The following elements add new address spaces for z/OS V2R4:

  • z/OS Container Extensions (zCX) is a new element in z/OS V2R4. It provides the runtime support to deploy and run Linux on IBM Z applications that are packaged as Docker Container images on z/OS.

The following address space is new for z/OS V2R4:

  • zCX creates one address space for each provisioned server that is started by the user.

The following elements add new address spaces for z/OS V2R3:

  • JES2.

The following address space is new for z/OS V2R3:

  • JES2 Email Delivery Services (EDS). One new persistent address space is created by JES2 when JES2 email interfaces are used:
    • A job is submitted with the NOTIFY JCL statement that requests notification by an email message.
    • The Notify user message service (SSI 75) is called with email address as the target of a message.

    The address space is named jesxEDS, where jesx is the name of the JES2 subsystem. You must ensure that a proper user ID is assigned to the address space. This user identifier does not have to be the same as the user identifier for JES2, but you can avoid unnecessary complexity by using the same one. The user ID is specified either by adding an entry in the started procedures table (ICHRIN03) or by creating a profile in the STARTED class that matches address space name. If you prefer, both the started procedures table and STARTED class profile can be used. This action ensures that the correct user ID is assigned to the address space.

The following address spaces existed in prior releases, but are now started automatically in z/OS V2R3 during the IPL process:

HZR
Runtime Diagnostics address space
IZUANG1
IBM z/OS Management Facility (z/OSMF) angel process
IZUSVR1
IBM z/OS Management Facility (z/OSMF) server process

More information about the Runtime Diagnostics address space is provided in the workflow step called "Remove commands or logic that start or restart Runtime Diagnostics."

More information about the z/OSMF address spaces is provided in the workflow step called "Prepare for z/OSMF autostart."

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

  • z/OS Container Extensions (zCX)
  • JES2

When change was introduced:

  • z/OS V2R4 for the following:
    • ZCX
  • z/OS V2R3 for the following:
    • jesx EDS

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended to ensure that your MAXUSER value in parmlib member IEASYSxx is adequate.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If necessary, increase your MAXUSER value in parmlib member IEASYSxx to accommodate the new address spaces. One way to determine how many address spaces you use is to enter the DISPLAY A,L command. Then, add the number of address spaces in the output messages IEE114I and IEE115I on the old and new systems to determine the total number. As of z/OS V2R3, these messages are replaced by messages CNZ4015I and CNZ4016I, respectively.

Note:
  • A modest over-specification of MAXUSER should not affect system performance.
  • The number of total address spaces is the sum of M/S, TS USERS, SYSAS, and INITS.
  • If you change the MAXUSER value, you must re-IPL to make the change effective.
Reference information

For more information about the MAXUSER parameter, see z/OS MVS Initialization and Tuning Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.1.3 : Upgrade actions for everyone after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2 : Hardware upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes hardware upgrade actions. The information in this topic is not specifically related to upgrading to z/OSV2R4; it applies only if you are changing hardware. Therefore, this topic does not categorize the actions in terms of when they should be performed (before installing, before the first IPL, or after the first IPL).


Step 3.2.1 : Upgrade to an IBM z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Description

With the new IBM® z15™ (z15™) server as the infrastructure, your business has the power to optimize digital services delivery, accelerate business innovation, and ultimately improve the bottom line. The z15 can help you adapt to planned or unplanned events while keeping services and operations running smoothly and continuously, on premises or in the cloud.

The z15 server is one hardware model (T01) and machine type (8561), with five feature codes to represent the processor capacity. The feature codes are Max34, Max71, Max108, Max145, and Max190 with (respectively) 34, 71, 108, 145, and 190 processors. The z15 ™ uses a 19-inch form factor and industry-standardized power and networking hardware. The system is configurable as a one-to-four 19-inch frame system, which easily aligns with the modern cloud data center.

z/OS base support for specific z15 functions depends on the z/OS release. Table 1 lists the z15 functions and indicates whether each function is included in a specific z/OS release (Yes or No), or whether the function requires a PTF (PTF) or a web deliverable (Web). For information about finding the appropriate PTFs, see the workflow step "Actions you can take before you order an IBM z15 server." For more information about z/OS V2R1 support, see the Table Notes.

The following table shows a summary view of which z15 server functions are included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.

Table 1. z15 server functions included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z15 function included in base z/OS support (Y/N)

V2R2 3

V2R3 3

V2R4 3

Base support ¹

PTF

PTF

Yes, and in PTFs

CPU measurement facility

PTF

PTF

PTF

FICON® Express16S+ (CHPID type FC) when using FICON or channel-to-channel (CTC) 1

  • FICON Express16S+ LX
  • FICON Express16S+ SX

PTF

PTF

Yes

New z15 machine instruction (assembly language support) 2

PTF

PTF

PTF

OSA-Express7S 1

  • OSA-Express7S GbE LX (CHPID type OSC or OSD)
  • OSA-Express7S GbE SX (CHPID type OSC or OSD)
  • OSA-Express7S 10 GbE LR (CHPID type OSD)
  • OSA-Express7S 10 GbE SR (CHPID type OSD)
  • OSA-Express7S 25 GbE SR (CHPID type OSD)

PTF

PTF

Yes

OSA-Express7S 1000BASE-T Ethernet 1 (CHPID type OSC or OSD)

PTF

PTF

Yes

CHPID type CS5 for coupling

Yes

Yes

Yes

CHPID type OSE supporting 4 or 2 ports per feature

Yes

Yes

Yes

CFCC Fair Latch Manager

PTF

PTF

PTF

Table Notes:
  1. z/OS V2R1 (compatibility only). Extended support contract for IBM Software Support Services for z/OS is required with PTFs.
  2. z/OS V2R1 with an extended support contract for IBM Software Support Services and PTFs.
  3. To determine the PTFs for base support, use FIXCAT value IBM.Device.Server.z15-8561.RequiredService for the z15, and the fix categories for earlier processors.

The exploitation of specific z15 server functions depends on the z/OS release. The following table lists the z15 functions and indicates whether each function is exploited by a specific z/OS release (Yes or No), or whether the function requires a PTF (PTF) or a web deliverable (Web). For information about finding the appropriate PTFs, see the workflow step "Actions you can take before you order an IBM z15 server." For more information about z/OS V2R1 support, see the Table Notes.

The following table shows a summary view of which z15 server functions can be exploited in z/OS V2R2, z/OS V2R3, and z/OS V2R4.

Table 2. Exploitation of z15 server functions supported by z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z15 function included in base z/OS support (Y/N)

V2R2 ²

V2R3 ²

V2R4²

Processors: The maximum number of processors that can be configured per server.

For the IBM z15:

  • Up to 190 processors configurable as CPs, zIIPs, IFLs, ICFs, or optional SAPs.
  • The sum of CPs and zIIPs configured in a single z/OS LPAR cannot exceed:
    • 190 on z/OS V2R1 or later in non-SMT mode
    • 128 on z/OS V2R1 or later in SMT mode.

Yes

Yes

Yes

Two-way simultaneous multithreading (SMT) for zIIPs, IFLs, ICFs, or SAPs.

Yes

Yes

Yes

Channel subsystems.

The maximum number of channel subsystems (CSS) that can be configured per server.

For the IBM z15:

  • Up to six channel subsystems
  • Four subchannel sets per CSS.

Yes

Yes

Yes

Up to 40 TB of Redundant Array of Independent Memory (RAIM) per server. Up to 4 TB per z/OS LPAR with z/OS V2R1 or later.

Yes

Yes

Yes

2 GB Large Pages

Yes

Yes

Yes

Logical partitions.

The maximum number of logical partitions (LPARs) that can be configured per server. For the z15, up to 85 LPARs can be configured.

Yes

Yes

Yes

Coupling Facility Control Code Level 24 (CFLEVEL 24). 3

Includes support for:

  • CFCC Fair Latch Manager
  • CFCC Message Path Resiliency Enhancement

PTF

PTF

PTF

Coupling Express3 (CX3) LR 3

PTF

PTF

Yes

Support for 384 Coupling CHPIDs, 96 physical ICA SR coupling links, and 64 ICP internal coupling channels 3

Yes

Yes

Yes

Support of High-Performance FICON (zHPF) single-track or multitrack operations (CHPID type FC)

PTF

PTF

PTF

CHPID type OSC supporting TN3270E and non-SNA DFT

Yes

Yes

Yes

CHPID type OSD with exploitation of two ports per CHPID

Yes

Yes

Yes

CHPID type OSD without maximum port exploitation (one port on the PCIe adapter is available for use)

Yes

Yes

Yes

CHPID type OSE supporting 4 or 2 ports per feature

Yes

Yes

Yes

FICON Express16SA (CHPID type FC) when using FICON or channel-to-channel (CTC)¹

PTF

PTF

PTF

FICON Express16SA (CHPID type FC) for support of zHPF single track or multi-track operations 1

PTF

PTF

PTF

Checksum offload for IPV6 packets (CHPID type OSD) 1

Yes

Yes

Yes

Checksum offload for LPAR-to-LPAR traffic for IPv4 and IPV6 packets (CHPID type OSD) 1

Yes

Yes

Yes

Large Send for IPV6 packets (CHPID type OSD) 1

Yes

Yes

Yes

Crypto Express7S Toleration

Yes

Yes

Yes

Crypto Express7S support of VISA Format Preserving Encryption (VFPE)

Web: Enhanced Cryptographic Support for z/OS V2.2 (HCR77B0)

Yes

Yes

Crypto Express7S support of greater than 16 Domains

Web: Cryptographic Support for V2R2 - V2R4 (HCR77D1) with PTFs

Web: Cryptographic Support for V2R2 - V2R4 (HCR77D1) with PTFs

Web: Cryptographic Support for V2R2 - V2R4 (HCR77D1) with PTFs

Crypto Express6S Exploitation

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

Crypto Express7S support of PCI-HSM compliance

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1)

10 GbE RoCE Express2.1 for Shared Memory Communications-Remote Direct Memory Access (SMC-R)

PTF

PTF

Yes

25 GbE RoCE Express2.1 for Shared Memory Communications - Remote Direct Memory Access (SMC-R)

PTF

PTF

Yes

IBM Integrated Coupling Adapter (ICA SR1.1) (CHPID type CS5) 3

Yes

Yes

Yes

zHyperLink Express Reads support 3

PTF

PTF

Yes

zHyperLink Express Writes support

PTF

PTF

Yes

IBM Virtual Flash Memory

Yes

Yes

Yes

IBM z/OS XL C/C++ support of the ARCH(13) and TUNE(13) parameters

No

No

Yes

Integrated Accelerator for z Enterprise Data Compression

PTF

PTF

PTF

System Recovery Boost

No

PTF

PTF

IBM Z Data Privacy for Diagnostics

No

PTF

PTF

Quantum Safe Support

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1) and coexistence PTFs for SMF.

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1) and coexistence PTFs for SMF.

Web: Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4 (HCD77D1) and PTFs.

Table Notes:
  1. z/OS V2R1 (compatibility only). Extended support contract for IBM Software Support Services for z/OS is required with PTFs.
  2. To determine the PTFs for base support, use FIXCAT value IBM.Device.Server.z15-8561.RequiredService for the z15, and the fix categories for earlier processors.
  3. z/OS V2R1 with PTFs.

Web deliverables are available from the z/OS downloads page at z/OS downloads.

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Table 3. Information about this upgrade action

Element or feature:

Multiple.

When change was introduced:

IBM z15, which became available in September 2019.

Applies to upgrade from:

z/OS V2R4, z/OS V2R3, and z/OS V2R2.

Timing:

Before you introduce a z15 server into your environment.

Is the upgrade action required?

Yes, if you want to run z/OS V2R4, z/OS V2R3, or z/OS V2R2 on a z15 server, or if you want to run a coupling facility on a z15 server. If you plan to run only a coupling facility on a z15 system, only the sysplex-related actions are relevant. However, you must install the appropriate z/OS service for systems that are running on other servers that use the z15 coupling facilities.

Target system hardware requirements:

  • z/OS V2R4 and z/OS V2R3 require a minimum of 8 GB of memory to IPL. When running as a z/VM guest or on an IBM Z® Personal Development Tool (zPDT), at least 2 GB is required for z/OS V2R4 and z/OS V2R3. If the minimum is not met, a warning WTOR is issued at IPL.
  • A z15 with Hardware Management Console (HMC) Version 2.15.0 plus microcode change levels (MCLs) and the Support Element Version 2.15.0. The IBM Z Hardware Management Appliance feature code 0100 can be ordered to provide HMC/SE functions within the CPC frame, eliminating the need for separate HMCs outside of the frame.
  • Additional hardware required for specific functions:
    • IBM devices that are attached to z14, z14 ZR1, z13, and z13s servers are supported for attachment to z15 channels, unless otherwise noted. The subject I/O devices must meet FICON architecture requirements.
    • IBM Virtual Flash Memory requires FC #0643.
    • 10 GbE RoCE Express2.1 requires FC #0432.
    • 25 GbE RoCE Express2.1 requires FC #0450.
    • New OSA-Express7S adapters require the following feature codes:
      • OSA-Express7S GbE LX requires FC #0442
      • OSA-Express7S GbE SX requires FC #0443
      • OSA-Express7S 10 GbE LR requires FC #0444
      • OSA-Express7S 10 GbE SR requires FC #0445
      • OSA-Express7S 25 GbE SR1.1 requires FC #0449
      • OSA-Express7S 1000BASE-T requires FC #0446.
      Note:

      For storage related requirements for OSA-Express7S 25GbE, refer to the topic about fixed storage considerations for OSA-Express interfaces in QDIO mode in IP Configuration Guide.

    • New FICON Express16SA cards require the following feature codes:
      • FICON Express16SA LX requires FC #0436
      • FICON Express16SA SX requires FC #0437.
    • zHyperLink Express1.1 adapter requires FC #0451.
    • Coupling Express LR requires FC #0433.
    • IBM Integrated Coupling Adapter (ICA SR1.1) requires FC #0176.
    • zHyperLink Express1.1 requires FC #0451.
    • If you plan to enable the temporary activation of additional physical zIIP processors to be used with System Recovery Boost, you require the Boost Authorization feature (FC #9930) and the Sys Recovery Boost Record feature (FC ##6802).
    • Crypto Express7S adapter: Crypto Express7S (2 port) requires FC #0898; Crypto Express7S (1 port) requires FC #0899.
    • Use of hardware acceleration for cryptographic operations, including the use of Visa, Inc. Data Secure Platform (DSP) functions requires CP Assist for Cryptographic Function (CPACF) (#3863) or a supported cryptographic feature, such as Crypto Express7S, or both. See Table Note 1.
    • Use of a new Trusted Key Entry (TKE) workstation requires TKE Rack Mount w/4768 (FC #0087) or TKE w/4768 (FC #0086). The TKE workstation is a combination of hardware and software, with other features required, depending on which functions you plan to use. Different feature codes are required if you are upgrading an existing TKE workstation from an earlier server.

      Trusted Key Entry (TKE) 9.2 License Internal Code (FC ##0881) is required if you plan to use the TKE to manage a Crypto Express7S. For example, TKE 9.2 is required to:

      • Manage any Crypto Express feature that is running in IBM Enterprise PKCS #11 (EP11) mode.
      • Manage Common Cryptographic Architecture (CCA) mode PCI-HSM settings that are available on the Crypto Express7S.

      CCA in PCI-HSM mode and EP11 also require a smart card reader (FC #0885 or #0891), plus FIPS certified smart cards (FC #0892).

Target system software requirements:

For more information, see the step "Support is delivered by service, z/OS features, and web deliverables" under "General recommendations and considerations for a z15 server." You will install the required service updates on your system when you perform the step "Install the necessary z/OS service" under "Actions you can take before you order an IBM z15 server."

Other system (coexistence or fallback) requirements:

  • The suggested practice is to install and run the required service on your existing server. This action enables you to fall back from a hardware perspective, yet maintain your software level.
  • If you have not installed the preconditioning and exploitation PTFs for CFLEVEL 17-23, note that those PTFs are required to be installed throughout your sysplex before implementing CFLEVEL 24. Use the appropriate fix category. For the IBM z15, use FIXCAT value IBM.Device.Server.z15-8561.RequiredService.
  • If you are using ICSF and plan to share keys with other z/OS systems that have an earlier level of ICSF, install the ICSF coexistence PTFs on those earlier levels of ICSF. For ICSF coexistence PTFs, see "Step 4.5. Determine the level of cryptographic support you require on a z15 server" for the appropriate SMP/E fix category values to use.

Restrictions:

See the steps under "Restrictions for a z15 server."

System impacts:

None.

Related IBM Health Checker for z/OS check:

Use health check IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL, which issues a warning for a system that is configured with less than 8 GB of real memory.


Table Note:
  1. IBM Z® cryptography features include VISA Format Preserving Encryption (VFPE) technology, which forms part of the Visa, Inc. Data Secure Platform (DSP). The use of VFPE technology requires a service agreement with Visa, Inc. For details, contact your Visa account manager or Visa at P2PE@visa.com. Clients who use IBM Z® cryptography features, but do not make use of the FPE functionality, are not required to enter into any such agreement with Visa.

Steps to take

Continue your upgrade to the z15 by performing the following steps in this workflow. Each step contains a number of sub-steps for you to perform.

  • "General recommendations and considerations for a z15 server"
  • "Restrictions for a z15 server"
  • "Actions you can take before you order an IBM z15 server"
  • "Actions you can take after installing an IBM z15 server"
  • "Accommodate functions for the z15 to be discontinued on future servers"

Reference information

For more information about new functions to exploit, see the IBM z15 Library, which is available online in Resource Link™.


Step 3.2.1.1 : General recommendations and considerations for a z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

As you plan your upgrade to an IBM z15™ server, observe the recommendations and considerations in the steps that follow.


Step 3.2.1.1.1 : Migration actions for IBM servers are cumulative


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you upgrade to a z15™ server from a z14™ or z14 ZR1 server, and have performed the upgrade actions that are associated with the z14 or z14 ZR1, you have fewer upgrade actions than if you upgrade from an earlier generation server. Thus, if you upgrade from an earlier generation server, you might need to perform more upgrade actions. For example, if you are upgrading from a z13 and z13s server, you should perform the "z14 Upgrade Workflow" or the "Upgrade to an IBM z14 server" steps in the "z/OS V2R4 Upgrade Workflow".

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.1.2 : Support is delivered by service, z/OS features, and web deliverables


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The base support for the z15™ is delivered through service (PTFs). To determine which PTFs are required, get the current enhanced HOLDDATA file, either by using the SMP/E RECEIVE ORDER command or by downloading the 2-year file and using the SMP/E RECEIVE command to process it. Then, use the SMP/E REPORT MISSINGFIX report to identify the missing PTFs, if any. For example:

SET BDY(GLOBAL). REPORT MISSINGFIX ZONES( target zone) FIXCAT(IBM.Device.Server.*.RequiredService).

If you want more granular reports for REPORT MISSINGFIX, you can use the individual fix categories for each server, plus the fix categories for any intermediate services. For the z15 server, the FIXCAT for z15 required service is: IBM.Device.Server.z15-8561.RequiredService.

Though it is more time-consuming and error-prone than using REPORT MISSINGFIX with the appropriate fix categories, you can use the Preventive Service Planning (PSP) bucket to obtain the list of required PTFs for the z15 server. PSP buckets are identified by an Upgrade name and one or more Subset names. For the IBM z15, the PSP Upgrade name is 8561DEVICE, and the z/OS support can be found in Subset 8561/ZOS.

Exploitation of some functions requires a web deliverable. Specifically:

  • Exploitation of Crypto Express7S requires the Cryptographic Support for z/OS V2R2 - z/OS V2R4 (FMID HCR77D1) web deliverable.

    If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the following fix category: IBM.Coexistence.ICSF.z/OS_V2R2-V2R4-HCR77D1

  • If you are running z/OS V2R1 and require Crypto Express6S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V2R1-z/OS V2R3 web deliverable (FMID HCR77C0) or the Cryptographic Support for z/OS V2R1 - z/OS V2R3 web deliverable (HCR77C1).

    If you are using either of these web deliverables (HCR77C0 or HCR77C1) and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the appropriate fix category: IBM.Coexistence.ICSF.z/OS_V2R1-z/OS_V2R3-HCR77C0 or IBM.Coexistence.ICSF.z/OS_V2R1-z/OS_V2R3-HCR77C1.

  • If you are running z/OS V2R1 and require Crypto Express5S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or the Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (HCR77B1).

    If you are using either of these web deliverables (HCR77B0 or HCR77B1) and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the appropriate fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B0 or IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B1.

  • To run z/OS V2R1 on a z15™ server, you require IBM Software Support Services for extended z/OS V2R1 support.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.1.3 : Larger coupling facility structure sizes might be necessary


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

When you change the coupling facility control code level (CFLEVEL), your coupling facility structure sizes might change.

If, as part of your upgrade to a z15™ server, you change the CFLEVEL, you might have larger structure sizes than you did previously. If your CFLEVEL is identical, structure sizes are not expected to change when you upgrade from a previous server to a newer generation server.

In addition, similar to CFLEVEL 17 and later, ensure that the CF LPAR has at least 512MB of storage. CFLEVEL 24, introduced on the z15, supports the Coupling Facility use of Large Memory to improve availability for larger CF cache structures and data sharing performance with larger DB2 Group Buffer Pools (GBP). This support removes inhibitors to using large CF cache structures, enabling use of Large Memory to scale to larger DB2 Local Buffer Pools (LBP) and Group Buffer Pools (GBP) in data sharing environments.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.1.4 : Use the same software level throughout a sysplex


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Having members of a sysplex at the same software level (other than during brief upgrade periods) is good software management policy.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.1.5 : Migrate hardware and software at different times


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To minimize the amount of change that you experience at one time, do not upgrade your software release level at the same time that you upgrade your hardware.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.1.6 : Use the latest version of SCRT


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, you do not need to update SCRT because it is included in the z/OS base. If you are running an earlier release of z/OS, and you use SCRT, make sure that SCRT is at the latest level. This is a requirement for sub-capacity pricing.

The latest level of SCRT for releases prior to z/OS V2R3 can be downloaded from the SCRT web site at IBM Z software pricing - Licensing - Sub-capacity licensing.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2 : Restrictions for a z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

For a description of each restriction, perform the steps that follow.


Step 3.2.1.2.1 : Functional limitations


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Not all z15™ functions are available in every z/OS release.

In the step "Upgrade to an IBM z15 server," see the following:

  • Table 1 shows a summary view of which z15 server functions are included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.
  • Table 2 shows a summary view of which z15 functions are available for exploitation in each z/OS release.

Some functions have upgrade or exploitation considerations. In this workflow, see the steps "Actions you can take before you order an IBM z15 server" and "Actions you can take after installing an IBM z15 server" for the applicable upgrade actions.

Many functions are enabled or disabled, based on the presence or absence of the required hardware and software. If you plan to use new z15 functions, you can install the software and hardware in either order. That is, there is no requirement to install either software or hardware first to use a specific function. However, because of outage windows and testing considerations, you might want to consider installing all the software and PTFs required for the machine and the functions you plan to use first. Then, upgrade the hardware and, finally, update your customization to use the new functions.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2.2 : z15 servers in a sysplex


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Be aware of the following considerations:

  • A Parallel Sysplex® that contains a z15™ server either for a z/OS image or a coupling facility (CF) image can contain only other z15 servers, or z14, z14 ZR1, z13, or z13s servers.
  • The z15 requires ICA-SR and CE-LR fanouts. The older HCA3-O or the HCA3-O LR coupling fanouts are not supported on the z15 server.
  • Systems such as the z14, z14 ZR1, z13, or z13s can connect to the z15 by using the Integrated Coupling Adapter Short Reach (ICA SR) and the Coupling Express Long Reach (CE LR) coupling links. Earlier systems, such as the zEC12 and zBC12, do not support ICA SR or CE LR, and therefore cannot have coupling link connectivity to the z15 server.
  • If you are running z/OS on any servers earlier than a z13 or z13s, you cannot add a z15 to that sysplex; that is, you will not be able to perform rolling IPLs to introduce a z15 server if you have any of the earlier servers as z/OS images or coupling facility images in the sysplex.
  • The earlier servers in the sysplex must be upgraded to z13 or z13s or later to have z15™ servers supported in the sysplex. If you have any z/OS images or coupling facility images on an earlier server, and you intend to introduce a z15 server into that sysplex, you must move those images to a z13 or z13s or later server before introducing the z15 server.
  • GRS supports the use of FICON CTCs for Ring configurations. However, if you are currently using ESCON CTCs for GRS ring configurations within a sysplex, consider converting to GRS Star if possible, or using XCF signaling in a GRS ring configuration. XCF sysplex signaling is preferred instead of GRS CTC connections.
  • IBM Z® servers that require time synchronization (for example, to support a base or Parallel Sysplex) must be configured in Server Time Protocol (STP) mode. STP is designed to allow multiple servers and coupling facilities to maintain time synchronization with each other, in a coordinated timing network (CTN). STP is a hardware feature of the z15, z14, z14 ZR1, z13, z13s, zEC12, and zBC12. The most recent servers (z15, z14, z14 ZR1, z13, and z13s) can participate only in an STP-only CTN.
  • Starting with IBM z15, the IBM Z Hardware Management Appliance (FC #0100) can be ordered to provide HMC/SE functions within the CPC frame, eliminating the need for separate HMCs outside of the frame.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2.3 : HCD and HCM support for the z15


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As with previous servers, hardware can be defined on any supported OS version and server. However, dynamic activation of new server and new adapter types can be done only on z15™ and future high-end IBM Z® servers. Dynamic activation is supported on z/OS V2R1 and later releases.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2.4 : Plan for discontinued functions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For a list of functions on the z15™ that are planned to be discontinued on future servers, see the step "Accommodate functions for the z15 to be discontinued on future servers" in this workflow.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2.5 : Unsupported hardware features


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The following hardware features are not supported on the z15™ server. They cannot be ordered on the z15 and cannot be carried forward from an upgrade on an earlier server to the z15.

  • Host Channel Adapter (HCA) for InfiniBand is no longer supported, including the following features:
    • HCA2-O and HCA2-O LR features
    • HCA3-O and HCA3-O LR features

    Enterprises must upgrade from HCA channels to one of the following coupling links:

    • For high-speed short-range coupling connectivity, the IBM Integrated Coupling Adapter (ICA SR) is a two-port, short-distance coupling fanout that uses a new coupling channel type: CS5. The ICA SR can only be used for coupling connectivity between z15, z14, z14 ZR1, z13, and z13s servers. The ICA SR fanout requires new cabling, and can connect only to another ICA SR.
    • For long-range coupling connectivity, the Coupling Express® Long Reach (CE LR) is a two-port, long-distance coupling adapter that uses a new coupling channel type: CL5. The CE LR can be used only for coupling connectivity between z15, z14, z14 ZR1, z13, and z13s servers.

    The suggested practice is to order ICA SR (#0172) or CE LR (#0433) on the z15™ servers that are used in a Parallel Sysplex to help ensure coupling compatibility with future server generations.

  • CHPID type OSN (OSA-Express for NCP) is not supported on the OSA-Express5S GbE LX feature
  • OSA-Express4S features
  • Crypto Express3 and Crypto Express4S
  • InterSystem Channel-3 (ISC-3) coupling links feature
  • FICON Express4
  • zEDC Express (FC #0420). In the z15, the compression functions are moved into the processor chip, which is referred to as IBM Integrated Accelerator for z Enterprise Data Compression (zEDC). As an integrated part of the z15™ processor chip, the Integrated Accelerator for zEDC does not require the purchase of a hardware feature or usage of I/O slots.
  • IBM Flash Express (features #0402 and #0403), which is replaced by IBM Virtual Flash Memory (VFM), starting with the z14. VFM implements Extended Asynchronous Data Mover (EADM) Architecture that uses HSA-like memory instead of Flash card pairs. No application changes are required to change from IBM Flash Express to VFM.
  • As of HMC version 2.15.0, new builds of the Hardware Master Console (HMC) and the Support Element (SE) no longer include a CD/DVD drive as part the HMC server hardware. Instead, the HMC provides two options for installing functional updates: USB media and electronic delivery. These solutions are available for:
    • Firmware for the HMC or Support Element
    • eBusiness on Demand (eBoD) records, such as On/Off Capacity on Demand (On/Off CoD)
    • Operating system code, as used for Load from Removable Media or the Server task.

    If you select to use USB media, the appropriate USB Flash Memory Drive Media is provided with the particular feature, using either of the following feature codes:

    • Feature code 0843: USB Load media that can be used for IBM Z operating system code
    • Feature code 0848: USB Backup media that can be used for an HMC or SE Critical Data Backup task.

    If USB media is not acceptable for your environment, choose electronic delivery instead. Order feature code 0846 (No Physical Media Option) and follow the instructions on how to electronically deliver the required content over the network by using any of the following options:

    • Z Remote Support Facility (zRSF)
    • IBM Resource Link
    • FTP/SFTP/FTPS Server connections from the HMC.

    For an electronic only delivery environment, two HMCs are required on every unique network subnet on which an HMC, SE, or TKE workstation is connected.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.2.6 : Carry forward hardware features


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The following hardware features are not orderable on z15™ servers. If they are installed on your existing server at the time of an upgrade to a z15 server, they can be retained or carried forward.

  • TKE with/4768 #0080 or #0081
  • TKE workstation #0085 and #0086
  • HMC #0082, #0083, #0095, #0096
  • HMC Rack KMM #0154
  • TKE Rack Keyboard/Monitor/Mouse #0156
  • Internal Coupling Adapter Short Reach (ICA SR) #0172
  • Fanout Airflow PCIe #0174
  • FICON Express8S 10KM LX #0409
  • FICON Express8S SX #0410
  • 10 GbE RoCE Express #0411
  • 10 GbE RoCE Express #0412
  • OSA-Express5S GbE LX #0413
  • OSA-Express5S GbE SX #0414
  • OSA-Express5S 10 GbE LR #0415
  • OSA-Express5S 10 GbE SR #0416
  • OSA-Express5S 1000BASE-T #0417
  • FICON Express16S LX #0418
  • FICON Express16S SX #0419
  • OSA-Express6S GbE LX #0422
  • OSA-Express6S GbE SX #0423
  • OSA-Express6S 10 GbE LR #0424
  • OSA-Express6S 10 GbE SR #0425
  • OSA-Express6S 1000BASE-T #0426
  • FICON Express16S+ LX #0427
  • FICON Express16S+ SX #0428
  • OSA-Express7S 25 GbE SR #0429
  • 25 GbE RoCE Express2 #0430
  • zHyperLink Express #0431
  • Coupling Express LR #0433
  • Addl smart cards #0884
  • TKE Smart Card Reader #0885
  • Crypto Express5S #0890
  • TKE Smart Card Reader #0891
  • NXP Smart Card w/FIPS #0892
  • Crypto Express6S #0893
  • 512 GB MEM DIMM(5/FEAT) #1631.

For information about supported storage controllers, see the step "Ensure that you are using supported servers, storage controllers, and machine facilities" in the z/OS V2R4 Upgrade Workflow.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3 : Actions you can take before you order an IBM z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

These are the upgrade actions that you perform on your current system, either because they require the current system or because they are possible on the current system. You do not need the z15™ server to make these changes, and the changes do not require the z15™ server once they are made. For example, discontinuing use of hardware that is no longer supported.


Step 3.2.1.3.1 : Review the Large Systems Performance Reference (LSPR)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

LSPR is designed to provide comprehensive z/Architecture® processor capacity ratios for different configurations of central processors (CPs) across a wide variety of system control programs and workload environments.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.2 : Review the sysplex configuration in which the z15 server will participate


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For the limitations to observe when you are using the z15™ server with earlier servers in a Parallel Sysplex, see the step "Restrictions for a z15 server" (and its substeps) in this workflow.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.3 : Implement an STP timing network


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

You must use an STP timing network. This action is needed because Sysplex Timers (9037-002) are not supported on z15™ servers.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.4 : Upgrade from unsupported hardware features to newer technology


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

This action is needed because specific features are not available on the z15™ server. For example, OSA-Express4 is not supported on the z15.

In this workflow, see the following step:

  • "Restrictions for a z15 server"

In the z/OS V2R4 Upgrade Workflow, see the following steps:

  • "Replace unsupported devices"
  • "Provide for new device installations"

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.5 : Determine the level of cryptographic support you require on a z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The level of function that is provided for cryptographic support differs by z/OS release and the installed ICSF web deliverable. Also, toleration PTFs are available for some cryptographic web deliverables

For z/OS V2R4, consider the following:

  • If you are using the level of ICSF that is shipped as part of z/OS V2R4 (FMID HCR77D0), you can use most functions of the Crypto Express7S feature on a z15™ server.
  • ICSF Web Deliverable HCR77D1 - Cryptographic Support for z/OS V2R2 – z/OS V2R4 (FMID HCR77D1) provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R4. This web deliverable includes support for:
    • Crypto Express7S adapter
    • Ability to use CP Assist for Cryptographic Functions (CPACF) for certain clear key ECC operations
    • CCA Release 5.5 and CCA Release 6.3
    • Coupling Facility Level (CFLEVEL) 24
    • Integrated Accelerator for z Enterprise Data Compression
    • System Recovery Boost
    • IBM Data Privacy Passports
    • IBM Data Privacy for Diagnostics.

    If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs that are identified by SMP/E fix category IBM.Coexistence.ICSF.z/OS_V2R2-V2R4-HCR77D1.

  • If you require support for more than 16 domains on Crypto Express7S, you must install the PTFs that are identified by the SMP/E fix category for the z15™ server: IBM.Device.Server.z15-8561.Exploitation.

For z/OS V2R3, consider the following:

  • If you are using the level of ICSF that is shipped as part of z/OS V2R3 (FMID HCR77C0), you can use most functions of the Crypto Express6S feature on a z15™ server.
  • ICSF Web Deliverable HCR77D1 - Cryptographic Support for z/OS V2R2 – z/OS V2R4 (FMID HCR77D1) provides additional function and enhancements. If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs that are identified by SMP/E fix category IBM.Coexistence.ICSF.z/OS_V2R2-V2R4-HCR77D1.
  • ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 - z/OS V2R3 provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R3. The web deliverable includes support for a PCI HSM (“ Payment Card Industry Hardware Security Module”) configured CCA coprocessor. Crypto Express6S also introduces the use of X.509 certificates in CCA. If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs that are identified by SMP/E fix category IBM.Coexistence.ICSF.z/OS_V2R1-V2R3-HCR77C1

For z/OS V2R2, consider the following:

  • If you are using the level of ICSF that is shipped as part of z/OS V2R2 (FMID HCR77B0), you can use most functions of the Crypto Express6S feature on a z15™ server.
  • ICSF Web Deliverable HCR77D1 - Cryptographic Support for z/OS V2R2 – z/OS V2R4 (FMID HCR77D1) provides additional function and enhancements. If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs that are identified by SMP/E fix category IBM.Coexistence.ICSF.z/OS_V2R2-V2R4-HCR77D1.
  • ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 – z/OS V2R3 provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R2. The web deliverable includes support for a PCI HSM (“ Payment Card Industry Hardware Security Module”) configured CCA coprocessor. Crypto Express6S also introduces the use of X.509 certificates in CCA.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.6 : Ensure that enough real memory is installed


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For z/OS V2R4 with the IBM z15 (z15) server, a minimum of 8 GB of real memory is required to IPL. When running as a z/VM guest or on an IBM Z® Personal Development Tool (zPDT), a minimum of 2 GB is required for z/OS V2R4.

If you attempt to IPL z/OS V2R4 on a z15 with less than the minimum amount of real memory, z/OS issues the following warning message (a WTOR) during IPL:

IAR057D LESS THAN 8 GB OF REAL STORAGE IMPACTS SYSTEM AVAILABILITY - ADD STORAGE OR REPLY C TO CONTINUE

Continuing with less than the minimum amount of real memory might impact the availability of your system. If you attempt to IPL z/OS V2R4 on an earlier IBM server, no warning message is issued.

To help you with upgrading from z/OS V2R2, IBM provides a new health check, IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL, which issues a warning for a system that is configured with less than 8 GB of real memory.

Steps to take

For a z/OS V2R4 system that you plan to run on a z15 server, follow these steps:

  • For a system that is running as a z/VM guest, ensure that the server has a minimum of 2 GB of real memory.
  • For a system that is running on IBM Z® Personal Development Tool (zPDT), ensure that the server has a minimum of 2 GB of real memory.
  • Otherwise, ensure that the LPAR has a minimum of 8 GB of real memory.
Reference information

For more information about the minimum real memory requirement, see z/OS Planning for Installation.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This check is available on the following releases: z/OS V2R2 and z/OS V2R3.

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 3.2.1.3.7 : Install the necessary z/OS service


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM recommends that you use the SMP/E REPORT MISSINGFIX command to identify PTFs for the z15™ server that you do not already have installed. The simplest way to do that is to specify IBM.Device.Server.* and IBM.Function.* as the fix categories for the REPORT MISSINGFIX command. Doing so identifies not only z15™ support PTFs, but also the PTFs for prior generations of IBM servers that you might need, and those required to enable various functions. Also, REPORT MISSINGFIX creates a batch job for the SMP/E RECEIVE ORDER command that you can use to get any PTFs you do not already have. SMP/E also provides an Explorer function that you can use to find new fix categories that might be of interest. For a description of all the fix categories, see the Values and Descriptions page at IBM Fix Category Values and Descriptions. For more information about the REPORT MISSINGFIX command, see z/OS SMP/E Commands.

Here is an example of the SMP/E control statements you can use for REPORT MISSINGFIX:

SET BDY(GLOBAL). REPORT MISSINGFIX ZONES( target zone) FIXCAT(IBM.Device.Server.**, IBM.Function.*)

If you want to use specific fix categories, you can specify the following fix categories either individually or together for the z/OS PTFs that are required to use a z15™ server, exploit its functions and features, and those that IBM recommends that you install if you are using a z15™ server. Also needed are the fix categories for intermediate servers.

  • For the IBM z15:
    • IBM.Device.Server.z15-8561.RequiredService
    • IBM.Device.Server.z15-8561.Exploitation
    • IBM.Device.Server.z15-8561.RecommendedService

If you are exploiting z15™ capabilities by installing a web deliverable, more PTFs might be required. Follow the instructions in the Program Directory that is associated with each web deliverable to identify the required PTFs.

If you choose not to use SMP/E FIXCAT IBM.Device.Server.z15-8561.RecommendedService, another way to find the recommended list of PTFs is to use the Preventive Service Planning (PSP) “buckets” for the applicable hardware and software. However, note that using PSP buckets and checking the status of the PTFs listed in them is more time-consuming and potentially error-prone than using REPORT MISSINGFIX with the appropriate fix category. For the IBM z15, the PSP Upgrade name is 8561DEVICE, and the z/OS support can be found in Subset 8561/ZOS.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.8 : Run the CFSIZER tool


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you are moving your coupling facilities, and the coupling facility structures are on a higher CFLEVEL than they were previously, run the Coupling Facility Structure Sizer (CFSIZER) tool to find out whether you must increase coupling facility structure sizes. Prepare to make the necessary changes to the CFLEVEL as indicated by the tool.

You can download the CFSIZER tool at: Coupling Facility sizer.

Also, see the following step in the z/OS V2R4 Upgrade Workflow:

  • "Update your CFRM policy with coupling facility structure size changes"

Note: After you make a coupling facility available on the new hardware, you can run the Sizer utility, which is an authorized z/OS program that you can use to evaluate structure size changes. The Sizer utility is distinct from CFSizer, and should be run after the new hardware (CFLEVEL) is installed, but before any CF LPAR on the new hardware is populated with structures. You can download the Sizer utility at CFSizer Alternate Sizing Techniques.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.9 : Prepare for the new machine instruction mnemonics


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The instruction set has been expanded on the z15™ server, as is usual for new servers. Each machine instruction is represented by a mnemonic in Assembler language. It is possible that the new mnemonics can match names that you chose for Assembler macro instructions. If such naming collisions occur, the Assembler default opcode table (UNI) processes new mnemonics as instructions, not as macros, after z15™ required service is installed. If this occurs, it is likely to cause Assembler error messages and can cause incorrect object code to be generated. If you write programs in Assembler Language, compare the names of your existing Assembler macro instructions to the new machine instructions, to identify any such conflicts or collisions that would occur. The Assembler macro instructions are documented in z/Architecture Principles of Operation. For information about a tool to help in identifying mnemonic conflicts, see the IBM Techdocs web site under Presentations and Tools. Search for the Techdoc PRS5289.

If a conflict is identified, take one of these actions:

  • Change the name of your macro instruction.
  • Specify PARM='...OPTABLE(YOP)...' (or some other earlier opcode table).
  • Specify a separate ASMAOPT file containing assembler options such as in the previous method (this method requires no changes to source code or JCL).
  • Add as the first statement of your source program: *PROCESS OPTABLE(YOP) (or some other earlier opcode table).
  • Specify the PROFILE option either in JCL or the ASMAOPT file, and the specified or default member of the SYSLIB data set is copied into the front of the source program.
  • If you must use both a new instruction and a macro with the same name in an assembly, use a coding technique that allows the use of a new instruction and a macro with the same name in an assembly, such as HLASM mnemonic tags ( :MAC:ASM).

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.10 : Learn about the HiperDispatch enhancement


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In HiperDispatch processing, changes in LPAR weight can cause I/O enabled vertical-high (Vh) and vertical-medium (Vm) processors to be converted to vertical-low (Vl) processors, and immediately parked by HiperDispatch. That is, the Vh and Vm processors can be pushed to the lowest configured online processors.

Starting with z/OS V2R4, the system resources manager (SRM) component of z/OS reverses the search direction that is used to find processors for I/O enablement. SRM enables processors for I/O interrupts from the lowest configured CPU ID to the highest configured CPU ID. This enhancement keeps Vh or Vm processors enabled for I/O interrupts after processor topology changes.

The HiperDispatch enhancement is included in the z/OS V2R4 base. It can be added to z/OS V2R2 and z/OS V2R3 by installing the PTF for APAR OA55935. It is identified by SMP/E fix category IBM.Device.Server.z15-8561.Exploitation.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.11 : Learn about the z/OS SLIP enhancements


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The z/OS SLIP command is enhanced to monitor an address or range of addresses for a key change and in response take a memory dump or set a trace. This behavior is supported in z/OS V2R4 running on the z15. No toleration support is required on earlier releases.

To enable the SLIP function, enter the SLIP command with new options, as follows:

SLIP SET[,options],END

To disable the SLIP function, enter the SLIP command with new options, as follows:

SLIP DEL[,options]

For more information, see SLIP command in z/OS MVS System Commands.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.12 : Accommodate the changes to default ARCH and TUNE level


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The z15™ supports the new levels ARCH(13) and TUNE(13), which are needed to take advantage of most of the enhanced vector instructions available on the z15™ in z/Architecture mode. ARCH(13) produces code that uses instructions that are available on the z15, such as the following:

  • Vector Enhancement Facility 2
  • Miscellaneous-Instruction-Extension Facility 3
  • Aligned Vector Load/Store Hint instructions
  • Limited exploitation of Vector Packed Decimal Enhancement Facility.

Application developers can recompile their applications with the ARCH 13 compiler option to instruct the compiler to generate code that uses the instructions available on the z15. This action can bring performance improvements for applications without requiring any changes to source code.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.13 : Upgrade actions for IBM Integrated Accelerator for z Enterprise Data Compression (zEDC)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In the z15, the compression functions are moved into the processor chip, which is referred to as IBM Integrated Accelerator for z Enterprise Data Compression (zEDC). IBM Integrated Accelerator for zEDC replaces zEDC Express (FC #0420). IBM Integrated Accelerator for zEDC uses industry standard compression formats for file compression that can enable reduction in the size of data, which can save storage space and increase data transfer rates. The z/OS APIs, both authorized and zlib, transparently enable all existing software exploitation on z15, which was already enabled on z14 and earlier with zEDC Express. Support is available on z/OS V2R1, z/OS V2R2, z/OS V2R3, and z/OS V2R4 when running on z15.

No toleration support is required.

Data that is compressed with zEDC Express can be decompressed with IBM Integrated Accelerator for zEDC. The software inflate routine is updated to be RFC-compliant. This change allows for fallback so that IBM Integrated Accelerator for zEDC compressed data can be decompressed on z14 and earlier servers.

As with zEDC Express, IBM Integrated Accelerator for zEDC compression supports two types of processing:

  • Synchronous processing in problem state, which is requested through the zlib data compression library services
  • Asynchronous processing in authorized state, which is requested through the IBM Z authorized compression services.

As was done previously for zEDC, parmlib member IFAPRDxx is used to enable compression. However, with IBM Integrated Accelerator for zEDC compression on the z15, you use IFAPRDxx only for enabling asynchronous processing. It is not required for zlib-based (problem state) uses.

The following example shows a typical IFAPRDxx entry for IBM Integrated Accelerator for zEDC compression, which uses the same format as the zEDC Express. If your IFAPRDxx member already contains this entry, you can retain it on the z15.

PRODUCT OWNER('IBM CORP') NAME('Z/OS') FEATURENAME('ZEDC') ID(5650-ZOS) VERSION(*) RELEASE(*) MOD(*) STATE(ENABLED)

Before upgrading to the z15, you must install z/OS zlib PTFs for this support, which are identified by SMP/E fix category IBM.Device.Server.z15-8561.RequiredService. Also, you must apply the PTF for APAR OA56143. Then, relink your applications with the updated zlib data compression library. If the PTFs are not installed, z/OS attempts to find a zEDC device, which is not supported on the z15. If so, no compression or decompression can occur.

The IBM Z Batch Network Analyzer (zBNA) tool is updated to provide usage estimation for IBM Integrated Accelerator for zEDC compression.

In the future, after you have upgraded all servers to the z15™ level (including servers that are used for disaster recovery), and you have installed the related PTFs on all of your z/OS systems, you might have the following clean-up actions to perform:

  • In parmlib member IQPPRMxx, the MAXSEGMENTS option is obsolete and therefore ignored. Also, the defaults for DEFMINREQSIZE and INFMINREQSIZE are changed and those values can no longer be updated through parmlib. You can remove these settings from your IQPPRMxx parmlib member.
  • Applications that use zlib no longer require READ access to SAF resource FPZ.ACCELERATOR.COMPRESSION in the FACILITY CLASS. You can remove these application authorizations from your external security manager, such as RACF

Reference information

For more information, see Integrated Accelerator for zEnterprise Data Compression (zEDC) content solution.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.3.14 : Upgrade the I/O Configuration Program (IOCP) for z15


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

It is possible carry forward an IOCDS from a z13 or z14, if no new functions are required from the z15. However, to use the new I/O hardware that is available only on the z15, you must apply the required PTFs, which are identified by SMP/E fix category IBM.Device.Server.z15-8561.RequiredService. Also, you must apply the PTF for APAR OA56761.

Note that the z15™ I/O hardware includes:

  • Increased coupling CHPIDs per CEC from 256 to 384
  • Support for increased ICA-SR to 96 and ICP to 64.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4 : Actions you can take after installing an IBM z15 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

These are upgrade actions that you perform only after you have installed the z15™ server. You need a running z15™ server to perform these actions.

For information about PTFs, see the table notes in the the workflow step called "Upgrade to an IBM z15 server."


Step 3.2.1.4.1 : FICON Express16SA


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

FICON Express16SA supports a link data rate of 16 gigabits per second (Gbps) and auto-negotiation to 8 Gbps for synergy with current generation switches, directors, and storage devices. With support for native FICON, High Performance FICON for z Systems (zHPF), and Fibre Channel Protocol (FCP), the IBM z15™ server is designed to help you to prepare for an end-to-end 16 Gbps infrastructure to meet the lower latency and increased bandwidth demands of your applications.

The FICON Express16SA adapter will work with your existing fiber optic cabling environment, both single mode and multimode optical cables.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4.2 : Upgrade to Virtual Flash Memory (VFM)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM Virtual Flash Memory (VFM) is the replacement for the Flash Express features (#0402, #0403) which were available on the IBM zEC12 and IBM z13. No application changes are required to change from IBM Flash Express to VFM.

Ensure that you replace your Flash memory with adequate VFM.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4.3 : Upgrade actions for Hardware Instrumentation Services (HIS)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

New extended and crypto counters and diagnostic samples are added for the z15. If you want to enable them, you must have Hardware Instrumentation Services (HIS) set up on z/OS.

To start or stop collecting extended or crypto counters or diagnostic sampling, enter the command MODIFY HIS.

No toleration support is needed.

If you want to ignore the HIS enhancements, you might need to update your HIS profilers. For more information, see the topic about starting, configuring, and stopping hardware event data collection. in z/OS MVS System Commands.

Note: If you use the CPU Measurement Facility, IBM recommends that your installation collect SMF 113 subtype 1 and 2 records. IBM also recommends that products process SMF 113 subtype 1 records when available because that is where future enhancements are made. If subtype 1 records are not available, products can process subtype 2 records.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4.4 : Learn about System Recovery Boost


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

New for the z15, this enhancement can provide faster operating system IPL, middleware and workload restart and recovery, and planned shutdown. During "boost periods" that apply during operating system shutdown and following a reIPL or restart, the IBM z15™ can make additional processing capacity available to the system in a variety of ways to help accelerate processing, and apply that same boosted capacity to improve workload throughput and response time and elapsed time during the boost. Enhancements in Geographically Dispersed Parallel Sysplex (GDPS) automation are also designed to provide faster, more efficient, and more highly-parallel orchestration of GDPS automated reconfiguration activities, such as activating or deactivating images, IPLing images, and so on.

During a boost period, System Recovery Boost works by providing additional processor capacity and parallelism, using your installation's already-entitled CPUs and zIIPs. System Recovery Boost does this without increasing the four-hour rolling average (4HRA) software billing cost or MSU consumption associated with your workload during this time.

For more information about System Recovery Boost, see the following books:

  • IBM z15 Technical Introduction, SG24-8850
  • IBM Z Capacity on Demand User's Guide, SC28-6985-03

These books are included in the IBM z15 Library, which is available online in Resource Link™.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4.5 : Grant cross-partition authority to the support element


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For Support Elements that run on the z15, the setting for the “Cross Partition Authority” option is replaced by new security settings on the System Details panel and the Customize Image Profiles panel.

For more information, see the workflow step "Enable BCPii communications on the support element."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.4.6 : Learn about IBM Integrated Accelerator for z Enterprise Data Compression (zEDC)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Beginning with the z15, IBM Integrated Accelerator for z Enterprise Data Compression (zEDC) replaces the zEDC Express (FC #0420). As an integrated part of the z15™ processor chip, the Integrated Accelerator for zEDC does not require the purchase of a hardware feature or usage of I/O slots.

No change is required when z/OS is upgraded from a z14 to a z15.

Observe the following differences in processing:

  • RMF changes:
    • On earlier IBM Z servers, you used the RMF PCIE report to monitor the usage of zEDC devices. Starting with the z15, you can now monitor compression activity by referring to the I/O Queuing Activity report and the Extended Asynchronous Data Mover (EADM) device summary instead. RMF EADM reporting (RMF 74.10) is enhanced with asynchronous execution information.
    • On the z15, the RMF PCIE report no longer contains any information about compression.
  • Synchronous mode compression is not recorded; it is treated as an instruction invocation.
  • Asynchronous mode compression is recorded, as follows:
    • SMF30 information is captured
    • In RMF, the EADM device summary provides information about compression.
    • SAP utilization is updated to include time for compression and decompression.

Reference information

For more information, see Integrated Accelerator for zEnterprise Data Compression (zEDC) content solution.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.5 : Accommodate functions for the z15 to be discontinued on future servers


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Note:

IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

The steps in this section involve changes in hardware support that could affect your environment. Make the appropriate changes, as needed.


Step 3.2.1.5.1 : Prepaid On/Off Capacity on Demand tokens will not carry forward


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Beginning with IBM z15™, new prepaid On/Off Capacity on Demand (On/Off CoD) temporary CP resource tokens do not carry forward to future systems. On/Off CoD from IBM allows you to enable and disable hardware engines to meet temporary peak business needs. On the IBM Z platform, this hardware offering has been made available exclusively on supported IBM Z servers. Charges that are related to both hardware and software are tied to the duration of the temporary enablement and the capacity enabled.

Note: IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.5.2 : Prepare for the removal of the internal battery feature


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM z15™ is planned to be the last IBM Z server to offer the Internal Battery Feature (IBF), which is an internal short term uninterruptible power supply (UPS). The IBF is available on z15 T01 servers with the Balanced Power Plan Ahead feature (FC#3003). The IBF is not available on the z15 z15 T02.

As client data centers continue to improve power stability and uninterruptible power supply (UPS) coordination, IBM Z continues to innovate to help clients take advantage of common power efficiency and monitoring across their ecosystems.

Additional support for data center power planning can berequested through your IBM Sales contact.

Note: IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.1.5.3 : Prepare for the removal of support for TLS 1.0 and TLS 1.1 for SE, HMC, and OSC


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM z15™ is planned to be the last IBM Z server to to support the use of the Transport Layer Security protocol versions 1.0 (TLS 1.0) and version 1.1 (TLS 1.1) for establishing secure connections to the Support Element (SE), Hardware Management Console (HMC), and Open Systems Adapter (OSA) Integrated Console Controller (channel path type OSC).

Note: IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 3.2.2 : Upgrade to an IBM z14 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Description

The IBM z14™ (z14™) is designed to be the cornerstone for a trust economy. The z14 provides a scalable, highly available platform that delivers differentiated value to enable business growth, reduce cost, and protect existing investments. z/OS V2R3 enhances the role of the z14 by supporting solutions for a trusted digital economy. Capabilities that are designed to optimize high availability, performance, security, and operational flexibility can help organizations grow and secure their most critical transaction environments.

The IBM z14 family of mainframes includes the following models, which are dual frame configurations: M01, M02, M03, M04, M05. The newest addition to the IBM z14 family, the IBM z14™ Model ZR1 (z14 ZR1), is a single frame configuration. The z14 ZR1 is designed for clients who do not need the capacity of the larger M01-M05 models.

In this document, references to "z14" pertain to all models of the IBM z14, including the z14 Model ZR1, unless otherwise noted.

z/OS base support for specific z14 functions depends on the z/OS release. Table 1 lists the z14 functions and indicates whether each function is included in a specific z/OS release (Yes or No), or whether the function requires a PTF (PTF) or a web deliverable (Web). For information about finding the appropriate PTFs, see the workflow step called "Actions you can take before you order an IBM z14 server." For more information about V1R13 support, see the Table Notes.

Table 1. z14 server functions included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z14 function included in base z/OS support (Y/N)

V2R2 4

V2R3 4

V2R4 4

Base support ¹

PTF

PTF

Yes, and in PTFs

CHPID type CS5 for coupling

Yes

Yes

Yes

CHPID type OSE supporting 4 or 2 ports per feature

Yes

Yes

Yes

CHPID type OSM for intranode management network (INMN)

Yes

Yes

Yes

CPU measurement facility

PTF

Yes

Yes

Crypto Express6S Toleration 2

One of the following:

  • z/OS V2.2 with Cryptographic Support for z/OS V1R13 - z/OS V2R2 (HCR77B1) with PTFs
  • z/OS V2.2 with Cryptographic Support for z/OS V2R1 - z/OS V2R2 (HCR77CO) with PTFs

PTF

Yes

FICON® Express8S (CHPID type FC)

Yes

Yes

Yes

FICON Express16S (CHPID type FC)

Yes

Yes

Yes

FICON Express16S+ (CHPID type FC) when using FICON or channel-to-channel (CTC) 3

  • FICON Express16S+ LX
  • FICON Express16S+ SX

PTF

PTF

Yes

IBM z BladeCenter Extension (zBX) Model 004

Yes

Yes

Yes

IBM z Unified Resource Manager

Yes

Yes

Yes

New z14 machine instruction (assembler support) 3

PTF

PTF

Yes

OSA-Express6S (CHPID type OSD) 3

  • OSA-Express6S GbE LX
  • OSA-Express6S GbE SX
  • OSA-Express6S 10 GbE LR
  • OSA-Express6S 10 GbE SR
  • OSA-Express6S 1000BASE-T

Yes

Yes

Yes

Parallel Sysplex Infiniband (PSIFB) Coupling Link 5

Yes

Yes

Yes

z/OS global resource serialization (GRS) support for FICON CTCs

Yes

Yes

Yes

Table Notes:
  1. z/OS V1R13 (compatibility only). Extended support contract for IBM Software Support Services for z/OS is required with PTFs.
  2. z/OS V1R13 with PTFs, the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 (HCR77B0) Web deliverable installed, and an extended support contract for IBM Software Support Services. The web deliverable is available at z/OS downloads.
  3. z/OS V1R13 with an extended support contract for IBM Software Support Services and PTFs.
  4. PTFs for base support have the following fix categories:
    • For IBM z14 models M01 through M05, use FIXCAT value IBM.Device.Server.z14-3906.RequiredService and the FIXCATs for earlier processors.
    • For IBM z14 Model ZR1, use FIXCAT value IBM.Device.Server.z14ZR1-3907.RequiredService and the FIXCATs for earlier processors.
  5. InfiniBand coupling links are not supported on the z14 Model ZR1.

The exploitation of specific z14 server functions depends on the z/OS release. Table 2 shows a summary view of which z14 server functions can be exploited in z/OS V2R2, z/OS V2R3, and z/OS V2R4. The table lists z14 functions and indicates whether each function is exploited by a specific z/OS release (Yes or No), or whether the function requires a PTF (PTF) or a web deliverable (Web). For information about finding the appropriate PTFs, see the workflow step called "Actions you can take before you order an IBM z14 server." For more information about V1R13 support, see the Table Notes.

Table 2. Exploitation of z14 server functions supported by z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z14 function included in base z/OS support (Y/N)

V2R2 ²

V2R3 ²

V2R4²

Processors: The maximum number of processors that can be configured per server.

For IBM z14 models M01 through M05:

  • Up to 170 processors configurable as CPs, zIIPs, IFLs, ICFs, or optional SAPs.
  • The sum of CPs and zIIPs configured in a single z/OS LPAR cannot exceed:
    • 170 on z/OS V2R1 or later in non-SMT mode
    • 128 on z/OS V2R1 or later in SMT mode.

For IBM z14 Model ZR1:

  • Up to 30 processors configurable as CPs, zIIPs, IFLs, ICFs, or optional SAPs.
  • The sum of CPs and zIIPs configured in a single z/OS LPAR cannot exceed 30 on z/OS V2R1 or later (in either SMT or non-SMT mode).

Yes

Yes

Yes

Two-way simultaneous multithreading (SMT)

Yes

Yes

Yes

Channel subsystems.

The maximum number of channel subsystems (CSS) that can be configured per server:

  • For IBM z14 models M01 through M05:
    • Up to six channel subsystems
    • Up to four subchannel sets per CSS.
  • For IBM z14 Model ZR1:
    • Up to three channel subsystems
    • Up to three subchannel sets per CSS.

Yes

Yes

Yes

Up to 4 TB of Redundant Array of Independent Memory (RAIM) per z/OS LPAR with z/OS V2.1 or later.

Yes

Yes

Yes

Transactional memory

Yes

Yes

Yes

2 GB Large Pages

Yes

Yes

Yes

Logical partitions.

The maximum number of logical partitions (LPARs) that can be configured per server:

  • For IBM z14 models M01 through M05, up to 85 LPARs can be configured.
  • For IBM z14 Model ZR1, up to 40 LPARs can be configured.

Yes

Yes

Yes

Coupling Facility Control Code Level 22 (CFLEVEL 22)

PTF

Yes 3

Yes

Coupling Express LR (CHPID type CL5)

PTF

Yes

Yes

Support for 256 Coupling CHPIDs

Yes

Yes

Yes

Support of High Performance FICON (zHPF) single-track or multitrack operations (CHPID type FC)

PTF

Yes

Yes

IBM Integrated Coupling Adapter Fanout (ICA SR) (CHPID type CS5)

Yes

Yes

Yes

CHPID type OSX for access control to the intra-ensemble data network (IEDN) from IBM z14 to Unified Resource Manager functions

Yes

Yes

Yes

CHPID type OSC supporting TN3270E and non-SNA DFT

Yes

Yes

Yes

OSA-Express6S (CHPID type OSD) without maximum port exploitation

Yes

Yes

Yes

OSA-Express6S IWQ IPSec

PTF

PTF

Yes

CHPID type OSD with exploitation of two ports per CHPID

Yes

Yes

Yes

Inbound workload queuing for Enterprise Extender (CHPID type OSD)

Yes

Yes

Yes

Checksum offload for IPv6 packets (CHPID type OSD)

Yes

Yes

Yes

Checksum offload for LPAR-to-LPAR traffic for IPv4 and IPv6 packets (CHPID type OSD)

Yes

Yes

Yes

Large Send for IPv6 packets (CHPID type OSD)

Yes

Yes

Yes

Crypto Express6S support of VISA Format Preserving Encryption (VFPE)

Yes

Yes

Yes

Crypto Express6S support of greater than 16 Domains

Yes

Yes

Yes

Crypto Express6S Exploitation

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

Crypto Express6S support of PCI-HSM compliance

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

Web: Cryptographic Support for z/OS V2R1 - z/OS V2R3 (HCR77C1)

10 GbE RoCE Express2 for Shared Memory Communications-Remote Direct Memory Access (SMC-R)

PTF

Yes

Yes

Single Instruction Multiple Data (SIMD) instruction set 4

Yes

Yes

Yes

IBM Virtual Flash Memory 1

Yes

Yes

Yes

zHyperLink Express

PTF

PTF

Yes

HiperDispatch enhancements

PTF

Yes

Yes

Data set encryption

PTF

Yes

Yes

Guarded Storage Facility (GSF)

PTF

Yes

Yes

IBM z/OS XL C/C++ compiler support of the ARCH(12) and TUNE(12) parameters.

No

Yes

Yes

IBM z/OS XL C/C++ runtime support of ARCH(12) and TUNE(12) parameters.

PTF 4

Yes

Yes

Instruction Execution Protection (IEP)

PTF

Yes

Yes

zEDC capability using zEDC Express®

Y (requires the z/OS zEDC software feature to be enabled)

Y (requires the z/OS zEDC software feature to be enabled)

Y (requires the z/OS zEDC software feature to be enabled)

Table Notes:
  1. z/OS V1R13 with PTFs, the z/OS V1.13 RSM Enablement Offering web deliverable installed, and an extended support contract for IBM Software Support Services. The web deliverable is available at z/OS downloads.
  2. PTFs for exploitation have the following fix categories:
    • For IBM z14 models M01 through M05, use FIXCAT value IBM.Device.Server.z14-3906.Exploitation and the FIXCATs for earlier processors.
    • For IBM z14 Model ZR1, use FIXCAT value IBM.Device.Server.z14ZR1-3907.Exploitation and the FIXCATs for earlier processors.
  3. Full support (duplexing with master/slave for CFLEVEL 22 on a z14) requires a V2R3 PTF.
  4. Running the code on z/OS V2R1 or z/OS V2R2 requires the PTF for APAR PI12281.

Web deliverables are available from the z/OS downloads page at z/OS downloads.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

  • IBM z14 models M01 through M05, which became available September, 2017.
  • IBM z14 Model ZR1, which became available May, 2018.

Applies to migration from:

z/OS V2R3 and z/OS V2R2.

Timing:

Anytime before you introduce a z14 server into your environment.

Is the upgrade action required?

Yes, if you want to run z/OS V2R4, z/OS V2R3, or z/OS V2R2 on a z14 server, or if you want to run a coupling facility on a z14 server. If you plan to run only a coupling facility on a z14 system, only the sysplex-related actions are relevant. However, you must install the appropriate z/OS service for systems that are running on other servers that use the z14 coupling facilities.

Target system hardware requirements:

  • z/OS V2R4 with IBM z14 (z14) requires a minimum of 8 GB of memory to IPL. When running as a z/VM guest or on an IBM Z® Personal Development Tool (zPDT), a minimum of 2 GB is required for z/OS V2R4. If the minimum is not met, a warning WTOR is issued at IPL.
  • A z14 with Hardware Management Console (HMC) Version 2.14.0 plus microcode change levels (MCLs) and the Support Element Version 2.14.0.
  • Additional hardware required for specific functions.
    • IBM devices that are attached to z13, z13s, zEC12, and zBC12 servers are supported for attachment to z14 channels, unless otherwise noted. The subject I/O devices must meet FICON architecture requirements.
    • IBM Virtual Flash Memory requires FC #0604
    • zEDC Express requirements:
      • IBM z14 models M01 through M05 require FC #0420.
      • IBM z14 Model ZR1 requires FC #0420 and PCIe I/O drawer (FC #4001).
    • 10 GbE RoCE Express2 requires FC #0412
    • New OSA-Express6S cards require the following feature codes:
      • OSA-Express6S GbE LX requires FC #0422
      • OSA-Express6S GbE SX requires FC #0423
      • OSA-Express6S 10 GbE LR requires FC #0424
      • OSA-Express6S 10 GbE SR requires FC #0425
      • OSA-Express6S 1000BASE-T requires FC #0426
    • New FICON Express16S cards require the following feature codes:
      • FICON Express16S+ LX requires FC #0427
      • FICON Express16S+ SX requires FC #0428
    • zHyperLink Express requires FC #0431
    • Coupling Express LR requires FC #0433
    • Crypto Express6S requires FC #0893
    • Use of hardware acceleration for cryptographic operations, including the use of Visa, Inc. Data Secure Platform (DSP) functions requires a CPACF (FC #3863) or a CEX5S (FC #0890) feature, or both.

      See Table Note 1.

    • Use of a new Trusted Key Entry (TKE) workstation requires TKE Rack Mount w/4768 (FC #0085) or TKE w/4768 (FC #0086). The TKE workstation is a combination of hardware and software, with other features required, depending on which functions you plan to use. Different feature codes are required if you are upgrading an existing TKE workstation from an earlier server.

      TKE 9.0 (FC #0879) is also required if you plan to use the TKE workstation to manage any of the following:

      • A Crypto Express6S
      • The new CCA mode PCI-HSM settings that are available on the Crypto Express6S
      • Any Crypto Express feature that is running in IBM Enterprise PKCS #11 (EP11) mode.

Target system software requirements:

See the topic Support is delivered by service, z/OS features, and web deliverables in the workflow step "General recommendations and considerations for a z14 server" and Install the necessary z/OS service, as indicated in the PSP buckets that are described in the workflow step "Actions you can take before you order an IBM z14 server."

Other system (coexistence or fallback) requirements:

  • The suggested practice is to install and run the required service on your existing server. This action enables you to fall back from a hardware perspective, yet maintain your software level.
  • If you have not installed the preconditioning and exploitation PTFs for CFLEVEL 17-21, note that those PTFs are required to be installed throughout your sysplex before implementing CFLEVEL 22. Use the appropriate fix category, as follows:
    • For IBM z14 models M01 through M05, use FIXCAT value IBM.Device.Server.z14-3906.RequiredService
    • For IBM z14 Model ZR1, use FIXCAT value IBM.Device.Server.z14ZR1-3907.RequiredService
  • If you plan to implement zEDC, you should install the z/OS toleration PTFs on systems that access data that is compressed using zEDC Express on a z14 server.
  • If you are using ICSF and plan to share keys with other z/OS systems that have an earlier level of ICSF, you should install the ICSF coexistence PTFs on those earlier levels of ICSF. For ICSF coexistence PTFs, see the workflow step called "Actions you can take before you order an IBM z14 server" for the appropriate SMP/E FIXCAT values to use.

Restrictions:

See the workflow step called "Restrictions for a z14 server."

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Table Note:
  1. IBM Z® cryptography features include VISA Format Preserving Encryption (VFPE) technology, which forms part of the Visa, Inc. Data Secure Platform (DSP). The use of VFPE technology requires a service agreement with Visa, Inc. For details, contact your Visa account manager or Visa at P2PE@visa.com. Clients who use IBM Z® cryptography features, but do not make use of the FPE functionality, are not required to enter into any such agreement with Visa.

Steps to take

Continue with the workflow steps "General recommendations and considerations for a z14 server" and "Restrictions for a z14 server," and perform the tasks that are described in the following steps:

  • "Actions you can take before you order an IBM z14 server"
  • "Actions you can take after installing an IBM z14 server"
  • "Accommodate functions for the z14 to be discontinued on future servers"

Reference information

For more information about new functions to exploit, see the IBM z14 Library.


Step 3.2.2.1 : General recommendations and considerations for a z14 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

As you plan your migration to an IBM z14™ server, consider the following items.

  1. Upgrade actions for IBM servers are cumulative. If you migrate to a z14 server from a z13™ or z13s server, and have performed the upgrade actions that are associated with the z13 or z13s, you have fewer upgrade actions than if you migrate from an earlier generation server. Thus, if you migrate from an earlier generation server, you might need to perform more upgrade actions. For example, if you migrate from a zEC12 server, you should read about and perform the z13 and z13s server upgrade actions in the workflow step called "Upgrade to an IBM z13 or IBM z13s server."
  2. Support is delivered by service, z/OS features, and web deliverables. The base support for the z14 is delivered through service (PTFs). To determine which PTFs are required, get the current enhanced HOLDDATA file, either by using the SMP/E RECEIVE ORDER command or by downloading the 2-year file and using the SMP/E RECEIVE command to process it. Then, use the SMP/E REPORT MISSINGFIX report to identify the missing PTFs, if any. For example:
    SET BDY(GLOBAL). REPORT MISSINGFIX ZONES(target zone) FIXCAT(IBM.Device.Server.*.RequiredService).

    If you want more granular reports for REPORT MISSINGFIX, you can use the individual FIXCATs for each server, plus the FIXCATs for any intermediate services. The FIXCATs for the z14 servers are:

    • For IBM z14 models M01 through M05, the FIXCAT for z14 required service is: IBM.Device.Server.z14-3906.RequiredService.
    • For IBM z14 Model ZR1, the FIXCAT for z14 required service is: IBM.Device.Server.z14ZR1-3907.RequiredService.

    Exploitation of some functions requires a web deliverable. Specifically:

    • Exploitation of the Crypto Express6S requires the Cryptographic Support for z/OS V2R1 - z/OS V2R3 (FMID HCR77C1) web deliverable.

      If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the following fix category: IBM.Coexistence.ICSF.z/OS_V2R1-V2R3-HCR77C1

    • If you are running z/OS V2R1 and require Crypto Express4S functionality for CCA 4.4 and other EP11 cryptographic enhancement support, which includes: RKX Key Export Wrap, UDX Reduction/simplification, additional EP11 algorithms, expanded EMV support, AP Configuration simplification, CTRACE Enhancements, and KDS Key Utilization Stats, then you must download and install the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or the Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (HCR77B1).

      If you are using either of these web deliverables (HCR77A1 or HCR77B1) and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the appropriate Fix Category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77A1 or IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B1.

    • If you are running z/OS V2R1 and require Crypto Express5S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or the Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (HCR77B1).

      If you are using either of these web deliverables (HCR77B0 or HCR77B1) and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the appropriate fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B0 or IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B1.

    • If you are running z/OS V1R13, you might need to install a Cryptographic Support web deliverable, depending on which ICSF functions you require.

      To run z/OS V1R13 on a z14 server, you require IBM Software Support Services for extended z/OS V1R13 support.

  3. Larger coupling facility structure sizes might be necessary. When you change the coupling facility control code level (CFLEVEL), your coupling facility structure sizes might change. If, as part of your migration to a z14 server, you change the CFLEVEL, you might have larger structure sizes than you did previously. If your CFLEVEL is identical, structure sizes are not expected to change when you migrate from a previous server to a newer generation server. In addition, similar to CFLEVEL 17 and later, ensure that the CF LPAR has at least 512MB of storage. CFLEVEL 22, introduced on the z14, supports the Coupling Facility use of Large Memory to improve availability for larger CF cache structures and data sharing performance with larger DB2 Group Buffer Pools (GBP). This support removes inhibitors to using large CF cache structures, enabling use of Large Memory to scale to larger DB2 Local Buffer Pools (LBP) and Group Buffer Pools (GBP) in data sharing environments.
  4. Use the same software level throughout a sysplex. Having members of a sysplex at the same software level (other than during brief migration periods) is good software management policy.
  5. Migrate hardware and software at different times. To minimize the amount of change that you experience at one time, do not migrate your software release level at the same time that you migrate your hardware.
  6. Use the latest version of SCRT. In z/OS V2R3, you do not need to update SCRT because it is included in the z/OS base. If you are running an earlier release of z/OS, and you use SCRT, make sure that SCRT is at the latest level. This is a requirement for sub-capacity pricing. The latest level of SCRT for releases prior to z/OS V2R3 can be downloaded from the SCRT web site at IBM Z software pricing - Licensing - Sub-capacity licensing.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.2.2 : Restrictions for a z14 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Restrictions that are associated with the IBM z14™ server are described as follows:

  1. Functional limitations. Not all z14 functions are available in every z/OS release. See Table 1 and Table 2 in the workflow step "Upgrade to an IBM z14 server" for a list of the z14 functions available in each z/OS release. Some functions have migration or exploitation considerations. See the workflow steps "Actions you can take before you order an IBM z14 server" and "Actions you can take after installing an IBM z14 server.") Many functions are enabled or disabled, based on the presence or absence of the required hardware and software. If you plan to exploit new z14 functions, you can install the software and hardware in either order; that is, there is no requirement to install either software or hardware first to exploit a specific function. However, because of outage windows and testing considerations, you might want to consider installing all the software and PTFs required for the machine and the functions you plan to exploit first, then upgrade the hardware and, finally, update your customization to exploit the new functions.
  2. z14 servers in a sysplex.
    • A Parallel Sysplex® that contains a z14 server either for a z/OS image or a coupling facility (CF) image can only contain other z14 servers, or z13, z13s, zEC12, or zBC12 servers.

      Note that no coupling link connectivity is possible between IBM zEC12 and IBM zBC12 systems and the IBM z14 Model ZR1. Other systems, such as the z13, z13s, and z14, can connect to the z14 Model ZR1 by using the Integrated Coupling Adapter Short Reach (ICA SR) and the Coupling Express Long Reach (CE LR) coupling links. The zEC12 and zBC12 systems do not support ICA SR or CE LR, and therefore cannot have coupling link connectivity to the z14 Model ZR1. Also, the InfiniBand coupling links are not supported on the z14 Model ZR1.

      If you are running z/OS on any servers earlier than a zEC12 or zBC12 server, you cannot add a z14 server to that sysplex; that is, you will not be able to perform rolling IPLs to introduce a z14 server if you have any of the earlier servers as z/OS images or coupling facility images in the sysplex.

      The earlier servers in the sysplex must be upgraded to zEC12, zBC12, or later to have z14 servers supported in the sysplex. If you have any z/OS images or coupling facility images on an earlier server, and you intend to introduce a z14 server into that sysplex, you must migrate those images to a zEC12, zBC12, or later server before introducing the z14 server.

      GRS supports the use of FICON CTCs for Ring configurations. However, if you are currently using ESCON CTCs for GRS ring configurations within a sysplex, consider converting to GRS Star if possible, or using XCF signaling in a GRS ring configuration. XCF sysplex signaling is preferred instead of GRS CTC connections.

    • Starting with z13, servers that require time synchronization (for example, to support a base or Parallel Sysplex) must be configured in Server Time Protocol (STP) mode. STP is designed to allow multiple servers and coupling facilities to maintain time synchronization with each other, in a coordinated timing network (CTN). STP is a hardware feature of the z14, z13, z13s, zEC12, and zBC12. The most recent servers (z14, z13, and z13s) can participate only in an STP-only CTN.

      Starting with the z14 and the IBM Hardware Management Console (HMC) Version 2.14.0, you can use the Manage System Time task to configure an STP-only CTN. This task provides a simplified workflow for system time management, and features a visual topology display that surfaces configuration errors, if any, in the CTN.

  3. HCD and HCM support for the z14. As with previous servers, hardware can be defined on any supported OS version and server. However, dynamic activation of new server and new adapter types can be done only on z14 and future high-end IBM Z® servers.

    Dynamic activation is fully supported on z/OS V2R1 and later releases. Dynamic activation is restricted on z/OS V1R13; no hardware activation is permitted, if PCIe functions or the PNETID attribute for channel paths are defined. Limited software activation is available with hardware validation support.

    To run z/OS V1R13 on a z14 server, you require IBM Software Support Services for extended z/OS V1R13 support.

  4. Environmental Record Editing and Printing (EREP) support for the z14. Starting with the PTF for APAR IO24874, EREP supports any specification for the CPU parameter. That is, EREP does not fail an unrecognized value on the CPU parameter. If no matching records are found, EREP issues warning message IFC120I, as done in previous releases.
  5. Removal of support for running an operating system in ESA/390 architecture mode. Starting with the z14, the IBM Z® servers no longer support running in ESA/390 mode. The z14 and future systems support operating systems running in z/Architecture® mode. However, all 24-bit and 31-bit problem-state application programs that were originally written to run on the ESA/390 architecture are not affected by this change.
  6. Plan for discontinued functions. For a list of functions on the z14 that are planned to be discontinued on future servers, see the workflow step "Accommodate functions for the z14 to be discontinued on future servers."
  7. Unsupported hardware features. The following hardware features are not supported on the z14. They cannot be ordered on the z14 and cannot be carried forward from an upgrade on an earlier server to the z14.
    • Host Channel Adapter fanout:
      • The HCA2-O and HCA2-O LR features are not supported on any of the z14 models.
      • The HCA3-O and HCA3-O LR coupling fanouts are not supported on the z14 Model ZR1. This model requires ICA-SR and CE-LR fanouts.
    • IFB-MP Daughter Card #0326
    • STI-A8 Mother Card #0327
    • InterSystem Channel-3 (ISC-3) coupling links feature
    • CHPID type OSN (OSA-Express for NCP) is not supported on the OSA-Express5S GbE LX feature
    • OSA-Express4S features
    • Crypto Express4S feature
    • FICON Express8 features
    • Flash Express, which is replaced by Virtual Flash Memory on the z14
    • IBM zAware Firmware Appliance. IBM zAware analytics functions are now available through software, starting with IBM Operations Analytics for z Systems® Version 3.1. For more information, go to IBM Operations Analytics for z Systems.
    • STP Mixed CTN. The zEC12 and zBC12 were the last IBM Z® servers to support connections to an STP Mixed CTN. This also includes the Sysplex Timer (9037). Starting with the z13, servers that require Time synchronization, such as to support a base or Parallel Sysplex, require Server Time Protocol (STP) and all servers in that network must be configured in STP-only mode.
    • IBM zEnterprise® Application Assist Processor (zAAP). IBM continues to support running zAAP workloads on IBM z Integrated Information Processors (zIIPs). IBM has removed the restriction preventing zAAP-eligible workloads from running on zIIPs when a zAAP is installed on the CEC. This change was intended to help facilitate migration and testing of zAAP workloads on zIIPs. With a z14, one CP must be installed with the installation of any zIIPs or prior to the installation of any zIIPs. The total number of zIIPs purchased cannot exceed twice the number of CPs purchased. However, for upgrades from zEC12s with zAAPs, conversions from zAAPs can increase this ratio to 4:1.
  8. Carry forward hardware features. The following hardware features are not orderable on z14 servers. If they are installed on your existing server at the time of an upgrade to a z14 server, they can be retained or carried forward.
    • HMC #0092, #0094, #0095, and #0096
    • TKE with/4767 #0096 or #0097
    • OSA-Express4S 1000BASE-T #0408
    • OSA-Express5S GbE LX #0413
    • OSA-Express5S GbE SX #0414
    • OSA-Express5S 10 GbE LR #0415
    • OSA-Express5S 10 GbE SR #0416
    • OSA-Express5S 1000BASE-T #0417
    • FICON Express8S 10KM LX #0409
    • FICON Express8S SX #0410
    • FICON Express16S LX #0418
    • FICON Express16S SX #0419
    • 10GbE RoCE Express #0411
    • TKE workstation #0842
    • TKE workstation w/4767 #0847
    • Addl smart cards #0884
    • TKE Smart Card Reader #0885 or #0891
    • Crypto Express5S #0890
    • Fill and Drain Kit #3378
    • Universal Lift Tool/Ladder #3759.

    For information about supported storage controllers, see the workflow step "Ensure that you are using supported servers, storage controllers, and machine facilities."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.2.3 : Actions you can take before you order an IBM z14 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

These are upgrade actions that you perform on your current system, either because they require the current system or because they are possible on the current system. You do not need the z14™ server to make these changes, and the changes do not require the z14 server once they are made. For example, discontinuing use of hardware that is no longer supported.

You can perform the following upgrade actions before you order or install a z14 server:

  1. Review the Large Systems Performance Reference (LSPR). LSPR is designed to provide comprehensive z/Architecture processor capacity ratios for different configurations of central processors (CPs) across a wide variety of system control programs and workload environments.
  2. Review the sysplex configuration in which the z14 server will participate. See the workflow step called "Restrictions for a z14 server" for a description of the limitations when using z14 server with certain earlier servers in a Parallel Sysplex.
  3. Implement an STP timing network. This action is needed because Sysplex Timers (9037-002) are not supported on z14 servers.
  4. Upgrade from ISC-3 links to the Integrated Coupling Adapter (ICA) links. This action is needed because ISC-3 links are not supported on z14 servers. If desired, you can take this action after you order a z14 server, as you upgrade to the new server.
  5. Upgrade from InfiniBand coupling links, if you are ordering a z14 Model ZR1. For connectivity to other systems, the z14 ZR1 requires Integrated Coupling Adapter Short Reach (ICA SR) and the Coupling Express Long Reach (CE LR) coupling links. The z14 ZR1 does not support InfiniBand coupling links.
  6. Upgrade from unsupported hardware features to newer technology. This action is needed because specific features are not available on the z14 server. For example, Crypto Express4S and OSA-Express4 are not supported. See the following workflow steps:
    • "Restrictions for a z14 server"
    • "Replace unsupported devices"
    • "Provide for new device installations"
  7. Determine the level of cryptographic support you require on a z14 server. The level of function that is provided for cryptographic support differs by z/OS release and the installed ICSF web deliverable. Also, toleration PTFs are available for some cryptographic web deliverables.

    For z/OS V2R3, consider the following:

    • If you are using the level of ICSF that is shipped as part of z/OS V2R3 (FMID HCR77C0), you can use most functions of the Crypto Express6S feature on a z14 server.
    • ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 - z/OS V2R3 provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R3. The web deliverable includes support for a PCI HSM (“Payment Card Industry Hardware Security Module”) configured CCA coprocessor. Crypto Express6S also introduces the use of X.509 certificates in CCA.
    • If you are using this web deliverable and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs identified by the following Fix Category: IBM.Coexistence.ICSF.z/OS_V2R1-V2R3-HCR77C1

    For z/OS V2R2, consider the following:

    • If you are using the level of ICSF that is shipped as part of z/OS V2R2 (FMID HCR77B0), you can use most functions of the Crypto Express6S feature on a z14 server.
    • ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 – z/OS V2R3 provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R2. The web deliverable includes support for a PCI HSM (“Payment Card Industry Hardware Security Module”) configured CCA coprocessor. Crypto Express6S also introduces the use of X.509 certificates in CCA.

    For z/OS V2R1, consider the following:

    • If you are using the level of ICSF that is shipped as part of z/OS V2R1 (FMID HCR77A0), Crypto Express5S is tolerated on a z14 server, which treats Crypto Express5S cryptographic coprocessors and accelerators as Crypto Express4S coprocessors and accelerators. However, you must install the required PTFs identified by the SMP/E fix category:
      • For IBM z14 models M01 through M05, use FIXCAT value IBM.Device.Server.z14-3906.RequiredService
      • For IBM z14 Model ZR1, use FIXCAT value IBM.Device.Server.z14ZR1-3907.RequiredService
    • If you require support for more than 16 domains on Crypto Express5S, you must install the PTFs that are identified by the appropriate fix category for your z14 server (either IBM.Device.Server.z14-3906.Exploitation or IBM.Device.Server.z14ZR1-3907.Exploitation), or install the ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 – z/OS V2R3, or a later ICSF web deliverable.
    • If you require Crypto Express4S functionality for CCA 4.4 and other EP11 cryptographic enhancement support that includes: RKX Key Export Wrap, UDX simplification, more EP11 algorithms, expanded EMV support, AP Configuration simplification, CTRACE Enhancements, and KDS Key Utilization stats, you must download and install the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or a later ICSF web deliverable. Note:

      If you are using the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or a later ICSF web deliverable, and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs listed here, which are identified by fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77A1, or the FIXCAT for the ICSF level that you are using.

    • If you require Crypto Express6S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or a later ICSF web deliverable. Note:

      If you are using ICSF Web Deliverable HCR77C1 - Cryptographic Support for z/OS V2R1 – z/OS V2R3, or a later ICSF web deliverable, and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs listed here, which are identified by fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B0, or a later ICSF web deliverable.

  8. Install the necessary z/OS service. IBM recommends that you use the SMP/E REPORT MISSINGFIX command to identify PTFs for the z14 server that you do not already have installed. The simplest way to do that is to specify IBM.Device.Server.* and IBM.Function.* as the fix categories for the REPORT MISSINGFIX command. Doing so will identify not only z14 support PTFs, but those for prior generations of IBM servers that you might need, and those required to enable various functions. Also, REPORT MISSINGFIX creates a batch job for the SMP/E RECEIVE ORDER command that you can use to get any PTFs you do not already have. SMP/E also provides an Explorer function that you can use to find new fix categories that might be of interest. For a description of all the fix categories, see the Values and Descriptions page at IBM Fix Category Values and Descriptions. For more information about the REPORT MISSINGFIX command, see z/OS SMP/E Commands.

    Here is an example of the SMP/E control statements you can use for REPORT MISSINGFIX:

    SET BDY(GLOBAL) . REPORT MISSINGFIX ZONES(target zone) FIXCAT(IBM.Device.Server.* IBM.Function.*) .

    If you want to use specific fix categories, you can specify the following fix categories either individually or together for the z/OS PTFs that are required to use a z14 server, exploit its functions and features, and those that IBM recommends you install if you are using a z14 server. Also needed are the FIXCATs for intermediate processors.

    • For IBM z14 models M01 through M05:
      • IBM.Device.Server.z14-3906.RequiredService
      • IBM.Device.Server.z14-3906.Exploitation
      • IBM.Device.Server.z14-3906.RecommendedService
    • For IBM z14 Model ZR1:
      • IBM.Device.Server.z14ZR1-3907.RequiredService
      • IBM.Device.Server.z14ZR1-3907.Exploitation
      • IBM.Device.Server.z14ZR1-3907.RecommendedService

    In addition, if you choose to use specific fix categories, your environment might require that you specify one or more of these fix categories:

    • IBM.Function.DataSetEncryption
    • IBM.Function.ParallelSysplexInfiniBandCoupling
    • IBM.Function.PricingInfrastructure
    • IBM.Function.ServerTimeProtocol
    • IBM.Function.UnifiedResourceManager
    • IBM.Function.zEDC
    • IBM.Function.zHighPerformanceFICON
    • IBM.Function.zHyperLink

    If you are exploiting z14 capabilities by installing a web deliverable, additional PTFs might be required. Follow the instructions in the Program Directory that is associated with each web deliverable to identify the required PTFs.

    Another way to find required PTFs is by using Preventive Service Planning (PSP) "buckets." In addition to the applicable hardware PSP buckets, you must also obtain the software PSP buckets. The hardware PSP bucket lists the recommended, required, and exploitation PTFs, and also includes information about the appropriate fix categories that are needed to identify those PTFs. However, using PSP buckets and checking on the status of the PTFs listed in them is more time-consuming and potentially error-prone than using REPORT MISSINGFIX with the appropriate fix categories. 1

  9. Run the CFSIZER tool. If you are moving your coupling facilities and the coupling facility structures are on a higher CFLEVEL than they were previously, run the Coupling Facility Structure Sizer (CFSIZER) tool to find out if you have to increase coupling facility structure sizes. Prepare to make the necessary changes to the CFLEVEL as indicated by the tool.

    You can download the CFSIZER tool at Coupling Facility sizer. Also, see the workflow step called "Update your CFRM policy with coupling facility structure size changes."

    Note: After you make a coupling facility available on the new hardware, you can run the Sizer utility, an authorized z/OS program to evaluate structure size changes. The Sizer utility is distinct from CFSizer, and should be run after the new hardware (CFLEVEL) is installed, but before any CF LPAR on the new hardware is populated with structures. You can download the Sizer utility at CFSizer Alternate Sizing Techniques.

  10. Prepare for the new machine instruction mnemonics. The instruction set has been expanded on the z14 server, as is usual for new servers. Each machine instruction is represented by a mnemonic in Assembler language. The new mnemonics can be identical to the names you chose for Assembler macro instructions. In the event of such naming collisions, the Assembler's default opcode table (UNI) processes new mnemonics as instructions, not as macros, after z14 required service has been installed. If this occurs, it is likely to cause Assembler error messages and can cause incorrect object code to be generated. If you write programs in Assembler Language, compare the names of Assembler macro instructions that are used to the new machine instructions (documented in the latest z/Architecture Principles of Operation, SA22-7832) to identify any such conflicts or collisions that would occur. Identical names cause Assembler errors or the generation of incorrect object code when you assemble your programs. For information about a tool to help in identifying mnemonic conflicts, see IBM Techdocs. Search for the Techdoc PRS5289.

    If a conflict is identified, take one of these actions:

    • Change the name of your macro instruction.
    • Specify PARM='...OPTABLE(YOP)...' (or some other earlier opcode table).
    • Specify a separate ASMAOPT file containing assembler options such as in the previous method (this method requires no changes to source code or JCL).
    • Add as the first statement of your source program: *PROCESS OPTABLE(YOP) (or some other earlier opcode table).
    • Specify the PROFILE option either in JCL or the ASMAOPT file, and the specified or default member of the SYSLIB data set is copied into the front of the source program.
    • If you must use both a new instruction and a macro with the same name in an assembly, you can use a coding technique that permits both use of a new instruction and a macro with the same name in an assembly such as HLASM mnemonic tags ( :MAC:ASM).
  11. Accommodate the changes to default ARCH and TUNE level. Starting with z/OS V2R3, the default ARCH level is changed from ARCH(8) to ARCH(10), and the default TUNE level is changed from TUNE(8) to TUNE(10). The new default levels align with the zEC12; thus, code can run on any server that is supported by z/OS V2R3 without requiring changes to compiler options. However, if you compile programs to be run on processors at lower architecture levels, you must specify the appropriate ARCH and TUNE levels when you compile those programs.

    The z14 supports the new levels ARCH(12) and TUNE(12), which are needed to take advantage of the new z14 instructions, and are intended to provide performance improvements for applications. ARCH(12) produces code that uses instructions that are available on the z14 in z/Architecture mode. The z14 adds instructions for vector programming, including allowing packed decimal operations to be performed in registers rather than memory. TUNE(12) generates code that is executable on all models, but is optimized for the z14.

  12. Update I/O Configuration Program (IOCP) for earlier FICON cards. To continue using FICON Express8S cards, you must specify the new IOCP keyword MIXTYPE.
  13. Use the LOADxx MACHMIG statement to help with upgrade. In the LOADxx member, you can include the new MACHMIG statement to specify particular z14 hardware facilities that you want to disable during your upgrade to another processor, z/OS release, or both. You can exclude the following z14 facilities:
    • Hardware-based enhanced-DAT facility (EDAT2)
    • Hardware-based transactional-execution facility (TX)
    • Hardware-based vector registers (VR) in support of SIMD (VEF)
    • Guarded Storage Facility (GSF).

    If you omit the MACHMIG statement, z/OS does not limit its use of the machine facilities.

  14. Decide on the steps to take for your upgrade to a z14 server. Besides the steps that are listed here, see the following workflow step for guidance: "Actions you can take after installing an IBM z14 server."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.2.4 : Actions you can take after installing an IBM z14 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

These are upgrade actions that you perform only after you have installed the z14 server. You need a running z14 server to perform these actions.

For more information about PTFs, see the table notes for "Base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4."

  1. FICON Express16S. FICON Express16S supports a link data rate of 16 gigabits per second (Gbps) and auto-negotiation to 4 or 8 Gbps for synergy with existing switches, directors, and storage devices. With support for native FICON, High Performance FICON for z IBM z Systems (zHPF), and Fibre Channel Protocol (FCP), the new FICON Express16S channel is designed to work with your existing fiber optic cabling environment. The FICON Express16S feature running at end-to-end 16 Gbps link speeds can provide reduced latency for large read/write operations, and increased bandwidth compared to the FICON Express8S feature.
  2. Upgrade to Virtual Flash Memory (VFM). IBM Virtual Flash Memory (VFM) is the replacement for the Flash Express features (#0402, #0403) which were available on the IBM zEC12 and IBM z13. No application changes are required to change from IBM Flash Express to VFM. Ensure that you replace your Flash memory with adequate VFM.
  3. Upgrade actions for Hardware Instrumentation Services (HIS). New diagnostic samples are added for the z14. If you want to ignore them, you might need to update your HIS profilers. Also, to tolerate the new counters (cycle and instruction) in the Problem Counter Set, you might need to update your HISSERV profilers, SMF 113 records, or z/OS UNIX System Services counter file consumers. For more information, see the topic "Starting, configuring, and stopping hardware event data collection" in z/OS MVS System Commands.

    Note: As of z/OS V2R1, if you use the CPU Measurement Facility, IBM recommends that your installation collect SMF 113 subtype 1 and 2 records. IBM also recommends that products process SMF 113 subtype 1 records when available because that is where future enhancements are made. If subtype 1 records are not available, products can process subtype 2 records.

  4. Enable BCPii communications on the support element. For Support Elements that run on z14, the setting for the “Cross Partition Authority” option is replaced by new security settings on the System Details panel and the Customize Image Profiles panel. For more information, see the workflow step "Enable BCPii communications on the support element."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.2.5 : Accommodate functions for the z14 to be discontinued on future servers


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Note:

IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

Description

The following changes in hardware support could affect your environment. Make the appropriate changes, as needed.

  1. Removal of support for Host Channel Adapter fanout optical features. The z14™ is the last IBM Z® high-end server to support HCA3-O fanout (#0171) and HCA3-O LR fanout for 1x IFB (#0170). Note:

    The z14 Model ZR1 does not support the HCA3-O or the HCA3-O LR coupling fanouts. This model requires ICA-SR and CE-LR fanouts.

    Enterprises should begin migrating from HCA3-O and HCA3-O LR channels to one of the following coupling links on the z14, z13, and z13s.

    • For high-speed short-range coupling connectivity, the IBM Integrated Coupling Adapter (ICA SR). The ICA SR is a two-port, short-distance coupling fanout that uses a new coupling channel type: CS5. The ICA SR can only be used for coupling connectivity between z14, z13, and z13s servers. The ICA SR fanout requires new cabling, and can only connect to another ICA SR.
    • For long-range coupling connectivity, the Coupling Express Long Reach (CE LR). The CE LR is a two-port, long-distance coupling adapter that uses a new coupling channel type: CL5. The CE LR can only be used for coupling connectivity between z14, z13, and z13s servers.

    The suggested practice is to order ICA SR (#0172) or CE LR (#0433) on the z14 processors that are used in a Parallel Sysplex to help ensure coupling compatibility with future processor generations.

  2. Removal of FICON Express8S support. The z14 is the last IBM Z® high-end server to support FICON Express8S (#0409 and #0410) channels. Your installation should begin migrating from FICON Express8S channels to FICON Express16S+ channels(#0427 and #0428). FICON Express8S will not be supported on future high-end IBM Z® servers as carry forward on an upgrade.
  3. Removal of support for the zEDC Express. The z14 is the last IBM Z® high-end server to support the zEDC Express (#0420). In the future, IBM Z® high-end server compression acceleration functionality moves from the zEDC adapter to processors.
  4. Removal of support for OSA-Express6S 1000BASE-T adapters. The OSA-Express6S 1000BASE-T adapter (#0426) is the last generation of OSA 1000BASE-T adapters to support connections operating at 100 Mb/second link speed. Future OSA-Express 1000BASE-T adapter generations will support operation only at 1000 Mb/second (1 Gb/s) link speed.
  5. Removal of support for sysplex coexistence between zEC12 and zBC12 servers and future servers.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.3 : Upgrade to an IBM z13 or IBM z13s server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Description

z/OS running on the z13 or z13s sets the groundwork for digital business by providing the foundation you need to support demanding workloads, such as operational analytics and clouds, and your traditional mission-critical applications.

In a Parallel Sysplex that includes a z13 or z13s with either a z/OS system running in at least one LPAR or at least one LPAR being used as a coupling facility (CF), you can include the following servers:

  • z13 and z13s servers
  • zEC12 and zBC12 servers
  • zEnterprise servers (z196 or z114)

The specific z13 and z13s functions, including base support, that are used by z/OS depend on the z/OS release. PTFs might be required for many of these functions. See the workflow step called "Actions you can take before you order a z13 or z13s server" for information about finding the appropriate PTFs.

Base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4

The following table shows a summary view of which z13 and z13s server functions are included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z13 and z13s function included in base z/OS support (Y/N)

V2R2¹

V2R3¹

V2R4¹

Base support

Y

Y

Yes, and in PTFs

CHPID type CS5 for coupling

Y

Y

Y

CHPID type OSE supporting 4 or 2 ports per feature

Y

Y

Y

CHPID type OSM for intranode management network (INMN)

Y

Y

Y

CHPID type OSN for OSA-Express for NCP (LPAR-to-LPAR)

Y

Y

Y

CPU measurement facility

Y

Y

Y

Crypto Express5S Toleration

Y

Y

Y

FICON Express 8S (CHPID FC)

Y

Y

Y

FICON Express16S (CHPID FC)

Y

Y

Y

IBM z BladeCenter Extension (zBX) Model 004

Y

Y

Y

IBM z Unified Resource Manager

Y

Y

Y

New z13 machine instruction (assembler support)

Y

Y

Y

OSA-Express4S (GbE LX and SX, 1000BASE-T, 10 GbE LR and SR)

Y

Y

Y

OSA-Express5S (GbE LX and SX, 1000BASE-T, 10 GbE LR and SR)

Y

Y

Y

Parallel Sysplex InfiniBand (PSIFB) Coupling Link

Y

Y

Y

z/OS global resource serialization (GRS) support for FICON CTCs

Y

Y

Y

Note:
  1. PTFs for base support have the following fix category:
    • For z13: IBM.Device.Server.z13-2964.RequiredService
    • For z13s: IBM.Device.Server.z13S-2965.RequiredService

Exploitation support for z/OS V2R2, z/OS V2R3, and z/OS V2R4

The following table shows a summary view of which z13 and z13s server functions can be exploited in z/OS V2R2, z/OS V2R3, and z/OS V2R4.

z13 and z13s function included in base z/OS support (Y/N)

V2R2²

V2R3²

V2R4²

Coupling Facility Control Code Level 20 (CFLEVEL 20)

Y

Y

Y

CFCC Dump Reasons support for CFLEVEL 21

Y

Y

Y

Crypto Express5S support for up to 85 Domains

Y

Y

Y

High Performance FICON (zHPF)

Y

Y

Y

IBM Integrated Coupling Adapter (ICA SR)

Y

Y

Y

Support for 256 coupling CHPIDs

Y

Y

Y

2 GB Large Pages

Y

Y

Y

Checksum offload for IPv6 packets (CHPID OSD)

Y

Y

Y

Checksum offload for LPAR-to-LPAR traffic for IPv4 and IPv6 packets (CHPID OSD)

Y

Y

Y

Crypto Express5S support of VISA Format Preserving Encryption (FPE), Next Generation Coprocessor support

Y

Y

Y

Flash Express (Storage Class Memory or SCM)

Y

Y

Y

IBM System Advanced Workload Analysis Reporter (IBM zAware)

Y

Y

Y

Inbound workload queuing for Enterprise Extender (CHPID OSD)

Y

Y

Y

Large Send for IPv6 packets (CHPID OSD)

Y

Y

Y

Manage FICON Dynamic Routing Support

Y

Y

Y

Transactional memory

Y

Y

Y

Up to 4 Subchannels Sets per CSS (z13)

Y

Y

Y

Up to 3 Subchannels Sets per CSS (z13s)

Y

Y

Y

Up to 85 LPARs (z13)

Y

Y

Y

Up to 40 LPARs (z13s)

Y

Y

Y

Greater than 100 CPs per z/OS system image

Y (z13 only). The z13 can have a maximum of 128 CPs in non-SMT mode, or up to 213 threads in SMT mode.

The z13s can have a maximum of 40 CPs in non-SMT mode, or up to 66 threads in SMT mode.

Y (z13 only). The z13 can have a maximum of 128 CPs in non-SMT mode, or up to 213 threads in SMT mode.

The z13s can have a maximum of 40 CPs in non-SMT mode, or up to 66 threads in SMT mode.

Y (z13 only). The z13 can have a maximum of 128 CPs in non-SMT mode, or up to 213 threads in SMT mode.

The z13s can have a maximum of 40 CPs in non-SMT mode, or up to 66 threads in SMT mode.

Miscellaneous PCIe enhancements

Y

Y

Y

RoCE Express for Shared Memory Communications-Remote (SMC-R) Direct Memory Access including shared RoCE Express support

Y

Y

Y

Shared Memory Communications-Direct Memory Access (SMC-D)

Y

Y

Y

Simultaneous multithreading (SMT)

Y

Y

Y

Single Instruction Multiple Data (SIMD) instruction set

Y

Y

Y

XL C/C++ support of ARCH(11) and TUNE(11) parameters

Y

Y

Y

zEDC capability using zEDC Express

Y (requires the z/OS zEDC software feature to be enabled)

Y

Y

Notes:
  1. PTFs for base support have the following fix category:
    • For z13: IBM.Device.Server.z13-2964.RequiredService
    • For z13s: IBM.Device.Server.z13S-2965.RequiredService
  2. PTFs for exploitation have the following fix category:
    • For z13: IBM.Device.Server.z13-2964.Exploitation
    • For z13s: IBM.Device.Server.z13S-2965.Exploitation

Web deliverables are available from the z/OS downloads page at z/OS downloads.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

  • IBM z13®, which first shipped March 2015.
  • z13s, which first shipped March 2016.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Anytime before you introduce a z13 or z13s server into your environment.

Is the upgrade action required?

Yes, if you want to run z/OS V2R4, z/OS V2R3, or z/OS V2R2 on a z13 or z13s server, or if you want to run a coupling facility on a z13 or z13s server. If you plan to run only a coupling facility on a z13 or z13s system, only the sysplex-related actions are relevant. However, you must install the appropriate z/OS service for systems that are running on other servers that use the z13 or z13s coupling facilities.

Target system hardware requirements:

  • A z13 or z13s
  • Additional hardware required for specific functions.
    • IBM devices previously attached to zEC12, zBC12, and zEnterprise servers are supported for attachment to z13 or z13s channels, unless otherwise noted. The subject I/O devices must meet FICON architecture requirements
    • IBM zAware requires the following server firmware:
      • IBM zAware 10 pack FC #1010
      • IBM zAware 10 pack on a Disaster Recovery Server FC #1011
    • Flash Express requires FC #0403
    • zEDC Express requires FC #0420
    • 10 GbE RoCE Express FC #0411
    • Use of IBMWebSphere DataPower® Integration Appliance XI50 for zEnterprise (DataPower XI50z) or select IBM BladeCenter PS701 Express blades or IBM BladeCenter HX5 blades requires a z BladeCenter Extension (zBX) Model 004
    • z BladeCenter Extension (zBX) Model 004 requires:
      • AIX® 5.3, AIX 6.1, AIX 7.1 and up, and PowerVM® Enterprise Edition (on POWER7® blade)
      • Red Hat RHEL 5.5, 6.0, 7.0 and up, SLES 10 (SP4), 11 (SP1), 12 and up, 64-bit only (on HX5 blade)
      • Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2008 R2, and Microsoft Windows Server 2008 (SP2) (Datacenter Edition recommended), 64-bit only (on HX5 blade)
    • Use of hardware acceleration for cryptographic operations, including the use of the Visa, Inc. Data Secure Platform (DSP) functions requires a CPACF (FC #3863) or a CEX5S (FC #0890) feature, or both.

      See Table Note 1.

  • - Use of a Trusted Key Entry (TKE) workstation requires FC #0847.

Target system software requirements:

See the topic Support is delivered by service, z/OS features, and web deliverables in the workflow step "General recommendations and considerations for a z13 or z13s server" and Install the necessary z/OS service, as indicated in the PSP buckets that are described in the workflow step "Actions you can take before you order a z13 or z13s server."

Other system (coexistence or fallback) requirements:

  • It is recommended that you install and run the required service on your existing server. This will enable you to fall back from a hardware perspective, yet maintain your software level.
  • If you have not installed the preconditioning and exploitation PTFs for CFLEVEL 17-19, note that those PTFs are required to be installed throughout your sysplex before implementing CFLEVEL 20 or CFLEVEL 21.
  • If you plan to implement zEDC, you should install the z/OS toleration PTFs on systems that access data that is compressed using zEDC Express on a z13 or z13s server.
  • If you are using ICSF and plan to share keys with other z/OS systems that have an earlier level of ICSF, you should install the ICSF coexistence PTFs on those earlier levels of ICSF.

Restrictions:

See the workflow step called "Restrictions for a z13 or z13s server."

System impacts:

None.

Related IBM Health Checker for z/OS check:

A health check for FICON dynamic routing, CHECK(IBMIOS,IOS_FABRIC_MONITOR), is available with the PTF for APAR OA40548 for z/OS V2R1, and included in z/OS V2R2 and z/OS V2R3. This health check is designed to check all components of a dynamic routing fabric, the channel subsystem, and disk control units to make sure that dynamic routing requirements are met if dynamic routing is enabled for one or more FICON switches. This support is intended to help you identify misconfiguration errors that can result in data integrity exposures.

Table Note:
  1. IBM Z® cryptography features include VISA Format Preserving Encryption (VFPE) technology, which forms part of the Visa, Inc. Data Secure Platform (DSP). The use of VFPE technology requires a service agreement with Visa, Inc. For details, contact your Visa account manager or Visa at P2PE@visa.com. Clients who use IBM Z® cryptography features, but do not make use of the FPE functionality, are not required to enter into any such agreement with Visa.

Steps to take

Perform the workflow steps that follow:

  • "General recommendations and considerations for a z13 or z13s server"
  • "Restrictions for a z13 or z13s server"

Reference information

None.


Step 3.2.3.1 : General recommendations and considerations for a z13 or z13s server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

As you plan your migration to a z13 or z13s TM server, consider the following:

  1. Relatively few upgrade actions are new when coming from an IBM zEnterprise EC12 or zEnterprise BC12 server. Migration to an IBM z13 or IBM z13s® server has, as its base, a migration to the IBM zEnterprise EC12 or zEnterprise BC12 servers. This means that if you are migrating to a z13 or z13s server from a zEC12 or zBC12 server, and have performed the upgrade actions that are associated with the zEC12 or zBC12, you have fewer upgrade actions than if you were migrating from an earlier generation server and have not yet performed the upgrade actions that are associated with these servers. It is important to note that you can migrate directly to a z13 or z13s server without installing the intermediate servers, but you still need to ensure that any migration considerations are satisfied for the servers that you skipped. To read about the zEC12 and zBC12 server upgrade actions, see the workflow step called "Upgrade to an IBM zEnterprise EC12 or IBM zEnterprise BC12 server."
  2. Support is delivered by service, z/OS features, and web deliverables. The base support for the z13 and z13s is delivered by service (PTFs).
    • The PSP bucket that contains the required list of PTFs for the z13 server is: Upgrade 2964DEVICE, Subset 2964/ZOS and is identified by the following SMP/E Fix Category IBM.Device.Server.z13-2964.RequiredService
    • The PSP bucket that contains the required list of PTFs for the z13s server is: Upgrade 2965DEVICE, Subset 2965/ZOS and is identified by the following SMP/E Fix Category IBM.Device.Server.z13S-2965.RequiredService.

    Exploitation of some functions requires a web deliverable. Specifically:

    • If you are running z/OS V2R1 and require Crypto Express4S functionality for CCA 4.4 and other EP11 cryptographic enhancement support that includes: RKX Key Export Wrap, UDX Reduction/simplification, additional EP11 algorithms, expanded EMV support, AP Configuration simplification, CTRACE Enhancements, and KDS Key Utilization Stats, then you must download and install the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or the Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (HCR77B1).

      If you are using either of these web deliverables (HCR77A1 or HCR77B1) and sharing keys with other z/OS systems that have a lower-level of ICSF, you require the coexistence PTFs identified by the appropriate Fix Category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77A1 or IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B1.

    • If you are running z/OS V2R1 and require Crypto Express5S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or the Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (HCR77B1).

      If you are using either of these web deliverables (HCR77B0 or HCR77B1) and sharing keys with other z/OS systems that have a lower-level of ICSF, you require the coexistence PTFs identified by the appropriate Fix Category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B0 or IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B1.

    • If you are running z/OS V2R1 and require exploitation of new hardware instructions using XL C/C++ ARCH(11) and TUNE(11) including SIMD, vector programming, MASS and ATLAS libraries, you must download and install the XL C/C++ V2R1M1 web deliverable with z13 support for z/OS 2.1.
    • If you are running z/OS V1R13 and want to exploit Flash Express (including pageable 1 MB Large Page Support, optional paging of PLPA and Common (CSA, ECSA) pages to Flash Express, and Dynamic reconfiguration support for Flash Express); or 2 GB Large Page support, you must download and install the z/OS V1.13 RSM Enablement Offering Web deliverable and install the required PTFs identified by the Fix Category.
    • If you are running z/OS V1R13, you might need to install a Cryptographic Support web deliverable, depending on which ICSF functions you require.
  3. Larger coupling facility structure sizes might be necessary. When you change the coupling facility control code level (CFLEVEL), your coupling facility structure sizes might change. If, as part of your migration to a z13 server, you change the CFLEVEL, you might have larger structure sizes than you did previously. If your CFLEVEL is identical, structure sizes are not expected to change when you migrate from a previous server to a newer generation server. In addition, similar to CFLEVEL 17 and later, ensure that the CF LPAR has at least 512MB of storage. CFLEVEL Levels 20 and 21, introduced on the z13 and 13s, support the Coupling Facility use of Large Memory to improve availability for larger CF cache structures and data sharing performance with larger DB2 Group Buffer Pools (GBP). This support removes inhibitors to using large CF cache structures, enabling use of Large Memory to appropriately scale to larger DB2 Local Buffer Pools (LBP) and Group Buffer Pools (GBP) in data sharing environments.
  4. Use the same software level throughout a sysplex. Having members of a sysplex at the same software level (other than during brief migration periods) is good software management policy.
  5. Migrate hardware and software at different times. To minimize the amount of change (and therefore risk) that you experience at one time, do not migrate your software release level at the same time that you migrate your hardware.
  6. Use the latest version of SCRT. In z/OS V2R3, you do not need to update SCRT because it is included in the z/OS base. If you are running an earlier release of z/OS, and you use SCRT, make sure that SCRT is at the latest level. This is a requirement for sub-capacity pricing. The latest level of SCRT for releases prior to z/OS V2R3 can be downloaded from the SCRT web site at IBM Z software pricing - Licensing - Sub-capacity licensing.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMIOS,IOS_FABRIC_MONITOR.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 3.2.3.2 : Restrictions for a z13 or z13s server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Restrictions associated with the z13™ and z13s™ servers are described as follows:

  1. Functional limitations. Not all z13 or z13s functions are available in every z/OS release. See the tables in workflow step "Upgrade to an IBM z13 server" for a list of the z13 and z13s functions available in each z/OS release. Some functions have migration or exploitation considerations (see workflow step "Actions you can take before you order a z13 or z13s server" and "Migration and exploitation considerations for z13 and z13s server functions.") Many functions are enabled or disabled, based on the presence or absence of the required hardware and software. If you plan to exploit new z13 or z13s functions, you can install the software and hardware in either order; that is, there is no requirement to install either software or hardware first to exploit a specific function. However, because of outage windows and testing considerations, you might want to consider installing all the software and PTFs required for the machine and the functions you plan to exploit first, then upgrade the hardware and, finally, update your customization to exploit the new functions.
  2. z13 and z13s servers in a sysplex.
    • A Parallel Sysplex that contains a z13 or z13s server either for a z/OS image or a CF image can only contain other z13 or z13s servers, or z196, z114, zEC12, or zBC12 servers.

      If you are running z/OS on any servers earlier than a z196 or z114 server, you cannot add a z13 or z13s server to that sysplex; that is, you will not be able to perform rolling IPLs to introduce a z13 or z13s server if you have any of the earlier servers as z/OS images or coupling facility images in the sysplex.

      The earlier servers in the sysplex must be upgraded to z196, z114, or later to have z13 or z13s servers supported in the sysplex. If you have any z/OS images or coupling facility images on an earlier server, and you intend to introduce a z13 or z13s server into that sysplex, you must migrate those images to a z196, z114, or later server before introducing the z13 or z13s server.

      GRS supports the use of FICON CTCs for Ring configurations. However, if you are currently using ESCON CTCs for GRS ring configurations within a sysplex, consider converting to GRS Star if possible, or using XCF signalling in a GRS ring configuration. XCF sysplex signalling is preferred instead of GRS CTC connections.

    • InterSystem Channel 3 (ISC-3) and Integrated Cluster Bus 4 (ICB-4) Coupling Links are not supported on z13 or z13s CPC. Instead, the IBM Integrated Coupling Adapter (ICA SR), introduced on the z13 and z13s, is a two-port, short distance coupling fanout that utilizes a new coupling channel type: CS5. The ICA SR can only be used for coupling connectivity between z13 or z13s servers, and the ICA SR can only connect to another ICA SR. IBM recommends that you order ICA SR (#0172) on the z13 processors used in a Parallel Sysplex to help ensure coupling compatibility with future processor generations. You can also use 12x InfiniBand coupling links, which are designed to replace Integrated Cluster Bus 4 (ICB-4), and to complement 1x InfiniBand and ISC-3 on a z13 or z13s server. InfiniBand coupling can provide significantly improved service times compared to ISC-3s for distances up to 150 meters. You can read about coupling links in IBM System z® Connectivity Handbook (SG24-5444).
    • The z13 or z13s server cannot be connected to a Sysplex Timer (9037-002). The Server Time Protocol (STP) feature is the follow-on to the Sysplex Timer. STP is designed to allow multiple servers and coupling facilities to maintain time synchronization with each other without requiring a Sysplex Timer. STP is a hardware feature of the z13, z13s, zEC12, zBC12, z196, and z114. For more information about how to implement STP, see the Server Time Protocol (STP) website.

      The STP design introduced a concept called Coordinated Timing Network (CTN). A CTN is a collection of servers and coupling facilities that are time-synchronized to a time value called Coordinated Server Time. A CTN can be configured in two ways:

      • STP-only CTN, which does not require a Sysplex Timer. A z13 or z13s must participate in an STP-only CTN.
      • Mixed-CTN (External Time Reference and STP), which does require a Sysplex Timer. zEC12 and zBC12 were the last servers to support mixed-CTN. The z13 and z13s do not support connections to a Mixed-CTN. All servers in the network must be configured in STP-only mode. Consider migrating servers that require time synchronization, such as to support a base or Parallel Sysplex, to the Server Time Protocol (STP).

    For more information, see the following references:

  3. Plan for discontinued functions. For a list of functions on the z13 server that are planned to be discontinued on future servers, see the workflow step "Accommodate functions for the z13 server or z13s to be discontinued on future servers."
  4. Unsupported hardware features. The following hardware features cannot be ordered and cannot be carried forward from an upgrade on an earlier server to the z13 server.
    • HCA2-O
    • HCA2-O LR
    • ISC-3 links
    • CHPID type OSN (OSA-Express for NCP) is not supported on the OSA-Express5S GbE LX feature
    • Crypto Express3 (#0864)
    • Crypto Express4S (#0865)
    • STP Mixed CTN. The zEC12 and zBC12 were the last IBM Z® servers to support connections to an STP Mixed CTN. This also includes the Sysplex Timer (9037). Starting with z13, servers that require Time synchronization, such as to support a base or Parallel Sysplex, will require Server Time Protocol (STP) and all servers in that network must be configured in STP-only mode.
    • IBM zEnterprise Application Assist Processor (zAAP). IBM continues to support running zAAP workloads on IBM z Integrated Information Processors (zIIPs). IBM has removed the restriction preventing zAAP-eligible workloads from running on zIIPs when a zAAP is installed on the CEC. This change was intended to help facilitate migration and testing of zAAP workloads on zIIPs. With a z13, one CP must be installed with the installation of any zIIPs or prior to the installation of any zIIPs. The total number of zIIPs purchased cannot exceed twice the number of CPs purchased. However, for upgrades from zEC12s with zAAPs, conversions from zAAPs may increase this ratio to 4:1.
  5. Carry forward hardware features. The following hardware features are not orderable on z13 servers. If they are installed on your existing server at the time of an upgrade to a z13 server, they can be retained or carried forward.
    • HMC #0091
    • HCA2-C Fanout #0162
    • IFB-MP Daughter Card #0326
    • STI-A8 Mother Card #0327
    • Flash Express #0402 and #0403
    • OSA-Express4S 1 GbE LX #0404
    • OSA-Express4S 1 GbE SX #0405
    • OSA-Express4S 10 GbE LR #0406
    • OSA-Express4S 10 GbE SR #0407
    • OSA-Express4S 1000BASE-T #0408
    • OSA-Express5S GbE LX #0413
    • OSA-Express5S GbE SX #0414
    • OSA-Express5S 10 GbE LR #0415
    • OSA-Express5S 10 GbE SR #0416
    • OSA-Express5S 1000BASE-T #0417
    • TKE workstation #0842
    • Addl smart cards #0884
    • TKE Smart Card Reader #0885
    • FICON Express8 10KM LX #3325
    • FICON Express8 SX #3326
    • FICON Express8S 10Km LX #0409
    • FICON Express8S SX #0410
    • 10GbE RoCE Express #0411
    • zEDC Express #0420
    • Fill and Drain Kit #3378
    • Universal Lift Tool/Ladder #3759

    Also, FICON Express8 will not be supported on future high-end IBM Z® servers as carry forward on an upgrade. The z13 and z13s servers will be the last IBM Z® servers to offer ordering of FICON Express8S channel features. Enterprises that have 2GB device connectivity requirements must carry forward these channels.

    For information about supported storage controllers, see the workflow step "Ensure that you are using supported servers, storage controllers, and machine facilities."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.3.3 : Actions you can take before you order a z13 or z13s server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

You can perform the following upgrade actions before you order or install a z13 or z13s TM server:

  1. Review the sysplex configuration in which the z13 or z13s server will participate. See the workflow step called "Restrictions for a z13 or z13s server" for a description of the limitations when using z13 or z13s servers with certain earlier servers in a Parallel Sysplex.
  2. Implement an STP timing network. This action is needed because Sysplex Timers (9037-002) are not supported on z13 or z13s servers.
  3. Migrate from ISC-3 links to Infinband or Integrated Coupling Adapter (ICA) links. This action is needed because ISC-3 links are not supported on z13 or z13s servers. If desired, you can take this action after you order a z13 or z13s server, as you upgrade to the new server.
  4. Migrate from unsupported hardware features to newer technology. This action is needed because ESCON, FICON Express4, Crypto Express3, and OSA-Express3 are not supported on z13 or z13s servers. See the following steps in this workflow:
    • "Restrictions for a z13 or z13s server"
    • "Replace unsupported devices"
    • "Provide for new device installations"
  5. Determine the level of cryptographic support you require on a z13 or z13s server. The level of function provided for cryptographic support differs by z/OS release and the installed ICSF web deliverable. Also, toleration PTFs are available for some cryptographic web deliverables.

    For z/OS V2R3, if you are using the level of ICSF that is shipped as part of z/OS V2R3, you can use all functions of the Crypto Express5 feature on a z13 or z13s server.

    For z/OS V2R2, consider the following:

    • If you are using the level of ICSF that is shipped as part of z/OS V2R2, you can use the most functions of the Crypto Express5 feature on a z13 or z13s server.
    • The Cryptographic Support for z/OS V1R13 - z/OS V2R2 web deliverable (FMID HCR77B1) provides some additional function and also incorporates enhancements that are available in PTFs for the base level of ICSF included in z/OS V2R1. The web deliverable includes new operator commands with Parallel Sysplex wide scope that can be used to perform certain cryptographic administrative functions. These functions include activating, deactivating, and restarting cryptographic coprocessors. This support can also be used to display status for available cryptographic devices and information about active key data sets (KDSs).

    For z/OS V2R1, consider the following:

    • If you are using the level of ICSF that is shipped as part of z/OS V2R1, you can tolerate Crypto Express5 on a z13 or z13s server, which treats Crypto Express5S cryptographic coprocessors and accelerators as Crypto Express4S coprocessors and accelerators. However, you must install the required PTFs identified by the SMP/E fix category:
      • For the z13: IBM.Device.Server.z13-2964.RequiredService
      • For the z13s: IBM.Device.Server.z13S-2965.RequiredService
    • If you require support for greater than 16 domains (up to 85) on Crypto Express5S, you must install the PTFs that are identified by the appropriate fix category IBM.Device.Server.z13-2964.Exploitation or IBM.Device.Server.z13S-2965.Exploitation, or install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or a later ICSF web deliverable.
    • If you require Crypto Express4S functionality for CCA 4.4 and other EP11 cryptographic enhancement support that includes: RKX Key Export Wrap, UDX simplification, additional EP11 algorithms, expanded EMV support, AP Configuration simplification, CTRACE Enhancements, and KDS Key Utilization stats, you must download and install the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or a later ICSF web deliverable.

      Note: If you are using the Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77A1) or a later ICSF web deliverable, and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs listed here, which are identified by fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77A1, or the FIXCAT for the ICSF level that you are using.

    • If you require Crypto Express5S exploitation support for the next Generation Coprocessor support or VISA Format Preserving Encryption (FPE), you must download and install the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 web deliverable (FMID HCR77B0) or a later ICSF web deliverable.

      Note: If you are using the Enhanced Cryptographic Support for z/OS V1R13-z/OS V2R1 Web Deliverable (FMID HCR77B0) or a later ICSF web deliverable, and sharing keys with other z/OS systems that have a lower level of ICSF, you require the coexistence PTFs listed here, which are identified by fix category: IBM.Coexistence.ICSF.z/OS_V1R13-z/OS_V2R1-HCR77B0, or a later ICSF web deliverable.

  6. Install the necessary z/OS service, as indicated in PSP buckets. You must obtain all of the appropriate Preventive Service Planning (PSP) buckets. In addition to the hardware PSP buckets, you must also obtain the software PSP buckets. Use the Fix Categories that are specified in the associated FIXCAT HOLDDATA to identify PTFs required for the z13 server, PTFs needed to exploit z13 capabilities, and PTFs recommended to fix known problems. Specifically, fixes in the following categories:
    • For the z13:
      • IBM.Device.Server.z13-2964.RequiredService
      • IBM.Device.Server.z13-2964.Exploitation
      • IBM.Device.Server.z13-2964.RecommendedService
    • For the z13s:
      • IBM.Device.Server.z13S-2965.RequiredService
      • IBM.Device.Server.z13S-2965.Exploitation
      • IBM.Device.Server.z13S-2965.RecommendedService

    Fixes required for several zEnterprise functions (such as Parallel Sysplex InfiniBand Coupling Links, Server Time Protocol (STP), the Unified Resource Manager, High Performance FICON for IBM z Systems (zHPF), and zEnterprise Data Compression (zEDC) are not listed in the hardware PSP bucket, but can be found by using the following Fix Categories:

    • For the z13:
      • IBM.Device.Server.z13-2964.ParallelSysplexInfiniBandCoupling
      • IBM.Device.Server.z13-2964.ServerTimeProtocol
      • IBM.Device.Server.z13-2964.UnifiedResourceManager
      • IBM.Device.Server.z13-2964.zHighPerformanceFICON
      • IBM.Function.zEDC
    • For the z13s:
      • IBM.Device.Server.z13S-2965.ParallelSysplexInfiniBandCoupling
      • IBM.Device.Server.z13S-2965.ServerTimeProtocol
      • IBM.Device.Server.z13S-2965.UnifiedResourceManager
      • IBM.Device.Server.z13S-2965.zHighPerformanceFICON
      • IBM.Function.zEDC

    Because the PTFs associated with these Fix Categories are not specific to a z13 server, you should consider specifying a generic wildcard for the server to ensure that you have all the appropriate service installed. For example:

    • IBM.Device.Server.*.ParallelSysplexInfiniBandCoupling
    • IBM.Device.Server.*.ServerTimeProtocol
    • IBM.Device.Server.*.UnifiedResourceManager
    • IBM.Device.Server.*.zHighPerformanceFICON

    Similarly, fixes needed for zBX or to support the IBM DB2 Analytics Accelerator (IDAA) are not listed in the hardware PSP bucket, but can be found by using the following Fix Categories:

    • IBM.Device.Server.zBX-2458
    • IBM.DB2.AnalyticsAccelerator.*

    If you are exploiting z13 capabilities by installing a web deliverable, you must install the PTFs listed in the software PSP buckets for each of the web deliverables that you are installing. See the program directory for the web deliverable to identify the required software PSP buckets.

    The REPORT MISSINGFIX command checks your GLOBAL zone for FIXCAT HOLDDATA matching the FIXCAT values specified on the command. The command then compares the APARs identified in that FIXCAT HOLDDATA with the PTFs installed in the specified zones, and produces a report to identify any APARs not resolved. In other words, it reports which PTFs (fixes) are missing for the specified fix categories. Furthermore, the command produces a customized job that is used to obtain any PTFs not already received through the RECEIVE ORDER command, and install any missing service via the APPLY CHECK command.

    The FIXCAT operand on the REPORT MISSINGFIX command can list multiple fix categories, as well as using the same wildcarding techniques described in this topic for the SOURCEID operand. Because both of these techniques are simple and integrated into basic SMP/E commands, use them periodically to ensure the latest PTFs specified in the hardware and software PSP buckets are installed (because PSP buckets can be updated daily). SMP/E also provides an Explorer function which helps in identifying new fix categories which might be of interest. For a description of all the fix categories, see the Values and Descriptions page at IBM Fix Category Values and Descriptions. For more information about the REPORT MISSINGFIX command, see z/OS SMP/E Commands.

  7. Run the CFSIZER tool. If you are moving your coupling facilities and the coupling facility structures are on a higher CFLEVEL than they were previously, run the Coupling Facility Structure Sizer (CFSIZER) tool to find out if you have to increase coupling facility structure sizes. Prepare to make the necessary changes to the CFLEVEL as indicated by the tool.

    You can download the CFSIZER tool at Coupling Facility sizer. Also, see the workflow step called "Update your CFRM policy with coupling facility structure size changes."

    Note: After you make a coupling facility available on the new hardware, you can run the Sizer utility, an authorized z/OS program, to evaluate structure size changes. The Sizer utility is distinct from CFSizer, and should be run after the new hardware (CFLEVEL) is installed, but before any CF LPAR on the new hardware is populated with structures. You can download the Sizer utility at CFSizer Alternate Sizing Techniques.

  8. Prepare for the new machine instruction mnemonics. In support of the z13 server, there are new machine instructions. The new machine instructions (mnemonics) can collide with (be identical to) the names of Assembler macro instructions you use. In the event of such collisions, the Assembler default opcode table (UNI) treats specification of these names as instructions when the z13 required service is installed, probably causing Assembler error messages and possibly causing generation of incorrect object code. If you write programs in Assembler Language, compare the names of Assembler macro instructions that are used to the new machine instructions (documented in the latest z/Architecture Principles of Operation, SA22-7832) to identify any such conflicts or collisions that would occur. Identical names cause Assembler errors or the generation of incorrect object code when you assemble your programs. For information about a tool to help in identifying mnemonic conflicts, see IBM Techdocs. Search for the Techdoc PRS5289.

    If a conflict is identified, take one of these actions:

    • Change the name of your macro instruction.
    • Specify PARM='...OPTABLE(YOP)...' (or some other earlier opcode table).
    • Specify a separate ASMAOPT file containing assembler options such as in the previous method (this method requires no changes to source code or JCL).
    • Add as the first statement of your source program: *PROCESS OPTABLE(YOP) (or some other earlier opcode table).
    • Specify the PROFILE option either in JCL or the ASMAOPT file, and the specified or default member of the SYSLIB data set is copied into the front of the source program.
    • If you must use both a new instruction and a macro with the same name in an assembly, you can use a coding technique that permits both use of a new instruction and a macro with the same name in an assembly such as HLASM mnemonic tags (:MAC :ASM).
  9. Decide on the steps to take for your migration to a z13 server. Besides the steps listed here, see the following workflow step for guidance: "Migration and exploitation considerations for z13 and z13s server functions."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.3.4 : Migration and exploitation considerations for z13 and z13s server functions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

The following z13 and z13s TM functions have considerations when you are planning for migration and exploitation. For PTF information, see the table notes for "Base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4."

  1. Large Systems Performance Reference (LSPR) method. LSPR is designed to provide comprehensive z/Architecture processor capacity ratios for different configurations of central processors (CPs) across a wide variety of system control programs and workload environments.
  2. Simultaneous multithreading (SMT). Incremental throughput is achieved partly because the new processor chip offers intelligently implemented 2-way simultaneous multithreading. Simultaneous multithreading allows two active instruction streams per core, each dynamically sharing the core's execution resources. SMT is available on the z13 for workloads that are running on the Integrated Facility for Linux (IFL) and the IBM z Integrated Information Processor (zIIP).
  3. CFLEVEL 20 and CFLEVEL 21 support. CFLEVEL 20 and 21 support the Coupling Facility use of Large Memory to improve availability for larger CF cache structures and data sharing performance with larger DB2 Group Buffer Pools. This support removes inhibitors to using large CF cache structures, enabling use of Large Memory to scale to larger DB2 Local Buffer Pools and Group Buffer Pools in data sharing environments.
  4. Coupling links. IBM z13 introduced new PCIe (Integrated Coupling Adapter ICA SR) based Short Reach coupling links using a new CHPID type, CS5. ICA-SR links can only connect z13 and z13s CPCs to other z13 and z13s CPCs.

    IBM z13 and z13s CPC now support up to 256 links. A single z/OS or a CF Image supports a maximum of 128 links. When displaying STP (DISPLAY ETR) from a z/OS image, information is provided for the entire CPC. If more than 128 links are defined, the z/OS support must be installed on all z/OS releases running on that CPC, so that information about more than 128 links, including STP timing information, can be displayed.

  5. SIMD. z/OS V2R1 (and later) is designed to support the new vector extension facility (Single Instruction Multiple Data, SIMD) instructions available on IBM z13 servers. SIMD provides a powerful framework for development of new Business Analytics workloads, porting math-intensive workloads from other platforms, and accelerating Business Analytics workloads on IBM z13 and z13s servers. High Data Intensity, High Computational Intensity, Predictive IT Analytics, Advanced Security/Crypto, BI Reporting, Perspective Analytics, and Next-Generation Data Warehousing are some of the workloads that may benefit from Data Parallelism (SIMD). z/OS support includes enablement of Vector Registers (VR) on IBM z13 and z13s servers, Mathematical Acceleration Subsystem (MASS), and Automatically Tuned Linear Algebra Software (ATLAS) support, as well as Language Environment enablement for C runtime functions.
  6. Cryptographic Enhancements. Cryptographic enhancements for z/OS V2R1 (and later) on z13 servers include:
    • VISA Format Preserving Encryption (VFPE). Support for VFPE algorithms in CCA-based callable services helps legacy databases to contain encrypted data of sensitive fields without having to restructure the database or applications. This support relies on the Crypto Express5S coprocessor.
    • Greater than 16 Domain support. This support allows a cryptographic coprocessor to be shared across more than 16 domains, up to the maximum number of LPARs on the system. This support relies on enhanced firmware available with a minimum microcode level for the Crypto Express5S coprocessor.
    • Trusted Key Entry (TKE) 8.0 Licensed Internal Code (LIC). This support includes Crypto Express5S Coprocessor support, FIPS Certified Smart Card, Crypto Coprocessors with more than 16 domains, a full-function migration wizard for EP11 coprocessors, new master key management functions, a Smart Card Readers Available indicator, a Configure Displayed Hash Size utility, ECC Authority Signature Keys, print capability, new features in the Crypto Node Management (CNM) utility, ENC-Zero verification pattern for 24-byte DES operational keys, and usability enhancements.

    See Decide on the steps you will take for your migration to a z13 server in the workflow step called "Actions you can take before you order a z13 or z13s server."

  7. IBM zAware system. The IBM zAware feature is designed to offer a near real-time, continuous learning, and diagnostics capability intended to help you pinpoint and resolve potential problems quickly enough to minimize impacts to your business. The new version of IBM zAware introduces a new generation of technology with improved analytics to provide better results. After you order a z13 or z13s server, you can prepare to set up an IBM zAware environment by defining the IBM zAware logical partition (LPAR), defining and using OPERLOG log streams, and network definitions to connect the z/OS LPAR to the IBM zAware LPAR. For more information, see IBM z Advanced Workload Analysis Reporter (IBM zAware) Guide, (SC27-2623), and z/OS MVS Setting Up a Sysplex.
  8. Java exploitation. This support is added by:
    • IBM 31-bit SDK for z/OS, Java Technology Edition, Version 8 (5655-DGG)
    • IBM 64-bit SDK for z/OS, Java Technology Edition, Version 8 (5655-DGH)
  9. Flash Express. With this support, z/OS is designed to help improve system availability and responsiveness by using Flash Express across transitional workload events such as market openings, and diagnostic data collection. z/OS is also designed to help improve processor performance by supporting middleware exploitation of pageable large (1 MB) pages. This support requires the Flash Express hardware feature.
  10. 2GB Large Page support. This support includes support for 2 GB large fixed pages.
  11. New z/Architecture instructions: XL C/C++ ARCH(11) and TUNE(11) parameters. This function provides new hardware instruction support, including support for the vector facility, the decimal floating point packed conversion facility, and numerous performance improvements (machine model scheduling and code generation updates). Single Instruction Multiple Data (SIMD) instruction set and execution support is provided through the new vector support in the compiler, including Business Analytics vector processing through the MASS and ATLAS libraries. Unlike prior generations of servers, to use any of these functions on z/OS V2R1, you must download and install the XL C/C++ V2R1M1 web deliverable with z13 support for z/OS 2.1.
  12. FICON Express16S. FICON Express16S supports a link data rate of 16 gigabits per second (GBPS) and auto-negotiation to 4 or 8 GBPS for synergy with existing switches, directors, and storage devices. With support for native FICON, High Performance FICON for System z (zHPF), and Fibre Channel Protocol (FCP), the new FICON Express16S channel is designed to work with your existing fiber optic cabling environment. The FICON Express16S feature running at end-to-end 16 GBPS link speeds provides reduced latency for large read/write operations, and increased bandwidth compared to the FICON Express8S feature.
  13. FICON Dynamic Routing. With z13, FICON channels are no longer restricted to the use of static Storage Area Network (SAN) routing policies for Inter-Switch Links (ISLs) for cascaded FICON directors. You need to ensure that all devices in your FICON SAN support FICON Dynamic Routing before implementing this feature.
  14. Improved High Performance FICON for System z (zHPF) I/O Execution at Distance. High Performance FICON for System z (zHPF) has been enhanced to allow all large write operations (> 64 KB) at distances up to 100 km to be executed in a single return trip to the control unit, thereby not elongating the I/O service time for these write operations at extended distances.
  15. Improved Channel Subsystem (CSS) Scalability. The IBM Z® servers have improved the channel subsystem (CSS) scalability, as follows:
    • The z13 server improves CSS scalability with support for six logical channel subsystems (LCSSs), which are required to support the 85 LPARs for z13, four subchannel sets (to support more devices per logical channel subsystem), and 32K devices per FICON channel, up from 24K channels in the previous generation. Additionally, a fourth subchannel set for each LCSS is provided to facilitate elimination of single points of failure for storage after a disk failure.
    • The z13s server improves CSS scalability with support for three logical channel subsystems (LCSSs) which are required to support the 40 LPARs for IBM z13s, three subchannel sets (to support more devices per logical channel subsystem), and 32K devices per FICON channel up from 24K channels in the previous generation. Additionally, a third subchannel set for each logical channel subsystem (LCSS) is provided to facilitate elimination of single points of failure for disk storage devices.
  16. PCIe and HCD Definitions. z/OS V2R1, and z/OS V2R1 HCD (FMID HCS7790) support full exploitation for z13 and z13s processors (types 2964 and 2965) with support for up to 6 channel subsystems and 4 subchannel sets. To support PCIe functions for systems that are running on zEC12, zBC12, z13, or z13s servers, HCD introduced a new dialog for defining PCIe functions and assigning the functions to LPARs.

    IBM recommends that you define and activate all the new hardware definitions on a z/OS V2R2 system, or on a V2R1 system with the appropriate HCD PTF (APAR OA44294) installed and perform software activations (with hardware validation) only on lower-level systems.

  17. Consider the changes in the CPU Measurement Facility counters. The number of CPU measurement facility counters for z13 and z13s servers remains at 128. Though the structure of the SMF 113 record does not change, the values, interpretations, and frequency of certain sections do change; therefore, current tools that use the data must be updated for the z13 and z13s servers.

    For example, consider the following SMF record field:

    • SMF113_2_CtrVN2 identifies how to interpret the MT-Diagnostic, Crypto, and Extended Counter Sets. As described in The IBM CPU Measurement Facility Extended Counters Definition for z10 and z196, SA23-2260, this field is set to 1 (for z10), 2 (for z196 or z114), 3 (for zEC12 and zBC12), or 4 (for z13 and z13s).

    Note: As of z/OS V2R1, if you use the CPU Measurement Facility, IBM recommends that your installation collect SMF 113 subtype 1 and 2 records. IBM also recommends that products process SMF 113 subtype 1 records when available because that is where future enhancements are made. If subtype 1 records are not available, products can process subtype 2 records.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.3.5 : Accommodate functions for the z13 server or z13s to be discontinued on future servers


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Note:

IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.

Description

The following changes in hardware support could affect your environment. Make the appropriate changes, as needed.

  • Removal of support for running an operating system in ESA/390 architecture mode. The z13 and z13s™ are the last IBM Z® servers to support running in ESA/390 mode. All future systems will support only operating systems running in z/Architecture mode. However, all 24-bit and 31-bit problem-state application programs originally written to run on the ESA/390 architecture will be unaffected by this change.
  • Removal of support for Classic Style User Interface on the Hardware Management Console and Support Element. The z13 and z13s are the last IBM Z® servers to support Classic Style User Interface. In the future, user interface enhancements will be focused on the Tree Style User Interface.
  • Removal of support for the Hardware Management Console Common Infrastructure Model (CIM) Management Interface. The z13 and z13s are the last IBM Z® servers to support the Hardware Console Common Infrastructure module (CIM) Management Interface. The Hardware Management Console Simple Network Management Protocol (SNMP), and Web Services Application Programming Interfaces (APIs) will continue to be supported.
  • Removal of FICON Express8 support. The z13 and z13s are the last IBM Z® servers to support FICON Express8. You should begin migrating from FICON Express8 channel features (#3325, #3326) to FICON Express16S channel features (#0418, #0419). FICON Express8 will not be supported on future high-end IBM Z® servers as carry forward on an upgrade.
  • Removal of support for ordering FICON Express8S channel features. Enterprises that have 2GB device connectivity requirements must carry forward these channels.
  • Removal of an option for the way shared logical processors are managed under PR/SM LPAR. The z13 and z13s are the last IBM Z® servers to support selection of the option Do not end the timeslice if a partition enters a wait state when the option to set a processor run-time value has been previously selected in the CPC RESET profile. The CPC RESET profile applies to all shared logical partitions on the machine, and is not selectable by logical partition.
  • Removal of support for configuring OSN CHPID types. OSN CHPIDs are used to communicate between an operating system instance running in one logical partition and the Communications Controller for Linux (CCL) product in another logical partition on the same CPC. See announcement letter #914-227 dated 12/02/2014 for details regarding withdrawal from marketing for the CCL product.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.4 : Upgrade to an IBM zEnterprise EC12 or IBM zEnterprise BC12 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

Description

An IBM zEnterprise EC12 (zEC12) and IBM zEnterprise BC12 (zBC12) server can include the following in a zEnterprise environment:

  • IBM zEnterprise EC12 server Central Processing Complex (CPC) or IBM zEnterprise BC12 server CPC
  • zEnterprise BladeCenter Extension (zBX) Model 003 with its integrated optimizers or select IBM blades
  • zEnterprise Unified Resource Manager (Unified Resource Manager)

The zEC12 and zBC12 are distinct from the earlier zEnterprise and other servers. In this publication, the IBM zEnterprise EC12 server is referred to as the model zEC12 server and the IBM zEnterprise BC12 server is referred to as the model zBC12 server.

In a Parallel Sysplex, you can include the following servers:

  • zEC12 and zBC12 servers
  • zEnterprise servers (z196 or z114)
  • z10 EC and z10 BC servers.

The specific zEC12 and zBC12 functions including base support that are used by z/OS depend on the z/OS release. Availability and other restrictions are noted in the Notes column. PTFs might be required for many of these functions. See the workflow step called "Actions you can take before you order a zEC12 or zBC12 server" for information about finding the appropriate PTFs.

Base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4

The following table shows a summary view of which zEC12 and zBC12 server functions are included in the base support for z/OS V2R2, z/OS V2R3, and z/OS V2R4.

zEC12 and zBC12 function included in base z/OS support (Y/N)

V2R2¹

V2R3¹

V2R4¹

Base support

Y

Y

Y

OSA-Express4S (GbE LX and SX, 1000BASE-T, 10 GbE LR and SR)

Y

Y

Y

OSA-Express5S (GbE LX and SX, 1000BASE-T, 10 GbE LR and SR)

Y

Y

Y

FICON Express 8S (CHPID FC)

Y

Y

Y

High Performance FICON (zHPF)

Y

Y

Y

Parallel Sysplex InfiniBand (PSIFB) Coupling Link

Y

Y

Y

CPU measurement facility

Y

Y

Y

New z/Architecture instructions: XL C/C++ ARCH(10) and TUNE(10) parameters

Y

Y

Y

Crypto Express3 Toleration (if carried forward)

Y

Y

Y

IBM zEnterprise Unified Resource Manager

Y

Y

Y

IBM zEnterprise BladeCenter Extension (zBX) Model 3

Y

Y

Y

GRS FICON CTC toleration

Y

Y

Y

Notes:
  1. PTFs for base support have a fix category of either:
    • For zEC12: IBM.Device.Server.zEC12-2827
    • For zBC12: IBM.Device.Server.zBC12-2828
  2. PTFs for exploitation have a fix category of either:
    • For zEC12: IBM.Device.Server.zEC12-2827.Exploitation
    • For zBC12: IBM.Device.Server.zEC12-2828.Exploitation
  3. PTFs for zEDC exploitation or software decompression have a fix category (for both zEC12 and zBC12) of IBM.Function.zEDC.

Exploitation of zEC12 and zBC12 functions by z/OS V2R2, z/OS V2R3, and z/OS V2R4

The following table shows a summary view of which zEC12 and zBC12 server functions can be exploited in z/OS V2R2, z/OS V2R3, and z/OS V2R4.

zBC12 functional exploitation of z/OS support (Y/N)

V2R2²

V2R3²

V2R4²

Coupling Facility Control Code Level 18 (CFLEVEL 18)

Y

Y

Y

Coupling Facility Control Code Level 18 (CFLEVEL 19)

Y

Y

Y

CFLEVEL 19 Coupling thin interrupt support

Y

Y

Y

Crypto Express4S (#0865) exploitation, including Enterprise Security PKCS #11-Hardware Security Module (HSM), DUKPT for MAC and Data Encryption, Cipher Text Translate CCA Verb, PKDS/TKDS Constraint Relief, Random Number Cache, FIPS on Demand, and Wrapping Keys with Strong Keys

Y

Y

Y

Crypto Express4S CCA enhancements, including: Export TDES key under AES transport key, Diversified Key Generation CBC, IPEK, RKX key wrapping method, and Integration of UDX into CCA

Y

Y

Y

Crypto Express4S: EP11 enhancements when the Crypto Express4S PCIe adapter is configured as an EP11 coprocessor, including: (PKCS #11 v2.1 PSS, EP11 Key agreement algorithms, and Offload Generation of Domain Parameters)

Y

Y

Y

Crypto Express4S support of greater than 16 Domains

Y

Y

Y

Flash Express (Storage Class Memory or SCM)

Y

Y

Y

Pageable 1 MB Large Page Support.

Y

Y

Y

Dynamic reconfiguration support for Flash Express.

Y

Y

Y

2 GB Large Page support.

Y

Y

Y

Optional PLPA/common page data set support.

Y

Y

Y

10GbE RoCE Express

Y

Y

Y

Java Exploitation of Transactional Execution (requires Java7 SR3)

Y

Y

Y

IBM System Advanced Workload Analysis Reporter (IBM zAware)

Y

Y

Y

New z/Architecture instructions: XL C/C++ ARCH(10) and TUNE(10) parameters

Y

Y

Y

New z/Architecture Assembler Language instruction mnemonic

Y

Y

Y

zEDC capability using zEDC Express

Y³ (requires the z/OS zEDC software feature to be enabled)

Y³ (requires the z/OS zEDC software feature to be enabled)

Y³ (requires the z/OS zEDC software feature to be enabled)

Notes:
  1. PTFs for base support have a fix category of either:
    • For zEC12: IBM.Device.Server.zEC12-2827
    • For zBC12: IBM.Device.Server.zBC12-2828
  2. PTFs for exploitation have a fix category of either:
    • For zEC12: IBM.Device.Server.zEC12-2827.Exploitation
    • For zBC12: IBM.Device.Server.zEC12-2828.Exploitation
  3. PTFs for zEDC exploitation or software decompression have a fix category (for both zEC12 and zBC12) of IBM.Function.zEDC.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

  • IBM zEnterprise EC12, which first shipped September 2012.
  • IBM zEnterprise BC12 (zBC12), which first shipped September 2013.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Anytime before you introduce a zEC12 or zBC12 server into your environment.

Is the upgrade action required?

Yes, if you want to run z/OS V2R3 or z/OS V2R2 on a zEC12 or zBC12 server, or if you want to run a Coupling Facility on a zEC12 or zBC12 server. If you will run only a Coupling Facility on a zEC12 or zBC12 system, only the sysplex-related actions are relevant.

Target system hardware requirements:

  • A zEC12 or zBC12
  • Additional hardware required for specific functions.
    • IBM devices previously attached to IBM System z10, z196 and zSeries servers are supported for attachment to zEC12 channels, unless otherwise noted. The subject I/O devices must meet FICON architecture requirements
    • IBM zAware requires the IBM zAware server firmware (FC #0011, #0101, and #0102)
    • Flash Express requires FC #0402
    • zEDC Express requires FC #0420
    • 10 GbE RoCE Express FC #0411
    • Use of IBMWebSphere DataPower Integration Appliance XI50 for zEnterprise (DataPower XI50z) or select IBM BladeCenter PS701 Express blades or IBM BladeCenter HX5 blades requires a zEnterprise BladeCenter Extension (zBX) Model 003

Target system software requirements:

  1. See the list of PTFs in the Software Service Level section of the PSP buckets and use the SMP/E Fix Categories:
    • For zEC12 base support: IBM.Device.Server.zEC12-2827
    • For zBC12 base support: IBM.Device.Server.zBC12-2828
    • For zEC12 exploitation: IBM.Device.Server.zEC12-2827.Exploitation
    • For zBC12 exploitation: IBM.Device.Server.zBC12-2828.Exploitation
    • For zEC12 and zBC12 zEDC exploitation or toleration: IBM.Function.zEDC
  2. See Support is delivered by service, z/OS features, and web deliverables described in the workflow step called "General recommendations and considerations for a zEC12 or zBC12 server" and Install the necessary z/OS service, as indicated in PSP buckets described in the workflow step called "Actions you can take before you order a zEC12 or zBC12 server."

Other system (coexistence or fallback) requirements:

  • It is recommended that you install and run the zEnterprise required service on your existing server. This will enable you to fall back from a hardware perspective, yet maintain your software level.
  • If you have not installed the preconditioning and exploitation PTFs for CFLEVEL 17, note that these PTFs are required to be installed throughout your sysplex before implementing CFLEVEL 18 or 19.
  • If you plan to implement zEDC, you should install the z/OS toleration PTFs on systems that access data that is compressed using zEDC Express on a zEC12 or zBC12 server.

Restrictions:

See the workflow step called "Restrictions for a zEC12 or zBC12 server."

System impacts:

None.

Related IBM Health Checker for z/OS check:

To verify that HiperDispatch is enabled on a z196 or later system, use IBMSUP, SUP_HiperDispatchCPUConf, which was added to z/OS V1R12 with APAR OA30476.

Steps to take

Follow the information in the follwoing steps:

  • "General recommendations and considerations for a zEC12 or zBC12 server"
  • "Restrictions for a zEC12 or zBC12 server"

Reference information

None.


Step 3.2.4.1 : General recommendations and considerations for a zEC12 or zBC12 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

As you plan your migration to a zEnterprise server, consider the following:

  1. Relatively few upgrade actions are new when coming from a z196 or z114 server. Migration to an IBM zEnterprise EC12 or zEnterprise BC12 server has, as its base, a migration to the z196 or z114 servers. This means that if you are migrating to a zEnterprise server from a z196 or z114 server, and have performed the upgrade actions that are associated with the z196 or z114, you have fewer upgrade actions than if you were migrating from an earlier generation server and have not yet performed the upgrade actions that are associated with these servers. It is important to note that you can migrate directly to a zEC12 or zBC12 server without installing the intermediate servers, but you still need to ensure that any migration considerations are satisfied for the servers that you skipped.
  2. Support is delivered by service, z/OS features, and web deliverables. The base support for an zEC12 or zBC12 server is delivered by service (PTFs).
    • The PSP bucket that contains the required list of PTFs for zBC12 is: Upgrade 2828DEVICE, Subset 2828/ZOS and is identified by the following SMP/E Fix Category IBM.Device.Server.zBC12-2828.
    • The PSP bucket that contains the required list of PTFs for zEC12 is: Upgrade 2827DEVICE, Subset 2827/ZOS

    and is identified by the following SMP/E Fix Category IBM.Device.Server.zEC12-2827.

    For Flash Express support (including dynamic reconfiguration support and optional PLPA/COMMON page data set support), pageable 1 MB Large Page support, and 2 GB Large Page Support, a separate web deliverable for z/OS V1R13 (the z/OS V1R13 RSM Enablement Offering web deliverable) is required. For more information, see Decide on the steps you will take for your migration to a zEC12 or zBC12 server in the workflow step called "Actions you can take before you order a zEC12 or zBC12 server."

  3. Larger coupling facility structure sizes might be necessary. When you change the coupling facility control code level (CFLEVEL), your coupling facility structure sizes might change. zEC12 servers that were ordered before September 2013 initially shipped with CFLEVEL 18, zEC12 or zBC12 models ordered after September 2013 initially shipped with CFLEVEL 19. If, as part of your migration to a zEC12 or zBC12 server, you change the CFLEVEL, you might have larger structure sizes than you did previously. If your CFLEVEL is identical, structure sizes are not expected to change when you migrate from a previous server to a newer generation server. In addition, similar to CFLEVEL 17 and later, ensure that the CF LPAR has at least 512MB of storage. CFLEVEL 19 introduces support for storage-class (flash) memory in the CF and Coupling thin interrupt support. CF structures that exploit SCM might require significantly more CF real storage than they did before storage class memory exploitation.
  4. Use the same software level throughout a sysplex. Having members of a sysplex at the same software level (other than during brief migration periods) is good software management policy.
  5. Migrate hardware and software at different times. To minimize the amount of change (and therefore risk) that you experience at one time, do not migrate your software release level at the same time that you migrate your hardware.
  6. Use the latest version of SCRT. In z/OS V2R3, you do not need to update SCRT because it is included in the z/OS base. If you are running an earlier release of z/OS, and you use SCRT, make sure that SCRT is at the latest level. This is a requirement for sub-capacity pricing. The latest level of SCRT for releases prior to z/OS V2R3 can be downloaded from the SCRT web site at IBM Z software pricing - Licensing - Sub-capacity licensing.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMSUP,SUP_HiperDispatchCPUConfig.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 3.2.4.2 : Restrictions for a zEC12 or zBC12 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

The following restrictions are associated with zEnterprise servers:

  1. Functional limitations. Not all zEC12 or zBC12 functions are available in every z/OS release. For the zEC12 and zBC12 functions that are available in each z/OS release, see the tables in the workflows step "Upgrade to an IBM zEC12 or zBC12 server."

    Some functions have migration or exploitation considerations (see the workflow steps "Actions you can take before you order a zEC12 or zBC12 server" and "Migration and exploitation considerations for zEC12 and zBC12 server functions.") Many functions are enabled or disabled, based on the presence or absence of the required hardware and software. If you wish to position yourself to exploit any new zEC12 or zBC12 functions, you can install the software and hardware in either order; that is, there is no requirement to install either software or hardware first to exploit a specific function. However, because of outage windows and testing considerations, you might want to consider installing all the required software first, then upgrading the hardware and, finally, updating your customization to exploit the new functions.

  2. zEC12 and zBC12 servers in a sysplex.
    • A Parallel Sysplex that contains an zEC12 or zBC12 server either for a z/OS image or a CF image can contain only zEC12 or zBC12 servers or zEnterprise z196, z114, z10 EC, or z10 BC servers.

      If you are running z/OS on any servers earlier than a z10 EC or z10 BC server, you cannot add a zEC12 or zBC12 server to that sysplex; that is, you cannot perform rolling IPLs to introduce a zEC12 or zBC12 server if you have any of the earlier servers either as z/OS images or coupling facility images in the sysplex.

      The earlier servers in the sysplex must be upgraded to System z10 or later to have zEC12 or zBC12 servers supported in the sysplex. If you have any z/OS images or coupling facility images on an earlier server, and you intend to introduce a zEC12 or zBC12 server into that sysplex, you must migrate those images to a System z10 (or later) server before introducing the zEC12 or zBC12 server.

      If you are currently using ESCON CTCs for GRS ring configurations within a sysplex, consider using XCF signaling in a GRS ring configuration. XCF sysplex signaling is preferred instead of GRS CTC connections.

    • The Integrated Cluster Bus 4 (ICB-4) Coupling Links are not supported on a zEC12 or zBC12 CPC. Use 12x InfiniBand coupling links, which are designed to replace Integrated Cluster Bus 4 (ICB-4), and to complement 1x InfiniBand and ISC-3 on a zEC12 or zBC12 server. InfiniBand coupling can provide significantly improved service times compared to ISC-3s for distances up to 150 meters. You can read about InfiniBand coupling links in IBM System z Connectivity Handbook (SG24-5444).
    • The zEC12 or zBC12 server cannot be connected to a Sysplex Timer (9037-002). The Server Time Protocol (STP) feature is the follow-on to the Sysplex Timer. STP is designed to allow multiple servers and coupling facilities to maintain time synchronization with each other without requiring a Sysplex Timer. STP is a hardware feature of the zEC12, zBC12, z196, z114, z10 EC, and z10 BC. For more information about how to implement STP, see the Server Time Protocol (STP) website.

      The STP design introduced a concept that is called Coordinated Timing Network (CTN). A CTN is a collection of servers and coupling facilities that are time-synchronized to a time value called Coordinated Server Time. A CTN can be configured in two ways:

      • STP-only CTN, which does not require a Sysplex Timer.
      • Mixed-CTN (External Time Reference and STP), which does require a Sysplex Timer.

        The Sysplex Timer provides the timekeeping information in a Mixed-CTN. Even though the zEC12 or zBC12 servers do not support attachment to a Sysplex Timer, they can participate in a Mixed-CTN with a z10 server that is synchronized to the Sysplex Timer. This maintains the capability for enterprises to concurrently migrate from an existing External Time Reference (ETR) to a Mixed-CTN and from a Mixed-CTN to an STP-only CTN.

      Note:

      The zEC12 and zBC12 are the last high-end servers to support connections to an STP Mixed-CTN. All servers in the network must be configured in STP-only mode. Consider migrating servers that require time synchronization, such as to support a base or Parallel Sysplex, to the Server Time Protocol (STP).

  3. For a list of functions on the zEC12 or zBC12 server that are planned to be discontinued on future servers, see the workflow step "Accommodate functions for the zEC12 and zBC12 servers to be discontinued on future servers."
  4. Unsupported hardware features. The following hardware features cannot be ordered and cannot be carried forward from an upgrade on an earlier server to the zEC12 or zBC12 server.
    • Power® Sequence Controller (PSC).
    • FICON Express. Your installation should begin migrating to FICON Express8S channels.
    • FICON Express2. Your installation should begin migrating to FICON Express8S channels.
    • FICON Express4 4KM LX. Your installation should begin migrating to FICON Express8S channels.
    • OSA Express2. Your installation should begin migrating to OSA-Express4S (GbE LX and SX, 1000BASE-T, 10 GbE LR and SR).
    • ESCON. Your installation should begin migrating to FICON Express8S channels.
    • Dial up modems. The currently available Network Time Protocol (NTP) server option for ETS, as well as Internet time services available using broadband connections, can be used to provide the same degree of accuracy as dial-up time services. You should begin migrating from dial-up modems to broadband for RSF connections.
    Carry forward hardware features.

    The following hardware features are not orderable on zEC12 or zBC12 servers. If they are installed on your existing server at the time of an upgrade to a zEC12 or zBC12 server, they can be retained or carried forward.

    • ISC-3. Your installation should begin migrating from ISC-3 features (#0217, #0218, #0219) to 12x InfiniBand (#0163 - HCA2-O or #0171- HCA3-O fanout) or 1x InfiniBand (#0168 - HCA2-O LR or #0170 - HCA3-O LR fanout) coupling links.
    • FICON Express4 10KM LX. Your installation should begin migrating to FICON Express8S channels.
    • FICON Express4 SX. Your installation should begin migrating to FICON Express8S channels.
    • Crypto Express3.

    For information about supported storage controllers, see the workflow step "Ensure that you are using supported servers, storage controllers, and machine facilities."

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.4.3 : Actions you can take before you order a zEC12 or zBC12 server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

You can perform the following upgrade actions before you order or install a zEC12 or zBC12 server:

  1. Review the sysplex configuration in which the zEC12 or zBC12 server will participate. See the workflow step called "Restrictions for a zEC12 or zBC12 server" for the limitations of using zEC12 or zBC12 servers with certain earlier servers in a Parallel Sysplex.
  2. Implement STP (or a Mixed-CTN) timing network. This action is necessitated because Sysplex Timers (9037-002) are not supported on zEC12 or zBC12 servers.
  3. Migrate from ICB-4 to InfiniBand coupling links. This action is necessitated because ICB-4 links are not supported on zEC12 or zBC12 servers. If desired, you can take this action after you order a zEC12 or zBC12 server, as you upgrade to the new server.
  4. Migrate from unsupported hardware features to newer technology. This action is necessitated because FICON Express, FICON Express2, Crypto Express2, and OSA-Express2 10 GbE LR are not supported on zEnterprise servers. See the following steps in this workflow:
    • "Restrictions for a zEC12 or zBC12 server"
    • "Replace unsupported devices"
    • "Provide for new device installations"
  5. Install the necessary z/OS service, as indicated in PSP buckets.
    • For an IBM zEnterprise BC12 CPC, PTFs are identified in the in the 2828DEVICE PSP bucket ( Subset 2828/ZOS).
    • For an IBM zEnterprise EC12 CPC, PTFs are identified in the 2827DEVICE PSP bucket ( Subset 2827/ZOS).
    • For an IBM zEnterprise BladeCenter Extension (zBX) attached to your zEC12 CPC or zBC12 CPC, the PTFs are identified in the 2458DEVICE PSP bucket ( Subset 2458/ZOS).
    In each PSP bucket, the content is dependent on the z/OS release you will run on the zEnterprise server. If you reviewed the PSP buckets some time ago, review them again to ensure that any newly identified z/OS service has been installed. To assist you in determining if you have the recommended service (identified in these PSP buckets) installed on your system, you can use the SMP/E REPORT MISSINGFIX command in conjunction with the FIXCAT type of HOLDDATA, as follows:
    1. Acquire and RECEIVE the latest HOLDDATA onto your z/OS system(s). Use your normal service acquisition portals or download the two (2) year HOLDDATA directly from Enhanced HOLDDATA for z/OS. Ensure that you select Full from the Download NOW column (last 730 days) to receive the FIXCAT HOLDDATA, as the other files do not contain FIXCAT HOLDDATA.
    2. Run the SMP/E REPORT MISSINGFIX command on your z/OS systems and specify one or more of the following Fix Categories (FIXCAT):
      • IBM.Device.Server.zEC12-2827
      • IBM.Device.Server.zEC12-2827.Exploitation
      • IBM.Device.Server.zEC12-2827.ParallelSysplexInfiniBandCoupling
      • IBM.Device.Server.zEC12-2827.ServerTimeProtocol
      • IBM.Device.Server.zEC12-2827.zHighPerformanceFICON
      • IBM.Device.Server.zEC12-2827.UnifiedResourceManager
      • IBM.Function.zEDC
      • IBM.Device.Server.zBC12-2828
      • IBM.Device.Server.zEC12-2828.Exploitation
      • IBM.Device.Server.zBC12-2828.ParallelSysplexInfiniBandCoupling
      • IBM.Device.Server.zBC12-2828.ServerTimeProtocol
      • IBM.Device.Server.zBC12-2828.zHighPerformanceFICON
      • IBM.Device.Server.zBC12-2828.UnifiedResourceManager

      The report will identify any missing coexistence and fallback PTFs for that system. For complete information about the REPORT MISSINGFIX command, see z/OS SMP/E Commands.

    3. Periodically, you might want to acquire the latest HOLDDATA and rerun the REPORT MISSINGFIX command to find out if there are any new PTFs recommended for the zEnterprise servers.
    Notes:
    1. You can also use Service Link's PSP Service Extraction tool.
    2. Because the Enhanced PSP Tool (EPSPT) was removed the end of 2010, you can no longer use that tool to identify missing PSP bucket service. You should use SMP/E Fix Category support, which is fully integrated into SMP/E procedures and IBM product and service deliverables.
  6. Run the CFSIZER tool. If you are moving your coupling facilities and the coupling facility structures will be on a higher CFLEVEL than they were previously, run the Coupling Facility Structure Sizer (CFSIZER) tool to find out if you have to increase coupling facility structure sizes.

    If ordered before September 2013, zEC12 servers initially ship with CFLEVEL 18. For zEC12 and zBC12 servers ordered after September 2013, the servers ship with CFLEVEL 19; prepare to make the necessary changes as indicated by the tool.

    You can download the CFSIZER tool at Coupling Facility sizer. Also see the workflow step called "Update your CFRM policy with coupling facility structure size changes."

    Note: After you make a coupling facility available on the new hardware, you can run the Sizer utility, an authorized z/OS program, to evaluate structure size changes. The Sizer utility is distinct from CFSIZER, and should be run after the new hardware (CFLEVEL) is installed, but before any CF LPAR on the new hardware is populated with structures. You can download the Sizer utility at CFSizer Alternate Sizing Techniques.

  7. Decide on the steps you will take for your migration to a zEC12 or zBC12 server. In addition to the actions listed in the workflow step called "Actions you can take before you order a zEC12 or zBC12 server," also see the workflow step "Migration and exploitation considerations for zEC12 and zBC12 server functions." Also, note the following web deliverables considerations.

    The level of function provided for cryptographic support differs by z/OS release and the ICSF web deliverable that is installed. Toleration PTFs are also available for some cryptographic web deliverables:

    Consider the following:

    • For z/OS V1R13 and z/OS V2R1, if you require the cryptographic enhancements support for CCA (including Export TDES key under AES transport key, Diversified Key Generation CBC, IPEK, RKX key wrapping method, and integration of UDX into CCA), you must install the web deliverable Cryptographic Support for z/OS V1R13-z/OS V2R1 (FMID HCR77A1). You must also perform the required ICSF upgrade actions.
    • PTFs for coexistence: Coexistence PTFs must be installed on older levels of ICSF. To assist in identifying the coexistence service, you can use the following Fix Categories:
      • IBM.Coexistence.ICSF.z/OS_V1R11-V1R13-HCR7790
      • IBM.Coexistence.ICSF.z/OS_V1R12-V1R13-HCR77A0
      • IBM.Coexistence.ICSF.z/OS_V1R13-V2R1-HCR77A1

    If you plan to use the IBM zEnterprise Data Compression (zEDC) feature, you must enable it, similar to enabling other z/OS priced features. To do so, you must:

    • Notify IBM that you are using the feature
    • Update the IFAPRDxx PARMLIB member to specify that the z/OS ZEDC software feature is enabled
    • Follow the z/OS documentation to customize the exploiting functions.

    You should also ensure that all z/OS V1R13 systems that will access zEDC compressed data have the required toleration maintenance installed to enable software decompression.

  8. Review the new mnemonics introduced for the zEC12 or zBC12 server. The new mnemonics might collide with (be identical to) the names of assembler macro instructions you use or provide. In the event of such collisions, the HLASM default opcode table (UNI) treats specification of these names as instructions when APAR PM49761 and PM86821 are installed. This will probably cause assembler error messages and possibly cause generation of incorrect object code.

    If you write programs in Assembler Language, you should compare the list provided in z/Architecture Principles of Operation, SA22-7832 to the names of assembler macro instructions you use or provide, to identify any such conflicts or collisions that would occur following installation of HLASM APAR PM49761 and PM86821. If a conflict is identified, take one of the following actions:

    • Change the name of your macro instruction.
    • Specify PARM='...OPTABLE(YOP)...' (or some other earlier opcode table).
    • Specify a separate ASMAOPT file containing assembler options, such as in the previous method (this method requires no changes to source code or JCL).
    • Add, as the first statement of your source program, *PROCESS OPTABLE(YOP).
    • Specify the PROFILE option either in JCL or the ASMAOPT file, and the specified or default member of the SYSLIB data set is copied into the front of the source program.
    • If you must use both a new instruction and a macro with the same name in an assembly, you can use the following technique (where XXX is a sample mnemonic):
      Assume the default OPTABLE(UNI) is in effect XXX a,b new instruction PUSH ACONTROL save current optable definition ACONTROL OPTABLE(YOP) switch optable dynamically XXX r,s,t macro invocation POP ACONTROL restore previous definition XXX c,d new instruction

    For more information about HLASM opcode table, see HLASM Programmer's Guide, which is available at High Level Assembler and Toolkit Feature in IBM Knowledge Center.

  9. Plan for changes to your global resource serialization complex with the zEC12 or zBC12 server. If you use a global resource serialization ring complex that spans more systems than is part of the sysplex or does not use sysplex signaling for communications within the complex, you need to take upgrade actions. Instead of using global resource serialization ring, consider using the global resource serialization star configuration in a sysplex. You can take the following actions before you install the zEC12 or zBC12 server:
    • Migrate to a Parallel Sysplex that uses the recommended global resource serialization star complex.
    • Convert to a basic sysplex that uses XCF sysplex signaling with global resource serialization ring instead of GRS-managed channel-to-channel (CTC) communications.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.4.4 : Migration and exploitation considerations for zEC12 and zBC12 server functions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Consider the number of CPU measurement facility counters for zEC12 or zBC12. The number of CPU measurement facility counters for zEC12 and zBC12 is increased to 128. More extended counters means that more internal storage is required. Though the structure of the SMF 113 record does not change, the values, interpretations, and frequency of certain sections do change; therefore, current tools using the data must be updated for the zEC12 or zBC12.

For example, consider the following SMF record field:

  • SMF113_2_CtrVN2 identifies how to interpret the Crypto and Extended counter sets. As described in The IBM CPU Measurement Facility Extended Counters Definition for z10 and z196, SA23-2260, this field is set to 1 (for z10), 2 (for z196 or z114), or 3 (for zEC12 and zBC12).
Note:

As of z/OS V2R1, if you use the CPU Measurement Facility, IBM recommends that your installation collect SMF 113 subtype 1 and 2 records. IBM also recommends that products process SMF 113 subtype 1 records when available, because that is where future enhancements will be made. If subtype 1 records are not available, products can process subtype 2 records.

The following zEC12 and zBC12 functions are available on z/OS V2R1. For PTF information, see the table notes for "Server functions that can be exploited in z/OS V2R2, z/OS V2R3, and z/OS V2R4."

  1. CFLEVEL 19 Coupling thin interrupt support. With PTFs CFLEVEL 19 provides Coupling thin interrupt support that allows a shared logical coupling facility partition to be dispatched by PR/SM if not already dispatched and allows for more timely processing of events to which the CF must respond. It is designed to improve service times for shared engine coupling facilities, and to help improve the response time for asynchronous CF operations. This function requires CFLEVEL 19.
  2. Cryptographic Enhancements. Cryptographic enhancements for z/OS V2R1 on zEC12 and zBC12 server include:
    • Crypto Express4S CCA enhancements when the PCIe adapter is configured as CCA coprocessor including: Export TDES key under AES transport key, Diversified Key Generation CBC, IPEK, RKX key wrapping method, and Integration of UDX into CCA requires z/OS V2R1 with the Cryptographic Support for z/OS V1R13-z/OS V2R1 Web deliverable (FMID HCR77A1) installed.
    • Crypto Express4S EP11 enhancements when the Crypto Express4S PCIe adapter is configured as an EP11 coprocessor including: (PKCS #11 V2R1 PSS, EP11 Key agreement algorithms, and Offload Generation of Domain Parameters) and requires z/OS V2R1 with the Cryptographic Support for z/OS V1R13-z/OS V2R1 Web deliverable (FMID HCR77A1) to be installed.
    • Crypto Express4S (#0865) exploitation including Enterprise Security PKCS #11-Hardware Security Module (HSM), DUKPT for MAC and Data Encryption, Cipher Text Translate CCA Verb, PKDS/TKDS Constraint Relief, Random Number Cache, FIPS on Demand, and Wrapping Keys with Strong Keys.

    See Decide on the steps to take for your migration to a zEC12 or zBC12 server in the workflow step called "Actions you can take before you order a zEC12 or zBC12 server."

  3. zEDC capability using zEDC Express. zEDC provides IBM zEnterprise data compression/decompression capability. For z/OS V2R2, the zEDC software feature must be enabled with your product enablement policy (IFAPRDxx); then follow the z/OS V2R2 documentation to customize the exploiting functions.
  4. IBM zAware system. The IBM zAware feature is designed to offer a near real-time, continuous learning, and diagnostics capability intended to help you pinpoint and resolve potential problems quickly enough to minimize impacts to your business. After you order a zEC12 or zBC12, you can prepare to set up an IBM zAware environment by defining the IBM zAware logical partition (LPAR), defining and using OPERLOG log streams, and network definitions to connect the z/OS LPAR to the IBM zAware LPAR. For more information, see IBM z Advanced Workload Analysis Reporter (IBM zAware) Guide, (SC27-2623) and z/OS MVS Setting Up a Sysplex.
  5. Java Exploitation of Transactional Execution (requires Java 7 SR3). This function provides support for Java exploitation of the Transaction Execution Facility on IBM zEnterprise zEC12 or zBC12. Transactional Execution will offer increased scalability and parallelism to drive higher transaction throughput. Java exploitation is planned with
    • IBM 31-bit SDK for z/OS, Java Technology Edition, V7.0.0 (5655-W43)
    • IBM 64-bit SDK for z/OS, Java Technology Edition, V7.0.0 (5655-W44).
    Note:

    Using z/OS V1R13 XL C/C++ compiler and later, specify ARCH(10) to provide the hardware with built-in functions to enable applications to use the Java Transactional Execution Facility.

  6. Flash Express (Storage Class Memory or SCM). This support includes pageable 1 MB Large Page support, dynamic reconfiguration support of SCM, and optional PLPA/COMMON page data set usage. This support requires the Flash Express hardware feature.
  7. 2GB Large Page support. This support includes support for 2 GB large fixed pages.
  8. CFLEVEL 19 Flash Express. This exploitation will provide improved resilience for MQ shared queues. The function requires CFLEVEL 19 and is planned to be available in a future update.
  9. New z/Architecture instructions: XL C/C++ ARCH(10) and TUNE(10) parameters. This function provides new zArchitecture instructions.
  10. Shared Memory Communications using RDMA (SMC-R) exploitation. Shared Memory Communication using RDMA (Remote Direct Memory Access) enables transparent exploitation of RDMA technology for TCP/IP sockets based applications. It requires the 10 GbE RoCE Express hardware feature.
  11. 24k subchannels per channel (port) for the FICON Express features. This is planned to help facilitate growth as well as continuing to enable server consolidation. You will be able to define more devices per FICON channel, which includes primary, secondary, and alias devices. This support applies to the FICON Express8S, FICON Express8, and FICON Express4 features when defined as CHPID type FC.
  12. OSA-Express5S. OSA-Express5S provides a new generation of Ethernet features for use in the PCIe I/O drawer and continues to be supported by the 8 GBps PCIe Gen2 host bus. This support includes: 1000BASE-T Ethernet for copper environments, in addition to 10 Gigabit Ethernet (10 GbE) and Gigabit Ethernet (GbE) for single-mode and multimode fiber optic environment.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.4.5 : Accommodate functions for the zEC12 and zBC12 servers to be discontinued on future servers


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The following changes in hardware support could affect your environment. Make the appropriate changes as needed.

  • Removal of support for connections to an STP Mixed CTN. The zEC12 and zBC12 are the last IBM Z® servers to support connections to an STP Mixed CTN. This also includes the Sysplex Timer (9037). After the zEC12 and the zBC12, servers that require Time synchronization, such as to support a base or Parallel Sysplex, will Require Server Time Protocol (STP) and all servers in that network must be configured in STP-only mode.
  • Removal of support for Ethernet half-duplex operation and 10 Mbps link data rate. The OSA-Express4S 1000BASE-T Ethernet feature is planned to be the last copper Ethernet feature to support half-duplex operation and a 10 Mbps link data rate. The zEC12 and zBC12 servers are planned to be the last IBM Z® servers to support half-duplex operation and a 10 Mbps link data rate for copper Ethernet environments. Any future 1000BASE-T Ethernet feature will support full-duplex operation and auto-negotiation to 100 or 1000 Mbps exclusively. This hardware statement of direction is fulfilled with the delivery of OSA-Express5S.
  • Removal of ISC-3 support on IBM Z®. The zEC12 and zBC12 are planned to be the last IBM Z® servers to offer support of the InterSystem Channel-3 (ISC-3) for Parallel Sysplex environments at extended distances. ISC-3 will not be supported on future IBM Z® servers as carry forward on an upgrade. Previously, it was announced that the IBM zEnterprise 196 (z196) and IBM zEnterprise 114 (z114) servers were the last to offer ordering of ISC-3. Enterprises should continue upgrading from ISC-3 features (#0217, #0218, #0219) to 12x InfiniBand (#0171 - HCA3-O fanout) or 1x InfiniBand (#0170 - HCA3-O LR fanout) coupling links.
  • Removal of OSA-Express3 support on IBM Z®. The zEC12 and zBC12 servers are planned to be the last IBM Z® servers to offer support of the Open System Adapter-Express3 (OSA-Express3 #3362, #3363, #3367, #3370, #3371) family of features. OSA-Express3 will not be supported on future IBM Z® servers as carry forward on an upgrade. Enterprises should continue upgrading from the OSA-Express3 features to the OSA-Express4S (#0404, #0405, #0406, #0407, #0408) and OSA-Express5S features (#0413, #0414, #0415, #0416, #0417).
  • Removal of FICON Express4 support on IBM Z®. The zEC12 and zBC12 servers are planned to be the last IBM Z® servers to offer support of the FICON Express4 features (#3321, #3322). FICON Express4 will not be supported on future IBM Z® servers as carry forward on an upgrade. Enterprises should continue upgrading from the FICON Express4 features to the FICON Express8S features (#0409, #0410).
  • Removal of Crypto Express3 support on IBM Z®. The zEC12 and zBC12 servers are planned to be the last IBM Z® servers to offer support of the Crypto Express3 features (#0864 and #0871 - zBC12). Crypto Express3 will not be supported on future IBM Z® servers as carry forward on an upgrade. Enterprises should continue upgrading from the Crypto Express3 features to the Crypto Express4S feature (#0865).
  • IBM z Integrated Information Processor (zIIP) and IBM zEnterprise Application Assist Processor (zAAP) simplification. The zEC12 and zBC12 are planned to be the last IBM Z® servers to offer support for zAAP specialty engine processors. IBM intends to continue support for running zAAP workloads on zIIP processors ( zAAP on zIIP). This change is intended to help simplify capacity planning and performance management, while still supporting all the currently eligible workloads.
  • Removal of support for the HCA2-O fanouts for 12x IFB and 1x IFB InfiniBand coupling links. The zEC12 and zBC12 are planned to be the last IBM Z® servers to support the following features as carry forward on an upgrade: HCA2-O fanout for 12x IFB coupling links (#0163) and HCA2-O LR fanout for 1x IFB coupling links (#0168). Enterprises should continue upgrading to the HCA3-O fanout for 12x IFB (#0171) and the HCA3-O LR fanout for 1x IFB (#0170).
  • Removal of support for IEEE 802.3 Ethernet frame types. The zEC12 and zBC12 are planned to be the last IBM Z® servers to support IEEE 802.3 Ethernet frame types. All OSA-Express features supported on future IBM Z® servers are planned to support DIX Version 2 (DIX V2) exclusively.
Note:

IBM's statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM's sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

  • 28 August 2012 in U.S. Announcement Letter for the zEC12.
  • 23 July 2013 in U.S. Announcement Letter for the zBC12.

Applies to migration from:

z/OS V2R2.

Timing:

Before upgrading to a zEC12 or zBC12 server.

Is the upgrade action required?

No, but recommended if you are using a zEC12 or zBC12 server because this is the last IBM Z® server that will support the changes that are mentioned in Description.

Target system hardware requirements:

See "Description."

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Consider the statements in "Description" as you migrate to zEC12 or zBC12.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.5 : Ensure that you are using supported servers, storage controllers, and machine facilities


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is supported on the following IBM Z® servers:

  • IBM z14™ (z14) models M01 through M05
  • IBM z14™ Model ZR1 (z14 ZR1)
  • IBM z13
  • IBM z13s™
  • IBM zEnterprise EC12 (zEC12)
  • IBM zEnterprise BC12 (zBC12)
z/OS V2R4

supports these and later IBM storage control units:

  • 3990 Model 3 and 3990 Model 6
  • 9393
  • 2105
  • 2107
  • 2421
  • 2422
  • 2423
  • 2424

z/OS uses particular machine facilities on these servers, depending on the z/OS release. Though additional machine facilities might be available on a server, it does not mean that z/OS supports those facilities. For a list of the machine facilities that are supported for each release of z/OS, see z/OS Planning for Installation.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

z/OS V2R4

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Anytime

Is the upgrade action required?

Yes, if you use any of the servers, controllers, or machine facilities that are no longer supported to run with z/OS V2R4.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

  • During IPL/NIP processing, if you try to use an unsupported control unit for z/OS V2R4, you receive the following error condition for devices under the control unit.
    IEA434I (nnnn) ONLINE IS NOT ALLOWED, INVALID CONTROL UNIT MODEL

    During VARY ONLINE command processing after IPL/NIP, you receive the following error condition for devices under the unsupported control unit:

    IEA434I DEVICE ONLINE IS NOT ALLOWED, INVALID CONTROL UNIT MODEL
  • If you IPL z/OS V2R4 on a server that it does not support, you might receive wait state 07B-1E (decimal 30). Note:

    The number of IEA434I messages is limited to 32 during IPL/NIP to avoid exhausting initial ESQA. An IEA444I message is reported one time during IPL/NIP to indicate that more IEA434I messages are suppressed:

    IEA444I NUMBER OF IEA434I MESSAGES EXCEEDS NIP MAXIMUM

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Determine whether the servers, control units, and machine facilities that you use are supported for z/OS V2R4. If you have a question about support for any hardware that are not listed, contact your IBM representative.
  2. Install replacement servers and control units. Detach unsupported servers and control units from the system and delete their corresponding definitions from the input/output definition file (IODF).

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.6 : Enable BCPii communications on the support element


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

It is necessary to grant authority on the support element (SE) to allow the support element to accept the BCPii APIs flowing from the user application through the HWIBCPii address space. With this enablement, a logical partition can issue a subset of control program instructions to other logical partitions that are activated on the same CPC.

For Support Elements that run on z14, the method for enabling cross-partition authority is changed from previous IBM Z® servers. The setting of the cross-partition authority checkbox is replaced by new security settings in the Hardware Management Console (HMC) and the Support Element (SE), as follows:

  • CPC permission is now specified by using the System Details task.
  • Image (LPAR) permission is now specified by using the Image Activation Profile or the Change LPAR Security task.

These new security controls allow for more granular control for specifying BCPii send and receive capabilities. For example, you can enable all partitions or a subset of partitions to receive BCPii requests.

For previous IBM Z® servers, you enabled cross-partition authority by selecting the cross-partition checkbox. You selected this option on the local SE for the CPC of the image that the z/OS BCPii application is running on, plus any other systems for which BCPii communication was required.

This table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple

When change was introduced:

IBM z14, which became available September 2017.

Applies to migration from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are migrating from an earlier IBM Z® server to the z14, and you want to maintain the same BCPii permissions on the z14.

Target system hardware requirements:

IBM z14 server.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To maintain the same permissions:

If you are migrating from an earlier IBM Z® server to the z14, and you want to maintain the same BCPii permissions on the z14, you can port (export/import) your definitions to the new server. Then, perform the following steps on the HMC:

  1. Select Systems Management
  2. Select the CPC that is required.
  3. Click the System Details task.
  4. Click the Security tab to display the default settings.
    • To grant authority to all partitions on all CPCs to issue BCPii calls against this CPC, ensure that the following options are selected:
      1. Enable the system to receive commands from partitions
      2. All partitions
  5. Select CPC Operational Customization > Change LPAR Security. For each LPAR that was identified to support BCPii on the pre-z14 machine, click the current BCPii enablement level in the BCPii Permissions column and perform the following:
    • Ensure that the option Enable the partition to send commands is selected to grant authority for this LPAR to send BCPii requests to other CPCs and LPARs.
    • Ensure that the option Enable the partition to receive commands from other partitions is selected to allow other LPARs to target this LPAR with BCPii requests.
    • Ensure that the option All partitions is selected, which grants all partitions on all CPCs permission to issue BCPii calls against this LPAR.

To use more granular permissions: If you are migrating from an earlier IBM Z® server, and you want to use more granular BCPii permissions on the z14, you can select individual partitions by using the Selected partitions option for both CPC and LPAR authority.

To disable permissions:

If you do not want to enable BCPii permissions on the z14, perform the following steps on the HMC:

  1. Select Systems Management
  2. Select the CPC that is required.
  3. Click the System Details task.
  4. Click the Security tab to display the default settings.
  5. To deny authority to LPARs to issue BCPii calls against this CPC, ensure that the option Enable the system to receive commands from partitions is not selected.

If your installation has just a few LPARs for which to disable permissions, consider the following steps:

  • Select CPC Operational Customization > Change LPAR Security. For each LPAR that is not disabled, select the BCPii enablement level in the BCPii Permissions column and do the following:
    1. Deselect the option Enable the partition to send commands. This action denies authority for this LPAR to send BCPii requests to other CPCs and LPARs.
    2. Deselect the option Enable the partitions to receive commands from other partitions. This action prevents other LPARs from sending BCPii requests to this LPAR.

If your installation has multiple LPARs for which to disable BCPii permissions, consider changing multiple Image Activation Profiles at one time. To do so, follow these steps:

  1. Select CPC Operational Customization > Customize/Delete Activation Profiles
  2. Select multiple images for which you want to change the BCPii permissions.
  3. Select the option Customize profile.
  4. Select Next until the Security page is shown.
  5. For BCPii permissions, select Apply to all profiles and deselect the options Send and Receive.
  6. Select Next until Summary is shown. Review your changes.
  7. If the settings are correct, select Finish to save your changes. Otherwise, if the settings are not correct, select Back to return to the tasks and make corrections. Or, select Cancel to end your session.

Reference information

For more information, see the following references:

  • Support Element Operations Guide
  • zEnterprise System Processor Resource/Systems Manager Planning Guide.

These books are included in the IBM z15 Library, which is available online in Resource Link™.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.7 : Replace unsupported devices


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

You should remove and replace devices that were supported by earlier releases but cannot be used with the current release of z/OS because they are no longer supported.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

V2R3 and V2R2.

Timing:

Anytime.

Is the upgrade action required?

Yes, if you use any of the devices that are no longer supported.

Target system hardware requirements:

Replacement devices as necessary.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Determine whether the I/O devices you use are supported. A list of supported IBM devices is in the topic about identifying I/O device requirements in z/OS Planning for Installation. If you have a question about support for any devices not listed, contact your IBM representative.
  2. Install replacement devices. Move data that is stored on unsupported devices to the supported devices. Detach unsupported devices from the system and delete their corresponding device definitions from the input/output definition file (IODF).

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.8 : Provide for new device installations


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The hardware configuration of your processors and I/O devices determines how many devices you can attach to your system. z/OS supports attachment of up to 65,280 devices in Subchannel Set 0, each with eight access paths, and the attachment of up to 64,000 secondary devices in each additional subchannel set.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

V2R3 and V2R2.

Timing:

Anytime.

Is the upgrade action required?

Yes, if you are going to use new devices with z/OS V2R4 and later.

Target system hardware requirements:

Dependent upon the new devices used.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

The following are general considerations related to I/O device support.

  • Attaching devices through HCD. You can define, or attach, new devices to your system through the interactive panels of the Hardware Configuration Definition (HCD) base element. HCD has dynamic I/O capabilities, changing hardware definitions without the need for an IPL or hard power-on reset.

    Any time you make changes to your I/O configuration, you need to use HCD to modify your system's I/O definition file (IODF). You should also update the input/output configuration data set (IOCDS) when you run HCD to ensure that the configuration information is consistent across the software and microcode.

  • Operating modes. Most devices attached to z/OS operate in full function mode, that is, all features on the device are compatible with, and usable on, the operating system. Some of these features include:
    • For DASD devices: dynamic path reconnection, extended count-key-data operation, and caching and cache-related facilities
    • For tape devices: cartridge stack loading and data compaction.

    Some devices also operate in compatibility mode, which allows you to simulate the function of another device or model. Compatibility mode causes the device to function like a different device of the same type, ignoring some or all of the additional features the device might have. This allows you to migrate between devices with minimal impact on programs that have device dependencies.

  • UCB virtual storage constraint relief. Each device attached to the system has one or more UCBs associated with it. The size of the I/O configuration and placement of UCBs affects the amount of available virtual memory, both below 16MB and below 2GB. For more information, see the description of the LOCANY parameter in z/OS HCD Planning and the topic "Module placement effect on virtual storage" in z/OS MVS Initialization and Tuning Guide. The system programmer should review the contents of the link pack area (LPA) list to determine whether to remove or move libraries to gain virtual storage constraint relief.
  • Hardware maintenance. Some devices require a specific level of hardware maintenance to operate properly on a z/OS system. DFSMS software support for new hardware devices might also require the installation of PTFs.

Reference information

For more information, see the following references:

  • For a summary of the most commonly-used I/O devices supported by z/OS that are also directly supported by DFSMS functions, see the topic about identifying I/O devices in z/OS Planning for Installation. If you have a question about support for a device that is not listed, contact your IBM representative.
  • For more information about HCD, see z/OS HCD Planning.
  • For information about working with IODFs, see z/OS HCD User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 3.2.9 : Update your CFRM policy with coupling facility structure size changes


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you are upgrading to a new coupling facility control code level (CFLEVEL), you must make the appropriate coupling facility structure size updates in the z/OS coupling facility resource management (CFRM) policy.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Multiple.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

V2R3 and V2R2.

Timing:

Anytime.

Is the upgrade action required?

Yes, if you are upgrading to a new CFLEVEL.

Target system hardware requirements:

For information about coupling facility code levels and the processors that support those levels, see Coupling Facility Level (CFLEVEL) Considerations.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you are upgrading to a new CFLEVEL, do the following:

  1. Run the Coupling Facility Structure Sizer (CFSizer) tool. This tool sizes structures based on the amount of space needed for the current CFLEVEL. The tool sizes for the most currently available level; you might find that the results are oversized if you use an earlier CFLEVEL. You can find the tool at Coupling Facility sizer.

    Alternatively, you can run an as-is batch utility program that is called SIZER after you bring a new CFLEVEL coupling facility into use in your configuration. SIZER examines your currently allocated coupling facility structures and recalculates the size that should be used for them with the new later-CFLEVEL coupling facility. The as-is SIZER utility is available as a compressed package that you can download from CFSizer Alternate Sizing Techniques.

  2. Update the CFRM policy with the size modifications that are needed.
  3. Activate the updated CFRM policy so that it becomes the active policy that governs structure allocation in the sysplex.

Reference information

Coupling facility code levels have hardware and software requirements. For more information, see Coupling Facility Level (CFLEVEL) Considerations.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4 : Upgrading from z/OS V2R2


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This z/OSMF Workflow was derived from the Abstract for the z/OS Upgrade Workflow.


Step 4.1 : BCP upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element BCP (Base Control Program).


Step 4.1.1 : BCP actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BCP upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.1.1.1 : BCP: The ASCB and WEB are backed in 64-bit real storage by default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In a future release of z/OS, the address space control block (which is mapped by IHAASCB) and the work element block (which is mapped by IHAWEB) will be backed in 64-bit real storage by default. Currently, these data structures are backed in 31-bit storage, unless your DIAGxx parmlib member specifies CBLOC REAL31(IHAASCB,IHAWEB).

In z/OS 2.4, the keywords REAL31 and REAL64 are added to the CBLOC statement of parmlib member DIAGxx. With these keywords, you can specify which data structures are backed in 31-bit real storage or 64-bit real storage.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you have an application that relies on the ASCB or WEB to be in 31-bit storage.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check for programs that issue the load real address (LRA) instruction in 31-bit addressing mode for the ASCB or WEB data structures. The LRA instruction cannot be used to obtain the real address of locations backed by real frames above 2 gigabytes in 24-bit or 31-bit addressing mode. For those situations, use the LRAG instruction instead of LRA.

The TPROT instruction can be used to replace the LRA instruction when a program is using it to verify that the virtual address is translatable and the page backing it is in real storage.

If you have programs that do not tolerate 64-bit real storage backing for the ASCB or WEB data structures, update the DIAGxx parmlib member to specify CBLOC REAL31(IHAASCB,IHAWEB).

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.2 : BCP: Plan for removal of support for the IEWTPORTS transport utility


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release of z/OS that will include the transport utility, IEWTPORT. This program management binder utility converts a program object in a PDSE into a "transportable program file" in a sequential (nonexecutable) format and conversely can also reconstruct the program object from a transportable program file and store it back into a PDSE. The use of this utility has been discouraged for a number of years, as described in z/OS MVS Program Management: User's Guide and Reference.

The appropriate utility for copying load modules and program objects is the IEBCOPY.IEWTPORTS transport utility.

In a future release, z/OS will not include the IEWTPORTS transport utility.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 220-226, dated June 16, 2020

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you use the IEWTPORTS transport utility.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation currently uses the IEWTPORTS transport utility, update your procedures to use the IEBCOPY.IEWTPORTS transport utility instead. After z/OS V2R4, z/OS will not include the IEWTPORTS transport utility.

Reference information

For more information, see z/OS MVS Program Management: User's Guide and Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.3 : BCP: Ensure that your sysplex uses the distributed mode of console operation


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, z/OS consoles must be operated in distributed mode, rather than shared mode. Your sysplex must be migrated to distributed mode before you can add a z/OS V2R3 system to the sysplex.

Distributed mode was introduced in z/OS V1R10; it became the default mode in z/OS V1R13.

As of V2R3, the IBMCNZ,CNZ_CONSOLE_OPERATING_MODE health check is removed.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3. Also, see the IBM statement of direction in IBM z/OS IBM United States Software Announcement 212-086 April 11, 2012.

Applies to migration from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are using shared mode.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If your sysplex is not operating in distributed mode, you cannot add a z/OS V2R4 system to the sysplex.

Related IBM Health Checker for z/OS check:

Use health check IBMCNZ,CNZ_CONSOLE_OPERATING_MODE to determine whether your sysplex is operating in the distributed console mode, which is preferred.

This health check:

  • Is available on z/OS V2R2
  • Is removed in z/OS V2R3.

Steps to take

To run in distributed mode, you must perform a sysplex-wide migration to distributed mode. You can do so through a sysplex-wide IPL or dynamically, by using the command SETCON MODE=DISTRIBUTED. To perform the migration, all of your systems must be z/OS V1R10 or later.

Note: For a monoplex configuration, an IPL is required to migrate to distributed mode.

Tip: On a z/OS V2R2 system, you can determine the current console operation mode at any time by using the DISPLAY OPDATA,MODE command. In z/OS V2R3 and later, with the change from console mode to distributed mode, this command is removed.

Reference information

For more information about distributed mode, see z/OS MVS Planning: Operations.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCNZ,CNZ_CONSOLE_OPERATING_MODE.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This health check has been removed in z/OS V2.3. If you attempt to run this step on a z/OS V2.3 system, it will not be found.


Step 4.1.1.4 : BCP: Recompile programs with the new IRARMCTZ macro in APAR OA55218


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, several fields in the IRARMCTZ control block were moved to incorrect offsets. APAR OA55218 corrects the offsets of these fields.

After you apply the PTF for APAR OA55218, you must recompile any programs that use the affected fields in the IRARMCTZ control block.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3 with APAR OA55218 applied.

Applies to upgrade from:

z/OS V2R3 (without APAR OA55218 applied) and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have programs that use the affected fields in the IRARMCTZ control block.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check your programs for any use of the following fields in the IRARMCTZ control block:

  • RMCTZ_WLMIRDSTRUC
  • RMCTZ_FLAGS
  • RMCTZ_WLMIRDSTRUC_SET
  • RMCTZ_RTCapLeadTime
  • RMCTZ_Time_To_Cap
  • RMCTZ_Time_To_Cap_Group

After you apply the PTF for APAR OA55218, recompile any affected programs with the new version of the IRARMCTZ macro. The macro version ( RMCTZ_Version) is updated to Version 6 by this APAR.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.5 : BCP: Stop using z/OS Batch Runtime


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, support is removed for z/OS Batch Runtime. This component provided a framework for interoperability between PL/I, COBOL, and Java applications that run on z/OS. It was designed to provide a managed environment that enables shared access to a DB2 connection by PL/I, COBOL, and Java programs.

It is recommended that you use IBM WebSphere® Application Server JSR 352 instead. Doing so might require you to modify and test your programs in a JSR 352 compliant batch container.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use z/OS Batch Runtime.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Determine whether your programs use z/OS Batch Runtime. Check for references to:
    • JCL PROC BCDPROC
    • BCDBATCH
    • Java classes in com.ibm.zos.batch.container.BCDBatchContainer.
  2. If your programs use z/OS Batch Runtime, you must modify them to use the WebSphere JSR 352 compliant container. Running the programs requires that WebSphere Application Server is installed.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.6 : BCP: Accommodate the removal of GPMP


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the z/OS Guest Platform Management Provider (GPMP) component, which provides data to the Ensemble management function of the Unified Resource Manager, is removed.

It is recommended that you verify that GPMP is not in use on your system.

GPMP can be started on z/OS in either of the following ways:

  • By entering the operator command Modify WLM,GPMP
  • Through the WLM service definition. The service definition settings for GPMP are set in the WLM ISPF application Option 11 – Edit Guest Platform Management Provider settings.

If neither of these actions is performed, GPMP is not started on your system.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. To determine whether GPMP is running on your system, enter the command D WLM,AM. If the command output lists a GPMP job name, GPMP is running. Otherwise, if the output shows the following message, GPMP is not running and no further action is required:
    NO GUEST PLATFORM MANAGEMENT PROVIDER IS CURRENTLY CONNECTED
  2. If GPMP is running, check for usage of the class com.ibm.wlm.arm40SDK.trans.Arm40TransactionFactory in the directory com.ibm.wlm.arm40SDK.trans.Arm40TransactionFactory.

    If WebSphere Application Server is configured to use com.ibm.wlm.arm40SDK.trans.Arm40TransactionFactory as the Request Metrics ARM Transaction Factory class name, remove this setting.

Reference information

For more information, see z/OS MVS Planning: Workload Management

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.7 : BCP: Remove INCLUDE1MAFC(NO) from the LFAREA parameter in IEASYSxx


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Before z/OS V2R3, you could specify INCLUDE1MAFC(NO) to override the default behavior to include frames that can be used to satisfy fixed 1 MB page requests in the available frame count (RCEAFC). The default, INCLUDE1MAFC(YES), results in less paging even when enough 1 MB frames are available to satisfy requests for fixed 1 MB pages.

Starting with z/OS V2R3, real storage is no longer reserved when the LFAREA parameter is specified. As a result, INCLUDE1MAFC(NO) is no longer applicable.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

The system ignores the use of the INCLUDE1MAFC(NO) specification on the LFAREA parameter in IEASYSxx. If INCLUDE1MAFC(NO) is detected, the system issues message IAR051I and uses the default of INCLUDE1MAFC(YES).

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

IBMRSM,ZOSMIGV2R3_RSM_INCLUDE1MAFC

This check determines whether INCLUDE1MAFC(NO) was specified on the LFAREA parameter in IEASYSxx.

Steps to take

Follow these steps:

  1. Check the LFAREA parameter specification in the IEASYSxx member on your pre-z/OS V2R3 system.
  2. If you specified INCLUDE1MAFC(NO) on the LFAREA parameter in IEASYSxx, take one of the following actions:
    • Leave the INCLUDE1MAFC keyword as is. The system ignores the INCLUDE1MAFC(NO) specification.
    • Remove the INCLUDE1MAFC keyword, as INCLUDE1MAFC(YES) is the default and the only accepted specification.
  3. Check any application programs that use SYSEVENT STGTEST to determine whether any changes need to be made. The STGTEST event returns information about the amount of storage available in the system, which includes the LFAREA when INCLUDE1MAFC(YES) is specified or defaulted. Application programs can check the RCEINCLUDE1MAFC bit to determine the setting of INCLUDE1MAFC in the LFAREA specification.

Reference information

For information about the LFAREA parameter and the INCLUDE1MAFC keyword in IEASYSxx, see z/OS MVS Initialization and Tuning Guide and z/OS MVS Initialization and Tuning Reference.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMRSM,ZOSMIGV2R3_RSM_INCLUDE1MAFC.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.1.1.8 : BCP: Evaluate absolute hardware capping limits for temporary capacity demands


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The Provisioning Manager monitors systems for defined absolute hardware LPAR limits, to detect the possibility that more temporary On/Off Capacity on Demand (OOCoD) capacity might not be absorbed by capped LPARs. The Capacity Provisioning Manager allows for enabling or to disabling of the awareness of absolute hardware LPAR capping.

Starting in z/OS V2R3, the Provisioning Manager suppresses, by default, any activation of temporary OOCoD capacity that is triggered by workload running on LPARs that are capped by an absolute hardware LPAR limit. In previous releases, the Provisioning Manager recognized workload demands and activated temporary OOCoD capacity, regardless of whether the LPAR Absolute Hardware LPAR limit was set.

Consider whether to disable this default to allow the activations. If so, see the instructions in "Steps to take."

The detailed workload report indicates when the Provisioning Manager suppresses the activation of temporary OOCoD capacity, that is, when the activation of temporary OOCoD capacity might be triggered by workload requirements, but is disallowed by the enabled function. The report indicates types of processor demand that the Provisioning Manager is detecting, and the reason why Provisioning Manager is not recognizing a specific demand. The report also shows when a demand was not recognized due to the detection of an absolute hardware LPAR limit.

For information about the workload report, see z/OS MVS Capacity Provisioning User's Guide.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you want Provisioning Manager to always activate temporary OOCoD capacity, without regard for absolute hardware LPAR limits.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

The function can be disabled to allow activations. To do so, specify the value 255.0 for the following Provisioning Manager parameters:

  • parameters:Analyzer.Threshold.PartitionCpAbsoluteLparCappingLimit
  • Analyzer.Threshold.PartitionZiipAbsoluteLparCappingLimit
  • Analyzer.Threshold.PartitionZaapAbsoluteLparCappingLimit

Reference information

For more information about setting the Capacity Provisioning Manager parameters, see z/OS MVS Capacity Provisioning User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.9 : BCP: Be aware that NOPASS and NODSI are no longer honored for batch jobs


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In the SCHEDxx parmlib member, the PPT statement allows your installation to specify a list of programs that require special attributes, or to change the attributes of the IBM-supplied default entries in the Program Properties Table (PPT). Before the system initiates a program, it scans the PPT to determine which, if any, special attributes to apply to the program.

In z/OS V2R1 and later releases with APAR OA50215, the NOPASS and NODSI PPT attributes are ignored by the system for programs that run as batch job steps (non-started tasks).

Briefly, these attributes are described, as follows:

NOPASS
The specified program can bypass security protection (password protection and RACF®).
NODSI
The specified program does not require data set integrity. That is, the job does not hold an ENQ for the data sets it allocates.

For installations that require these options for batch jobs, APAR OA50215 introduces the new PPT attributes NOPASS_ALLOWBATCH and NODSI_ALLOWBATCH, which you can specify in SCHEDxx. However, the new attributes are not recommended and must be used with care.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3 and z/OSV2R2 with APAR OA50215 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA50215 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if your installation specifies the PPT attributes NOPASS or NODSI for programs that run as batch job steps.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If your installation specifies the PPT attributes NOPASS or NODSI for programs that run as batch job steps, these specifications are no longer honored. Instead, the following message is issued:

IEF188I PROBLEM PROGRAM ATTRIBUTES ASSIGNED

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Check your active SCHEDxx parmlib members for usage of the NOPASS or NODSI attributes. You can display the contents of your active SCHEDxx parmlib members by using the command DISPLAY PPT.
  2. For any program for which NOPASS or NODSI is specified, determine whether the program runs as a batch job step. For such programs, consider removing the NOPASS or NODSI attributes.

    Otherwise, if these attributes are required for the program, replace them with the NOPASS_ALLOWBATCH and NODSI_ALLOWBATCH attributes. Be aware that allowing programs that run as batch job steps to receive the NOPASS_ALLOWBATCH or NODSI_ALLOWBATCH attributes can expose potential integrity issues.

    Tip:

    To determine whether the new attributes are in effect, enter the command DISPLAY PPT. In the command output, check for Y in column DA (NODSI_ALLOWBATCH) and Y in column PA (NOPASS_ALLOWBATCH).

Reference information

For more information about the SCHEDxx parmlib member, see z/OS MVS Initialization and Tuning Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.10 : BCP: Evaluate your stand-alone dump data set allocations and your IPCS processing of them


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As your applications grow in size and use greater amounts of storage, you should evaluate whether the DASD allocated for your stand-alone dump data continues to be adequate.

In z/OS V1R6, support was introduced for extended-format sequential data sets, a form of data set that is SMS-managed and can occupy more than 64 K tracks per volume. In z/OS V1R7, this support was supplemented with support for large format sequential data sets (DSNTYPE=LARGE), a form of data set that is essentially the same as conventional sequential data sets except that more than 64 K tracks may be spanned per volume. If your stand-alone dump data sets are spread over more volumes than you want, both types of support can help you gain better control over the number of volumes used for each stand-alone dump data set.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because of changes that have been made to stand-alone dump processing (that reorder dump records with the intent of recording more important data early), and especially recommended if you deploy any LPARs with significantly more main storage than previously used.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • Use multivolume stand-alone dump data sets. Adjust the number of volumes and their separation to achieve tolerable stand-alone dump capture times.
  • Use extended-format sequential data sets or large format sequential data sets. Copy their contents to an extended-format, compressed, striped data set using the IPCS COPYDUMP subcommand before analysis. Use the same or a larger striping factor than you used for your stand-alone dump data sets. Dump data sets to which stand-alone dump can write may be neither compressed nor striped, but both attributes are advantageous for the target of the copy operation. Starting with z/OS V1R12, stand-alone dump data sets can be placed in track-managed space as well as cylinder-managed space on Extended Address Volumes (EAV).
  • Use a large CISIZE and striping for IPCS dump directories, and use blocking, striping, and compression for the stand-alone dump data set. Very large stand-alone dumps might require that you define your directory with the extended addressing attribute, allowing it to hold more than 4 GB. Tip:

    Control interval sizes less than 24K have been shown to be more vulnerable to fragmentation when used as IPCS dump directories, and IPCS performance can be degraded when such fragmentation occurs. In this background, warning message BLS21110I will be issued and you might recreate the DDIR by using the CLIST BLSCDDIR.

    BLS21110I CISIZE(cisize) is less than 24K. It may degrade IPCS performance

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.11 : BCP: Regenerate the Unicode conversion image


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

APAR OA50306 introduced extension tables for conversions with code points of length 3 or larger through a PTF on z/OS V2R2 and z/OS V2R1. If your system uses Unicode conversion images that were created before OA50306, you might encounter ABEND 0C4 in module CUN4MCNV or have unexpected output that contains FEFE. This problem can also occur with the base code of z/OS V2R3.

If your system does not use dynamic loading of conversion data ( Unicode on demand), and you have not applied the PTF for APAR OA56812, you must perform this upgrade action.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3. z/OS V2R2 with the PTF for APAR OA50306 applied.

Applies to upgrade from:

z/OS V2R3. z/OS V2R2 without APAR OA50306.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if your system uses Unicode conversion images that were generated before OA50306 was applied.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

You might encounter ABEND 0C4 in module CUN4MCNV or have unexpected output that contains FEFE.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your system performs dynamic loading of conversion data (also known as Unicode on demand), no further action is needed.

To determine whether your system uses dynamic loading of conversion data, check the active CUNUNIxx parmlib member. The UNI parameter of IEASYSxx specifies the CUNUNIxx parmlib member for your conversion environment.

If your system does not use dynamic loading of conversion data, you must do either of the following:

  • Apply the PTF for APAR OA56812. This service makes regenerating the Unicode conversion image unnecessary.
  • Regenerate the Unicode conversion image and IPL your system again.

Reference information

For more information, see the topic about creating a conversion image in z/OS Unicode Services User's Guide and Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.1.12 : BCP: Prepare for the removal of service coefficients from WLM service definitions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release of the operating system to support specifying service coefficients in the WLM service definition.

The amount of system resources an address space or enclave consumes is measured in service units. Service units are calculated based on the CPU, SRB, I/O, and storage (MSO) service the address space or enclave consumes.

Service units are the basis for period switching within a service class that has multiple periods. The duration of a service class period is specified in terms of service units. When an address space or enclave running in the service class period has consumed the amount of service that is specified by the duration, workload management moves it to the next period. The work is then managed to the goal and importance of the new period.

Because not all kinds of services are equal in every installation, more weight can be assigned to one kind of service over another. These weights are called service coefficients.

Assigning different weights made sense in the past, when resources like storage and I/O were scarce. However, in today's environments, it does not make sense to allow storage and I/O to influence period switch, or weight CPU and SRB service differently. Therefore, to streamline and simplify user experience, and to facilitate more consistent management, the service coefficients are removed from the WLM service definition, and set to hardcoded defaults.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 219-344, dated July 23, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because specifying service coefficients in the WLM service definition will not be supported in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If the upgrade action is not done, address spaces or enclaves that are running in a service class period might move faster or slower than expected to the next period.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check the values of the service coefficients in your WLM service definitions. You can do so in z/OSMF on the Service Definition Details tab of the Workload Management task, or in the WLM ISPF application on the Service Coefficients/Options panel.

The recommended values are:

CPU
1.0
IOC
0.0
MSO
0.0000
SRB
1.0

If the values of the service coefficients in your WLM service definition differ from the recommended values, change them to the recommended values. If you do so, you must recalculate the duration of your service class periods, and your accounting procedures.

The capacity limits of resource groups and tenant resource groups are not affected by this change because they are specified in unweighted service units.

Reference information

For more information, see the topic "Defining service coefficients and options" inz/OS MVS Planning: Workload Management.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2 : BCP actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BCP upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.1.2.1 : BCP: Accommodate the new DSLIMITNUM default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In the SMFLIMxx parmlib member, the parameter DSLIMITNUM is used to override the maximum number of data spaces and hiperspaces that can be created by a user-key program. Currently, by default, the number of data spaces and hiperspaces is limited to 4294967295. In a future release, this default will be decreased to 4096.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if the default is not acceptable to your environment.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Applications that invoke DSPSERV CREATE, especially those applications that loop erroneously, might fail with the more restrictive DSLIMITNUM default in effect.

Related IBM Health Checker for z/OS check:

None.

Steps to take

SMF 30 record field SMF30NumberOfDataSpacesHWM indicates the high-water mark of the number of data spaces that are owned by the problem state or user key tasks associated with a job. This field is added with APAR OA59137 and APAR OA59126 applied.

If your installation runs jobs that rely on the default for SMFLIMxx DSLIMITNUM or IEFUSI word 7 subword 3, inspect the SMF 30 record field SMF30NumberOfDataSpacesHWM fields for values that exceed 4096. For jobs that exceed 4096, update SMFLIMxx or IEFUSI to allow the maximum number of data spaces that are required.

Reference information

For more information, see the description of the DSLIMITNUM parameter in z/OS MVS Initialization and Tuning Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.2 : BCP: XCF/XES FUNCTIONS XTCSIZE is enabled by default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the FUNCTIONS statement is added to the COUPLExx parmlib member. This statement specifies the initial enablement state of XCF/XES optional functions on the current system. Included on the FUNCTIONS statement is the option XTCSIZE. When enabled, XTCSIZE causes XCF to automatically manage message size segregation when sending messages to a z/OS system. By enabling XTCSIZE, you no longer need to manually configure for message size segregation.

The XTCSIZE keyword is ENABLED by default. You can disable it, if necessary. You can set the state of the FUNCTIONS statement dynamically by using the SETXCF FUNCTIONS system command.

The status of the XTCSIZE option does not impact XCF message traffic that includes systems earlier than z/OS V2R4. Existing XCF transport class definitions do not need to be changed.

Removing transport class definitions for message size segregation should not be done until all systems in the sysplex are z/OS V2R4 or later and you have no plans to fall back to an earlier release.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended. Disabling XTCSIZE is possible, but not recommended.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

Health check IBMXCF,XCF_TCLASS_CLASSLEN is enhanced to check the status of the XTCSIZE option, in addition to definitions for message size segregation. If you do not want XTCSIZE to be enabled, you can change the health check parameter from XCFMGD to USERMGD.

Steps to take

The XTCSIZE keyword is ENABLED by default. You can disable it, if necessary. You can set the state of the FUNCTIONS statement dynamically by using the SETXCF FUNCTIONS system command.

Reference information

For more information, see the description of the XCF/XES FUNCTIONS options in z/OS MVS Setting Up a Sysplex.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMXCF,XCF_TCLASS_CLASSLEN.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.1.2.3 : BCP: Create IPL text


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IPL text is bootstrap information that is required for IPL, such as the location of the nucleus library. You must create IPL text by running ICKDSF against the system residence volume.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • Update and run the IPLTEXT job to write a new copy of the IPL text. If you install z/OS with a ServerPac, an installation dialog job is provided to perform this action. If you install z/OS with a CBPDO, refer to the instructions in z/OS Program Directory in the z/OS Internet library.

Tip: With ICKDSF R17 APAR PM42057 applied, you can use the REFORMAT command with the new parameter REMOVEIPLTXT to remove IPL text from the volume.

Note:

When the IPLTXTEXIST parameter (which was introduced by ICKDSF R17 APAR PK16403) is specified with the REFORMAT command with the IPLDD parameter, WTOR message ICK21836D is suppressed if IPL text exists.

Reference information

For a sample IPLTEXT job, see z/OS Program Directory in the z/OS Internet library. ServerPac provides a similar job for accomplishing this task; see ServerPac: Installing Your Order.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.4 : BCP: Review the list of WTORs in parmlib member AUTOR00


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The IBM-supplied parmlib includes the AUTOR00 member. When the member is found in your parmlib concatenation during IPL, it causes auto-reply processing to be started. If the WTORs listed in AUTOR00 are automated by your existing automation product, ensure that the replies in AUTOR00 are appropriate.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use the auto reply facility of z/OS, which is enabled by default when the AUTOR00 member is found in the parmlib concatenation.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • Examine the WTOR replies in the AUTOR00 parmlib member. If the replies or delay duration are not desirable, you can create a new AUTORxx parmlib member and make corresponding changes. Also compare the replies to what your automation product would reply to these WTORs. Make sure that the AUTOR00 replies are in accordance with the replies from your automation product. IBM does not recommend making updates to AUTOR00, because updates to AUTOR00 might be made by the service stream or in new z/OS releases.

Note: The IBM-shipped data set SYS1.IBM.PARMLIB contains the AUTOR00 member. So, if you specify it within the PARMLIB concatenation and will not intend to activate the auto reply functionality, you need to specify AUTOR=OFF in the IEASYSxx parmlib member.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.5 : BCP: Reassemble the stand-alone dump program


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The stand-alone dump program produces a dump of storage that is occupied by a system that failed or a stand-alone dump program that failed. You must reassemble the stand-alone dump program each release. When the stand-alone dump program is properly created on a DASD residence volume, it resides in the SYS1.PAGEDUMP.Vvolser data set.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • Reassemble the stand-alone dump program. If you install z/OS with a ServerPac, an installation dialog job is provided to perform this action. If you install z/OS with a CBPDO, instructions to perform this action are provided in z/OS MVS Diagnosis: Tools and Service Aids.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.6 : BCP: Ensure that enough real memory is installed


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For z/OS V2R4 with the IBM z14 (z14) server, a minimum of 8 GB of real memory is required to IPL. When running as a z/VM guest or on an IBM Z® Personal Development Tool (zPDT), a minimum of 2 GB is required for z/OS V2R4.

If you attempt to IPL z/OS V2R4 on a z14 with less than the minimum amount of real memory, z/OS issues the following warning message (a WTOR) during IPL:

IAR057D LESS THAN 8 GB OF REAL STORAGE IMPACTS SYSTEM AVAILABILITY - ADD STORAGE OR REPLY C TO CONTINUE

Continuing with less than the minimum amount of real memory might impact the availability of your system. If you attempt to IPL z/OS V2R4 on an earlier IBM server, no warning message is issued.

To help you with upgrading from z/OS V2R2, IBM provides a new health check, IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL, which issues a warning for a system that is configured with less than 8 GB of real memory.

This table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

IBM z14 server.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If the system detects that it is running on a z14 server, and less than 8 GB of real memory is configured, the system issues warning message IAR057D (a WTOR) during IPL.

Related IBM Health Checker for z/OS check:

IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL

You can use this health check to determine whether the system meets the minimum memory requirements.

Steps to take

For a z/OS V2R4 system that you plan to run on a z14 server, follow these steps:

  • For a system that is running as a z/VM guest, ensure that the server has a minimum of 2 GB of real memory.
  • For a system that is running on IBM Z® Personal Development Tool (zPDT), ensure that the server has a minimum of 2 GB of real memory.
  • Otherwise, ensure that the LPAR has a minimum of 8 GB of real memory.
Reference information

For more information about the minimum real memory requirement, see z/OS Planning for Installation.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMRSM,ZOSMIGV2R3_RSM_MINIMUM_REAL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This check is available on the following releases: z/OS V2R2 and z/OS V2R3.

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 4.1.2.7 : BCP: Verify that the new default value for REAL is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In parmlib member IEASYSxx, the REAL parameter controls the amount of central storage that can be allocated for ADDRSPC=REAL (V=R) jobs. The V=R (virtual=real) area is a dedicated storage area below 16 MB in which virtual addresses are the same as real addresses.

In previous releases, the REAL parameter had a default value of 76, which means that 76 KB of V=R storage was reserved on the system. In z/OS V2R3, the REAL parameter default is changed to 0, which means that no V=R area is created.

For improved performance in satisfying storage requests, IBM suggests that you do not create a V=R area and instead, set REAL to 0 (the new default).

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

REAL=0 is not valid if your installation runs V=R jobs; these jobs might abend.

Related IBM Health Checker for z/OS check:

IBMRSM,RSM_REAL

You can use this health check to determine whether a V=R area is defined on your system. The check queries the current setting for the REAL parameter in IEASYSxx.

Steps to take

On a z/OS V2R2 system, do the following:

  1. Review the current setting of the REAL parameter on your system by checking the IEASYSxx parmlib concatenation. If the REAL= setting is specified, you have nothing more to do. Otherwise, proceed to Step 2.
  2. Search for the Storage and Paging Section of SMF type 30 (common address space work) subtype 4 records. Locate the SMF30SFL field within the record. If bit 0 is 1, the V=R area is used by a job. Add the setting REAL=76 to your IEASYSxx member to maintain compatibility with z/OS V2R2.

Alternatively, you can follow these steps on a z/OS V2R4 system:

  1. Before you IPL the system, review the current setting of the REAL parameter on your system by checking the IEASYSxx parmlib concatenation. If the REAL= setting is specified, you have nothing more to do. Otherwise, proceed to Step 2.
  2. Add the setting REAL=76 to your IEASYSxx parmlib member before IPLing the system. After IPL, use the Generic Tracker to identify V=R jobs. If any are identified, leave the setting. Otherwise, remove the setting and use the default of 0 for subsequent IPLs.

Tip: In the SMF Type 30 subtype 4 record, in the paging and storage section, check bit 0 of the byte labeled SMF30SFL. This bit is set to 1 to indicate V=R usage for the job step.

Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMRSM,RSM_REAL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

NOTE: The successful running of this IBM Health Checker for z/OS check only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 4.1.2.8 : BCP: Removal of support for user key common areas


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM strongly recommends that you eliminate all use of user key common storage. Allowing programs to obtain user key (8-15) common storage creates a security risk because the storage can be modified or referenced, even if fetch protected, by any unauthorized program from any address space. Therefore, without the restricted use common service area (RUCSA) optional priced feature, the obtaining of user key (8-15) storage is not supported in z/OSV2R4.

RUCSA is more secure because it can be managed as a SAF resource. However, it does not prevent two or more different SAF-authorized applications from altering or referencing another application's RUCSA storage. RUCSA became available as a part of the BCP base element with APAR OA56180 on earlier z/OS releases, but it is only available as a priced feature in z/OS V2R4.

Related to this change:

  • Support to change the key of common ESQA storage to a user key (via CHANGKEY) is removed regardless of RUCSA exploitation.
  • NUCLABEL DISABLE(IARXLUK2) is no longer a valid statement in the DIAGxx parmlib member. ( Note: This statement only exists in z/OS V2R3.)
  • Support of user-key (8 - 15) SCOPE=COMMON data spaces is removed regardless of RUCSA exploitation.
  • YES is no longer a valid setting for the following statements in the DIAGxx parmlib member:
    VSM ALLOWUSERKEYCSA
    Controls the allocation of user key CSA.
    ALLOWUSERKEYCADS
    Controls the allocation of user key SCOPE=COMMON data spaces.

    If set to YES on a z/OS V2R4 system, these statements are treated as syntax errors with messages, such as the following:

    SET DIAG=J2 IEE252I MEMBER DIAGJ2 FOUND IN D10JHM1.PARMLIB ASA002I SYNTAX ERROR IN PARMLIB MEMBER=DIAGJ2 LINE 17: 393 NO EXPECTED BEFORE <NON-KEYWORD>. DETECTING MODULE IS IGVDITMS. INPUT LINE: VSM ALLOWUSERKEYCSA(YES) ASA004I PARSING OF PARMLIB MEMBER=DIAGJ2 395 CONTINUED AT ), LINE 17. DETECTING MODULE IS IGVDITMS. INPUT LINE: VSM ALLOWUSERKEYCSA(YES) ASA002I SYNTAX ERROR IN PARMLIB MEMBER=DIAGJ2 LINE 18: 396 NO EXPECTED BEFORE <NON-KEYWORD>. DETECTING MODULE IS IGVDITMS. INPUT LINE: ALLOWUSERKEYCADS(YES) ASA004I PARSING OF PARMLIB MEMBER=DIAGJ2 397 CONTINUED AT ), LINE 18. DETECTING MODULE IS IGVDITMS. INPUT LINE: ALLOWUSERKEYCADS(YES) IEE536I DIAG VALUE J2 NOW IN EFFECT

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

  • If running CICS Transaction Server for z/OS, you require V5.2 or later.
  • If running Tivoli OMEGAMON XE for DB2 PE/PM, you require APAR PI97225 ("Removed User Key CADS Creation").

Other PTFs on other IBM products might also be required. As a reminder, use the TargetSystem-RequiredService.z/OS.V2R4 FIXCAT to identify those necessary PTFs.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

See "Steps to take."

Related IBM Health Checker for z/OS check:

Use the following IBM Health Checker for z/OS checks:

  • IBMVSM,VSM_ALLOWUSERKEYCSA to examine the setting of the ALLOWUSERKEYCSA option in the DIAGxx parmlib member.
  • IBMVSM,ZOSMIGV2R3_NEXT_VSM_USERKEYCOMM to detect usage of user key common storage.
Steps to take
  1. On the production system that you are upgrading to z/OS V2R4, determine whether you are using user key common storage by checking the response to the following operator commands :
    • D IPLINFO,RUCSA . If RUCSA was specified with nonzero values, you are already using RUCSA and must do either of the following:
      • Upgrade to the z/OS V2R4 priced optional feature. For instructions, see z/OS Planning for Installation. No other steps are required. However, you might want to see whether you can reduce or possibly eliminate user key common storage usage by following the additional steps below.
      • Start with Step 2 below to remove all usage of user key common storage from your current system and then remove the use of RUCSA before IPLing z/OS V2R4.
    • D DIAG . If VSM ALLOWUSERKEYCSA and ALLOWUSERKEYCADS are set to NO and you are not using RUCSA, no further action is required. You already prevent the use of user key common storage.
  2. Query all software vendor products to determine whether any service is required to eliminate the use of user key common storage.
    • If you are running CICS Transaction Server for z/OS, ensure that you are running V5.2 or a later version.
    • If you are running Tivoli OMEGAMON XE for DB2 PE/PM, apply APAR PI97225 ("Removed User Key CADS Creation").
  3. Check for usage of user key common areas, such as the following:
    • Using the STORAGE, GETMAIN or CPOOL service to obtain common ECSA/CSA storage (subpool 227, 228, 231, 241) that specifies a key of 8-15.
    • Using the DSPSERV service to allocate a SCOPE=COMMON data space in a key of 8-15.
    • Using the CHANGKEY service to change the storage key of common storage to a key of 8-15.

    To aid in finding all instances of user key common usage, apply the PTF for APAR OA53355 on your production system. Doing so allows you to take one or more of the following actions:

    • Enable the following example SLIP trap to produce GTF trace records to help in identifying software that uses user key common storage:
      SLIP SET,IF,A=TRACE,ID=UKEY,NUCEP=(IARXLUK4,0,1),TRDATA=(STD,REGS),END

      In the GTF trace record, register 1 contains the address of the program that used user key common storage.

    • Activate the ZOSMIGV2R3_NEXT_VSM_USERKEYCOMM health check. This health check issues an exception message when it detects usage of user key common storage.
    • Ensure that SMF Type 30 recording is active. The Storage and Paging section contains flags that indicate whether user key common storage is used. For information about the SMF30_UserKeyCsaUsage, SMF30_UserKeyCadsUsage and SMF30_UserKeyChangKeyUsage flags, see z/OS MVS System Management Facilities (SMF).
  4. If the PTF for APAR OA53355 is not applied, you can take one or more of the following actions to help find instances of user key common usage:
    • Set the DIAGxx parmlib statement VSM ALLOWUSERKEYCSA to NO, which is the default. Then, IPL a test system with the updated setting. Any software on your test system that attempts to obtain user key CSA/ECSA storage by using the GETMAIN, STORAGE, or CPOOL service will fail. The service receives one of the following abends: B04-5C, B0A-5C, or B78-5C.
    • Specify ALLOWUSERKEYCADS(NO) in your DIAGxx parmlib. Then, IPL a test system with the updated setting. Any software on your test system that attempts to obtain a user key (8-15) SCOPE=COMMON data space fails with a 01D-xx0015xx abend.
    • On z/OS V2R3 systems and later, specify NUCLABEL ENABLE(IARXLUK2) in your DIAGxx parmlib member. Then, IPL a test system with the updated setting. Any software on your test system that attempts to use CHANGKEY to change subpool 247 or 248 common storage to a user key (8-15) will fail with a 08F-1C abend.
    • Enable the following example SLIP trap to produce GTF trace records to help in identifying software that obtains user key CSA/ECSA storage:
      SLIP SET,IF,A=TRACE,ID=UCSA,NUCEP=(IGVVSMG2,0,1),END
    • Enable the following example SLIP trap to produce GTF trace records to help in identifying software that allocates user key SCOPE=COMMON data spaces:
      SLIP SET,IF,A=TRACE,ID=UCAD,NUCEP=(IAXDKUKY,0,1),END
    • Check for usage of the CHANGKEY service to change the storage key of common storage to a key of 8-15.
  5. Change the affected software to use a system key rather than a user key. Or, change the affected software to use storage that is not common to all address spaces. Some alternatives for sharing storage (instead of having storage common to all address spaces) include the following options:
    • Use a SCOPE=ALL data space to share data space storage with specific units of work in specific address spaces.
    • Use IARVSERV SHARE to share below-the-bar storage with specific address spaces.
    • Use IARV64 GETSHARED to share above-the-bar storage with specific address spaces.
    • Use z/OS UNIX shared memory to share below-the-bar or above-the-bar storage with specific address spaces.
  6. For those who cannot immediately eliminate all affected software programs or need more assistance in identifying the programs that reference user key CSA storage, the more secure restricted use common service area (RUCSA), an optional priced feature in z/OS V2R4 (and provided in the BCP base element by APAR OA56180 for earlier z/OS releases) can be used. However, IBM still recommends the elimination of all user key common storage. For more information about RUCSA and upgrading to it, see z/OS MVS Initialization and Tuning Guide.
Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit jobs to run two health checks that are associated with this upgrade action, IBMVSM,VSM_ALLOWUSERKEYCSA and IBMVSM,ZOSMIGV2R3_NEXT_VSM_USERKEYCOMM.

These checks will be activated if they are not already active. If the checks are activated, they will be deactivated at the end of the job, so that they remain in the same state as they were found.

If the health checks run with no exceptions, this step will be marked "Complete" indicating that this upgrade action requires no further activity.

If either of the health checks find an exception, this step will be marked as "Failed". If so, further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (using any method you use to view health check output, such as SDSF) and correct any situations as appropriate. You can then re-run this workflow step to submit the health check job again, until the health checks no longer receive exceptions and the step is marked "Complete".

NOTE: The successful running of these health checks only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 4.1.2.9 : BCP: Remove commands or logic that start or restart Runtime Diagnostics


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the command to start Runtime Diagnostics is added to the IBM-supplied parmlib member IEACMD00. As a result, Runtime Diagnostics is started automatically during system initialization, when you include the SYS1.IBM.PARMLIB data set in your parmlib concatenation. This change means that it is no longer necessary for you to explicitly start Runtime Diagnostics after each system IPL, whether through the COMMNDxx parmlib member, an automation program, or an operator command entered manually at the console.

For example, in previous releases, you might have placed the start command in your COMMNDxx parmlib member, as follows:

COM='S HZR,SUB=MSTR'

As in previous releases, the Runtime Diagnostics address space (HZR) continues to run as an address space under the master subsystem and remains active until you stop it with the STOP command.

Tip: IBM recommends that you allow the HZR address space to be classified into the SYSSTC service class, or place it into an importance 1 single period service class with a high velocity goal.

This table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have any system automation that starts or restarts Runtime Diagnostics.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If you leave an automated START command for Runtime Diagnostics in place, the following message is issued when the system processes the IBM-supplied START command in IEACMD00:

HZR0111I RUNTIME DIAGNOSTICS IS ALREADY ACTIVE

If your installation does not define a user ID for the HZR started task or a profile for HZR in the STARTED class with that user ID, the following message is issued when Runtime Diagnostics is started automatically during IPL:

IRR813I NO PROFILE WAS FOUND IN THE STARTED CLASS FOR HZR WITH JOBNAME HZR. RACF WILL USE ICHRIN03.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Remove commands or logic that start Runtime Diagnostics from automation programs or the COMMNDxx parmlib member. For example, remove the statement COM='S HZR,SUB=MSTR' from the COMMNDxx parmlib member, if specified.
  2. If your installation changed the Runtime Diagnostics default job name in SYS.PROCLIB, update the START command in IEACMD00 to associate the installation defined name with the default job name HZR. For example, if you changed the Runtime Diagnostics job name from HZR to HZRNEW, change the command in IEACMD00 from:
    COM='S HZR,SUB=MSTR'

    to:

    COM='S HZRNEW,SUB=MSTR,JOBNAME=HZR'
  3. When Runtime Diagnostics is started, the following message might be issued if the STARTED class is active. While this message is not a change to Runtime Diagnostics processing, the message might be new to you:
    IRR813I NO PROFILE WAS FOUND IN THE STARTED CLASS FOR HZR WITH JOBNAME HZR. RACF WILL USE ICHRIN03.

    If you receive this message, one of the following problems has occurred:

    • The STARTED class has the RACLIST option, but no SAF profile exists for Runtime Diagnostics (HZR)
    • A SAF profile is defined for HZR, but the STARTED class is not RACLIST enabled
    • A SAF profile is defined for HZR, but the STARTED class was not refreshed so that the changes could take effect.
    • The RACLIST profile is not enabled on the system.

    In response, RACF uses the information in the started procedures table (ICHRIN03) to assign security information for HZR . Either ensure that the proper definition exists in the ICHRIN03 for HZR, or take one of the following actions:

    • Define a SAF profile for HZR in the STARTED class, as described in z/OS Problem Management.
    • Ensure that the STARTED class has the RACLIST option. For example:
      SETROPTS RACLIST(STARTED)
    • Refresh the STARTED class. For example:
      SETROPTS RACLIST(STARTED) REFRESH

    If you have a security profile set up for Runtime Diagnostics (HZR) in the STARTED class before IPL, message IRR8131 is not issued. Security for Runtime Diagnostics works as it did in previous releases.

Reference information

For more information, see z/OS Problem Management.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.10 : BCP: Stop using the DRXRC duplex mode option for logstreams


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, system logger no longer supports the DRXRC duplex mode option for logstreams. IBM recommends that you use other available mirroring options with IBM z/OS Global Mirror (zGM), also known as Extended Remote Copy (XRC), or GDPS.

The withdrawal of this support has no impact on any other logstream configurations.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R3. Also, see the IBM statement of direction in Preview: IBM z/OS Version 2 Release 2 – Fueling the new digital enterprise” statement of direction (SOD) Announcement materials, dated January 2015.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you intend on having a mixed-release level sysplex, and you currently use the DRXRC option.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

Use IBM Health Checker for z/OS check IBMIXGLOGR,ZOSMIGV2R2_NEXT_IXG_REMOVE_DRXRC. This migration health check was provided by APAR OA49507 for z/OSV2R2.

Steps to take

Follow these steps:

  1. To enable health check ZOSMIGV2R2_Next_IXG_REMOVE_DRXRC to run, give the Health Checker user ID READ access to the MVS.DISPLAY.LOGGER resource in the OPERCMDS class.

    Also, when the FACILITY class is activated and a profile is defined that covers the MVSADMIN.LOGR resource, you must grant the user ID that is associated with the Health Checker address space READ access to this resource.

    For example, you might specify the following:

    RDEFINE FACILITY MVSADMIN.LOGR UACC(NONE) PERMIT MVSADMIN.LOGR CLASS(FACILITY) ID(hcsuperid) ACCESS(READ) SETROPTS CLASSACT(FACILITY) SETROPTS RACLIST(FACILITY)

    If you had already RACLISTed the FACILITY class, the last statement would have to be:

    SETROPTS RACLIST(FACILITY) REFRESH

    See the topic on LOGR parameters for administrative data utility in z/OS MVS Setting Up a Sysplex.

  2. For any exceptions reported by the health check ZOSMIGV2R2_Next_IXG_REMOVE_DRXRC, follow the actions that are described in the following message:
    IXGH013E One or more log stream definitions in this sysplex has the DUPLEXMODE(DRXRC)specification.

    Otherwise, the following informational message is issued:

    IXGH012I This sysplex does not contain any log streams with the DUPLEXMODE(DRXRC)specification.
  3. Alternatively:
    1. You can use the IXCMIAPU utility for DATA TYPE(LOGR) REPORT(YES), and identify any logstreams with the STG_DUPLEX(YES) DUPLEXMODE(DRXRC) attributes.

      Sample report job:

      //LOGRPT JOB //STEP1 EXEC PGM=IXCMIAPU //SYSPRINT DD SYSOUT=* //SYSIN DD * DATA TYPE(LOGR) REPORT(YES) /*

      If the IXCMIAPU utility identifies no logstreams with the DUPLEXMODE(DRXRC) option specified, you have no impact. You can skip the next step.

    2. For any logstreams with the DUPLEXMODE(DRXRC) specification, you must update the logstreams to use a different duplex option. You can run the IXCMIAPU utility or IXGINVNT API to update the logstream by specifying either DUPLEXMODE(COND) or DUPLEXMODE(UNCOND). Or, set the option STG_DUPLEX(NO) to avoid having a staging data set used to duplex the logstream data.

Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMIXGLOGR,ZOSMIGV2R2_Next_IXG_Remove_DRXRC.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This migration health check was provided by APAR OA49507 for z/OS V1R13, V2R1, and V2R2.


Step 4.1.2.11 : BCP: Define a SAF profile for the log stream subsystem exits


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of APAR OA51174, a log stream subsystem exit routine name is used only when it is one of the IBM-defined names, or the exit name is allowed through a SAF profile. Otherwise, z/OS does not invoke the exit routine name. Instead, z/OS issues message IXG507I and returns a failure indication to the log stream subsystem function (either converter or allocation).

Currently, log stream users can specify a log stream subsystem exit routine name to receive control for reading log data. Users can use either of the following methods to specify the exit routine names:

  • On the JCL DDNAME statement, on the keyword SUBSYS=(LOGR,exit_routine_name,...)
  • On a dynamic allocation request that includes a text unit value for key DALSSPRM (exit routine name)

With APAR OA51174, this behavior is changed. To continue to specify an exit routine name as described here, your installation must protect the resource IXGLOGR.SUBSYS.LSEXIT.exit_routine_name, where exit_routine_name identifies the name of the log stream subsystem exit routine.

If your installation uses RACF as its security management product, your security administrator can protect the resource by defining a profile in the FACILITY class. If your installation uses a security management product other than RACF, your security administrator can refer to this topic for reference when creating an equivalent protection in the security management product on your system.

The exception to this requirement is if your installation uses the following IBM-defined names for the exit routines. If so, you have no upgrade action to perform.

  • IXGSEXIT
  • IFASEXIT
  • IFBSEXIT
  • DFHLGCNV

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R2 with APAR OA51174 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA51174 applied.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if both of the following conditions are true:

  • Your installation has a log stream subsystem exit routine that is specified through the SUBSYS=(LOGR,...) keyword on a DDNAME JCL statement or on a dynamic allocation request that includes a text unit value for key DALSSPRM
  • Exit routine name is not one of the following IBM-defined names: IXGSEXIT, IFASEXIT, IFBSEXIT, or DFHLGCNV.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Jobs or dynamic allocation requests that specify a log stream exit routine name might fail with an authorization error.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation does not use any log stream subsystem exit routines, or if your installation uses only the IBM-defined names for the log stream subsystem exit routine names, you have no upgrade action to perform.

Otherwise, if your installation uses or plans to use log stream subsystem exit routine names other than the IBM-defined names, you must perform the following steps:

  • Define a discrete profile IXGLOGR.SUBSYS.LSEXIT.exit_routine_name for the FACILITY class, where exit_routine_name is the name of the log stream subsystem exit routine. Your security administrator can use this profile to audit access failures and grant users READ access. For example:
    RDEFINE FACILITY IXGLOGR.SUBSYS.LSEXIT. exit_routine_name UACC(READ) AUDIT(FAILURES(READ))
  • If you need to allow for exit routine names that might not be explicitly known on your system, consider also defining the generic profile IXGLOGR.SUBSYS.LSEXIT.* in the FACILITY class. Include the WARNING attribute in the profile definition (to issue a warning message, but allow access). This profile protects resources that are associated with the log stream subsystem exit routines. For example:
    RDEFINE FACILITY IXGLOGR.SUBSYS.LSEXIT.* UACC(NONE) WARNING

    When this generic profile is used to cover the authorization check for the resource IXGLOGR.SUBSYS.LSEXIT.exit_routine_name, if the check fails, RACF issues the appropriate warning message to the user, logs the access attempt, and allows the user to access the resource.

    Using a generic profile is recommended only as a temporary means for gathering information on the possible exit routine names on your system that require protection. When the exit routine names are identified, you can define the appropriate discrete profiles. After you protect the known exit routine names with discrete profiles, delete the generic profile.

    Note:

    If you do not define profiles as described here, but instead, define a generic profile that protects the resource IXGLOGR.SUBSYS.LSEXIT.exit_routine_name, the generic profile attributes are used to determine the following behaviors:

    • Outcome of the authorization checking
    • Logging
    • Whether the exit routine is invoked

Reference information

For the related publication updates, see APAR OA51527.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.12 : BCP: Accommodate the new default log stream data set base minimum size


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, options are added to the IXGCNFxx member of parmlib, so that you can indicate whether log stream offload and staging data sets are allocated on the system with base minimum default sizes. Specifically, the new options USEOFFLOADMIN and USESTAGINGMIN are YES, by default, for the associated MANAGE OFFLOAD and MANAGE STAGING statements.

This change means that the system ensures that log stream data sets are allocated on the system with a base minimum size of at least 1 MB and 10 MB for offload and staging data sets, respectively. These amounts are the IBM recommended minimum sizes.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you do not want the new logger behavior.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

A significant negative performance impact on log stream usage can occur when offload or staging data sets are sized too small. This problem can happen when base system defaults are used that result in data set sizes in the 2 - 3 track size range.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Unless the log stream exploiter specifically recommends a size below these amounts, IBM recommends the following:

  • Log stream staging data sets be sized no smaller than 10 MB
  • Offload data sets be sized no smaller than 1 MB.

Check the DASD management policies for your log stream use and determine whether the new logger policy of ensuring the base minimum sizes of these data sets is appropriate for your installation. If so, no further action is necessary.

Otherwise, if the new log stream data set management behavior is not appropriate for your installation, you must provide an IXGCNFxx parmlib member that specifies MANAGE OFFOAD USEOFFLOADMIN(NO) or MANAGE STAGING USESTAGINGMIN(NO) for the appropriate log stream data set types.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.13 : BCP: Prepare for log stream staging data set sizes greater than 4 GB


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, system logger allows log stream staging data set sizes greater than 4 GB. In previous releases, you could request more than 4 GB for a log stream staging data set, but system logger would allocate a smaller amount of storage for the data set (about 3.5 GB).

The new support in z/OS V2R3 means that the z/OS V2R3 release systems allow log stream staging data set sizes with a size greater than 4 GB when the staging data sets are newly allocated on that system. Any z/OS V2R2 and z/OS V2R1 release levels in the same sysplex require the appropriate coexistence support to be compatible with z/OS V2R3 and correctly manage the larger data sets.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, to ensure compatibility. Log stream staging data sets can already be allocated without any of the changes in z/OS V2R3.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Ensure that the PTFs for APAR OA49506 are applied (installed and activated) on any z/OS V2R2 or z/OS V2R1 systems in the sysplex.

This APAR is marked with the SMP/E FIXCAT for z/OS V2.3 coexistence, so you can use the appropriate SMP/E REPORT MISSINGFIX command.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Do the following:

  1. Install the PTFs for APAR OA49506 on all z/OS V2R2 and z/OS V2R1 systems in the same sysplex as the z/OS V2R3 and z/OS V2R4 systems.
  2. Understand that if you request an allocation of greater than 4 GB for a log stream staging data set, rather than receiving a smaller allocation, you now receive the requested size.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.14 : BCP: Ensure that TVSAMCOM or TVSMSG are not used as job statement symbols


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

New JCL keywords are added to the JCL EXEC statement, as follows:

  • TVSAMCOM was added in z/OS V2R3.
  • TVSMSG was added in z/OS V2R1 and V2R2 with APAR OA48450.

Because JCL keyword names are reserved, you must ensure that your jobs do not use symbols with these same names. That is, if a job contains the symbolic parameter names TVSAMCOM or TVSMSG on the EXEC or PROC statement, you must edit the jobs to use alternatively named symbols. Otherwise, the jobs can fail with JCL errors.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

TVSAMCOM
z/OS V2R3.
TVSMSG
z/OS V2R2, with APAR OA48450 applied.

Applies to upgrade from:

TVSAMCOM
z/OS V2R2.
TVSMSG
z/OS V2R2 without APAR OA48450 applied.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you used symbols TVSAMCOM or TVSMSG in jobs.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Jobs that use TVSAMCOM or TVSMSG as an EXEC or PROC statement symbol name fail with a JCL error.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Search for a symbol that is named TVSAMCOM or TVSMSG in all libraries that contain JCL, such as procedure libraries. Specifically, search for the following occurrences:

  • PROC statements that contain a symbolic parameter that is named TVSAMCOM or TVSMSG.

    Example:

    //PROC1 PROC TVSAMCOM=ABC //PROC1 PROC TVSMSG=ABC
  • EXEC statements that contain a symbolic parameter that is named TVSAMCOM or TVSMSG.

    Examples:

    //JSTEP1 EXEC PROC1,TVSAMCOM=ABC //JSTEP1 EXEC PROC1,TVSMSG=ABC
  • EXEC statements that contain the parameter value string '&TVSAMCOM' or '&TVSMSG'.

    Examples:

    //STEP1 EXEC PGM=MYPROG,PARM=’&TVSAMCOM’ //STEP1 EXEC PGM=MYPROG,PARM='&TVSMSG'

For any occurrences that you find, change the JCL statement to refer to a different symbolic parameter name.

Reference information

For more information about JCL statements, see z/OS MVS JCL Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.15 : BCP: Update Capacity Provisioning for the new minimum Java requirement


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, Capacity Provisioning requires at least the following minimum level of Java:

  • IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).
Restriction:

Capacity Provisioning does not support the 64-bit version of the SDK.

If the references in the ENV member of the Provisioning Manager parameters data set specify the location of an earlier version of Java, you must update the LIBPATH environment variable.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your installation uses Capacity Provisioning.

Target system hardware requirements:

None.

Target system software requirements:

IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).

Other system (coexistence or fallback) requirements:

None.

Restrictions:

Levels prior to z/OS V2R3 Capacity Provisioning Manager are not compatible with IBM 31-bit SDK for z/OS V8.0, Java Technology Edition.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Install IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).
  2. Change the LIBPATH variable in the ENV member of your Provisioning Manager PARM data set to refer to the installation directories of your Java V8 installation. For example:
    LIBPATH=/usr/lpp/cpo/lib:/usr/lib:/usr/lpp/java/a80/J8.0/bin:/usr/

Reference information

For information about how to specify the Provisioning Manager parameters, see z/OS MVS Capacity Provisioning User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.16 : BCP: Update Predictive Failure Analysis for the new minimum Java requirement


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, Predictive Failure Analysis (PFA) requires at least the following minimum level of Java:

  • IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).

You must update the ini file in the /etc/PFA/ directory so that PFA processing can locate the Java code on your system.

Restriction: PFA does not support the 64-bit version of the SDK.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your installation uses PFA.

Target system hardware requirements:

None.

Target system software requirements:

The following Java level at a minimum:

  • IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).

Other system (coexistence or fallback) requirements:

None.

Restrictions:

PFA does not support the 64-bit version of the SDK.

System impacts:

If the PATH parameter or LIBPATH parameter specifies an unsupported Java version, PFA either fails to start or encounters errors later during operations.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Ensure that at least the following minimum level of Java is installed:
    • IBM 31-bit SDK for z/OS, Java Technology Edition, V8.0 (5655-DGG).
  2. Ensure that PFA users have READ access to the /etc/PFA/ini file. When PFA is started, PFA attempts to use the values in the /etc/PFA/ini file.
  3. If the /etc/PFA/ini exists, update the PATH= and LIBPATH= statements to refer to the minimum level of Java.

    The following example shows the default PATH and LIBPATH values for Java 8.0:

    PATH= /usr/lpp/java/J8.0/lib/s390/classic:/usr/lpp/java/J8.0/lib/s390 LIBPATH=/usr/lpp/java/J8.0/lib/s390:/usr/lpp/java/J8.0/lib/s390/classic:/lib:/usr/lib:
  4. If the /etc/PFA/ini file does not exist, copy it from /usr/lpp/bcp/samples/PFA/ini. If the path to the JDK for your installation is not the same as the path in the ini file, update it so that both the PATH= and LIBPATH= statements refer to the minimum level of Java.
  5. If the /etc/PFA/ini file does not exist and you do not copy the sample file, when PFA starts, it attempts to copy the ini file from an existing PFA check directory. If no ini files exist in any of the PFA check directories, PFA copies the sample file that specifies the default path for Java 8. If the path to the JDK for your installation is not the same as the default, PFA issues a message and does not start.

Reference information

For more information about PFA, see z/OS Problem Management.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.17 : BCP: Running z/OS as a guest requires z/VM V6R4 or later


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Introduced on the IBM System z EC12, transactional execution (TX) is a hardware-based facility that supports the notion of "transactions" by using such instructions as TBEGIN, TBEGINC, TABORT, and TEND — all of which are described in z/Architecture Principles of Operation. These instructions can be grouped into a transaction and any instructions that are used to update memory are committed to memory at the transaction's end.

As of z/OS V2R3, many functions of an EC12 were required (and enforced), but not transactional execution. As a result, z/OS programs that were coded to use TX needed to be sensitive to their environment, as follows:

  • z/OS not running under VM, TX is available.
  • z/OS running under VM V6R4 or later, TX is available.
  • z/OS running under VM V6R3 or earlier, TX is not available.

Starting with z/OS V2R4, running z/OS as a guest requires z/VM V6R4 or later. This requirement means that TX is available in all configurations.

A benefit of this change is that your programs no longer need to support a dual-path, regarding whether TX is available. In z/OS V2R4, the MACHMIG TX operand is still accepted, but is ignored. It is recommended, but not required, that you remove your use of this operand.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you are running z/OS under z/VM V6R3 or earlier.

Removing the MACHMIG TX operand in LOADxx parmlib member is recommended, but not required.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

This requirement is enforced at system IPL. If you attempt to run z/OS V2R4 under z/VM V6R3 or earlier, your system enters wait state 07B-21.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you do not plan to run z/OS V2R4 under z/VM, you have no action to take.

If you plan to run z/OS V2R4 under z/VM, ensure that you are running z/VM V6R4 or later. If not, you must upgrade to a supported z/VM release, such as z/VM V6R4.

If you have programs that support dual-paths based on the fields PSATX, PSATXC, CVTTX, or CVTTXC, and you know that your code will run on z/OS V2R4 or later, you can remove the check and the non-TX path.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.18 : BCP: Stop referencing the ETR parameters in CLOCKxx


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the default values of the CLOCKxx parmlib member ETRMODE and ETRZONE parameters are changed from YES to NO.

The IBM z10 was the last IBM mainframe to support the ETRMODE and ETRZONE parameters in CLOCKxx. Because z/OS V2R4 requires a zEC12 or later processor to run, the ETRMODE and ETRZONE parameters are now obsolete. They are deactivated (set to NO) by default.

It is recommended that you set these parameters to NO, or remove them from CLOCKxx. Specifying YES can cause unexpected behavior if you also specify STPZONE NO. For details, see APAR OA54440.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review the CLOCKxx member that you use to IPL your system, and take one of the following actions:

  • If CLOCKxx does not specify ETRMODE or ETRZONE, you have no action to take.
  • If CLOCKxx specifies ETRMODE YES or ETRZONE YES, set these parameters to NO, or remove them so that they default to NO.
  • If CLOCKxx specifies ETRMODE NO and ETRZONE NO, you have no action to take.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.2.19 : BCP: Evaluate the changed default for system logger's use of IBM zHyperwrite


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

With the installation of APAR OA57408, the use of IBM zHyperWrite data replication by system logger is changed from enabled to disabled by default.

The IBM zHyperWrite function was originally provided by APAR OA54814.

In parmlib member IXGCNFxx, this option is specified, as follows:

MANAGE . . . HYPERWRITE ALLOWACCESS(YESNO)

When IBM zHyperwrite is enabled for use with system logger, it provides data replication for the following types of log stream data sets:

  • Staging data sets for DASDONLY type log streams
  • Offload data sets for both the DASDONLY type and Coupling Facility structure-based type log streams.

System logger does not use zHyperwrite for the staging data sets for Coupling Facility structure-based type log streams.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP.

When change was introduced:

z/OS V2R3 and z/OS V2R2, both with PTF for APAR OA57408 applied.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, both without APAR OA57408.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you want system logger to use IBM zHyperwrite data replication.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you do not want system logger to use IBM zHyperwrite data replication, you have no action to take. When you install APAR OA57408, the use of IBM zHyperWrite data replication by system logger is disabled by default.

To determine whether system logger on your system uses IBM zHyperwrite data replication, you can query the current setting by entering the following command:

DISPLAY LOGGER,IXGCNF,MANAGE

In response, message IXG607I identifies the current setting.

To enable system logger use of IBM zHyperwrite data replication, you can do either of the following:

  • Enter the command SETLOGR MANAGE,HYPERWRITE,ALLOWUSE(YES)
  • Update the IXGCNFxx parmlib member with ALLOWUSE(YES).

Reference information

For more information, see IXGCNFxx parmlib member in z/OS MVS Initialization and Tuning Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.1.3 : BCP actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BCP upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.2 : BookManager READ upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element BookManager READ.


Step 4.2.1 : BookManager READ actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BookManager READ upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.2.1.1 : BookManager READ: Remove any dependencies on BookManager READ from your system


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 removes support for the BookManager READ element. IBM recommends that you use IBM Knowledge Center for z/OS, which was introduced in z/OS V2R2, to access product documentation on the web or from your own local repository.

IBM Knowledge Center for z/OS is the IBM platform for delivering product documentation. It is the replacement for both BookManager READ and Library Server.

In z/OS V2R2, IBM Knowledge Center for z/OS (KC4z) became a base element of z/OS. With KC4z, and Version 5 of the Softcopy Librarian tool, your installation can manage collections of Knowledge Center content (plug-ins) in your own repositories, and serve the content to users from those repositories.

KC4z provides function that is equivalent to BookManager READ and Library Server, as follows:

  • Similar to BookManager READ, you can use KC4z to manage your content collections. One difference is that KC4z provides a web interface to the documentation, rather than the“green screen” TSO/E interface as found in BookManager READ.
  • Similar to Library Server, you can use KC4z to host and serve documentation from your own server, within your intranet. By using links on the KC4z content Landing Page for each "z/OS elements+features" product, KC4z can serve PDFs from the IBM Publications Center website. Or, if the PDFs are loaded into a KC4z repository on your system (using the collection of Adobe Indexed PDFs for "z/OS elements+features"), the PDFs can be served from a local KC4z repository.

In z/OS V2R1, IBM ended its production of BookManager Book format publications. At this time, the need to continue reading documentation by using the BookManager READ “green screen” interface on TSO/E is much reduced or eliminated.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

BookManager READ

When change was introduced:

z/OS V2R4

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Remove any dependencies on BookManager READ from your system.

Check for the following uses:

  • Review any invocation of BookManager READ on any customized ISPF panels that you have provided.
  • Reading BookManager Book format documentation by using the BookManager READ “green screen” interface on TSO/E. Plan to replace your BookManager Book repository with a KC4z repository of Knowledge Center plugins.
  • Using the BookManager READ command line interface to access information in BookManager Book format documentation, such as the older “ green screen” version of the LookAT message tool.

Replace any use of the BookManager READ command line interface that accesses information in BookManager Book documentation with a Knowledge Center based solution. IBM Knowledge Center includes a replacement for the legacy LookAT facility that was used for message look-ups. You can find it here: IBM Z: Look@ Knowledge Center

In KC4z, the LookAT function can be configured to perform its message lookup against either the Knowledge Center hosted on ibm.com, or against a KC4z repository of Knowledge Center documentation hosted locally on your system.

If you still need the ability read legacy BookManager books, you can do so by moving the book files to a Windows system and using Softcopy Reader for Windows to read the files. This tool is available for download without charge from IBM Support Portal on ibm.com.

Reference information

For more information, see IBM Knowledge Center for z/OS Configuration and User Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.2.2 : BookManager READ actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BookManager READ upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.2.3 : BookManager READ actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes BookManager READ upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.3 : CIM upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element Common Information Model (CIM).


Step 4.3.1 : CIM actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes CIM upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.3.1.1 : CIM: Accommodate the default change from HTTP to HTTPS


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R4, the common information model (CIM) server uses HTTPS connections by default. On start-up, the CIM server listens on the HTTPS port, rather than the HTTP port, as was done in previous releases.

The change from HTTP to HTTPS is intended to allow for more secure communication with the CIM server.

The following CIM server configuration defaults are affected:

  • enableHttpConnection=true
  • enableHttpsConnection=false

In z/OS V2R4, these defaults were changed to:

  • enableHttpConnection=false
  • enableHttpsConnection=true

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

BCP

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have applications that connect to the CIM server through the HTTP protocol.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Based on this change, the CIM server opens a listener on port 5989 by default. If a client connection on this port is not secured by AT-TLS, the connection is closed and an appropriate error message is issued on the operations console.

Related IBM Health Checker for z/OS check:

The following migration health check indicates whether the CIM server is listening on the HTTP port of the system:
IBMCIM,ZOSMIGV2R4_CIM_HTTPS_ENABLED

This check is available for z/OS V2R3 with APAR OA57687 applied.

Steps to take

It is recommended that you use HTTPS instead of HTTP, which allows the CIM server to use Application Transparent Layer Security (AT-TLS) functions. Here, the communication between the CIM client and the CIM server is encrypted.

You must also configure the CIM client applications to use HTTPS. Ensure that the applications run as CIM clients connected to the CIM server on HTTPS port 5989.

Fall back to HTTP is possible, though it is not secure and therefore not recommended.

If you need the CIM server to use the HTTP protocol on start-up, follow these steps:

  • Start the CIM server with the following settings specified in the configuration properties file:
    • enableHttpConnection=true
    • enableHttpsConnection=false
  • Alternatively, you can dynamically change the enableHttpConnection value and restart the CIM server by entering either of these commands on the operations console:
    • cimconfig -s enableHttpConnection= true -p
    • F CFZCIM,APPL=CONFIG,enableHttpConnection=true,PLANNED

Reference information

For information about how to set up HTTPS connections for the CIM server, see the topic “Configuring the CIM server HTTPS connection using AT-TLS” in CIM User’s Guide.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCIM,ZOSMIGV2R4_CIM_HTTPS_ENABLED.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.3.2 : CIM actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes CIM upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.3.3 : CIM actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes CIM upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4 : Communications Server upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element z/OS Communications Server.


Step 4.4.1 : Communications Server actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Communications Server upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.4.1.1 : SNA services: Migrate from VTAM Common Management Information Protocol


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is planned to be the last release to support the VTAM® Common Management Information Protocol (CMIP). CMIP services is an API that enables a management application program to gather various types of SNA topology data from a CMIP application, which is called the topology agent. IBM recommends that you use the SNA network monitoring network management interface (NMI) to monitor SNA Enterprise Extender and High Performance Routing data.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R4. The removal of VTAM Common Management Information Protocol (CMIP) was announced on 26 February 2019 in IBM United States Software Announcement 219-013.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because support for this function is being removed in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether VTAM OSIMGMT functions are in use on this system, use the health check IBMCS,ZOSMIGV2R4_NEXT_CS_OSIMGMT

The health check is available on the following releases:

  • z/OS V2R2 and V2R3 with APAR OA57227
  • z/OS V2R4
Steps to take

Determine whether you have any programs that use VTAM Common Management Information Protocol (CMIP) to monitor SNA Enterprise Extender and High Performance Routing data. An indication of current usage would be if OSIMGMT=YES is specified in your VTAM start list. If so, update the programs to use the SNA network monitoring network management interface (NMI).

Reference information

None.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R4_NEXT_CS_OSIMGMT.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

The health check is available on the following releases: z/OS V2R2 and V2R3 (both with APAR OA57227) and z/OS V2R4


Step 4.4.1.2 : IP Services: Plan to upgrade the DCAS server to AT-TLS security


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release in which the Digital Certificate Access Server (DCAS) will support direct invocation of System SSL APIs for TLS/SSL protection. In the future, the only TLS/SSL protection option for this server will be Application Transparent Transport Layer Security (AT-TLS).

The direct System SSL support in this component is functionally outdated and supports only TLS protocols up through TLSv1.1.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R2 and z/OS V2R3.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you are using the native TLS/SSL support for DCAS (TLSMECHANISM DCAS).

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

DCAS configuration error messages are issued if any IBM system SSL configuration keywords or parameters are configured.

Related IBM Health Checker for z/OS check:

The following migration health check can help you determine whether you are using native TLS/SSL for FTP servers:
IBMCS,ZOSMIGV2R4_NEXT_CS_DCAS_NTVSSL

This check is available for z/OS V2R2 and V2R3 with APAR OA58255 applied.

Steps to take

You must migrate the DCAS server to use AT-TLS policies.

Complete the following steps to migrate the DCAS server to use AT-TLS policies:

  1. Customize the DCAS server for TLS/SSL. For more information, see the topic about customizing DCAS for TLS/SSL in IP Configuration Guide.
  2. Migrate the DCAS configuration file. For more information about DCAS configuration keywords and equivalent AT-TLS policies, see the table that follows.

Table 2. Migrating existing DCAS server to use AT-TLS policies
DCAS configurationAT-TLS equivalent statementAT-TLS policy statement
ClientAuth

Local1

HandshakeRole ServerWithClientAuthTTLSEnvironmentAction
ClientAuthType Required

TTLSEnvironmentAction ->

TTLSEnvironmentAdvancedParms

ClientAuth

Local2

HandshakeRole ServerWithClientAuthTTLSEnvironmentAction
ClientAuthType SAFCHECKTTLSEnvironmentAction ->

TTLSEnvironmentAdvancedParms

IPADDRLocalAddrTTLSRule
KEYRINGKeyringTTLSEnvironmentAction ->

TTLSKeyringParms

LDAPPORTGSK_LDAP_SERVER_PORTTTLSEnvironmentAction ->

TTLSGskAdvancedParms ->

TTLSGskLdapParms

LDAPSERVERGSK_LDAP_SERVERTTLSEnvironmentAction ->

TTLSGskAdvancedParms ->

TTLSGskLdapParms

PortLocalPortRangeTTLSRule
SAFKEYRINGKeyringTTLSEnvironmentAction ->

TTLSKeyringParms

STASHFILEKeyringStashFileTTLSEnvironmentAction ->

TTLSKeyringParms

V3CIPHERV3CipherSuitesTTLSEnvironmentAction ->

TTLSCipherParms

Reference information

None.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R4_NEXT_CS_DCAS_NTVSSL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.1.3 : IP Services: Plan to upgrade the FTP server to AT-TLS security


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release in which the FTP server will support direct invocation of System SSL APIs for TLS/SSL protection. In the future, the only TLS/SSL protection option for this server will be Application Transparent Transport Layer Security (AT-TLS). If you are using native TLS/SSL support for the FTP server, you must upgrade to using AT-TLS policies.

The following FTP.DATA parameters and settings for the FTP server are removed:

  • TLSMECHANISM FTP
  • TLSRFCLEVEL CCCNONOTIFY
  • KEYRING
  • CIPHERSUITE
  • TLSTIMEOUT
  • SSLV3

Note: TLS/SSL support for the FTP client is unchanged.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R4.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you are using the native TLS/SSL support for the FTP server.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

FTP configuration error messages are issued if any of the removed configuration keywords or parameters are configured for FTP servers.

Related IBM Health Checker for z/OS check:

The following migration health check can help you determine whether you are using native TLS/SSL for FTP servers:
IBMCS,ZOSMIGV2R4_NEXT_CS_FTPSRV_NTVSSL

This check is available for z/OS V2R2 and V2R3 with APARs PH21573 and OA59022 applied.

Steps to take

You must migrate any FTP server using native TLS/SSL to use AT-TLS policies.

Perform the following steps to migrate from an existing FTP server configuration using native TLS/SSL support to a configuration using AT-TLS:

  1. Configure AT-TLS and Policy Agent. For details about Policy Agent setup and AT-TLS policy statements, see IP Configuration Reference.

    Requirements:

    • The FTP server is a controlling application. Code a TTLSEnvironmentAdvancedParms statement with the ApplicationControlled and SecondaryMap parameters; both parameters should specify the value On. The ApplicatonControlled parameter allows FTP to start and stop TLS security on a connection. The SecondaryMap parameter enables active or passive data connections to use the AT-TLS policy that is used for the control connection. You do not need to code any additional TTLSRule statements for the data connections.
    • The FTP server requires the HandshakeRole parameter with the value Server or ServerWithClientAuth to be coded on the TTLSEnvironmentAction statement. If the SECURE_LOGIN statement is coded in FTP.DATA with the parameters REQUIRED or VERIFY_USER, the HandshakeRole parameter value must be ServerWithClientAuth.
    • The TTLSRule statement for the FTP server requires the Direction parameter with the value Inbound.

  2. Configure the FTP server to use AT-TLS by coding TLSMECHANISM ATTLS in FTP.DATA.

  3. If TLSRFCLEVEL CCCNONOTIFY is configured in FTP.DATA, update TLSRFCLEVEL to have a valid value for AT-TLS.

  4. Use Table 2 to migrate the existing FTP server configuration to AT-TLS. Remove the statements form FTP.DATA and code the AT-TLS equivalent statement.
    Table 2. Migrating existing FTP server configuration
    FTP.DATA statementAT-TLS equivalent statementAT-TLS policy statement
    KEYRINGKeyring

    TTLSKeyRingParms ->

    TTLSEnvironmentAction

    CIPHERSUITEV3CipherSuites

    TTLSCipherParms ->

    TTLSEnvironmentAction or TTLSConnectionAction

    TLSTIMEOUTGSK_V3_SESSION_TIMEOUT

    TTLSGskAdvancedParms ->

    TTLSEnvironmentAction

    SSLV3SSLv3

    TTLSEnvironmentAdvancedParms-> TTLSEnvironmentAction

    Or

    TTLSConnectionAdvancedParms-> TTLSConnectionAction


  5. Use Table 3 to migrate existing ciphers coded on CIPHERSUITE statements in FTP.DATA to AT-TLS TTLSCipherParms statements.
    Table 3. Migrating existing ciphers
    CIPHERSUITE cipherV3CipherSuites cipherHexadecimal value
    SSL_DES_SHA TLS_RSA_WITH_DES_CBC_SHA09
    SSL_3DES_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA0A
    SSL_NULL_MD5TLS_RSA_WITH_NULL_MD5 01
    SSL_NULL_SHA TLS_RSA_WITH_NULL_SHA 02
    SSL_RC2_MD5_EX TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 06
    SSL_RC4_MD5 TLS_RSA_WITH_RC4_128_MD504
    SSL_RC4_MD5_EX TLS_RSA_EXPORT_WITH_RC4_40_MD503
    SSL_AES_128_SHATLS_RSA_WITH_AES_128_CBC_SHA2F
    SSL_AES_256_SHA TLS_RSA_WITH_AES_256_CBC_SHA35

  6. AT-TLS supports more secure TLS versions and ciphers. Consider enabling TLSv1.2 or TLSv1.3 on the TTLSEnvironmentAdvancedParms or TTLSConnectionAdvancedParms statement. Consider enabling support for additional ciphers on the TTLSCipherParms statement.

Reference information

For the steps to migrate the FTP server, see the topic "Steps for migrating the FTP server and client to use AT-TLS" in IP Configuration Guide.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R4_NEXT_CS_FTPSRV_NTVSSL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.1.4 : IP Services: Plan to upgrade the TN3270E server to AT-TLS security


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release in which the TN3270E server will support direct invocation of System SSL APIs for TLS/SSL protection. In the future, the only TLS/SSL protection option for this server will be Application Transparent Transport Layer Security (AT-TLS). If you are using native TLS/SSL support for the TN3270E server, you must upgrade to using AT-TLS policies.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R2 and z/OS V2R3.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you are using native TLS/SSL support for TN3270E.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

TN3270E configuration error messages are issued if any IBM system SSL configuration keywords or parameters are configured.

Related IBM Health Checker for z/OS check:

The following migration health check can help you determine whether you are using native TLS/SSL for FTP servers:
IBMCS,ZOSMIGV2R4_NEXT_CS_TN3270_NTVSSL

This check is available for z/OS V2R2 and V2R3 with APAR OA58255 applied.

Steps to take

You must migrate the TN3270E server to use AT-TLS policies.

Complete the following steps to migrate the TN3270E server to use AT-TLS policies:

  1. Customize the TN3270E server for TLS/SSL. For more information, see the topic "TN3270E Telnet server security" in IP Configuration Guide.
  2. Migrate the TN3270E configuration file. For more information about TN3270E configuration keywords and equivalent AT-TLS policies, see Table 2.
    Table 2. Migrating existing TN3270E server to use AT-TLS policies
    Telnet statementAT-TLS equivalent statementAT-TLS equivalent statement
    CLIENTAUTH

    SSLCERT

    HandshakeRole

    ServerWithClientAuth and

    ClientAuthType Required

    TTLSConnectionAction or

    TTLSEnvironmentAction /

    TTLSEnvironmentAdvancedParms within TTLSEnvironmentAction

    CLIENTAUTH

    SAFCERT

    HandshakeRole

    ServerWithClientAuth and

    ClientAuthType SAFCHECK

    TTLSConnectionAction or

    TTLSEnvironmentAction /

    TTLSEnvironmentAdvancedParms within TTLSEnvironmentAction

    CRLLDAPSERVERGSK_LDAP_Server and

    GSK_LDAP_Server_Port

    TTLSGskLdapParms within TTLSEnvironmentAction
    ENCRYPTIONTTLSCipherParmsTTLSConnectionAction or TTLSEnvironmentAction
    KEYRINGKeyringTTLSKeyRingParms within TTLSEnvironmentAction
    SSLV2SSLv2TTLSEnvironmentAdvancedParms within TTLSEnvironmentAction or

    TTLSConnectionAdvancedParms within TTLSConnectionAction

    SSLTIMEOUTHandshakeTimeoutTTLSEnvironmentAdvancedParms within TTLSEnvironmentAction or

    TTLSConnectionAdvancedParms within TTLSConnectionAction

Reference information

For the steps to migrate the FTP server, see the topic "Steps for migrating the FTP server and client to use AT-TLS" in IP Configuration Guide.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R4_NEXT_CS_TN3270_NTVSSL.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.1.5 : TCP/IP: Prepare for the removal of Sysplex Distributor support for IBM DataPower Gateway products


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is planned to be the last release to support Sysplex Distributor target controlled distribution to DataPower Gateway products. This feature is deprecated in the DataPower Gateway. IBM recommends that you implement another solution for workload balancing, such as through an external load balancer.

This removal does not impact any other Sysplex Distributor functions. Only configurations that specify TARGCONTROLLED on the VIPADISTRIBUTE statement are affected.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

See IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because support for this function is being removed in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Typically, the PROFILE.TCPIP data set is specified on the PROFILE DD statement in the TCP/IP stack started procedure. However, other options exist for specifying it. The search order for accessing PROFILE.TCPIP information is as follows.The first file found in the search order is used.

  1. //PROFILE DD statement
  2. jobname.nodename.TCPIP
  3. TCPIP.nodename.TCPIP
  4. jobname.PROFILE.TCPIP
  5. TCPIP.PROFILE.TCPIP

For more information, see the topic PROFILE.TCPIP search order in IP Configuration Guide.

In the PROFILE.TCPIP data set, search for instances of the following keywords, which are related to Tier1 workload distribution:

  • GRE
  • ENCAP
  • TARGCONTROLLED
  • CONTROLPORT

Remove the keywords from the PROFILE.TCPIP data set.

Reference information

For more information, see the following references:

Step 4.4.1.6 : IP services: Ensure storage availability for IWQ IPSec traffic


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

As of z/OS V2R3 with TCP/IP APAR PI77649, or z/OS V2R2 with TCP/IP APAR PI77649 and SNA APAR OA52275, the processing of IPAQENET and IPAQENET6 INTERFACE statements is enhanced when you use OSA-Express6S. If you enabled QDIO inbound workload queuing (WORKLOADQ) and you have IPSec traffic, an additional ancillary input queue (AIQ) is established for IPSec inbound traffic. Additional storage is allocated for this input queue.

Each AIQ increases storage utilization in the following two areas:

  • Approximately 36 KB of fixed ECSA
  • 64-bit CSM HVCOMMON for READSTORAGE

    If you are using IPSec, when the first IPSec tunnel is activated (protocols ESP or AH), the new AIQ is backed with 64-bit CSM HVCOMMON fixed storage. The amount of HVCOMMON storage that is used is based on the specification of the INTERFACE READSTORAGE parameter.

If you configured QDIO inbound workload queuing (WORKLOADQ), ensure that sufficient fixed ECSA and fixed (real) 4 KB CSM HVCOMMON storage is available for the AIQ for IPSec traffic.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3 (with APAR PI77649) and z/OS V2R2 (with APARs PI77649 and OA52275).

Applies to upgrade from:

z/OS V2R3 (without APAR PI77649) and z/OS V2R2 (without APARs PI77649 and OA52275).

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but it is recommended if you have the WORKLOADQ parameter that is specified on the OSA IPAQENET and IPAQENET6 INTERFACE statements, you have IPSec traffic and you have concerns about using additional ECSA or real (fixed) storage.

Target system hardware requirements:

OSA-Express6S Ethernet features or later in QDIO mode running on IBM z14 and ZR1.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether sufficient fixed storage is available for IWQ IPSec enabling, use the following IBM health checks:

  • IBMCS,ZOSMIGV2R4PREV_CS_IWQSC_tcpipstackname issues a message if the TCP/IP stack has inbound workload queuing (IWQ) and IPSec enabled, but the OSA does not support IWQ for IPSec. Only OSA-Express6S and later support IWQ for IPSec. This health check is shipped INACTIVE and set to run once.
  • IBMCS,CSTCP_IWQ_IPSEC_tcpipstackname issues a message if the TCP/IP stack has IWQ and IPSec enabled, and the OSA does support IWQ for IPSec. This health check is shipped ACTIVE and is set to run once.

These health checks are available with PH11837 and OA57525 for V2R3, and PH12005 and OA57560 for V2R4.

Steps to take
  1. If you are using or plan to use OSA-Express6S or later, verify that the following conditions are true:
    • WORKLOADQ is specified on the IPAQENET and IPAQENET6 INTERFACE statements.
    • Have IPSec traffic; protocols ESP or AH.
  2. If step 1 is applicable, IWQ IPSec uses additional storage. Continue with step 3 - 6. Otherwise, there is no increase in storage usage, and no further action is required.
  3. To calculate the total storage increase, count the total number of IPAQENET and IPAQENET6 INTERFACE statements that are coded with the WORKLOADQ parameter that are associated with OSA-Express6S or later. Make a note of the number.
  4. Verify that sufficient ECSA is available. To calculate this, multiply the total INTERFACE statements that are counted in step 3 by 36 KB. The resulting number indicates how much additional ECSA is required.

    To determine whether sufficient ECSA is available to enable this function, verify the following ECSA definitions:

    • D CSM usage (PARMLIB member IVTPRM00, ECSA MAX value)
    • VTAM (Start Options CSALIMIT and CSA24)
    • TCPIP (GLOBALCONFIG ECSALIMIT statement in the TCPIP PROFILE)
  5. Verify that sufficient real (fixed) storage is available. 64-bit fixed (CSM HVCOMMON) storage is used for the IPSec AIQ read buffers. To calculate this value, multiply the total number of INTERFACE statements that are counted in step 3 by your configured READSTORAGE value (for example, 4 MB). You can verify how much storage is being used for READSTORAGE by using the D NET, TRLE command. The resulting number indicates how much additional fixed (64-bit) storage is required. To verify that the additional fixed storage is not a constraint for your system, take the following actions:
    • Use the DISPLAY CSM command to verify that sufficient fixed storage is available (CSM FIXED MAXIMUM defined in IVTPRM00).
    • Verify the actual amount of real storage available to this z/OS system by using D M=STOR or D M=HIGH.
  6. If sufficient ECSA or real storage is not available, increase the available real storage or consider defining some of the OSA-Express6S (or later) INTERFACE statements with the NOWORKLOADQ parameter. If your CSM FIXED MAXIMUM is too low, increase this value in IVTPRM00.
Reference information

For information about ECSA usage, see the IBM technote Communications Server ECSA and CSM Storage Usage.

For documentation updates to existing publications, check the following URL for the appropriate FMID:

Instructions:

This portion of the Workflow will guide you to submit jobs to run two IBM Health Check for z/OS health checks associated with this upgrade action, IBMCS,*IWQ*.

These checks will be activated if they are not already active. If the checks are activated, they will be deactivated at the end of the job, so that they remain in the same state as they were found.

If the health checks run with no exceptions, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health checks find an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation as you find appropriate. You can then re-run this workflow step to submit the health check jobs again, until the health checks no longer receive exceptions and the step is marked "Complete".

These health checks are available with PH11837 and OA57525 for V2R3, and PH12005 and OA57560 for V2R4.


Step 4.4.1.7 : IP Services: EZZ6044I and EZZ6045I descriptor codes are changed


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the descriptor codes for EZZ6044I and EZZ6045I messages were changed from 4 to 5. These messages are generated when either the Telnet Server is started or the command VARY OBEY is issued for the Telnet Server.

Only the descriptor codes changed. The message text is unchanged from previous releases:

EZZ6044I jobname PROFILE PROCESSING BEGINNING FOR FILE dataset_name EZZ6045I jobname PROFILE PROCESSING COMPLETE FOR FILE dataset_name

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if your automation is sensitive to descriptor codes of messages.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your automation processing is sensitive to message descriptor codes, ensure that the automation is updated for the change in the descriptor code for EZZ6044I and EZZ6045I. These messages are now issued as a command response (descriptor code=5).

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.1.8 : IP services: Migrate from SMTP and sendmail


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, support is removed for the SMTPD NJE: Mail Gateway and sendmail mail transports.

  • If you use the SMTPD NJE Gateway to send mail, migrate to the CSSMTP SMTP NJE Mail Gateway to send mail.
  • If you use the z/OS UNIX sendmail command, SMTPD, or the sendmail client to send mail, a compatible subset of sendmail function is provided by the new z/OS sendmail to CSSMTP bridge (sendmail bridge) and CSSMTP.
  • No replacement function is provided by z/OS Communications Server for receiving mail for delivery to local TSO/E or z/OS UNIX System Services user mailboxes or for forwarding mail to other destinations.

As of z/OS V2R3, the following migration health checks are removed:

  • ZOSMIGV2R2_NEXT_CS_SENDMAILCLIEN
  • ZOSMIGV2R2_NEXT_CS_SENDMAILDAEMN
  • ZOSMIGV2R2_NEXT_CS_SENDMAILMSA
  • ZOSMIGV2R2_NEXT_CS_SENDMAILMTA
  • ZOSMIGV2R2_NEXT_CS_SMTPDDAEMON
  • ZOSMIGV2R2_NEXT_CS_SMTPDMTA

As of V2R3, the CSAPP_SMTPD_MAIL_RELAY application health check is removed. This health check was introduced by VTAM APAR OA50122 and TCP/IP APAR PI51640, in both z/OS V2R1 and V2R2.

As of V2R3, the EZBMCOPY utility program is removed.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. The removal of the SMTPD NJE Mail Gateway and sendmail mail transports was first announced on 24 February 2014 in US Announcement Letter 114-009. On 25 July 2015, Software Announcement 215-267 further stipulated that z/OS V2R2 would be the last release to include these functions.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are using SMTPD or sendmail.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

The following migration health checks can help you determine whether you are using SMTPD or sendmail.

  • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILCLIEN
  • IBMCS,ZOSMIGV2R2_Next_CS_SENDMAILDAEMN
  • IBMCS,ZOSMIGV2R2_NEXT_CS_SENDMAILMSA
  • IBMCS,ZOSMIGV2R2_Next_CS_SENDMAILMTA
  • IBMCS,ZOSMIGV2R2_Next_CS_SMTPDDAEMON
  • IBMCS,ZOSMIGV2R2_Next_CS_SMTPDMTA

These checks are available in z/OS V2R2.

Steps to take
  • Beginning with z/OS V2R3, Communications Server does not support using SMTPD or sendmail as an SMTP server for receiving mail for delivery to local TSO/E or z/OS UNIX user mailboxes, or for forwarding mail to other destinations. No replacement function is provided.
    • IBM suggests that customers who currently use sendmail for purposes other than sending mail (for example, as a mail transfer agent (MTA) or a mail submission agent (MSA)) migrate those functions to a compatible third-part solution or to other operating system platforms, such as Linux on z Systems.
    • IBM suggests that customers who currently use SMTPD for purposes other than sending mail from the z/OS JES spool migrate those mail functions to other operating system platforms, such as Linux on z Systems.
  • If you are using the SMTPD NJE Gateway to send mail from the z/OS JES spool, migrate to the CSSMTP application. If you are using the SMTPD DBCS configuration statement, migrate to use the CSSMTP MBCS, TRANSLATE, and MBCharset configuration statements. For more details, see Communications Server SMTP server in z/OS Communications Server: IP Configuration Reference and Mail on z/OS in z/OS Communications Server: IP Configuration Guide. Note:

    CSSMTP support for DBCS characters is added by TCP/IP APAR PI93278 for z/OS V2R2 and z/OS V2R3.

  • Before z/OS V2R3, SMTPNOTE could be used for SMTPD and CSSMTP. Check that the configured SMTPJOB value in the SMTPNOTE CLIST matches the ExtWrtName name of the CSSMTP job name, not the SMTPD job name. See CSSMTP ExtWrtName statement in z/OS Communications Server: IP Configuration Reference.
  • If your LPD server SERVICE statement is configured with the FAILEDJOB MAIL parameter, check that the server_name of the SMTP statement is the CSSMTP external writer name, not the SMTPD job name. See z/OS Communications Server: IP Configuration Reference for information on the LPD SERVICE statement and the CSSMTP ExtWrtName statement.
  • If you use the sendmail client, a compatible subset of functions for sendmail is provided through the new z/OS sendmail to CSSMTP bridge (sendmail bridge). This support requires that CSSMTP is configured and running. Verify that the function that is provided by the sendmail bridge meets your needs.
    • The sendmail bridge is only a mail client function. It does not provide the mail server function that the removed sendmail daemon provided.
    • The sendmail bridge requires that CSSMTP is configured and running.
    • The sendmail bridge uses JES spool files. For information about how to control and access the JES spool data sets, see Steps for creating mail on the JES spool data set for CSSMTP in z/OS Communications Server: IP Configuration Guide
    • For Transport Layer Security (TLS) support, the value that is defined on configuration statement D{tls_version} is ignored. For more information about the D{tls_version} configuration statement, see sendmail bridge in z/OS Communications Server: IP Configuration Reference. The secured connection is set up between CSSMTP and target mail server based on configured AT-TLS policy. See Steps for using Transport Layer Security for CSSMTP in z/OS Communications Server: IP Configuration Guide.
  • The trace option group SMTP for event trace SYSTCPIP is removed. If you have this option specified in the component trace SYS1.PARMLIB member (CTIEZB00 by default), remove it. Otherwise, the PARMLIB member is considered in error and none of the requested trace options are activated.
Reference information

For more information, see the following references:

CSSMTP is changed to support DBCS character sets. See the appropriate technote for your z/OS release:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R2_NEXT_CS_S*.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

These checks are only available on the following releases: z/OS V2R1 with APARs PI40204 and OA47735 applied, and on z/OS V2R2.


Step 4.4.1.9 : IP Services: Replace configuration of additional TCP/IP legacy device types


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, support is removed for the following TCP/IP device types. You must migrate from these device types to a supported interface type, such as OSA-Express QDIO or HiperSockets.

  • FDDI and Token Ring (LCS with LINKs FDDI and IBMTR)
  • Token Ring (MPCIPA with LINK IPAQTR)
  • Ethernet and FDDI (MPCOSA with LINKs OSAENET and OSAFDDI)

This upgrade action affects only device types that are configured to the TCP/IP stack.

Support for the ZOSMIGV2R2_NEXT_CS_LEGACYDEVICE health check is also removed.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. This change was also announced in IBM United States Hardware Announcement 215-267 dated July 28, 2015.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are using any of these legacy device types, you must migrate to a later interface type, such as OSA-Express QDIO and HiperSockets.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

TCP/IP configuration error messages are issued if any of the affected profile statements are configured to the TCP/IP stack. The error messages indicate that the affected profile statement is not recognized.

Related IBM Health Checker for z/OS check:

To determine whether you are using the removed TCP/IP legacy device types, use the IBM health check called IBMCS,ZOSMIGV2R2_NEXT_CS_LEGACYDEVICE. This check is available in z/OS V2R2 with TCP/IP APAR PI49962 and SNA APAR OA49071 applied.

This check is removed in z/OS V2R3.

Steps to take

Use a later TCP/IP interface type, such as OSA-Express QDIO or HiperSockets.

Remove any customization for the ZOSMIGV2R2_NEXT_CS_LEGACYDEVICE health check in your IBM Health Checker for z/OS HZSPRMxx parmlib member.

Reference information

For information about configuring OSA-Express QDIO and HiperSockets interfaces, see the topic on considerations for networking hardware attachment in z/OS Communications Server: IP Configuration Guide

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R2_NEXT_CS_LEGACYDEVICE.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This check was available in z/OS V2R1 and V2R2 with TCP/IP APAR PI49962 and SNA APAR OA49071 applied. This check is removed in z/OS V2R3.


Step 4.4.1.10 : IP Services: Use alternate file transfer program


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R2 was the last release to include the Trivial File Transfer Protocol Daemon (TFTPD) function in z/OS Communications Server. If you use the TFTPD function, migrate to a supported file transfer protocol, such as FTP.

z/OS V2R3 also removes support for the ZOSMIGV2R2_NEXT_CS_TFTP migration health check.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

V2R3. Also, see IBM United States Software Announcement 215-267 IBM z/OS Version 2 Release 2 Fueling the new digital enterprise, dated July 28, 2015.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are using the TFTPD function.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether you are using the TFTP daemon, use check IBMCS,ZOSMIGV2R2_Next_CS_TFTP. This check is available on z/OS V2R2 with APARs PI61806 and OA50445 applied.

This check is removed in z/OS V2R3.

Steps to take

If you are using the TFTPD function, migrate to a supported file transfer protocol, such as FTP.

Reference information

For information on the FTP daemon, see z/OS Communications Server: IP Configuration Guide.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,ZOSMIGV2R2_NEXT_CS_TFTP.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This check is only available on the following releases: z/OS V2R1 with APARs PI61806 and OA50445 applied, and z/OS V2R2 with APARs PI61806 and OA50445 applied.


Step 4.4.1.11 : IP Services: Verify that the changed HowToAuthMsgs and HowToAuth defaults are acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the default values for the following IPSec policy parameters were changed:

  • The HowToAuthMsgs parameter on the KeyExchangeOffer statement is changed from MD5 to SHA1.
  • The HowToAuth parameter on the IpDataOffer statement is changed from HMAC_MD5 to HMAC_SHA1.

If you have an IPSec policy, determine whether this change affects your policy. If you use the IBM Configuration Assistant for z/OS Communications Server to configure your IPSec policy, an explicit HowToAuthMsgs value is generated on every KeyExchangeOffer statement and an explicit HowToAuth value is generated on every IpDataOffer statement, so default values are not used. If you manually configure your IPSec policy, default values might be used.

Note:

MD5 is considered a weak algorithm and is not recommended. Regardless of whether you use IBM Configuration Assistant for z/OS Communications Server or manually configure your policies, you should evaluate your usage of the MD5-based algorithms and decide whether to upgrade to a more secure algorithm.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. Also, z/OS V2R2 with APAR PI55022.

Applies to upgrade from:

z/OS V2R2 without APAR PI55022

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use an IPSec policy.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your policy is not generated by IBM Configuration Assistant for z/OS Communications Server:

  • Search your IPSec policy files for any KeyExchangeOffer statements that do not specify a HowToAuthMsgs parameter. If you find such a KeyExchangeOffer statement, your policy is affected. If you require the HowToAuthMsgs value to continue to use MD5, update your policy to explicitly set the HowToAuthMsgs parameter to MD5. If you want to use the new default of SHA1, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peer's policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with the remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.
  • Search your IPSec policy files for any IpDataOffer statements that do not specify a HowToAuth parameter. If you find such an IpDataOffer statement, your policy is affected. If you require the HowToAuth value to continue to use HMAC_MD5, update your policy to explicitly set the HowToAuth parameter to HMAC_MD5. If you want to use the new default of HMAC_SHA1, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peer's policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with the remote peer's policy, the IKE daemons will no longer be able to negotiate IPSec tunnels.
  • During this exercise, you should note any cases where your policy explicitly uses MD5-based algorithms. If you find any, consider changing your policy to use a stronger authentication algorithm. Before you make changes, you must coordinate with the owners of each remote IKE peer associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

If your policy is generated by IBM Configuration Assistant for z/OS Communications Server, evaluate your existing policy to determine whether MD5 is configured on any data offers or key exchange offers. If so, consider changing your policy to use a stronger authentication algorithm. Before you make changes, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.1.12 : IP Services: Verify that the changed HowToEncrypt default is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the default value for the HowToEncrypt parameter on the KeyExchangeOffer and IpDataOffer statements in the IPSec policy is changed from DES to AES_CBC Keylength 128. If you have an IPSec policy, determine whether this change affects your policy. If you use the IBM Configuration Assistant for z/OS Communications Server to configure your IPSec policy, an explicit HowToEncrypt value is generated on every KeyExchangeOffer and IpDataOffer statement, so default values are not used. If you manually configure your IPSec policy, default values might be used.

Note that DES is considered a weak algorithm and is not recommended. Thereffore, regardless of whether you use IBM Configuration Assistant for z/OS Communications Server or manually configure your policies, you should evaluate your usage of the DES and 3DES algorithms and decide whether to upgrade to a more secure algorithm.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. Also, z/OS V2R2 with APAR PI74383.

Applies to upgrade from:

z/OS V2R2 without APAR PI74383.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use an IPSec policy.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your policy is not generated by IBM Configuration Assistant for z/OS Communications Server, do the following:

  • Search your IPSec policy files for any KeyExchangeOffer statements and any IpDataOffer statements that do not specify a HowToEncrypt parameter. If you find such a KeyExchangeOffer statement or IpDataOffer statement, your policy is affected. If you require the HowToEncrypt value to continue to use DES, update your policy to explicitly set the HowToEncrypt parameter to DES. If you want to use the new default of AES_CBC Keylength 128, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peer's policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with the remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.
  • During this exercise, note any cases where your policy explicitly uses DES and 3DES algorithms. If you find any, consider changing your policy to use a stronger authentication algorithm. Before you make changes, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

If your policy is generated by IBM Configuration Assistant for z/OS Communications Server, you should evaluate your existing policy to determine whether DES or 3DES are configured on any data offers or key exchange offers. If so, consider changing your policy to use a stronger authentication algorithm. Before you make changes, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.1.13 : IP Services: Verify that the changed DHGroup default is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the default value for the DHGroup parameter on the KeyExchangeOffer statement in the IPSec policy was changed from Group1 to Group2. If you have an IPSec policy, determine whether this change affects your policy. If you use the IBM Configuration Assistant for z/OS Communications Server to configure your IPSec policy, an explicit DHGroup value is generated on every KeyExchangeOffer statement. A default value is not used. If you manually configure your IPSec policy, default values might be used.

Note:

Diffie-Hellman group 1 is considered to be a weak algorithm and is therefore not recommended. Regardless of whether you use IBM Configuration Assistant for z/OS Communications Server or manually configure your policies, you should evaluate your usage of DH group 1 and decide whether to plan an upgrade to a more secure group.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. Also, z/OS V2R2 with APAR PI43832.

Applies to upgrade from:

z/OS V2R2 without APAR PI43832.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use an IPSec policy.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS checks:

None.

Steps to take

If your policy is not generated by IBM Configuration Assistant for z/OS Communications Server:

  • Search your IPSec policy files for any KeyExchangeOffer statements that do not specify a DHGroup parameter. If you find such a statement, your policy is affected. If you require the DHGroup value to continue to use the previous default of Group1, update your policy to explicitly set the DHGroup parameter to Group1. If you want to use the new default, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peer's policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with the remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.
  • During this exercise, note any cases where your policy explicitly uses DH group 1. If you find any, consider changing your policy to use a stronger group. Before you make changes, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

If your policy is generated by IBM Configuration Assistant for z/OS Communications Server, you should evaluate your existing policy to determine whether DH group 1 is configured on any key exchange offers. If so, consider changing your policy to use a stronger group. Before you make changes, you must coordinate with the owners of each remote IKE peer that is associated with the z/OS policy changes to ensure that the remote peers' policy is compatible with the z/OS changes. If the z/OS policy changes so that it is incompatible with a remote peer's policy, the IKE daemons will not be able to negotiate IPSec tunnels.

Reference information

For more information about the KeyExchangeOffer statement in the IPSec policy, see z/OS Communications Server: IP Configuration Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.1.14 : Configuration Assistant: Migrate backing stores to V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the z/OSMF Configuration Assistant task does not open a backing store for systems prior to z/OS V2R1, or a z/OS V2R1 or V2R2 backing store that contains a z/OS V1R12 system image.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have Configuration Assistant backing store files at the V1R12 or V1R13 level, or Configuration Assistant backing store files at the V2R1 or V2R2 level that contain V1R12 system images.

Configuration Assistant opens a backing store only from the current and two prior releases (z/OS V2R2, V2R3, and V2R4). For pre-V2R2 backing stores, you must open and save your backing stores on the V2R2 or V2R3 Configuration Assistant before you open your backing stores on the V2R4 Configuration Assistant.

Before you open a V2R2 or V2R3 backing store on z/OS V2R4, you must ensure that all system images within the backing store are at the V1R13 level or above.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

An error message is issued if you have a backing store for systems prior to z/OS V2R1, or a z/OS V2R1 or V2R2 backing store that contains a z/OS V1R12 system image. The error message indicates that you need to migrate the backing store to V2R4.

Related IBM Health Checker for z/OS checks:

None.

Steps to take

To migrate a V1R13 backing store, or a backing store that contains one or more V1R12 system images, you must open the backing store in either V2R2 or V2R3 Configuration Assistant before you open it in V2R4 Configuration Assistant. The steps that you take depend on which level of Configuration Assistant you use to migrate the backing store.

If you are using V2R2 Configuration Assistant to migrate the backing store, open the backing store from the V2R2 Configuration Assistant welcome page:

  • If the backing store is release level V1R13, it is automatically migrated to the V2R2 level. Then, when you open it in V2R3 Configuration Assistant, it is automatically migrated to the V2R3 level.
  • If the backing store contains one or more system images at release level V1R12, edit the image properties and set the image level to V1R13 or higher on each V1R12 image.
    • If you set the image to V1R13, it is automatically reset to V2R4 when you open the backing store in V2R4 Configuration Assistant.
    • If you set an image to V2R1, it remains at the V2R1 level when you open the backing store in the V2R4 Configuration Assistant.
  • Transfer the backing store to the V2R4 system.

If you are using V2R2 Configuration Assistant to migrate the backing store, open the backing store from the V2R2 Configuration Assistant welcome page:

  • If the backing store is release level V1R13, it is automatically migrated to the V2R2 level. Then, when you open it in V2R3 Configuration Assistant, it is automatically upgraded to the V2R4 level.
  • If the backing store contains one or more system images at release level V1R12, the images are automatically reset to V2R2 and remain at that level when opened in the V2R4 Configuration Assistant.
  • Transfer the backing store to the V2R4 system.

You can refer to the Configuration Assistant help about exporting and transferring in backing stores for details.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.1.15 : IP Services: Verify that the changed ANONYMOUSLEVEL default is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the default value for the ANONYMOUSLEVEL parameter for the FTP server was changed from 1 to 3. If ANONYMOUS login is enabled at your installation, determine whether this change affects your configuration.

IBM suggests that ANONYMOUSLEVEL is set to 3 and ANONYMOUSFILETYPEJES is set to FALSE when ANONYMOUS is configured on the FTP server. Specifying ANONYMOUSLEVEL less than 3 or ANONYMOUSFILETYPEJES TRUE allows anonymous users to submit jobs.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if ANONYMOUS login is enabled.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

With the new default of ANONYMOUSLEVEL 3, anonymous access is controlled by the following FTP.data statements:

  • ANONYMOUSFILETYPESEQ
  • ANONYMOUSFILETYPEJES
  • ANONYMOUSFILETYPESQL
  • ANONYMOUSFILEACCESS
  • ANONYMOUSHFSFILEMODE
  • ANONYMOUSHFSDIRMODE
  • EMAILADDRCHECK

Related IBM Health Checker for z/OS checks:

The following application health check can help you determine whether anonymous FTP users can submit jobs:

IBMCS,CSAPP_FTPD_ANONYMOUS_JES

This check is available in z/OS V2R3. It is also available in z/OS V2R1 and V2R2 with TCP/IP APAR PI47637 and SNA APAR OA49668 applied.

Steps to take

Check all instances of your FTP server configuration files (FTP.DATA) for the ANONYMOUS statement.

  • If the ANONYMOUS statement is not configured, anonymous access is not enabled and the ANONYMOUSLEVEL statement is ignored. No action is required.
  • If the ANONYMOUS statement is configured and the ANONYMOUSLEVEL statement is configured with an explicit value, no action is required.
  • If the ANONYMOUS statement is configured and the ANONYMOUSLEVEL accepts the default, evaluate what ANONYMOUSLEVEL value is needed and take the corresponding action.
    • The new default of 3 for ANONYMOUSLEVEL along with the default value of FALSE for ANONYMOUSFILETYPEJES, help prevent job submissions by anonymous users.

      ANONYMOUSLEVEL 3 enables control of individual file types. If you choose to let ANONYMOUSLEVEL to default to 3, evaluate all the following filetype controls to ensure the required access is allowed. The anonymous filetype configuration statements are listed here with the default and allowed values.

      Table 1. Anonymous filetype configuration statements

      ANONYMOUS TYPE

      DEFAULT

      ALLOWED VALUES

      ANONYMOUSFILETYPESEQ

      TRUE

      FALSE TRUE

      ANONYMOUSFILETYPEJES

      FALSE

      FALSE TRUE

      ANONYMOUSFILETYPESQL

      FALSE

      FALSE TRUE

      ANONYMOUSFILEACCESS

      HFS

      BOTH MVS HFS

      ANONYMOUSHFSFILEMODE

      000

      nnn

      ANONYMOUSHFSDIRMODE

      333

      nnn

      EMAILADDRCHECK

      NO

      NO FAILWARNING

      Note: With the new default of ANONYMOUSLEVEL 3, the statement ANONYMOUSFILEACCESS is valid. If ANONYMOUSFILEACCESS is not explicitly specified, the default value of HFS is used, which is not compatible with the default value for STARTDIRECTORY. As a result, the anonymous login might be rejected by the FTP server after you migrate to z/OS V2R3.

      Note: The value of STARTDIRECTORY must be compatible with the ANONYMOUSFILEACCESS value when anonymous logins are enabled and ANONYMOUSLEVEL is 3 or greater. For example, if ANONYMOUSLEVEL is 3, ANONYMOUSFILEACCESS is MVS, and STARTDIRECTORY is z/OS UNIX, anonymous users receive a filetype error when they attempt to log in to FTP. The anonymous login is rejected by the FTP server.

    • To get the pre-V2R3 behavior, explicitly configure ANONYMOUSLEVEL 1 in the relevant FTP server configuration data set (FTP.DATA).

      Note: Specifying ANONYMOUSLEVEL less than 3 or ANONYMOUSFILETYPEJES TRUE allows anonymous users to submit jobs.

    • Optionally, disable anonymous access by removing the ANONYMOUS keyword.

Note: If you choose to retain anonymous access, it is recommended that ANONYMOUSLEVEL is set to 3 and ANONYMOUSFILETYPEJES is set to FALSE to prevent job submission by anonymous users.

Reference information

For more information about the FTP ANONYMOUS, ANONYMOUSLEVEL, and ANONYMOUSFILETYPEJES statements, see z/OS Communications Server: IP Configuration Reference.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,CSAPP_FTPD_ANONYMOUS_JES.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.1.16 : IP services: Accommodate the removal of SMS as a default VTAM VIT trace option


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, or an earlier release with APAR OA49999 applied, it is no longer necessary to manually disable the SMS option for VTAM internal trace (VIT). This option is now disabled by default.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R2 with APAR OA49999 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA49999 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you manually disable the SMS tracing option, or want it to be active.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To validate that the current VIT defaults are the standard options, use IBMCS,CSVTAM_VIT_OPT_STDOPTS. This check is provided in APAR OA50271, and is available on z/OS V2R2 and later.

Steps to take

If you need to enable the SMS VIT option for diagnostic purposes, you can use the command MODIFY to do so:

F NET,TRACE,TYPE=VTAM,OPT=SMS,MODE=INT
Note:

The response message IST199I from the command D NET,TRACES shows only the PSS option. The SMS option is no longer displayed by default.

IBM recommends that the STDOPTS set of VIT options are always active. These trace options are usually required for resolving problems with VTAM.

Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,CSVTAM_VIT_OPT_STDOPTS.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.2 : Communications Server actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Communications Server upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.4.2.1 : IP Services: Update /etc configuration files


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Some utilities provided by Communications Server require the use of certain configuration files. You are responsible for providing these files if you expect to use the utilities. IBM provides default configuration files as samples in the /usr/lpp/tcpip/samples directory. Before the first use of any of these utilities, you should copy these IBM-provided samples to the /etc directory (in most cases). You can further customize these files to include installation-dependent information. An example is setting up the /etc/osnmpd.data file by copying the sample file from /usr/lpp/tcpip/samples/osnmpd.data to /etc/osnmpd.data and then customizing it for the installation.

If you customized any of the configuration files that have changed, then you must incorporate the customization into the new versions of the configuration files.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Communications Server.

When change was introduced:

Various releases. See Table 2 below.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have customized a configuration file (listed in Table 2) that IBM has changed.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you added installation-dependent customization to any of the IBM-provided configuration files listed in Table 2, make the same changes in the new versions of the files by copying the IBM-provided samples to the files shown in the table and then customizing the files.

Table 2. Changed Communications Server configuration files

Utility

IBM-provided sample file

Target location

What changed and when

sendmail

/usr/lpp/tcpip/samples/sendmail/cf/sample.c

/etc/mail/sample.cf

In z/OS V2R3, this sample daemon configuration file for the sendmail application was removed. sendmail is no longer supported.

sendmail

/usr/lpp/tcpip/samples/sendmail/cf/submit.cf

/etc/mail/submit.cf

In z/OS V2R3, this sample client configuration file for the sendmail application was removed. sendmail is no longer supported.

sendmail

/usr/lpp/tcpip/samples/sendmail/cf/zOS.cf

/etc/mail/zOS.cf

In z/OS V2R3, this sample AT-TLS configuration file for the sendmail application was removed. sendmail is no longer supported.

sendmail bridge

/usr/lpp/tcpip/samples/etc/mail/ezatmail.cf

/etc/mail/ezatmail.cf

In z/OS V2R3, this sample file was added for the z/OS sendmail to CSSMTP bridge.

SNMP agent

/usr/lpp/tcpip/samples/etc/osnmpd.data

/etc/osnmpd.data

Every release, the value of the sysName MIB object is updated to the current release.

Reference information

For more information about Communications Server configuration files, see z/OS Communications Server: IP Configuration Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.2.2 : IP Services: Ensure TLS/SSL secure connection in non-FIPS mode meets the minimum peer end-entity ce


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

System SSL is raising the minimum asymmetric key size for peer certificates used during the negotiation of a TLS/SSL secure connection in non-FIPS mode. The minimum key sizes are as follows:

  • RSA changed to 1024 bits from 512 bits
  • DSA changed to 1024 bits from 512 bits
  • DH changed to 1024 bits from 512 bits
  • ECC changed to 192 bits from 160 bits

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes. See "Steps to take."

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Any of the listed Communications Server components can generate error messages or trace entries that indicate the specific error returned by System SSL during a TLS/SSL handshake. The new System SSL return code GSK_ERR_KEY_IS_SMALLER_THAN_MINIMUM (508) or GSK_ERROR_KEY_IS_SMALLER_THAN_MINIMUM (-127) is returned during the negotiation of the connection, if the peer provides an RSA, a DSA, or a DH certificate with a key size smaller than 1024 or an ECC certificate with a key size smaller than 192.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review each of the Communications Server components that follow to determine whether you are affected. Make changes as directed.

AT-TLS
To update the Application Transparent Transport Layer Security (AT-TLS) policy files manually, take the following steps:
  1. Locate the TTLSRule statement that applies to the traffic that still requires the weak key length.
  2. Locate the TTLSEnvironmentAction statement that is referenced by or contained in the TTLSRule statement.
  3. Locate the TTLSEnvironmentAdvancedParms statement that is referenced by or contained in the TTLSEnvironmentAction statement.
  4. In the TTLSEnvironmentAdvancedParms statement, code the PeerMinRsaKeySize, PeerMinDsaKeySize, PeerMinDHKeySize, or PeerMinECCKeySize parameters as appropriate with the required minimum key size.
  5. Save the updated policy file and refresh Policy Agent according to your local site procedures to put the changes into effect.
FTP server and FTP client
When the FTP client or server is configured with TLSMECHANISM ATTLS in the FTP.DATA data set, AT-TLS is used to provide the TLS/SSL protection. Therefore, you must follow the steps for AT-TLS applications.

When the FTP client or server is configured with TLSMECHANISM FTP, it calls System SSL directly. To enable the weaker key length in this case, set the appropriate GSK_PEER_RSA_MIN_KEY_SIZE, GSK_PEER_DSA_MIN_KEY_SIZE, GSK_PEER_DH_MIN_KEY_SIZE, or GSK_PEER_ECC_MIN_KEY_SIZE environment variable to specify the required minimum key size before starting the FTP server or FTP client program.

As an alternative, you can choose to enable your FTP client or server for AT-TLS and then use the procedure described above for AT-TLS applications. See z/OS Communications Server: IP Configuration Guide for more information about converting FTP from using TLSMECHANISM FTP to TLSMECHANISM ATTLS.

TN3270E Telnet server
When the TN3270E Telnet server is configured with TTLSPORT in the Telnet profile, AT-TLS is used to provide the TLS/SSL protection. Therefore, you must follow the steps for AT-TLS applications.

When the TN3270E Telnet server is configured with SECUREPORT, the related GSK environment variables cannot be passed to the TN3270E server. Therefore, the only way to enable the weaker key lengths is to enable the TN3270 for AT-TLS and then use the procedures described above for AT-TLS applications to enable the weaker key lengths. See z/OS Communications Server: IP Configuration Guide for more information about converting TN3270E from using SECUREPORT to TTLSPORT.

DCAS
When the Digital Certificate Access Server (DCAS) server is configured with TLSMECHANISM ATTLS in the DCAS configuration file, AT-TLS is used to provide the TLS/SSL protection. Therefore, you must follow the steps for AT-TLS applications.

When the DCAS server is configured with TLSMECHANISM DCAS, it calls System SSL directly. To enable the weaker key length in this case, set the appropriate GSK_PEER_RSA_MIN_KEY_SIZE, GSK_PEER_DSA_MIN_KEY_SIZE, GSK_PEER_DH_MIN_KEY_SIZE, or GSK_PEER_ECC_MIN_KEY_SIZE environment variable to specify the required minimum key size before starting the DCAS server.

As an alternative, you can choose to enable your DCAS server for AT-TLS and then use the procedure described above for AT-TLS applications. See z/OS Communications Server: IP Configuration Guide for more information about converting DCAS from using TLSMECHANISM DCAS to TLSMECHANISM ATTLS.

Policy Agent Client
When the Policy Agent is configured with the DynamicConfigPolicyLoad statement in the main Pagent configuration file, it acts as a policy server and can be protected using AT-TLS. AT-TLS is used to provide the TLS/SSL protection. Therefore, you must follow the steps for AT-TLS applications.

When the Policy Agent is configured with the PolicyServer and ServerConnection statement, it acts as a policy client. If the ServerSSL parameter is specified on the ServerConnection statement, the connection between the client and the remote policy server is protected by using System SSL directly. To enable the weaker key length in this case, set the appropriate GSK_PEER_RSA_MIN_KEY_SIZE, GSK_PEER_DSA_MIN_KEY_SIZE, GSK_PEER_DH_MIN_KEY_SIZE, or GSK_PEER_ECC_MIN_KEY_SIZE environment variable to specify the required minimum key size before starting the Policy Agent.

Reference information

For more information about the TTLSEnvironmentAdvancedParms statement, see z/OS Communications Server: IP Configuration Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.2.3 : IP Services: Make changes for Netstat enhancements


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The Netstat command displays the status of a local host. In each release of z/OS, the Netstat reports can change in ways that can affect automation or front-end programs.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if the changed or removed settings affect either automation that uses the Netstat report output or front-end programs that run the Netstat command.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Accommodate the Netstat changes in your automation and front-end programs. You can begin by reviewing the ways in which the displays are updated in each release. For details about the changes for each Netstat report, see z/OS Release Upgrade Reference Summary. However, you must run the commands to know with certainty what changes to make after you IPL a z/OS V2R4 system.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.2.4 : IP Services: Decide whether to accept the new FIXED CSM default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the default amount for communications storage manager (CSM) fixed storage for buffers is increased from 200 MB to 512 MB. Your installation can specify a value for the CSM fixed storage amount on the FIXED statement in the IVTPRM00 parmlib member.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use the default CSM FIXED MAX value of 200M and you do not want to use the new default of 512M.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether the maximum amount of storage dedicated to CSM is sufficient for your system, use the health check IBMCS,CSVTAM_CSM_STG_LIMIT. This check is available for z/OS V2R3 and z/OS V2R2 systems.

The health check issues message ISTH017E if the value specified for the maximum CSM storage for the FIXED, ECSA, or HVCOMM storage types as defined in parmlib member IVTPRM00 is less than the minimum value specified for the check.

Message ISTH002I is displayed prior to this message for each CSM storage type that failed the check.

Steps to take

Review your HVCOMMON setting in IVTPRM00 and determine whether you need to increase this value to account for the fact that the system reserves a larger portion of this storage by default for CSM buffers.

If you did not previously code a value for FIXED in IVTPRM00 and you do not want the new default, specify FIXED MAX(200M) in your IVTPRM00 parmlib member to retain the value as formerly defaulted.

Tip: You can use the D NET,CSM command to display the "FIXED MAXIMUM" storage specification in message IVT5538I.

Reference information

For information about the IVTPRM00 parmlib member, see the IVTPRM00 parmlib member in z/OS MVS Initialization and Tuning Reference.

See the topic about fixed maximum storage for CSM buffers in z/OS Communications Server: IP Configuration Guide.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMCS,CSVTAM_CSM_STG_LIMIT.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.4.2.5 : IP Services: Determine the storage impact if QDIOSTG=126 is in effect


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you specify QDIOSTG=126 in your VTAM start options, each OSA-Express QDIO interface that uses the default READSTORAGE setting of GLOBAL on the INTERFACE or LINK statement gets 8 MB of fixed CSM for read storage. For any OSA-Express QDIO interfaces that have a bandwidth of at least 10 GbE and use 8 MB of read storage, z/OS V2R4 allocates additional fixed CSM 4K HVCOMMON storage for work element processing.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Communications Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

The system allocates additional fixed CSM HVCOMMON storage for work element processing for each OSA-Express QDIO interface that is using 8 MB of read storage.

Related IBM Health Checker for z/OS check:

None.

Steps to take

See Additional fixed storage for OSA interfaces using 8 MB of read storage in z/OS Communications Server: IP Configuration Guide to understand how much additional storage z/OS V2R4 allocates for work element processing.

If you do not want the system to allocate this extra storage for a specific interface, update your INTERFACE or LINK statement to specify a READSTORAGE value other than GLOBAL.

Reference information

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.2.6 : IP Services: Permit Communications Server components to ICSF resources required by Network Authenti


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, Kerberos relies on ICSF PKCS#11 callable services for encryption, decryption, and hashing. As a result of this change, ICSF is required to be running before any Kerberos components or applications are running on the z/OS system. The following z/OS Communications Server components use Kerberos in certain situations and might therefore require access to the ICSF callable services that Kerberos uses:

  • With the UNIX System Services Telnet server, clients can support Kerberos version 5, as described in RFC 1416, to log in to the shell environment by using Kerberos as the authentication protocol.
  • FTP server and FTP client support connections to or from other servers and clients that support Kerberos version 5 authentication for the FTP protocol, as described in RFC 2228.
  • UNIX System Services RSH server can be configured to support client authentication by using Kerberos from RSH clients that support Kerberos version 5.

In addition, the default encryption and checksum (hash) types that are used when not explicitly set in the Kerberos configuration files are being changed from weak and non-collision proof types to stronger, more secure types.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3.

Applies to migration from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use Kerberos for the following conditions:

  • Authenticating clients of the UNIX System Services Telnet server
  • z/OS FTP client or server authentication
  • Authenticating clients of the UNIX System Services RSH server

Target system hardware requirements:

None.

Target system software requirements:

ICSF.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether any of z/OS Communications Server components on your system are using Kerberos in the following conditions:

  • If you use the UNIX System Services Telnet server (otelnetd), check your inetd configuration file (/etc/inetd.conf) for invocations of otelnetd that specify either the -a user or -a valid parameter. If you find such an invocation, your otelnetd server is using Kerberos version 5 authentication. If not, your otelnetd server is not affected.
  • If you use the FTP server, check the FTP.DATA data set of your server for the EXTENSIONS AUTH_GSSAPI parameter. If you find this parameter, your FTP server supports Kerberos version 5 authentication. If not, your FTP server is not affected.
  • If you use the FTP client command or API, check the FTP.DATA data set of each FTP client for the SECURE_MECHANISM GSSAPI parameter. If you find this parameter in any of those FTP.DATA data sets, those FTP clients use Kerberos version 5 authentication. Additionally, search for any invocations of the FTP command or FTP Client API that use the -a GSSAPI or the -r GSSAPI parameter, which also result in the use of Kerberos version 5 authentication. Any clients that use any of the above mechanisms are affected.
  • If you use the UNIX System Services RSH daemon (orshd), check your inetd configuration file (/etc/inetd.conf) for orshd with the -k KRB5 or the -k GSSAPI parameter. If you find these parameters, your orshd daemon uses Kerberos version 5 authentication. If not, your RSH daemon is not affected.

If any of the above components use Kerberos, you must perform the associated upgrade actions, as follows:

  1. Ensure that ICSF is started and completes initialization before starting the z/OS KDC or any Kerberized applications on the system. ICSF needs to be running for the duration of use of all Kerberos functions, including KDC, application servers, application clients, commands, and utilities.
  2. If the CSFSERV class is active, ensure that the z/OS KDC user ID and all user IDs that use Kerberos commands or Kerberized application running on the z/OS system have read access to the following ICSF resources:
    • When Kerberos is enabled for FIPS 140 mode: CSFRNG, CSFOWH, CSF1TRC, CSF1TRD, CSF1SKD, and CSF1SKE
    • When Kerberos is not enabled for FIPS 140 mode: CSFRNG and CSFOWH

    For the UNIX System Services Telnet server, the KDC user ID is the user ID under which the otelnetd -a user or -a valid command is started.

    For the FTP server that is configured with the EXTENSIONS AUTH_GSSAPI parameter, the KDC user ID is the user ID under which the FTP server runs.

    For FTP clients, the KDC user ID is any user ID that starts the FTP client command or API with the -a GSSAPI or -r GSSAPI parameter or that starts the FTP client with the SECURE_MECHANISM GSSAPI parameter specified in their FTP.DATA data sets.

    For the UNIX System Services RSH server, the KDC user ID is the user ID under which the orshd -k KRB5 or -k GSSAPI command is issued.

  3. The default encryption types for Kerberos applications have changed from DES encryption types to stronger encryption types, AES and 3DES. If the former default encryption types are still required, they must be explicitly set in the Kerberos configuration files, /etc/skrb/krb5.conf by default, by issuing the following commands:

    default_tgs_enctypes = des-cbc-crc,des-cbc-md5

    default_tkt_enctypes = des-cbc-crc,des-cbc-md5

  4. The default checksum types for Kerberos applications have changed from obsolete checksum types to more modern and secure checksum types. If the former defaults values are still required, they must be explicitly set in the Kerberos configuration files, /etc/skrb/krb5.conf by default, by issuing the following commands:

    ap_req_checksum_type = rsa-md5

    kdc_req_checksum_type = rsa-md5

    safe_checksum_type = rsa-md5-des

Reference information

For information about configuring otelnetd and orshd, see z/OS Communications Server: IP Configuration Guide.

For information about configuring the FTP server and FTP client, and running the orshd daemon, see z/OS Communications Server: IP Configuration Reference.

For information about invocation parameters for the FTP client, see z/OS Communications Server: IP User's Guide and Commands.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.2.7 : IP Services: Verify that the changed default TLS and SSL cipher lists are acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, several Communications Server components that use System SSL removed the following ciphers from the default cipher list when using TLS or SSL:

  • TLS and SSLv3:
    • 00/0000 (TLS_NULL_WITH_NULL_NULL)
    • 01/0001 (TLS_RSA_WITH_NULL_MD5)
    • 02/0002 (TLS_RSA_WITH_NULL_SHA)
    • 03/0003 (TLS_RSA_EXPORT_WITH_RC4_40_MD5)
    • 04/0004 (TLS_RSA_WITH_RC4_128_MD5)
    • 05/0005 (TLS_RSA_WITH_RC4_128_SHA)
    • 06/0006 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5)
    • 0C/000C (TLS_DH_DSS_WITH_DES_CBC_SHA)
    • 0D/000D (TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA)
    • 0F/000F (TLS_DH_RSA_WITH_DES_CBC_SHA)
    • 10/0010 (TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA)
    • 30/0030 (TLS_DH_DSS_WITH_AES_128_CBC_SHA)
    • 31/0031 (TLS_DH_RSA_WITH_AES_128_CBC_SHA)
    • 36/0036 (TLS_DH_DSS_WITH_AES_256_CBC_SHA)
    • 37/0037 (TLS_DH_RSA_WITH_AES_256_CBC_SHA)
  • SSLv2:
    • 01/0001 (128-bit RC4 encryption with MD5 message authentication (128-bit secret key))
    • 02/0002 (128-bit RC4 export encryption with MD5 message authentication (40-bit secret key))

The affected components are:

  • Application Transparent Transport Layer Security (AT-TLS) and any applications or middleware that rely upon AT-TLS for their TLS/SSL protection
  • FTP server and client, when configured with TLSMECHANISM FTP
  • TN3270E Telnet server, when configured with SECUREPORT
  • Digital Certificate Access Server (DCAS), when configured with TLSMECHANISM DCAS
  • Policy Agent, when configured with the PolicyServer and ServerConnection statements

If any of the listed ciphers are explicitly specified in the relevant configuration files, no change is required except to evaluate whether any of these ciphers are still required. If they are not, then remove those ciphers from your configuration as they are considered weak.

For configurations that rely on the default cipher list (that is, they do not explicitly specify any ciphers) but require the use of one or more of the listed ciphers, you will need to explicitly enable those ciphers in the relevant configurations files or data sets.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Communications Server.

When change was introduced:

z/OS V2R3. Also, z/OS V2R2 with APARs PI40963 and PI41008.

Applies to upgrade from:

z/OS V2R2 without APARs PI40963 and PI41008.

Timing:

Before the first IPL of this release.

Is the upgrade action required?

Yes, if you rely on any of the ciphers removed from the default cipher list.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take
Application Transparent Transport Layer Security (AT-TLS)
SSL V3/TLS cipher specification
You can code a specific set of SSL V3 cipher suites to be used when negotiating new TLS/SSL sessions.
  • To do this using the Configuration Assistant for z/OS Communications Server, select the desired V3 cipher suites in the Security Level dialog of the AT-TLS perspective.
  • To do this in the AT-TLS policy file, code the desired set of cipher suites on the V3CipherSuites or V3CipherSuites4Char parameter of your TTLSCipherParms statements.
SSL V2 cipher specification
You can code a specific set of SSL V2 cipher suites to be used when negotiating new SSL V2 sessions.
  • To do this using the Configuration Assistant for z/OS Communications Server, select the desired V2 cipher suites in the Security Level-> Advanced->SSL Version 2 Ciphers dialog of the AT-TLS perspective.
  • To do this in the AT-TLS policy file, code the desired set of cipher suites on the V2CipherSuites parameter of your TTLSCipherParms statements.

FTP client and FTP server

When the FTP client or server is configured with TLSMECHANISM ATTLS in the FTP.DATA data set, then AT-TLS is being used to provide the TLS/SSL protection, so you should refer to the AT-TLS instructions above.

When the FTP client or server is configured with TLSMECHANISM FTP, then FTP will call System SSL directly. In this case, you can configure a specific set of ciphers by coding the CIPHERSUITE parameter in the FTP.DATA data set.

Note:

SSL V2 is not supported when the FTP client or server is configured with TLSMECHANISM FTP, so there are no SSL V2 considerations in this case.

TN3270E Telnet server

When the TN3270E Telnet server is configured with TTLSPORT in the Telnet profile, then AT-TLS is being used to provide the TLS/SSL protection, so you should refer to the AT-TLS instructions above.

When the TN3270E Telnet server is configured with SECUREPORT, then the TN3270E server will call System SSL directly.

SSL V3/TLS ciphers
You can configure a specific set of ciphers by coding the ENCRYPTION statement of the Telnet profile.
SSL V2 ciphers
Since the use of SSL V2 is not recommended due to known weaknesses, the TN3270 Telnet server disables SSL V2 by default. If you choose to enable SSL V2 by specifying the SSLV2 parameter in the Telnet profile, then if the TN3270 secure connection is established using SSL V2, then the RC4-based ciphers ("1" and "2") will be included in the SSL V2 cipher set.

Digital Certificate Access Server (DCAS)

When the DCAS server is configured with TLSMECHANISM ATTLS in the DCAS configuration file, then AT-TLS is being used to provide the TLS/SSL protection, so you should refer to the AT-TLS instructions above.

When the DCAS server is configured with TLSMECHANISM DCAS, then DCAS will call System SSL directly.

SSL V3/TLS ciphers
You can configure a specific set of ciphers by coding the V3CIPHER parameter in the DCAS configuration file with an acceptable set of cipher suites. These suites will be used if the DCAS secure connection is established using the SSL V3 or a TLS protocol.
SSL V2 ciphers
Since the use of SSL V2 is not recommended due to known weaknesses, DCAS disables SSL V2 by default. If you choose to enable SSL V2 (and SSL V3) by specifying TLSV1ONLY FALSE in the DCAS configuration file, then if the DCAS secure connection is established using SSL V2, then the RC4-based ciphers ("1" and "2") will be included in the SSL V2 cipher set.

Policy Agent

When the Policy Agent is configured with the DynamicConfigPolicyLoad statement in the main Pagent configuration file, it is acting as a policy server and can be protected using AT-TLS. In this case, you should refer to the AT-TLS instructions above.

When the Policy Agent is configured with the PolicyServer and ServerConnection statements, it is acting as a policy client. If the ServerSSL parameter is specified on the ServerConnection statement, the connection between the client and the remote policy server is protected by using System SSL directly. You can configure a specific set of ciphers by coding the ServerSSLV3CipherSuites parameter of the ServerConnection statement.

Note:

SSL V2 is not supported when the Policy Agent is configured with the PolicyServer and ServerConnection statements, so there are no SSL V2 considerations in this case.

Reference information

For more information, see z/OS Communications Server: IP Configuration Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.4.3 : Communications Server actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Communications Server upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5 : Cryptographic Services upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element Cryptographic Services. Included are the components Integrated Cryptographic Service Facility (ICSF), Open Cryptographic Services Facility (OCSF), PKI Services, and System Secure Sockets Layer (SSL).


Step 4.5.1 : Cryptographic Services actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Cryptographic Services upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.5.1.1 : ICSF: Remove sequential data sets from the CSFPARM DD statement


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, it is no longer possible to specify a sequential data set on the CSFPARM DD statement in the ICSF procedure.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you specify a sequential data set on the CSFPARM DD statement.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check for the specification of any sequential data sets specified on the CSFPARM DD statement.

Consider using a partitioned data set in place of a sequential data set on the CSFPARM DD statement. For example:

//ICSF PROC PRM=XX //ICSF EXEC PGM=CSFINIT,TIME=NOLIMIT,MEMLIMIT=NOLIMIT //CSFPARM DD DSN=SYS1.ICSFLIB(CSFPRM&PRM),DISP=SHR

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies.


Step 4.5.1.2 : ICSF: Plan for the removal of support for EIM, OCSF, OCEP, and PKITP


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is planned to be the last release to support Enterprise Identity Mapping (EIM) and Open Cryptographic Services Facility (OCSF), including its plug-ins, such as Open Cryptographic Enhanced Plug-ins (OCEP) and PKI Services Trust Policy (PKITP). These components were not widely used or enhanced for several releases of z/OS.

IBM recommends that you use other applications for comparable functions, such as Integrated Cryptographic Services Facility (ICSF) and System SSL.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services.

When change was introduced:

See IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because this change will be required in a future release of ICSF.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check for the use of any of the following applications on your system:

  • Enterprise Identity Mapping (EIM)
  • Open Cryptographic Services Facility (OCSF) and its plug-ins, including:
    • Open Cryptographic Enhanced Plug-ins (OCEP)
    • PKI Services Trust Policy (PKITP)

Consider using other applications for comparable functions, such as Integrated Cryptographic Services Facility (ICSF) and System SSL.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2 : Cryptographic Services actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Cryptographic Services upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.5.2.1 : OCSF: Migrate the directory structure


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you previously configured Open Cryptographic Services Facility (OCSF), you need to verify that the OCSF directories have been migrated to the target system. When your system is up and running, customize OCSF by running the customization script and then the IVP.

Note:

If you want to take advantage of the Software Cryptographic Service Provider 2 (SWCSP2), you should bypass this upgrade action. When your system is up and running, install OCSF by running the install script and then the IVP.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you currently use OCSF or if new products or functions on your new z/OS system require OCSF to be active. However, if you installed your new z/OS system with ServerPac or SystemPac, the OCSF installation script has been run and you do not have to perform this upgrade action for that system.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Migrate the OCSF /var directory structure to the target system. If you installed z/OS with CBPDO or by cloning an already-installed z/OS system, you can either copy the /var/ocsf directory from your old system or rerun the installation script. If you installed z/OS with ServerPac, the OCSF installation script has been run and you have no upgrade actions for that target system (although you still have to migrate the directory structure to any cloned systems, as already described).

If you copy /var/ocsf, verify that the OCSF /var directory structure has been migrated to the target system as described in the workflow step called "Migrate /etc, /global, and /var system control files." The OCSF registry (the /var/ocsf files) contains the directory path names to the code libraries. If the registry files are copied, the CSSM DLL and the add-ins must be in the same location on the target system as on the prior release. The normal locations are /usr/lpp/ocsf/lib for the CSSM and supporting DLLs and /usr/lpp/ocsf/addins for the add-in libraries.

If you copied /var/ocsf, do the following:

  1. Verify that the following four files exist in that directory:
    • CDSA_Registry.dir with permissions (-rw-r--r--)
    • CDSA_Registry.pag with permissions ( -rw-r--r--)
    • CDSA_Sections.dir with permissions (-rw-r--r-- )
    • CDSA_Sections.pag with permissions (-rw-r--r--)
  2. Verify that the required RACF FACILITY class profiles are defined and set up:
    • CDS.CSSM authorizes the daemon to call OCSF services
    • CDS.CSSM.CRYPTO authorizes the daemon to call a cryptographic service provider (CSP)
    • CDS.CSSM.DATALIB authorizes the daemon to call a data storage library (DL) service provider
  3. Ensure that the necessary libraries are program controlled:
    • XL C/C++ runtime libraries
    • Language Environment libraries
    • SYS1.LINKLIB
    • SYS1.SIEALNKE

If you did not copy /var/ocsf, rerun the installation script:

  1. Set up the RACF FACILITY class profiles required by OCSF and authorize the appropriate user IDs to those profiles:
    • CDS.CSSM authorizes the daemon to call OCSF services
    • CDS.CSSM.CRYPTO authorizes the daemon to call a cryptographic service provider (CSP)
    • CDS.CSSM.DATALIB authorizes the daemon to call a data storage library (DL) service provider
  2. Ensure that the following libraries are defined as program controlled:
    • XL C/C++ runtime libraries
    • Language Environment libraries
    • SYS1.LINKLIB
    • SYS1.SIEALNKE
  3. Run the ocsf_install_crypto script from the OMVS shell. This must be run from the target system.
    1. Verify and update $LIBPATH.
    2. Change directory to the location of the script ( /usr/lpp/ocsf/bin).
    3. Run the script.

Whether you reinstalled or migrated, it is strongly recommended that you rerun IVP ocsf_baseivp from the OMVS shell. This IVP verifies that OCSF is installed and configured correctly. To run the IVP:

  1. Mount /usr/lpp/ocsf/ivp.
  2. Read the README file and follow the instructions.
  3. Run the IVP.

If you were using other IBM or non-IBM services to supplement the functions in OCSF, such as the Open Cryptographic Enhanced Plug-ins (OCEP) component of base element Integrated Security Services, or the PKI Services component of base element Cryptographic Services, you must ensure that these components are migrated or reinstalled.

Reference information

For more information, see z/OS Integrated Security Services Open Cryptographic Enhanced Plug-ins Application Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2.2 : PKI Services: ICSF is a prerequisite


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Before z/OS V2R3, PKI Services used an internal function to create:

  • CA certificate fingerprints (the SHA1, MD5, SHA256, and SHA512 hashes)
  • Hash for simple certificate enrollment protocol (SCEP) requests and online certificate status protocol (OCSP) responses.

Starting with z/OS V2R3, PKI Services replaces the internal function with the ICSF Public Key Cryptographic Standards #11 (PKCS#11) Digest functions. This change helps to consolidate cryptographic functions to certified components, and allows PKI Services to run in the National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) level supported by System SSL and ICSF PKCS#11.

This change occurred with z/OS V2R3, and will not be rolled back to earlier releases.

This table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

PKI Services

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use PKI Services.

Target system hardware requirements:

None.

Target system software requirements:

ICSF

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Ensure that ICSF is started and initialized before you start the z/OS PKI Services started tasks.
  2. If the CSFSERV resource class is active, ensure that the z/OS PKI Services daemon user ID has READ access to the following ICSF resources: CSFOWH, CSFIQA and CSF1TRL.
Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2.3 : System SSL: Ensure that System SSL applications meet minimum key sizes


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, System SSL applications that are running FIPS mode using a Triple DES symmetric key for encryption, the key must meet minimum strength requirements. Also, for System SSL non-FIPS applications that are negotiating secure SSL/TLS connections, the minimum asymmetric key size is being increased for the peer's end entity certificate.

Specifically, System SSL is changed, as follows:

  • For negotiating a secure connection in Federal Information Processing Standard (FIPS) mode, and using the Triple Data Encryption Standard (Triple DES) algorithm to protect the connection or encrypt a Public Key Cryptography Standards #7 (PKCS #7) enveloped data message, the Triple DES key that is used to encrypt the data must meet the National Institute of Standards and Technology (NIST) requirement that is stated in Special Publication 800-131A. In short, each of the three parts in a Triple DES key must be unique.

    When System SSL is used to generate a Triple DES key, System SSL ensures that an appropriate key is generated. If a Triple DES key is supplied by the calling application outside of a SSL/TLS connection, the supplier of the application must ensure that the passed key meets the NIST Triple DES requirement.

  • For negotiating a secure connection in non-FIPS mode, the minimum peer certificate key size for RSA, DSA, and DH certificates is increased from 512 bits to 1024 bits. For ECC certificates, the minimum key size is increased from 160 bits to 192 bits.

For applications that use smaller ("weak") keys, evaluate each application's usage and change it to use a stronger key, if possible. For applications that must continue to use weak keys, you must explicitly enable support for the weak keys.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if System SSL applications for secure SSL/TLS connections are used.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

SSL and TLS secure connections fail if weak keys are used.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check for applications that call any of the following APIs, and providing a Triple DES session key that consists of three unique parts. If not, determine how the key is generated and modify the application to generate an appropriate Triple DES key.

  • gsk_make_enveloped_data_content()
  • gsk_make_enveloped_data_content_extended()
  • gsk_make_enveloped_data_msg()
  • gsk_make_enveloped_data_msg_extended()

For non-FIPS mode applications that require secure SSL/TLS connections, examine the certificates for the partner applications. Verify that:

  • RSA, DSA, and DH certificates have a key size of at least 1024 bits
  • ECC certificates have a key size of at least 192 bits.

If the remote partner application uses an RSA, DSA, DH, or ECC certificate with a weak key size, have the partner application acquire a new certificate that meets the minimum supported key size.

For applications that must continue to operate using peer certificates with weak key sizes, you must explicitly enable support for the weak keys. To do so, you can use the API gsk_attribute_set_numeric_value(), or set one or more of the following environment variables:

  • GSK_PEER_RSA_MIN_KEY_SIZE
  • GSK_PEER_DSA_MIN_KEY_SIZE
  • GSK_PEER_DH_MIN_KEY_SIZE
  • GSK_PEER_ECC_MIN_KEY_SIZE

On the environment variables, specify the minimum supported key size (in bits). For example, to set the minimum supported peer certificate RSA key size to 512 bits, specify GSK_PEER_RSA_MIN_KEY_SIZE=512.

Note:

You can use these settings to enforce stronger key sizes than the default values.

Reference information

For more information about System SSL, see z/OS Cryptographic Services System SSL Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2.4 : System SSL: Define at least one cryptographic card as an accelerator for ICSF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To allow System SSL FIPS-enabled applications to use cryptographic cards for RSA digital signature verification, encryption, and decryption, at least one cryptographic card must be defined as an accelerator and be operational to ICSF. If ICSF is unable to perform the RSA cryptographic operation, System SSL performs the cryptographic operation in its software implementation.

When the System SSL DLLs are loaded, System SSL uses the ICSF Query Algorithm callable service (CSFIQA) to determine what hardware is available. If the user ID of the System SSL application does not have READ access to the CSFIQA resource in the CSFSERV class, System SSL processing continues. However, System SSL might not be aware of all the RSA key sizes that are supported by the accelerator card.

This table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS System SSL.

When change was introduced:

z/OS V2R3. z/OS V2R2 with APAR OA50589.

Applies to upgrade from:

z/OS V2R2 without APAR OA50589.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have System SSL FIPS-enabled applications and want to allow RSA digital signature verification, encryption, or decryption to be performed in the cryptographic accelerator card.

Target system hardware requirements:

None.

Target system software requirements:

ICSF

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Use the ICSF Coprocessor Management panel to determine what type of cards are configured and active for ICSF usage. For more information, see z/OS Cryptographic Services ICSF Administrator's Guide.

If your installation's level of ICSF is FMID HCR77B1 or later, you can also use the operator command DISPLAY ICSF,CARDS. For more information, see z/OS Cryptographic Services ICSF System Programmer's Guide.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2.5 : System SSL: Modify code or System SSL application configurations to enable removed ciphers


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, z/OS System SSL is changing its default SSL and TLS cipher support to no longer include the DES, Triple DES and Fixed Diffie-Hellman ciphers.

A cipher defines the authentication, encryption, message authentication code (MAC), and key exchange algorithm that is used when applications negotiate a secure connection by using SSL or TLS.

When a System SSL application calls the gsk_environment_open() routine to establish a secure environment, or the deprecated SSL or TLS gsk_secure_soc_init() routine specifying cipher_specs or v3cipher_spec set as NULL, the default enabled ciphers no longer include the ciphers that are listed in Table 1 and Table 2.

Table 1. SSL V3 and TLS ciphers

Two character cipher number

Four character cipher number

Short name

Description

When removed

09

0009

TLS_RSA_WITH_DES_CBC_SHA 1, 2

56-bit DES encryption with SHA-1 message authentication and RSA key exchange.

APAR OA51519

0A

000A

TLS_RSA_WITH_3DES_EDE_CBC_SHA

168-bit Triple DES encryption with SHA-1 message authentication and RSA key exchange.

APAR OA51519

0C

000C

TLS_DH_DSS_WITH_DES_CBC_SHA 1, 2

56-bit DES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with a DSA certificate.

APAR OA48868

0D

000D

TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA

168-bit Triple DES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with a DSA certificate.

APAR OA48868

0F

000F

TLS_DH_RSA_WITH_DES_CBC_SHA 1, 2

56-bit DES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA48868

10

0010

TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA

168-bit Triple DES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA48868

12

0012

TLS_DHE_DSS_WITH_DES_CBC_SHA 1, 2

56-bit DES encryption with SHA-1 message authentication and ephemeral Diffie-Hellman key exchange that is signed with a DSA certificate.

APAR OA51519

13

0013

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA

168-bit Triple DES encryption with SHA-1 message authentication and ephemeral Diffie-Hellman key exchange that is signed with a DSA certificate.

APAR OA51519

15

0015

TLS_DHE_RSA_WITH_DES_CBC_SHA 1, 2

56-bit DES encryption with SHA-1 message authentication and ephemeral Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA51519

16

0016

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

168-bit Triple DES encryption with SHA-1 message authentication and ephemeral Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA51519

30

0030

TLS_DH_DSS_WITH_AES_128_CBC_SHA

128-bit AES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with a DSA certificate

APAR OA48868

31

0031

TLS_DH_RSA_WITH_AES_128_CBC_SHA

128-bit AES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA48868

36

0036

TLS_DH_DSS_WITH_AES_256_CBC_SHA

256-bit AES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with a DSA certificate

APAR OA48868

37

0037

TLS_DH_RSA_WITH_AES_256_CBC_SHA

256-bit AES encryption with SHA-1 message authentication and fixed Diffie-Hellman key exchange that is signed with an RSA certificate.

APAR OA48868

  • 1 Ciphers that are not supported for TLS V1.2.
  • 2 Ciphers that are not supported in FIPS mode.
Table 2. SSL V2 ciphers

Cipher number

Description

When removed

6

56-bit DES encryption with MD5 message authentication.

APAR OA51519

7

168-bit Triple DES encryption with MD5 message authentication.

APAR OA51519

Note:

The SSL V2 and SSL V3 protocols are no longer enabled by default. Therefore, the ciphers for those protocols do not have any meaning unless the protocol is explicitly enabled.

For the cipher values that are in the default cipher specification list along with their order, see the description of the gsk_environment_open() routine in z/OS Cryptographic Services System SSL Programming.

For applications that must continue to use these ciphers, the ciphers must be explicitly enabled.

If the ciphers in Table 1 and Table 2 are the only ciphers in common between the two secure connection endpoints, the following are example SSL errors that might occur when the ciphers are not explicitly enabled:

  • Return code 402: No SSL cipher specifications.
  • Return code 420: Socket closed by remote partner.
  • Return code -1: No SSL cipher specifications.
  • Return code -22: Socket closed by remote partner.

The full list of supported ciphers is available in z/OS Cryptographic Services System SSL Programming.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services

When change was introduced:

  • DES and Triple DES ciphers were removed from the default list in:
    • z/OS V2R3
    • z/OS V2R2 with APAR OA51519 installed.
  • Fixed Diffie-Hellman ciphers were removed from the default list in:
    • z/OS V2R3
    • z/OS V2R2 with APAR OA48868 installed.

Applies to upgrade from:

z/OS V2R2 without OA48868 and OA51519.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if System SSL applications for secure SSL/TLS connections are used.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

SSL and TLS secure connections might fail if a System SSL application is relying on one of the System SSL defined default ciphers and it is no longer enabled.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation uses System SSL applications for secure SSL/TLS connections, examine those applications to determine whether they require the use of the removed ciphers in Table 1 and Table 2.

For each System SSL application that requires the use of one or more of these ciphers, consult each application's configuration documentation to determine the appropriate enablement capability. If the application supports the use of environment variables, see Method 2 in this section for environment variable information.

If your System SSL written application needs to support one or more of the removed ciphers, z/OS System SSL provides two methods to override the default SSL/TLS ciphers that are enabled when negotiating a secure connection by using the SSL/TLS routines. Your application must use one of the following methods:

Method 1
Use the gsk_attribute_set_buffer() or gsk_secure_soc_init() routine:
gsk_attribute_set_buffer()
The gsk_attribute_set_buffer() routine supports the specification of SSL V2 and SSL V3/TLS ciphers in preference order through the GSK_V2_CIPHER_SPECS, GSK_V3_CIPHER_SPECS, and GSK_V3_CIPHER_SPECS_EXPANDED attributes. Each attribute buffer consists of a single character string that consists of the cipher values enabled to be used for the secure connection.

To re-enable one or more of the SSL V2 ciphers, specify the GSK_V2_CIPHER_SPECS attribute, along with the complete list of ciphers to be available during the negotiation of the secure connection in preference order.

To re-enable one or more of the SSL V3/TLS ciphers, specify GSK_V3_CIPHER_SPECS if 2-character cipher specifications are enabled (the default), or GSK_V3_CIPHER_SPECS_EXPANDED if 4-character cipher specifications are enabled, along with the complete list of ciphers to be available during the negotiation of the secure connection in preference order.

For example, to restore the SSL V3/TLS 2-character default cipher list prior to the removal of the triple DES ciphers and DES ciphers 09, 0A, 12, 13, 15, and 16, set the GSK_V3_CIPHER_SPECs buffer value to "3538392F32330A1613091512". The 4-character GSK_V3_CIPHER_SPECS_EXPANDED buffer value would be "003500380039002F00320033000A00160013000900150012"

gsk_secure_soc_init()
The gsk_secure_soc_init() routine (deprecated API) supports the specification of SSL V2 and SSL V3/TLS ciphers through the cipher_specs and v3cipher_specs fields in the gsk_soc_init_data structure.

To re-enable one or more of the SSL V2 ciphers, specify the complete list of ciphers to be available during the negotiation of the secure connection in the cipher_specs field in preference order.

To re-enable one or more of the SSL V3/TLS ciphers, specify the complete list of ciphers to be available during the negotiation of the secure connection in the v3cipher_specs field in preference order.

For example, to restore the SSL V3/TLS default cipher list to contain triple DES and DES ciphers 09, 0A, 12, 13, 15, and 16, set the v3cipher_specs value to "3538392F32330A1613091512".

Method 2
Use the environment variables GSK_V2_CIPHER_SPECS, GSK_V3_CIPHER_SPECS, and GSK_V3_CIPHER_SPECS_EXPANDED:
GSK_V2_CIPHER_SPECS
To re-enable one or more of the SSL V2 ciphers, specify the GSK_V2_CIPHER_SPECS attribute along with the complete list of ciphers to be available during the negotiation of the secure connection in preference order.
GSK_V3_CIPHER_SPECS
To re-enable one or more of the SSL V3 ciphers, specify GSK_V3_CIPHER_SPECS, if 2-character cipher specifications are enabled (the default) along with the complete list of ciphers to be available during the negotiation of the secure connection in preference order. See Method 1 in this section for cipher specification list example.
GSK_V3_CIPHER_SPECS_EXPANDED
To re-enable one or more of the SSL V3 ciphers, specify GSK_V3_CIPHER_SPECS_EXPANDED, if 4-character cipher specifications are enabled along with the complete list of ciphers to be available during the negotiation of the secure connection in preference order. See Method 1 in this section for cipher specification list example.
Note:

Applications that specify the SSL V3 cipher specifications by using the gsk_attribute_set_buffer() or gsk_secure_soc_init() routine override the respective environment variable settings.

Reference information

For more information about System SSL, see z/OS Cryptographic Services System SSL Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.2.6 : System SSL: Determine whether to re-enable the MD5 with RSA algorithm in the defaults list


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, z/OS System SSL changed its default hash and signature algorithm support. Specifically, System SSL removed MD5 with RSA ("0101") from the default list of client and server hash and signature algorithm pairs. This list is used to determine the certificate signing algorithm for applications that negotiate a secure connection by using a TLS V1.2 handshake.

As a result of this change, when a System SSL application calls the gsk_environment_open() routine to establish a secure environment, the default hash and signature algorithm pairs list no longer includes the MD5 with RSA signature algorithm.

The MD5 with RSA ("0101") hash and signature algorithm pair was available in non-FIPS mode only.

If an SSL application or its connection partner uses certificates that are signed with the MD5 with RSA algorithm, the connection might fail because MD5 with RSA is no longer included in the hash and signature algorithms pairs list. These certificates include not only the end entity certificate, but also any signing certificates in the certificate chain.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services

When change was introduced:

z/OS V2R3. z/OS V2R2 with APAR OA49569 installed.

Applies to upgrade from:

z/OS V2R2 without APAR OA49569 installed.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if System SSL applications use MD5 with RSA certificates and are not explicitly specifying this algorithm through a supported interface.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

TLS V1.2 secure connections might fail if a System SSL application is relying on the MD5 with RSA algorithm being enabled by default.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation or System SSL applications do not enable TLS V1.2 at either the connection or environment level, you have no action to take. Also, if your System SSL applications are enabled for FIPS, you have no action to take because MD5 with RSA is not supported in FIPS.

If your System SSL applications use secure TLS V1.2 connections, examine the applications to determine whether they require MD5 with RSA certificates. If so, you must explicitly enable the MD5 with RSA signature algorithm. Or, you must modify the applications to use certificates that use alternative signature algorithms.

System SSL supports a wide range of signature algorithms that provide a higher level of security than MD5 with RSA. For information about the System SSL supported signature algorithms pairs, see the table of signature algorithm pair definitions for TLS in Appendix C of z/OS Cryptographic Services System SSL Programming.

If your System SSL applications must continue to use MD5 with RSA certificates, z/OS System SSL provides two methods for overriding the default list of signature algorithms. Your application must use one of the following methods:

Use the gsk_attribute_set_buffer() routine.
Use the gsk_attribute_set_buffer() routine to specify the hash and signature algorithm pairs list. Each attribute buffer consists of a single character string that indicates the algorithms that are enabled for use with a secure connection.

To re-enable the MD5 with RSA signature algorithm, enter the command gsk_attribute_set_buffer() with the attribute GSK_TLS_SIG_ALG_PAIRS and the complete list of available algorithms, including "0101".

For example:

  • To restore the previous V2R1 and V2R2 default hash and signature algorithms, which includes MD5 with RSA ("0101"), set the buffer to "0601060305010503040104030402030103030302020102030202 0101" .
  • To restore the previous V2R1 and V2R2 default hash and signature algorithms, which includes MD5 with RSA ("0101"), set the buffer to "0601060305010503040104030402030103030302020102030202 0101" .
Set the environment variable GSK_TLS_SIG_ALG_PAIRS.
Set the environment variable GSK_TLS_SIG_ALG_PAIRS to specify the hash and signature algorithm pairs list. Each attribute buffer consists of a single character string that indicates the algorithms that are enabled for use with a secure connection.

For example, to restore the previous V2R1 and V2R2 default hash and signature algorithms, which includes MD5 with RSA ("0101"), through an environment variable in non-FIPS mode, set GSK_TLS_SIG_ALG_PAIRS to "0601060305010503040104030402030103030302020102030202 0101" .

Note: The specification on the gsk_attribute_set_buffer() routine overrides the setting of the corresponding environment variable.

Reference information

For more information about System SSL, see z/OS Cryptographic Services System SSL Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.3 : Cryptographic Services actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Cryptographic Services upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.5.3.1 : PKI Services: Ensure users have the CA root certificate for PKI and web pages use HTTPS


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, the PKI Services component of z/OS uses the HTTPS protocol for its web page interfaces. In previous releases, PKI Services presented the first web page by using the HTTP protocol. Doing so allowed the user to use the link on this page to download the certificate authority (CA) root certificate of the web server certificate into the web browser. Thereafter, all the subsequent web pages used HTTPS.

To help ensure strong security, web pages should use HTTPS rather than HTTP. To use HTTPS, the CA root certificate of the web server must be preinstalled in the user’s web browser.

Starting with z/OS V2R4, the PKI page that previously used HTTP is now updated to use HTTPS. The link that is used to deliver the CA root certificate on the first page is removed. Therefore, you must use an alternative method to distribute the CA root certificate to the appropriate users at your installation. Also, you must remove the CA root certificate link from the template files and update the vhost files to use HTTPS.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

PKI Services.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, for first-time users of PKI Services web page interfaces. A web browser must have the root CA of the web server, otherwise, the user cannot access the PKI page.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

In Microsoft Internet Explorer, the following message is displayed:

This site is not secure

In Mozilla Firefox, the following message is displayed:

Your connection is not secure.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For any web browser that is planned to be used to access the PKI web page interface for the first time, your PKI administrator must distribute the CA root certificate of the web server (HTTP server, WebSphere, or WebSphere Liberty) to users who require access to the PKI web page interfaces. A possible method is to distribute the CA root certificate is by using the same communication channel that you use to provide users with the URI of the PKI web page.

If you send email, you can do the following:

  1. Add the CA root certificate as an attachment or include it as Base64 encoded text in the first email.
  2. Send a separate email with the root certificate fingerprint to help users ensure that the correct CA certificate was received in the previous email.

If you use the HTTP server, you can do the following:

  1. Remove the following CA root certificate link from pkiserv.tmpl:
    	<div role="region" aria-label="Install CA Certificate">	<A HREF="/PKIServ/cacerts/cacert.der">	Install the CA certificate to enable SSL sessions for PKI Services</A>	
  2. Change public-cgi to ssl-cgi-bin for the camain.rexx location from pkiserv.tmpl.

    Change the following statement:
    	<param name="" value="">	<FORM METHOD=GET ACTION="/[application]/public-cgi/camain.rexx">	
    to the following:
    	<FORM METHOD=GET ACTION="/[application]/ssl-cgi-bin/camain.rexx">	
  3. Remove the RewriteRule lines for public-cgi in your vhost files for SSL server authentication and SSL client authentication.

    For example:
    	RewriteRule   ^/(PKIServ|Customers)/public-cgi/(.*)  http://<server-domain-name>/$1/public-cgi/$2 [R,NE,L]	

If you use the WebSphere Application Server or WebSphere Liberty server, you can do the following:

  • Remove the following CA root certificate link from pkitmpl.xml:
    	<tns:CA_cert_URL>http://hostname:port/PKIServ/cacerts/cacert.der</tns:CA_cert_URL>	

For options for distributing the CA root certificate, see "Steps for accessing the user web pages" in Cryptographic Services PKI Services Guide and Reference.

Reference information

For more information, see Cryptographic Services PKI Services Guide and Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.5.3.2 : ICSF: Accommodate the TRACEENTRY option deprecation


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with ICSF HCR77A1, option TRACEENTRY has been deprecated and ICSF CTRACE support has been enhanced to support configurable ICSF CTRACE options from PARMLIB. A default CTICSF00 PARMLIB member is installed in SYS1.PARMLIB. The CTICSF00 PARMLIB member provides default component trace values for ICSF. By default, ICSF CTRACE support will trace with the KdsIO, CardIO, and SysCall filters using a 2M buffer. Configurable options are commented out within this PARMLIB member to provide examples of how to turn them on.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Cryptographic Services

When change was introduced:

Cryptographic Support for z/OS V1R13 z/OS V2R1 web deliverable (FMID HCR77A1), which installs only on z/OS V1R13 or z/OS V2R1.

Applies to upgrade from:

z/OS V2R1 and z/OS V1R13 without the Cryptographic Support for z/OS V1R13 - z/OS V2R1 web deliverable (FMID HCR77A1). Note that when the Cryptographic Support for z/OS V1R13 - z/OS V2R1 Web deliverable (FMID HCR77A1) is not installed, this migration item is not applicable.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have installed the Cryptographic Support for z/OS V1R13 z/OS V2R1 web deliverable (FMID HCR77A1) to handle TKDS with PKDS #11 objects for the new format in HCR77A1.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If the TRACEENTRY option is specified it will be ignored and will produce message CSFO0212 at startup; processing continues.

Related IBM Health Checker for z/OS check:

None.

Steps to take

You can code the new CTRACE option within a BEGIN(HCR77A1) END option pair in a options data set shared between multiple releases of ICSF.

  • If you share the installation options data set between HCR77A1 and pre-HCR77A1 systems, you can continue to supply the TRACEENTRY option at the lower-level systems as it is ignored, and processing will continue on the HCR77A1 systems.
  • If your installation cannot tolerate the CSFO0212 message that is issued at startup, you need to use different installation option data sets. Note that new CTRACE options will be in effect:
    • Review the default CTRACE options to ensure that they are satisfactory for your system.
    • Make any necessary changes. Use the CTICSF00 PARMLIB to create customized ICSF CTRACE Configuration Data Sets in PARMLIB. You can use the new CTRACE option to specify the customized ICSF CTRACE Configuration Data Set in the ICSF Options Data Set.

      For example, you can specify CTRACE(CTICSFxx), where xx is any two characters that were used when copying the default CTICSF00 parmlib member.

      Component tracing is active when ICSF starts using the trace options defined in the CTICSFxx PARMLIB member, where 00 is the default. If the CTICSF00 PARMLIB member is incorrect or missing, ICSF CTRACE performs tracing using an internal default set of trace options. The operator can specify trace options individually on the TRACE CT command or specify the name of a CTICSFxx PARMLIB member containing the desired trace options. Using a PARMLIB member on the TRACE CT command can help minimize operator intervention and avoid syntax or keystroke errors

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6 : DFSMS upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element DFSMSdfp and optional features DFSMSdss, DFSMShsm, DFSMSrmm, and DFSMStvs.


Step 4.6.1 : DFSMS actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes DFSMS upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.6.1.1 : DFSMS: Change DFSMSrmm Web Services to use the HTTPS protocol


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

DFSMSrmm web services provides support for remote Java applications to connect to the DFSMSrmm application programming interface over the internet. DFSMSrmm web services can be deployed either under z/OS WebSphere Application Server or Apache Tomcat (or another web service middleware). These packages are provided in the /usr/lpp/dfsms/rmm/ directory.

Starting in z/OS V2R4, DFSMSrmm web services uses HTTPS connections by default. If your installation uses DFSMSrmm web services, you must ensure that the web server and client software are both configured to use HTTPS. The server software must be configured to choose the protocol and the TCP/IP port that are to be used by one of the web services packages.

The change from HTTP to HTTPS is intended to allow for more secure communication with the DFSMSrmm application programming interface.

By default, only connections that use an encrypted HTTPS protocol are honored. Note that using an HTTPS protocol requires a signed certificate to be stored in a keystore file.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSrmm

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have applications that connect to the DFSMSrmm API over the internet through the HTTP protocol.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Unless the web server uses an encrypted HTTPS connection, and if the rmmApiSecureConnection variable is not set to “false”, any unencrypted connections to the DFSMSrmm API using the Web Services package provided by RMM will be rejected.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether your installation uses DFSMSrmm web services. This function requires one of the following server products to be running on your system:

  • IBM z/OS WebSphere Application Server
  • Apache Tomcat

Also, one of the following packages must be deployed:

  • /usr/lpp/dfsms/rmm/rmmapi.ear for IBM WebSphere
  • /usr/lpp/dfsms/rmm/rmmapitc.war for Apache Tomcat.

If the connector that is defined for DFSMSrmm web services is secure and is using the SSL protocol, no change is needed. However, if it is unencrypted, for example, the client is connecting to an “http://” address instead of “https://”, the connection will be rejected when used with the packages included with DFSMSrmm in z/OS V2R4 or later.

If you discover an unencrypted connection, do the following:

  1. Obtain a CA-signed certificate and place it in the keystore file for both the server (Apache Tomcat or IBM z/OS WebSphere Application Server) and the client.
  2. Change the server's connector to use SSL.
  3. Change the client software to connect to an HTTPS address rather than HTTP, and ensure that it has access to the certificate that is used.

Though not recommended, it is possible to bypass this restriction and use the HTTP protocol in the current release. To do so, you must define the environment variable rmmApiSecureConnection to the server software, and set it “false”.

Reference information

For more information, see the topic "Using the DFSMSrmm application programming interface with web services" in DFSMSrmm Application Programming Interface.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.2 : DFSMSdfp: Review XRC parmlib members for use of default values


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, some XRC default settings are changed to match IBM recommendations. If you depend on the old default, you must explicitly specify the old values in the appropriate parmlib members.

The following defaults are changed:

Value

Old Default

New Default

SCDumpType

STATESAV

NDSS

ReadDelay

1000

250

SuspendOnLongBusy

NO

YES

TracksPerRead

3

12

TracksPerWrite

3

12

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Examine parmlib members that are related to XRC for settings with changed defaults:

  • If the setting is not specified in any of the XRC-related parmlib members, determine whether the old default value needs to be retained according to the following table. If the value needs to be the old default, it must be specified in the member. Otherwise, the new default takes effect when XRC is started on the new z/OS release.
  • If the setting is specified in an XRC-related parmlib member (with any value, but especially with the old default value), consider whether the new default value is appropriate to use.

Setting

Effect of change in default

Reason to keep the old value

SCDumpType

Uses less disruptive mechanism to take storage control statesaves for diagnosis.

Use the old value STATESAV if your storage controls do not support non-disruptive statesaves. Or, when recommended by IBM Support.

ReadDelay

XRC record sets are read from primary storage control more frequently.

Use the old value 1000 for environments with >200 ms network latency to primary disk.

SuspendOnLongBusy

XRC is suspended immediately if the cache fills up on primary disk, resulting in less application impact.

Use the old value NO only for environments in which it is preferable to incur high application response time impact to maintain wanted recovery point objective (RPO).

TracksPerRead and TracksPerWrite.

These settings should be set to the same value.

Volume initialization and resync operations are faster and more reliable.

Note:

Higher values than the default are supported and can improve initialization and resync performance if sufficient bandwidth is available.

Use the old value 3 only if the new value 12 impacts performance.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.3 : DFSMSdfp: Check for an out-of-synch condition in the OAM configuration


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3 (and z/OS V2R2 with coexistence APAR OA51129), OAM processing of collection entries was changed so that duplicated collection information in the catalog is no longer used. This change can expose an existing collection entry out-of-synch condition that can be present between the catalog and the Db2 collection table. Before this change, OAM maintained duplicated collection information in two places (in Db2 and in the catalog). Now only Db2 is used for collection information.

This out-of-synch condition might have occurred at any point in the past, and was likely caused by manual updates to the collection information in the catalog or in Db2 (using SPUFI).

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R3. z/OS V2R2 with coexistence APAR OA51129 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA51129 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, for OAM object users.

Target system hardware requirements:

None.

Target system software requirements:

See information APAR II14842 and associated tools.

Other system (coexistence or fallback) requirements:

See "Steps to take."

Restrictions:

None.

System impacts:

Potential loss of object accessibility.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review APAR II14842 for more details and information about the associated comparison tool. Run the comparison tool for each Db2 subsystem that is used with OAM object support. In a shared environment (an OAMplex), you can run the tool on one of the systems in the sysplex.

APAR II14842 describes precautionary measures and methods for determining whether an out-of-synch condition exists in your configuration between the collection entries that are stored in the catalog and in the Db2 collection table. Observe the precautions to avoid a potential loss of object accessibility when you upgrade to z/OS V2R4.

Reference information

Review APAR II14842 for more details and information about the associated comparison tool.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.4 : DFSMSdfp: Back up SMS control data sets


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In a multisystem Storage Management Subsystem (SMS) complex, operating systems share a common set of SMS classes, groups, ACS routines, and a configuration base, which make up the storage management policy for the complex. This storage management policy is maintained in a source control data set (SCDS). When this policy is activated for SMS, the bound policy is maintained in processor storage and on DASD in an active control data set (ACDS). Systems in the complex communicate SMS information through a common communications data set (COMMDS).

It is recommended that to successfully share SMS control data sets in a multisystem environment where there are mixed levels of DFSMS, you update, translate, validate, and activate SMS policies on the system with the latest level of DFSMS. When an earlier control data set is to be updated or activated, the control data set is formatted by the later-level system. The shared SMS control blocks reflect the new, rather than the previous, lengths and control information.

For fallback, IBM recommends restoring SMS control data sets from backups taken on the fallback release.

Editing a policy on an earlier system could invalidate unused control information and prevent the control data set from being accessed by a later system. A warning message is provided before a policy can be changed on an earlier system. ACS routines may need to be updated and translated so to not reference policy items not known to the earlier system.

Remember, you risk policy activation failures if SCDS changes are not validated using the latest-level system in a sysplex.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended to ensure data integrity.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Install the PTFs, as described in the workflow step "Install coexistence and fallback PTFs" if they are not already installed.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Do the following on your pre-z/OS V2R4 systems:

  1. Back up SMS control data sets according to established procedures in the event that fallback is required. The control data set format is VSAM linear.
  2. Install all coexistence PTFs, as described in workflow step "Install coexistence and fallback PTFs."

In addition, if you modified and activated a higher-level policy on a pre-z/OS V2R4 system, do the following to ensure that the ACDS can be accessed on z/OS V2R4 and that the SMS control block reflect the new lengths and control information:

  1. On the pre-z/OS V2R4 system, save the active ACDS as an SCDS with the SETSMS SAVESCDS command.
  2. On z/OS V2R4, update, translate, validate, and activate the saved SMS policy.
Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.5 : DFSMSdfp: Consider replacing the SDM TSO commands with REXX


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As announced in Software Announcement 215-267, dated July 28, 2015, z/OS V2R2 is the last release of z/OS to include a number of System Data Mover (SDM) TSO/E commands. Based on client feedback, IBM now intends to continue to support these commands in the future, including the query and XSET commands. However, IBM plans no future enhancements for them. IBM recommends that you use the equivalent REXX versions of these commands instead, which are intended to be updated as needed to support any new functions in the future.

Specifically, the following commands were planned to be removed, but now remain in support:

  • FCESTABL
  • FCWITHDR
  • CDELPAIR
  • CDELPATH
  • CESTPAIR
  • CESTPATH
  • CGROUP
  • CRECOVER
  • CSUSPEND
  • RSESSION
  • RVOLUME
  • XADDPAIR
  • XADVANCE
  • XCOUPLE
  • XDELPAIR
  • XEND
  • XRECOVER
  • XSTART
  • XSUSPEND

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R3. Also, see IBM United States Software Announcement 216-392, dated October 4, 2016.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you use the TSO commands.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS checks:

None.

Steps to take

>

Evaluate whether to convert your existing non-query TSO commands to their REXX equivalents. To help you do so, IBM provides the following conversion programs in SYS1.DGTCLIB:

  • ANTFREXX for FlashCopy
  • ANTRREXX for Global Mirror
  • ANTPREXX for PPRC
  • ANTXREXX for XRC

Some of the TSO command keywords differ slightly from the REXX versions, and might need to be modified. For example, for full volume FlashCopy establish, you might enter the TSO command, as follows:

FCESTABL SDEVN(0F60) TDEVN(0F61)

To use the REXX interface, you can enter:

ANTFREXX FCESTABLISH SDEVN(0F60) TDEVN(0F61) SRCEXTNA() andTGTEXTNA()

Reference information

For information about REXX commands, see z/OS DFSMS Advanced Copy Services.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.6 : DFSMSrmm: Remove the CIM provider registration and its associated files


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R2 is the last release to support the DFSMSrmm Common Information Model (CIM) provider. This service is used to retrieve information about DFSMSrmm resources in real time.

IBM recommends that you remove the provider registration and its associated files from your system. If you need to retrieve information about DFSMSrmm resources, see "Steps to take" for alternative methods.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSrmm

When change was introduced:

z/OS V2R3. Also, see IBM United States Software Announcement 215-267 "IBM z/OS Version 2 Release 2 Fueling the new digital enterprise" dated July 28, 2015.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you configured the DFSMSrmm CIM provider.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS checks:

None.

Steps to take

Follow these steps:

  1. Determine whether the DFSMSrmm CIM provider is configured on your system. Check for the following conditions, which must be true if the DFSMSrmm CIM provider is active:
    • Determine whether Java Version 1.5.x is active on your system. This level is the maximum supported Java version for the DFSMSrmm CIM provider. You can use the following shell command: java -version
    • Determine whether the following files exist in z/OS UNIX System Services:
      /etc/rmm/rmmcust.properties /var/rmm/rmm.properties

      Or equivalent files exist in Linux, for example, in the $RMM_DIR- directory.

    • Determine whether the cimserver process is running under z/OS UNIX, or the CFZCIM started task procedure is running under z/OS.
    • Determine whether any DFSMSrmm providers are registered and running. You can use the following shell command: cimprovider -l -s
  2. For any DFSMSrmm CIM providers that you find, unregister the providers. You can use the following shell command: cimprovider -r -m module_name
  3. Remove the following files from z/OS UNIX or the equivalent files in Linux:
    /var/rmm/rmm.properties /etc/rmm/rmmcust.properties /etc/rmm/rmmlog.properties

If you need to display information about DFSMSrmm resources in real time, you can use DFSMSrmm subcommands or panels. To obtain this information programmatically, for example, to create reports or implement automation, you can retrieve the output through:

  • REXX variables
  • Structured field introducers (SFIs) or XML, by using high-level language APIs or web services.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.7 : DFSMShsm: Accommodate the default change for SETSYS MIGRATIONAUTOCLOUD


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the default target for DFSMShsm automatic migration is changed from both classic and cloud object storage to just classic migration. To have DFSMShsm data sets automatically migrated to cloud object storage, you must enable this processing.

Automatic migration to the cloud object storage was introduced in DFSMS SPE APAR OA52901, which was provided for z/OS V2R2 and z/OS V2R3. Initially, this function was enabled by default.

In addition, as of z/OS V2R4, the DFSMShsm command SETSYS MIGRATIONAUTOCLOUD(ALLCLOUDONLYNOCLOUD) is updated to allow you to specify that only a subset of DFSMShsm hosts are to process cloud migrations. Initially, the command defaulted to ALL, which indicates that both cloud and classic migrations are to be processed. In z/OS V2R4, the command default is changed to NOCLOUD, to prevent cloud migrations from impacting classic migration windows.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMShsm

When change was introduced:

z/OS V2R3 and z/OS V2R2, both with APAR OA52901 applied.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, without APAR OA52901 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if your DFSMShsm data set migrations are currently targeted to cloud object storage.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation does not migrate DFSMShsm data sets to cloud object storage, you have no action to take.

To determine whether your DFSMShsm data set migrations are automatically targeted to cloud object storage, check your SMS management classes for cloud object storage automatic migrations. These migrations are enabled by specifying that cloud object storage should be targeted, and by specifying a cloud object storage name. If both are not specified, classic migration is performed instead.

To maintain the current processing, specify either SETSYSMIGRATIONAUTOCLOUD(ALL) or MIGRATIONAUTOCLOUD(CLOUDONLY) in the DFSMShsm ARCCMDxx parmlib member.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.8 : DFSMSdfp: Increase storage for SMS ACDS data sets


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

With APAR OA52913, the length of the management class definition (MCD) in the SMS active control data set (ACDS) was increased from 328 to 760 bytes. This change was made in support of automatic migration support for transparent cloud tiering (TCT). With this change, the values that are used to estimate the size of storage that is needed for an active control data set are out of date.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

z/OS V2R3 and z/OS V2R2, both with the PTF for APAR OA52913 applied.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, both without APAR OA52913.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use the ACDS and it is reaching full capacity.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

The ACDS data set can fill sooner than you might expect.

The following errors can occur:

  • IEC070I 203: Extend was attempted but no secondary space was specified
  • IGD058I 6068 (X'17B4’): Problem could be caused by insufficient space to extend the data set

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check your utilization of the ACDS. To prevent the ACDS from reaching full, consider reallocating the ACDS to allow for more space.

When you allocate the SCDS and ACDS, specify secondary space allocations. This action helps to ensure that extends can be performed when:

  • New classes, groups, and other structures are added
  • Sizes of these structures increase in size.
Reference information

For more information, see:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.9 : DFSMSdfp: Accommodate code 4 for empty objects in the IDCAMS LISTCAT command


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, or z/OS V2R2 with APAR OA47745 applied, entering the IDCAMS LISTCAT command for an empty object results in a warning status (condition code 4). Previously, the command might have returned condition code 0 in some cases.

Along with this change, message IDC0001I is updated to include "empty objects" as a possible reason for condition code 4. "Empty objects" means that the total count of items displayed is zero.

IDC0001I FUNCTION COMPLETED, HIGHEST CONDITION CODE WAS nnn

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

  • z/OS V2R3
  • z/OS V2R2 with the PTF for APAR OA47745 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA47745.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have jobs that issue the IDCAMS LISTCAT command and depend on receiving condition code 0 for an empty object.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For any jobs that issue the IDCAMS LISTCAT command, determine whether the job depends on receiving condition code 0 for an empty object. If so, modify the job to expect condition code 4 instead.

For example, change COND=(0,LT,STEP2) to COND=(4,LT,STEP2).

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.1.10 : DFSMSdfp: Expect dumping of the catalog address space for VVDS manager error 050-020


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The VVDS is a VSAM entry-sequenced data set that contains information about the VSAM and SMS-managed non-VSAM data sets residing on the volume with the VVDS. The first logical record in a VVDS is the VSAM volume control record (VVCR). It contains information for management of DASD space and the BCS names, which have VSAM or SMS-managed non-VSAM data sets on the volume.

When a user catalog is opened, if a catalog name cannot be found in the VVCR record within the VVDS on a volume that is referenced by the master catalog CONNECTORE RECORD (U), the VVDS manager issues error code 050-020 and message IEC161I.

Starting in z/OS V2R3, or z/OS V2R2 with APARs OA50937 and OA52118 applied, a dynamic dump is taken with message IEC161I if a catalog name is not found in the VVCR record within the VVDS.

DUMP TITLE=CAS DYNAMIC DUMP-IGG0CLE1 RC50 RSN20

This action occurs regardless of the dynamic dumping status (DUMPON/DUMPOFF). Previously, both the dump and message IEC161I were suppressed.

This change in behavior is intended to improve first-failure data capture.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

  • z/OS V2R3
  • z/OS V2R2 with APARs OA50937 and OA52118 applied.

Applies to upgrade from:

z/OS V2R2 without APARs OA50937 and OA52118.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you expect the dump and message to be suppressed.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Be aware that a dynamic dump is always taken if a catalog name is not found in the VVCR record within the VVDS. This action occurs regardless of the dynamic dumping status (DUMPON/DUMPOFF).

To determine whether dynamic dumps will occur, check each VVDS for VVCR records that do not specify a catalog name.

Tip:

To clean up the obsolete CONNECTOR RECORD in master catalog, you can run the IDCAMS EXPORT DISCONNECT command.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2 : DFSMS actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes DFSMS upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.6.2.1 : DFSMSdfp: Prepare for the encryption of data sets


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS data set encryption, through SAF controls and RACF® or equivalent function along with SMS policies, allows you to identify new data sets or groups of data sets to be encrypted. With data set encryption, you are able to protect data on disk from being viewed by unauthorized users. For more information about data set encryption, see z/OS DFSMS Access Method Services Commands.

You must ensure that encrypted data sets are not created until your installation is ready to encrypt and decrypt. Until the decryption functions are available on all sharing systems (including backup systems and disaster recovery systems), encrypted data sets will be inaccessible to systems that cannot decrypt the data.

Because data set encryption has both hardware and software requirements, you must consider all systems that share data with a system on which you plan to enable data set encryption. For this discussion, all systems in your configuration means all systems that have access, or might have access (for example, in backup mode) to the same encrypted data sets.

Such systems include:

  • Backup systems
  • Read-only systems
  • Replication target systems
  • Disaster recovery systems
  • Systems that might back out to a lower software level.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

z/OS V2R2 with APAR OA50569 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA50569 applied.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Until the PTFs for OA50569 are applied and IPLed to all systems in your configuration, you must control the creation of encrypted data sets. Otherwise, unpredictable results can occur if encrypted data sets are accessed from a system that does not include the OA50569 support.

Restrictions:

None.

System impacts:

Until the decryption functions are available on all sharing systems, backup systems, and disaster recovery systems, access to encrypted data can be lost at any time.

Related IBM Health Checker for z/OS check:

None.

Steps to take

The PTFs for APAR OA50569 can be applied in a rolling IPL. However, to avoid unpredictable results such as data set corruption, the PTFs must be IPLed on all systems in your configuration prior to creating any encrypted data sets. If your configuration includes a z/OS V2R3 system, the PTFs for APAR OA50569 must be applied and IPLed on all systems in your configuration. If testing is to begin prior to this rollout, ensure that strict data set security measures are implemented to prevent access from a system that has not been IPLed with the PTFs for APAR OA50569.

To control the creation of encrypted data sets and prevent loss of access to data on any system that does not have the support, follow these steps:

  1. Restrict access to the SAF FACILITY class resource STGADMIN.SMS.ALLOW.DATASET.ENCRYPT until all systems in your installation have installed the PTFs for OA50569 and satisfy the minimum hardware requirements. On a system with RACF as the security manager, you can define the STGADMIN.SMS.ALLOW.DATASET.ENCRYPT profile in the FACILITY class, and set the universal access to NONE:
    RDEFINE FACILITY STGADMIN.SMS.ALLOW.DATASET.ENCRYPT UACC(NONE)
  2. If the SAF FIELD class is active, check for any profile that would allow any user without SPECIAL attribute access to the DATASET.DFP.DATAKEY. If there are none, no additional action is needed. If there is any profile that would allow access to DATASET.DFP.DATAKEY, create a DATASET.DFP.DATAKEY profile in the FIELD class with a UACC of NONE:
    RDEFINE FIELD DATASET.DFP.DATAKEY UACC(NONE)
  3. Do not create DATASET profiles with the KEYLABEL field in the DFP segment until all systems in your installation meet all of the software and hardware minimum requirements. Carefully follow the instructions in z/OS DFSMS Using the New Functions.
Reference information

For more information, see the following publications:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.2 : DFSMSdss: SHARE keyword is ignored for COPY and RESTORE of PDSE


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R4, your programs must close PDSE data sets before these data sets are overwritten by a DFSMSdss COPY or RESTORE operation. Otherwise, the DFSMSdss COPY or RESTORE operation encounters serialization errors, such as an ADR412E.

Note:

This behavior occurs regardless of whether the SHARE keyword is specified.

For programs that cannot close the PDSE data sets while a COPY or RESTORE operation is in progress, these programs can specify the TOLERATE(ENQFAILURE) keyword. If so, the program is responsible for ensuring data consistency. IBM recommends against using the TOLERATE(ENQFAILURE) keyword; use it at your own risk.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdss

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your programs open PDSE data sets when DFSMSdss is writing to them.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Applications must now close PDSEs before a copy or restore is to overwrite it. If you do not close down the application, serialization errors such as an ADR412E occurs on the DFSMSdss copy or restore.

Changing DFSMSdss to ignore the SHARE keyword for output data sets ensure integrity and prevent DFSMSdss from restoring a PDSE that an application has open. It also prevents an application from opening a PDSE that DFSMSdss is restoring.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.3 : DFSMSdfp: Verify that the new default for CA RECLAIM is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To reduce the need for reorganizing a KSDS, empty control area (CA) space on DASD can be reclaimed automatically so that it can be reused later when a CA split is required. The reclaimed CAs are available to be used for new records without any processing to obtain new space.

In parmlib member IGDSMSxx, the statement CA_RECLAIM specifies whether to use CA reclaim for KSDS data sets, based on the value of the CA Reclaim attribute in the associated data classes.

In z/OS V2R3, the default for CA_RECLAIM is changed to DATACLAS, which indicates that both SMS-managed and non-SMS-managed KSDS data sets use the CA reclaim attribute in the data class, which you set with ISMF. The attribute is set to Yes to enable CA reclaim by default.

In previous releases, the default was CA_RECLAIM(NONE), which indicates that none of the KSDS data sets use CA reclaim, regardless of the data class specification.

As of z/OS V2R3, if you do not want CA reclaims to be performed, you must specify CA_RECLAIM(NONE).

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you do not want CA reclaim processing on the system and you do not specify CA_RECLAIM(NONE) in IGDSMSxx.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Notes:
  • In a multi-system sysplex, it is possible that CA reclaim processing is enabled on some systems, but not others. Though this scenario is supported, it is recommended that all systems in the sysplex be enabled for CA reclaim processing.
  • If your installation is running with different CA reclaim options across systems, be aware that only systems with CA reclaim enabled can reclaim CAs and reuse them. The same data set that is accessed from a system without CA reclaim enabled always gets space at the end of the data set for its CA splits. Also, CAs that are "emptied" by the system without CA reclaim enabled cannot be reclaimed by the enabled systems.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

Use check IBMVSAM,VSAM_CA_RECLAIM to determine whether VSAM CA reclaim is enabled. This check is invoked during initialization and whenever CA reclaim status is changed. This check was added to z/OS V2R1 and V2R2 by APARs OA51394, OA51393, and OA51002.

Steps to take

For efficient DASD space usage, IBM recommends that you run your system with CA reclaim enabled.

CA reclaim can provide for improved DASD space usage, but it requires more I/O to track the reclaimed CAs so that they can be reused. The cost of this I/O might not be justified if there are no or few CA splits to reuse empty CAs. To determine whether CA reclaim is desirable for a data set, use the EXAMINE DATASET command, which shows the number of empty CAs in a KSDS with message IDC01728I.

If you do not want the default CA_RECLAIM(DATACLAS), you can override it by specifying CA_RECLAIM(NONE) in your IGDSMSxx parmlib member. With the DATACLAS setting, you can disable or enable CA reclaim at the data class level. You can also disable or enable the CA reclaim setting for specific data sets by using the command IDCAMS ALTER ksds_name RECLAIMCA NORECLAIMCA.

After IPL, you can dynamically change the CA_RECLAIM setting by using the SETSMS command.

Reference information

For more information about enabling or disabling the CA reclaim function, see the description of parmlib member IGDSMSxx in z/OS MVS Initialization and Tuning Reference.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMVSAM,VSAM_CA_RECLAIM.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.6.2.4 : DFSMSdfp: Accommodate change for data set name prefix in IDCAMS ALLOCATE


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R2 (with APAR OA49981) and z/OS V2R1 (with APAR OA42679), IDCAMS is changed in the way that it starts TSO/E to allocate a data set.

IDCAMS processing now uses the TSO/E Service Facility (TSF) to allocate a data set, rather than running the ALLOCATE command under the TSO/E terminal monitor program (IKJEFT01). With this change, the user ID assigned to the IDCAMS batch job is treated as the default data set prefix. That is, the user ID for the IDCAMS batch job is appended to the data set name as a high-level qualifier, if you specify the data set name on the DATASET keyword without quotation marks and the user ID does not have a RACF TSO segment.

Previously, the IDCAMS ALLOCATE command used a null prefix for the allocated data set, if you specified the data set name on the DATASET keyword without quotation marks and the user ID did not have a RACF TSO segment.

Assume, for example, that the user ID ZZZZZZZ is defined in both UADS and in RACF without a TSO segment; note the following differences in behavior:

  • Before this change, TSO runs under the UADS user. If the data set name is specified without quotation marks on the DATASET keyword, and the user has a UADS PROFILE PREFIX(prefix), the prefix is used as the data set prefix. Otherwise, the user ID is used as the data set prefix.
  • After this change, the user ID is always used as the data set prefix. Therefore, if the user ID and UADS PROFILE PREFIX(prefix) are different, the high-level qualifier for the data set is changed.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R2 with APAR OA49981.

Applies to upgrade from:

z/OS V2R2 without APAR OA49981.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use IDCAMS ALLOCATE, do not specify the data set name in quotation marks on the DATASET keyword, and the user ID assigned to the IDCAMS batch job does not have a RACF TSO segment.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Failure to include the data set name in quotation marks can result in allocation errors.

Related IBM Health Checker for z/OS checks:

None.

Steps to take

Check for JCL and programs that use the IDCAMS ALLOCATE command. Ensure that the data set name is specified in quotation marks on the DATASET keyword. Doing so ensures that the user ID is not appended to the data set name as a high-level qualifier.

When the IDCAMS ALLOCATE command is run by a user with a RACF TSO segment defined, no change is required.

Reference information

Documentation APAR OA47508 describes these changes.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.5 : DFSMSdfp: Accommodate change in the way that ANTRQST indicates the support level


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, the LEVEL request type of the ANTRQST macro is changed in how it indicates the level of support that is available. These changes affect assembler programs that use the LEVEL request to determine whether a function of ANTRQST can be used.

Without this enhancement, LEVEL returns a single numeric value for each ILK (XRC, PPRC, ESSRVCS, or MAIN) in the first 4 bytes of the RETINFO field. This numeric value is cumulative. For example, level 2 supports all of the function of level 1 plus the new function in level 2. This approach can create a problem when some functions are introduced in the service stream for all z/OS release levels, and some functions are introduced for a specific release only.

With this enhancement, a new mapping macro, ANTFEAT, is added, which contains a bit map of all supported ANTRQST functions. ANTFEAT maps the results that ANTRQST returns in the 100-byte RETINFO field. The first 4 bytes of RETINFO, which previously designated the level, are preserved for compatibility. A new value of 200 (a value that is greater than the current level for all ILK functions) is returned. This is done for compatibility for any users that are still using the single numeric LEVEL value rather than the new feature code bit map in ANTFEAT. It also allows users of the new function to know whether ANTFEAT is returning the bit map: A value less than 200 indicates that ANTFEAT is not supported. The new DSECT data that contains the feature codes, which are mapped by ANTFEAT, follows the first 4 bytes in the RETINFO field.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended if you have assembler programs that use the LEVEL request to determine whether a function of ANTRQST can be used.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

In assembler programs that use the LEVEL request to determine whether a function of ANTRQST can be used, modify the validation on return from the request, as follows:

  • If the first 4 bytes in the RETINFO field contain a value of 200, check the specific bit in the ANTFEAT data to determine whether a function is supported.
  • Otherwise, the value indicates the current supported level of that ILK.
Reference information

For more information, see z/OS DFSMS Advanced Copy Services.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.6 : DFSMSdfp: Ensure the Language Environment runtime library is available for DLLs


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Language Environment provides common services and language-specific routines in a single runtime environment. You can use Language Environment to build and use dynamic link libraries (DLLs) for applications.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your installation builds or references DLLs.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation builds or references DLLs, either you must set up the system link list to refer to the Language Environment runtime libraries (SCEERUN and SCEERUN2), or each job that creates or uses a DLL must include a STEPLIB DD statement referencing these libraries.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.7 : DFSMSdfp: Update SYS1.IMAGELIB


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you use page mode printers such as the IBM 3800 or the IBM 3900 running in line mode (not page mode), you must install library character sets, graphic character modification modules, and character arrangement tables in SYS1.IMAGELIB. This upgrade action does not apply if you are using IBM 3900 printers that are driven by PSF.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you are not using your old SYS1.IMAGELIB, you are installing with ServerPac or SystemPac, and you are using line mode printers, such as the 3800 or 3900.

Target system hardware requirements:

IBM 3800 or 3900 printers.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Run the LCSBLD1 job from the samplib data set to create character sets, graphic character modification modules, and character arrangement tables in SYS1.IMAGELIB.
  2. Copy customized or locally-written FCBs and UCS images from your old system's SYS1.IMAGELIB data set to the new system's SYS1.IMAGELIB data set.
Reference information

For information about maintaining SYS1.IMAGELIB, see z/OS DFSMSdfp Advanced Services.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.2.8 : DFSMSdss: Build the IPLable stand-alone DFSMSdss image


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V1R12, DFSMSdss uses BSAM instead of EXCP to read from and write to DFSMSdss dump data sets during DUMP, COPYDUMP, and RESTORE operations. As a result, if you plan to use DFSMSdss Stand-Alone Services, you must rebuild the IPL-capable core image for the Stand-Alone Services program.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdss.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you want to use DFSMSdss Stand-Alone Services.

Target system hardware requirements:

Stand-Alone Services supports the IBM 3494 TotalStorage™ Enterprise Automated Tape Library, the IBM 3495 TotalStorage Enterprise Automated Tape Library, and the IBM 3590 TotalStorage Enterprise Tape Subsystem.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

Stand-Alone Services does not support the creation of the core image on an SMS-managed volume.

System impacts:

If this upgrade action is not performed, users of DFSMSdss standalone restore cannot restore to tape any backups that were created with greater than 65520-byte blocks. The operation fails with the message ADRY3530I SEQUENCE ERROR ON RESTORE TAPE.

Backups that are created with 65520-byte blocks can be restored as before.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Use the DFSMSdss command BUILDSA to create a Stand-Alone Services IP-capable core image. On the command, you can specify:
    • Device from which Stand-Alone Services are to be IPLed (such as a card reader, tape drive, or DASD volume)
    • Operator console to be used for Stand-Alone Services

    The BUILDSA command builds the IPLable core image on the current operating system and determines a record size, based on whether the IPL is performed from a card, tape, or DASD.

  2. Use your security management product, such as RACF, to protect the SYS1.ADR.SAIPLD.Vvolser data set and the Stand-Alone Services modules.
  3. If you have not already done so, create a backup copy of your system that can be restored by this function. For information about backing up volumes, see z/OS DFSMSdfp Storage Administration.
Notes:
  1. To ensure that Stand-Alone Services is available when you run from DASD, do not delete the SYS1.ADR.SAIPLD.Vvolser data set or move it to another volume.
  2. If you IPL from DASD and later change the volume serial number, you must rerun the BUILDSA function to create a new core image data set with the new volume serial number in the name.
  3. If you attempt to use the DFSMSdss stand-alone restore program from z/OS V1R11 to restore a backup that was created with a block size greater than 65520 bytes, the operation fails with the message ADRY3530I SEQUENCE ERROR ON RESTORE TAPE.
Reference information

For more information, see z/OS DFSMSdfp Storage Administration.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.6.3 : DFSMS actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes DFSMS upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.6.3.1 : DFSMSdfp: Run OAM DB2 BIND jobs


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

When migrating to any new release of z/OS, you must run OAM DB2 BIND jobs if you are using OAM for object support. The BIND jobs update DB2 with new OAM DB2 code.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

DFSMSdfp.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use OAM object support.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Coexistence PTFs are applicable to DFSMSdfp OAM. For information about installing coexistence PTFs, see the workflow step called "Install coexistence and fallback PTFs."

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Run the BIND jobs appropriate to your installation:

  1. Update and execute the samplib job CBRPBIND (OAM DB2 Bind Package Job).
  2. Do one of the following:
    • If your installation starts OAM, uses the file system sublevel or optical or tape devices, or uses the OAM storage management component (OSMC), do the following:
      • Update and execute samplib job CBRABIND (OAM DB2 Application Plan Bind for LCS and OSR).
      • Update and execute samplib job CBRHBIND (OAM DB2 Application Plan Bind for OSMC).
    • If your installation does not start OAM, use the file system sublevel or optical or tape devices, or use OSMC, update and execute samplib job CBRIBIND (OAM DB2 Application Plan Bind for OSR only).
  3. For more information, see the topic on migrating, installing, and customizing OAM in z/OS DFSMS OAM Planning, Installation, and Storage Administration Guide for Object Support.
Note:

If you choose to edit a previous version of an OAM BIND job, you must incorporate any new changes as described in the header of each samplib OAM BIND job.

Reference information

For more information about OAM, see z/OS DFSMS OAM Planning, Installation, and Storage Administration Guide for Object Support.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.7 : Distributed File Service upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element Distributed File Service.


Step 4.7.1 : Distributed File Service actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Distributed File Service upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.7.1.1 : DFS/SMB: Use Network File System (NFS) instead of DFS/SMB


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, the z/OS operating system no longer supports Distributed File System / Server Message Block (DFS/SMB). Originally, the z/OS Distributed File Service base element consisted of two components: SMB and z/OS File System (zFS). In z/OS V2R4, the name of the base element is changed to z/OS File System.

If you need to share files between z/OS and Microsoft Windows, IBM recommends that you use the Network File System (NFS) protocol instead of DFS/SMB. NFS also allows for the sharing of z/OS data with UNIX and Linux systems.

NFS is the strategic file sharing protocol for the z/OS platform. To help your installation upgrade to NFS, IBM plans to deliver new NFS function on existing levels of the operating system, including installation, security, availability, and operational enhancements. These planned enhancements are intended to help you more easily migrate to NFS before you upgrade to the next release of z/OS.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Server Message Block (SMB) support of the IBM z/OS Distributed File Service base element.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 218-236, dated May 15, 2018.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use DFS/SMB.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether your system uses DFS/SMB, use health check IBMUSS,ZOSMIGV2R3_NEXT_USS_SMB_DETECTED. This check, which is added by APAR OA56251, is available for z/OS V2R3 and z/OS V2R2 systems.

Steps to take

Do the following:

  1. Determine whether your system uses DFS/SMB. To do so, use health check IBMUSS,ZOSMIGV2R3_NEXT_USS_SMB_DETECTED.
  2. If so, stop using DFS/SMB.
  3. Verify that NFS is configured and running.

    NFS provides two z/OSMF workflows to aid the system administrator, as follows:

    Workflow for Installing and Configuring the z/OS NFS Server
    Guides the system administrator through the process of setting up the z/OS NFS Server. This workflow provides information on the initial installation of the NFS server. You might find it to be helpful, if you have not set-up NFS before.
    Workflow for Migration from z/OS DFS/SMB to z/OS NFS
    Describes the steps that the system administrator must perform to have z/OS NFS provide function that is similar to an existing z/OS DFS/SMB configuration.

    For more information about these workflows, see APAR OA56186.

  4. Use the equivalent functions in NFS.

Reference information

For more information about NFS, see z/OS Network File System Guide and Reference.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMUSS,ZOSMIGV2R3_NEXT_USS_SMB_DETECTED.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.7.2 : Distributed File Service actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Distributed File Service upgrade actions that you can perform after you have installed z/OS V2R4 but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.


Step 4.7.2.1 : zFS: Accommodate the changed defaults in the IOEFSPRM configuration file


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, several default settings in the IOEFSPRM configuration file are changed, as follows:

  • The default value for the romount_recovery option is changed from OFF to ON. With romount_recovery=ON, the file system is temporarily mounted read/write to allow log recovery to run. Then, the file system is remounted read/only.
  • The default value for the format_aggrversion option is changed from 4 to 5. With format_aggrversion=5, the default version of the aggregate is 5.
  • The default value for the change_aggrversion_on_mount option is changed from OFF to ON. With change_aggrversion_on_mount, version 1.4 aggregates are changed to version 1.5 aggregates on a primary read/write mount.
  • The default value for the honor_syslist option is changed from OFF to IGNORED. If the honor_syslist=ignored option is specified, it is accepted but not used.

Information about this upgrade action

The following table provides more details about these upgrade actions. Use this information to plan your changes to the system.

Element or feature:

z/OS Distributed File Services.

When change was introduced:

V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, for romount_recovery, format_aggrversion, and change_aggrversion_on_mount if you do not want the new default.

No, but recommended for honor_syslist. If you want to restrict zFS owners to potential z/OS UNIX owners as allowed by a file system's automove options, ensure that honor_syslist=on is specified on all systems on earlier releases. Otherwise, no action needs to be taken.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For romount_recovery=on:

  • If you want recovery to be automatically performed for read-only mounts and romount_recovery is not specified in IOEFSPRM, there is no upgrade action.
  • If you do not want recovery to be automatically performed for read-only mount, ensure that romount_recovery=off is in IOEFSPRM. Alternatively, you can change the romount_recovery value for this mount instance by using zfsadm config -romount_recovery off.

For format_aggrversion:

  • If you want the format operation to produce version 5 aggregates when neither -version4 nor -version5 is specified, and format_aggrversion is not in IOEFSPRM, there is no upgrade action.
  • If you want the format operation to produce version 4 aggregates when neither -version4 nor -version5 is specified, ensure that format_aggrversion=4 is in IOEFSPRM. Alternatively, you can change the format_aggrversion value for this mount instance by using zfsadm config -format_aggrversion 4.

For change_aggrversion_on_mount:

  • If you want version 4 aggregates to be changed to version 5 aggregates on a primary read/write mount and change_aggrversion_on_mount is not in IOEFSPRM, there is no upgrade action.
  • If you do not want version 4 aggregates to be changed to version 5 aggregates, then ensure that convert_aggrversion_on_mount=off is in IOEFSPRM. Alternatively, you can change the change_aggrversion_on_mount value for this mount instance by using zfsadm config -change_aggrversion_on_mount off.

For honor_syslist:

Reference information

For more information, see z/OS File System Administration.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.7.3 : Distributed File Service actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Distributed File Service upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.8 : HCD upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element Hardware Configuration Definition (HCD).


Step 4.8.1 : HCD actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCD upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.8.1.1 : HCD withdraws support for out-of-service processor types


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, HCD no longer supports the following IBM Z processor types:

Processor Model

Processor Type

End of service date

z900

Type 2064

31 December 2014

z800

Type 2066

31 December 2014

z990

Type 2084

31 December 2014

z890

Type 2086

31 October 2016

HCD continues to support these processor types in z/OS V2R3 and earlier releases.

If your I/O definition file (IODF) contains definitions for these processor types, and you use HCD to maintain your configuration, you must delete the definitions before you upgrade your system to z/OS V2R4.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

HCD

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if unsupported processor models are still defined in your IODF.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

HCD cannot validate I/O configuration for unknown processor models.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check your currently active IODFs to determine whether you have any saved processor configurations for these out-of-service processors. To do so:

  1. Start HCD.
  2. Select option 1 “Define, modify, or view configuration data”
  3. Select option 3 “Processors” to see the list of defined processor configurations.
  4. Check the Type column for any of the out-of-service processor types.
  5. If you still have any processor configuration for one or more of the out-of-service processor types, determine whether the processor still exists. If not, delete the configuration.

    Otherwise, if the processor is still in use, it must remain at the z/OS V2R3 level for the system on which you maintain the IODF.

Reference information

For more information, see z/OS HCD User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.8.2 : HCD actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCD upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.8.2.1 : HCD: Remove HCD data sets and paths that refer to LDAP


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, HCD no longer supports LDAP as a way to work with I/O configurations in an IODF.

All LDAP related artifacts are removed from HCD. The following data sets and paths are removed in this release:

  • DDDEF SCBDMLDP, PATH ‘ /usr/lpp/hcd/msg/IBM/'
  • DDDEF SCBDEXMP, PATH '/usr/lpp/hcd/examples/IBM/'
  • DDDEF SCBDETCH, PATH '/usr/lpp/hcd/etc/IBM/'
  • DDDEF SCBDHFSL, PATH '/usr/lpp/hcd/bin/IBM/'
  • DDDEF ACBDEHFS, data set SYS1.ACBDEHFS.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

HCD

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you used LDAP to view your HCD IODF, or had references to the HCD paths, which provide the HCD LDAP support.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Remove the HCD data sets and paths that no longer exist in z/OS. Also, remove references to these objects.

You might find references to the data sets and paths in the following places:

  • Parmlib
  • Proclib
  • Logon procedures
  • Catalogs
  • Security definitions, including program control definitions
  • DFSMS ACS routines
  • /etc/profile
  • SMP/E DDEF entry
  • Backup and recovery procedures and references to them.

Reference information

For the data sets and paths that are included in z/OS, see z/OS Program Directory.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.8.3 : HCD actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCD upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.8.3.1 : HCD: Accommodate the removal of switch functions from Tivoli System Automation


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

With the I/O operations component (I/O Ops) of Tivoli System Automation (TSA) reaching its end of service date in September 2019, HCD has withdrawn support for I/O Ops, as of z/OS V2R4. The I/O Ops component is removed from TSA in Release 4.1, as stated in IBM United States Software Announcement 217-086, dated February 28, 2018. With this change, HCD and HCM no longer support the I/O Ops component, as of z/OS V2R4.

The changes for HCM are described in the workflow step "HCM: Accommodate the removal of I/O Operations from Tivoli System Automation."

In previous releases, HCD used the I/O Ops component for importing, exporting, definition, and activation of switch configurations, and for gathering input for the HCD I/O Path report. Withdrawing the I/O Ops support in HCD means that HCD no longer supports importing, exporting, or activating switch configurations. The corresponding HCD actions — 2.8, 2.9, and 5.2 — are removed from HCD.

Though it is still possible to define switches and switch configurations in HCD, the switch information in the IODF can become out of sync with information in the switch itself. Therefore, it is recommended that you stop using the switch configuration information in HCD.

Note:

More recent FICON switches are configured within the switches themselves.

With the removal of the support for I/O Ops, HCD no longer uses I/O Ops for gathering information for the I/O Path report, which remains available in HCD. HCD can provide similar function by using IBM Z Discovery and Auto-Configuration (zDAC), if zDAC is enabled on your system. Otherwise, if zDAC is not enabled, the HCD I/O Path report includes information from the IODF only. Be aware that zDAC dynamically defines temporary devices to be able to perform discovery.

A limitation of zDAC is that status information is available only for paths that are accessible from the local sysplex. If you currently run HCD and TSA I/O Ops for the I/O Path report, in z/OS V2R4, you must run the report on all z/OS sysplexes and then combine this information manually. Or, you can run the report on a system that has access to all of the paths that are of interest.

This change also means that the message CBDG129I is no longer displayed if an I/O Path report is requested and I/O Ops is not available.

HCM continues to show the I/O Path report as generated by HCD.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

HCD

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use the system status information in the I/O Path report.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether you still have switch configurations in your IODF by using HCD option 1.2 to find your switches. To determine whether you have switch configurations in your IODF, use action 's' "Work with switch configurations" and action 'p' "Work with ports."

If you are using the I/O Path report, enable zDAC on the system where you run the report. To do so, you must authorize the LPAR that is running HCD to make dynamic I/O configuration changes. In addition, the user running the report needs to be authorized to make dynamic I/O configuration changes. This activity requires UPDATE authority to the MVS.ACTIVATE profile in the OPERCMDS class. For more details on zDAC and how to enable it, see HCD User's Guide.

Determine whether you are running the HCD I/O Path report. If so, do the following:

  • Define, export, and activate switch configurations by using a previous version of HCD. It is recommended that you remove switch configuration information from your IODF.
  • Replace your I/O Path report that used TSA I/O OPS with I/O Path reports that use zDAC.
  • Be aware that message CBDG129I is no longer issued by HCD.
Reference information

For more information, see z/OS HCD User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.9 : HCM upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element Hardware Configuration Manager (HCM).


Step 4.9.1 : HCM actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCM upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.9.2 : HCM actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCM upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.9.3 : HCM actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HCM upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.9.3.1 : HCM: Accommodate the removal of I/O Operations from Tivoli System Automation


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The I/O operations component (I/O Ops) is removed from Tivoli System Automation (TSA) in Release 4.1. With this change, HCD and HCM no longer support the I/O Ops component, as of z/OS V2R4.

The changes for HCD are described in the workflow step called "HCD: Accommodate the removal of switch functions from Tivoli System Automation."

In previous releases, HCM used the I/O Ops component for the following functions:

  • Displaying the active sysplex and the status of its objects graphically
  • Retrieving, manipulating, and activating switch matrices
  • Issuing I/O Operation commands.

With this change, the corresponding functions are removed from HCM. Specifically, the functions are removed from the HCM Operations menu and the actions that are listed for View > Colors dialog > I/O Operations.

HCM continues to show the I/O Path report as generated by HCD.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

HCM

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 217-085, "IBM z/OS Version 2 Release 3 - Engine for digital transformation," dated February 21, 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use HCM to display information about the active sysplex, work with switch matrices, or issue I/O Operations commands.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you use HCM, be aware that you can no longer use HCM to display information about the active sysplex, work with switch matrices, or issue I/O Operations commands. Also, because HCM depends on HCD, it is recommended that you stop using the switch configuration information in HCM.

Note: More recent FICON switches are configured within the switches themselves.

Reference information

For more information, see z/OS and z/VM HCM User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.10 : HLASM upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element High Level Assembler (HLASM).


Step 4.10.1 : HLASM actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HLASM upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.10.1.1 : HLASM: Verify that the changed default of ILMA is acceptable


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Before HLASM APAR PI74470, if the active instruction set was switched during an assembly by using the ACONTROL OPTABLE, any previously defined macros were no longer visible, as they were only added to the current OPTABLE set. For SYSLIB macros, this behavior is harmless (though inefficient) because a new copy of the macro is fetched. However, for inline macros, this behavior causes errors because the macro becomes undefined.

To help avoid this problem, APAR PI97142 adds the option ILMA, which prevents this problem by causing inline macros to be defined in all OPTABLEs. The ILMA option was required to be explicitly specified to override the default NOILMA.

With APAR PI98655, the keyword value ILMA=YES is now included in the default options module ASMADOPT and the macro ASMAOPT, which is used to generate ASMADOPT.

This default change is unlikely to affect any but a few assembly language programs.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

HLASM.

When change was introduced:

z/OS V2R3 and z/OS V2R2, both with APAR PI98655 installed.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, both without APAR PI98655 installed.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you have assembly language programs that meeting the conditions described in "Steps to take."

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check your high-level assembly language programs for code that satisfies all of the following conditions:

  • Uses ACONTROL OPTABLE to switch the instruction set
  • Uses inline macros, where the assembly options do not include ILMA or an explicit NOILMA option
  • Expects to define different inline macros for different OPTABLE instruction sets.

For programs that meet all of these conditions, you must ensure that the option NOILMA is active at the point that each affected macro is defined. It can, for example, be specified for the whole assembly on a *PROCESS statement or in the PARM field, or on an ACONTROL statement before the affected macro.

Note:

If you assemble your own ASMADOPT default options module, the new default of ILMA does not take effect until you reassemble your default options module, or switch to using the supplied default options module.

Reference information

For more information, see HLASM Programmer's Guide. .

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.10.2 : HLASM actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HLASM upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.10.2.1 : HLASM: Discontinue the usermod for the IEV90 alias


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, and earlier releases with APAR PI71827 applied, you no longer need to define IEV90 as an alias of ASMA90. HLASM now includes the ALIAS IEV90 statement in the JCLIN for HMQ4160J, which means that an alias for ASMA90 is automatically created.

Programs that invoke ASMA90 through the name IEV90 will continue to work.

In previous releases, to ease the migration of assembler procedures from Assembler H (IEV90) to High Level Assembler (ASMA90), your installation might have defined IEV90 as an alias of ASMA90. Your installation could use the ASMAIEV sample usermod in the ASM.SASMSAM1 library to enable the alias, until you finished updating the references. IBM supplies module ASMAIEV in data set ASM.SASMSAM1. In the sample, ASMAIEV has a usermod name of ML00009.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

HLASM.

When change was introduced:

z/OS V2R3 with APAR PI90075 and z/OS V2R2 (with APAR PI71827).

Applies to upgrade from:

z/OS V2R3 (without APAR PI90075) and z/OS V2R2 (without APAR PI71827).

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use a usermod to define the IEV90 alias.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review your installation procedures for instructions for applying the ASMAIEV sample usermod. You no longer have to apply the usermod.

Reference information

For more information, see HLASM Installation and Customization Guide. .

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.10.3 : HLASM actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes HLASM upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.11 : IBM Knowledge Center for z/OS upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element IBM Knowledge Center for z/OS.


Step 4.11.1 : IBM Knowledge Center for z/OS actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes IBM Knowledge Center for z/OS upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.11.2 : IBM Knowledge Center for z/OS actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes IBM Knowledge Center for z/OS upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.11.3 : IBM Knowledge Center for z/OS actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes IBM Knowledge Center for z/OS upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.11.3.1 : IBM Knowledge Center uses /global by default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, IBM Knowledge Center for z/OS (KC4z) uses the new /global directory for KC product documentation content and associated properties files. This directory, which is available in the version root and sysplex root, can be used to store and maintain a single copy of KC4z data (KC product documentation content and associated properties files) that can be referenced by all members of the sysplex. Before V2R3, individual copies of the same KC4z data had to be maintained in each member of the sysplex.

With this change, the directory structure that is created by the KC4z 1.1 post-installation configuration scripts is changed to use the /global directory. As a result, a single copy of KC product content and associated properties files can be shared across all systems in a sysplex that use shared file system support. The entire post-installation directory structure is changed, so migration considerations, when applicable, apply to both sysplex and single system environments.

Following is the default tree structure that is created by the original KC4z 1.0 (z/OS V2R2) post-installation scripts. The /sharedapps/kc4z/servers/,/sharedapps/kc4z/data/, and /var/kc4z directories are mount points that are created by the first post-installation script. Then, sample JCL jobs are used to create Server Configuration (HKCCFGFZ), Data (HKCDATFZ) and Logs (HKCLOGFZ) file systems, and mount them on those three mount points. More scripts then create the subdirectories on the mounted file systems, and populate the server configuration subdirectory.

/sharedapps/kc4z/servers/kc4zServer /sharedapps/kc4z/data/conf /sharedapps/kc4z/data/content /sharedapps/kc4z/data/runtime/index /sharedapps/kc4z/data/runtime/diskcache /sharedapps/kc4z/data/runtime/datacache /var/kc4z/logs

Following, is the default tree structure that is created by the KC4z 1.1 (z/OS V2R3) post-installation scripts. The /global/kc4z/data/, /var/kc4z/runtime/, and /var/kc4z/ logs directories are mount points that are created by the first post-installation script. Then, sample JCL jobs are used to create Data (HKCDATFZ), Runtime (HKCRUNFZ) and Logs (HKCLOGFZ) file systems, and mount them on those three mount points. More scripts then create the subdirectories on the file systems, and populate the server configuration subdirectory. For KC4z 1.1, the Runtime file system (HKCRUNFZ) is new; because the server configuration files are now stored in the /etc/ file system, a Server Configuration file system (HKCCFGFZ) is no longer created and mounted.

/etc/kc4z/servers/kc4zServer /global/kc4z/data/conf /global/kc4z/data/content /var/kc4z/runtime/index /var/kc4z/runtime/diskcache /var/kc4z/runtime/datacache /var/kc4z/logs

Notice that the /global/kc4z/data/ mount point is created under the /global directory that is in effect for a given system. In a sysplex, for a system using shared file system support, that would be the /global directory in the sysplex root file system, and for a system not using shared file system support in the sysplex, that would be the /global directory in the version file system. In a non-sysplex, that would be the /global directory in the root file system. Regardless of location, the HKCDATFZ file system is mounted on the /global/kc4z/data mount point, and the /global/kc4z/data/conf and /global/kc4z/data/content subdirectories are then created there by subsequent post-installation scripts.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

IBM Knowledge Center for z/OS.

When change was introduced:

V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you want to save and restore the KC product content and associated properties files that were previously provisioned to the KC4z 1.0 server on z/OS V2R2. Or, if you want to save the KC4z 1.0 server log data that was created on z/OS V2R2.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

In a sysplex, if the Data file system is mounted at /global/kc4z/data in the sysplex root for z/OS V2R3, it is shareable by all KC4Z server instances in the sysplex running with shared file system support. Because sharing of the Data file system is supported between z/OS V2R3 and V2R2 KC4z and is more convenient, it is recommended that you configure z/OS V2R2 KC4z to also use the /global/kc4z/data Data file system. Follow the instructions in "Steps to take."

If you choose not to have a z/OS V2R2 KC4z use the shared z/OS V2R3 KC4z Data file system, you will have separate Data file system information (KC product documentation content and associated properties files) for the two KC4z servers.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Before you run any KC4z 1.1 (z/OS V2R3) post-installation scripts and sample JCL jobs, make a backup copy of the KC4z 1.0 (z/OS V2R2) data file systems (data set name HKC.HKCDATFZ, by default), and logs file systems (data set name HKC.HKCLOGFZ, by default). Only data file systems (HKCDATFZ) can be migrated from KC4z 1.0 (z/OS V2R2) to KC4z 1.1 (z/OS V2R3). Backup copies of the KC4z 1.0 Logs file systems can be used for archive purposes only. Regardless, unless backed up, the KC4z 1.0 Data and Logs file system data sets can (if unmounted) be overwritten by the KC4z 1.1 sample JCL jobs, by default.

After you run the newly documented KC4z 1.1 (z/OS V2R3) post-installation scripts and sample JCL jobs, if it is desired to migrate a backup copy of a KC4z 1.0 (z/OS V2R2) Data file system for use with KC4z 1.1 (z/OS V2R3), unmount the newly created Data file system (HKCDATFZ) from the /global/kc4z/data mount point directory. Then, mount the desired backup copy of the KC4z 1.0 Data file system (HKCDATFZ) in its place.

After doing so:

  1. Inspect the “path=” value within each *.properties file in the /global/kc4z/data/conf directory. For any *.properties files in which the prefix of the “path=” value is “ /sharedapps/kc4z/data” manually edit that prefix to reflect the new mount point of “ /global/kc4z/data”. The *.properties files are in the ASCII code page, and should remain in that code page.
  2. Remove the runtime directory (/global/kc4z/data/runtime) and its subdirectories. These old runtime directories are no longer needed, as the new runtime directories are in a separate runtime file system (HKCRUNFZ) for KC4z 1.1 (z/OS V2R3). The old runtime data cannot be migrated from KC4z 1.0 (z/OS V2R2) to KC4z 1.1 (z/OS V2R3).

In a z/OS V2R3 sysplex, if the Data file system is mounted at /global/kc4z/data in the sysplex root, it is shareable by all KC4Z server instances in the sysplex running on systems that use shared file system support. Because KC4z 1.1 (z/OS V2R3) servers, by default, are pre-configured to read data from the Data file system that is mounted at /global/kc4z/data, such a KC4z 1.1 (z/OS V3R3) server would automatically use the shared copy in the sysplex root. Any older such KC4Z 1.0 (z/OS V2R2) servers in the sysplex can also be made to read the data in the shared Data file system that is mounted at /global/kc4z/data in the sysplex root by editing their /sharedapps/kc4z/servers/kc4zServer/kc.properties file to replace the conf.path= “ /sharedapps/kc4z/data/conf” value with “ /global/kc4z/data/conf”.

After all post-installation configuration steps and upgrade actions are complete, each instance of the KC4z server (hkcsvr1) should be started according to the documented instructions in IBM Knowledge Center for z/OS Configuration and User Guide. Doing so causes the KC product content to be cached and indexed in each server configured runtime directory.

Reference information

For more information, see IBM Knowledge Center for z/OS Configuration and User Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12 : IBM z/OS Management Facility upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element IBM z/OS Management Facility (z/OSMF).


Step 4.12.1 : z/OSMF actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OSMF upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.12.1.1 : z/OSMF: Prepare for z/OSMF autostart


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, the base element z/OSMF is started by default at system IPL. This enhancement, which is referred to as z/OSMF autostart, means that z/OSMF is available for use as soon as the system is up.

For new z/OSMF installations, this change means that z/OSMF is active by default. The element is available for your use after you enable the required security authorizations. For existing z/OSMF installations, this change means that it is no longer necessary for you to explicitly start the z/OSMF server after each system IPL, whether through automation or operator commands entered manually at the console.

The autostart function introduces a set of upgrade actions that affect all z/OS installations. The upgrade actions are different, depending on whether your installation is new to z/OSMF or is already using this element. Installations that currently use z/OSMF meet most of the requirements already, and thus have fewer changes to make.

It is recommended that you perform the upgrade actions in three phases, as follows:

  1. Planning. To prepare for z/OSMF autostart, plan for how to deploy z/OSMF in your sysplex. For a sysplex, determine how many systems will run a z/OSMF server. Generally, it is sufficient to have one z/OSMF server active in a sysplex or monoplex, but you might choose to have more. A number of multi-system scenarios are supported. Deploying z/OSMF in a sysplex involves making updates to system libraries and your security management product, such as RACF. The planning considerations are described in "Steps to take."
  2. Security product updates. Your external security manager, such as RACF, requires a significant number of updates. The changes are needed to protect the resources that are used by z/OSMF, and to grant users access to the z/OSMF core functions. The steps are described in the workflow step "Create security authorizations for z/OSMF."
  3. System library updates. To accommodate z/OSMF autostart, you might need to modify settings in proclib and parmlib. The changes are needed to establish an autostart group for z/OSMF operations in your sysplex. The steps are described in the workflow step "Define one or more z/OSMF autostart groups."

If you choose not to have z/OSMF started automatically during IPL, you must explicitly disable the autostart function. Details for doing so are provided in "Steps to take."

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

The z/OSMF server requires a minimum of 4 GB of system memory to be configured. Otherwise, the server might fail to start, or some functions of z/OSMF might not be available.

Target system software requirements:

None.

The optional plug-ins of z/OSMF might require more software. See each plug-in for its requirements.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

If you disable z/OSMF autostart, none of the z/OSMF capabilities is available on your system until you start a z/OSMF server manually.

System impacts:

If this upgrade action is not followed, access failure messages result when the system attempts to start a z/OSMF server automatically. The messages describe required but missing SAF authorizations.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To prepare for z/OSMF autostart, follow the steps that are described in this section.

For ServerPac users, the ServerPac configuration process performs the upgrade actions that are needed to establish a base z/OSMF configuration on the target system. You can use the jobs and documentation in your ServerPac order to create an initial instance of z/OSMF on your z/OS V2R4 system.

Installations that install z/OSMF from a Custom-Built Product Delivery Option (CBPDO) software delivery package, or from a ServerPac order by using the software upgrade method of installation, must perform the steps that are described in this section. The upgrade actions are different, depending on whether your installation currently uses z/OSMF.

For a new z/OSMF installation :
  • Understand the functions and usage requirements of z/OSMF. See the IBM website z/OS Management Facility home page.
  • Ensure that the target system satisfies the minimum memory requirements. The z/OSMF server requires a minimum of 4 GB of system memory to be configured.
  • To make the best use of the z/OSMF autostart capability, plan to deploy one or more autostarted z/OSMF servers in your environment. Generally, having one z/OSMF server active in a sysplex or monoplex is sufficient, but you might choose to have more, based on your workload requirements. The goal is to ensure that at least one z/OSMF server is always active in your environment.

    For a monoplex, little or no planning is needed. The z/OSMF server is started when you IPL the system. Or, if you do not want to use the autostart capability, you can disable it, as described in the workflow step "Define one or more z/OSMF autostart groups."

    For a sysplex, more planning is required. You can choose to have one z/OSMF server autostart on a particular system and be used by the other systems in the sysplex. Or, you can select a subset of systems, or several subsets, and associate each subset with a specific z/OSMF server within an autostart group.

    The set of systems that is served by an autostarted server is known as the autostart group. z/OSMF includes one autostart group by default. To have more z/OSMF servers autostarted in a sysplex, you must associate each server—and the systems it serves—with a unique autostart group name.

    In your planning, you must decide:

    • What are the autostart groups in your sysplex.
    • Which systems autostart a z/OSMF server.
    • Which systems share the use of the autostarted server. These systems must be defined to the same autostart group as the system on which the autostarted server is running.

    Only one z/OSMF server can be active per autostart group in the sysplex. An autostarted z/OSMF server holds an enqueue on the z/OSMF user directory file system, and handles the z/OSMF requests from other systems that are connected to the same autostart group. Based on your planning, you can enable the desired number of z/OSMF autostart groups for your sysplex.

    Before installing z/OS V2R4, see the following publication for planning and setup considerations: IBM z/OS Management Facility Configuration Guide.

  • After you install z/OS V2R4, but before you IPL the system, complete the following upgrade actions:
    • Update your security management product, as described in the workflow step "Create security authorizations for z/OSMF." This action can be done before you install z/OS V2R4, if you add the authorizations to your security database manually, rather than by running the IBM-supplied job in the z/OSMF V2R4 level of SYS1.SAMPLIB (IZUSEC).
    • Update system libraries, as described in the workflow step "Define one or more z/OSMF autostart groups."
For an existing z/OSMF installation :
  • Review your plans for updating system libraries.
  • Review your plans for updating the security management product with your security administrator.
  • After you install z/OS V2R4, but before you IPL the system, you must complete the following workflow steps:
    • "Create security authorizations for z/OSMF." This action can be done before you install z/OS V2R4, if you add the authorizations to your security database manually, rather than by running the IBM-supplied job in SYS1.SAMPLIB (IZUSEC).
    • "Define one or more z/OSMF autostart groups."

If you prefer not to have z/OSMF started automatically during IPL: You can disable the autostart function. For instructions on disabling the autostart function, see the workflow step "Define one or more z/OSMF autostart groups."

If you disable autostart, be aware that the JES2 Email Delivery Services (EDS) function in z/OS requires an autostarted z/OSMF server to be up and running on at least one system in the sysplex. Otherwise, JES2 cannot send e-mail notifications to users who submit jobs. For information about configuring JES2 EDS, see the topic JES2 Email Delivery Services in z/OS JES2 Initialization and Tuning Guide.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.1.2 : z/OSMF: Establish security for cross-site z/OSMF REST requests


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OSMF includes a number of Representational State Transfer (REST) services, which are public APIs that an application can use to work with z/OS system resources and extract system data. The z/OSMF REST services are described in IBM z/OS Management Facility Programming Guide.

As of z/OS V2R3:

  • New HTTP custom header "X-CSRF-ZOSMF-HEADER" is required for all applications that issue cross-site requests to z/OSMF REST interfaces (both browser and non-browser applications). Further, for browser applications, the approved origin sites must be defined to your installation security "white list," as in previous releases.
  • z/OSMF server supports cross-origin resource sharing (CORS) in your enterprise. With this support, a web browser can issue REST requests to the z/OSMF server on your system without being automatically blocked as a potential cross-site request forgery (CSRF) attempt. To permit valid browser requests to the z/OSMF server, your installation must define the approved web browser origin sites to your installation security white list though your security manager, such as RACF.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If this upgrade action is not followed, valid browser requests to the z/OSMF server can be blocked as a potential cross-site request forgery (CSRF) attempts.

Related IBM Health Checker for z/OS check:

None.

Steps to take

z/OS V2R3 requires that you take the following actions to establish security for cross-site z/OSMF REST requests:

  1. Review your applications and identify those applications that use the z/OSMF REST services.
  2. For any applications that make cross-site requests to z/OSMF REST services, update the application by adding the following HTTP custom header to every cross-site request:
    X-CSRF-ZOSMF-HEADER
    This header can be set to any value or an empty string (""). This action is required for both browser and non-browser applications that issue cross-site REST requests to the z/OSMF server on your system.
  3. To enable REST calls from web browsers, create an exception by adding the browser origin sites to your installation's white list. An exception is required for every approved web browser application that is not running in the same host system and port as the target z/OSMF system. Non-browser applications, such as Java applications, require only the custom header (they do not require a "white list" definition).

    To create white list exceptions, work with your security administrator to create the appropriate authorizations in your z/OS security product. On a RACF system, for example, this work involves defining generic or discrete profiles for the remote sites in the ZMFAPLA class, and permitting the profiles to the z/OSMF REST interfaces.

    To define a profile for a remote site, use the following format:

    <SAF_PREFIX>.REST.<identifier>.<reversed-hostname>

    Where:

    • <SAF_PREFIX> is the SAF prefix for your z/OSMF configuration. By default, the prefix is IZUDFLT.
    • REST.<identifier> identifies the REST interface that is to be allowed for use by the remote site.

For the identifiers for each of the z/OSMF interfaces, see IBM z/OS Management Facility Programming Guide. To indicate all REST interfaces, specify an asterisk as the identifier.

Reference information

For more information, see IBM z/OS Management Facility Programming Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.1.3 : z/OSMF: Move the user directory from /var to /global


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

IBM recommends that you move the z/OSMF user directory (sometimes also called the z/OSMF data directory) from under /var/zosmf to /global/zosmf.

IBM previously recommended placing the z/OSMF user directory under /var/zosmf. IBM has changed the recommendation to /global/zosmf for the following reasons:

  • Make it easier for z/OSMF-based applications with sysplex scope to remain synchronized with sysplex-scoped data repositories, such as the RACF database and TCP/IP profile
  • Make it easier to move the z/OSMF server to different z/OS systems in a sysplex
  • Help simplify automatic recovery from LPAR or z/OSMF server failures.

With APAR PI92211, IBM changed the default z/OSMF user directory to reside under /global rather than /var.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3 with APAR PI92211.

Applies to upgrade from:

z/OS V2R3 without APAR PI92211 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

IBM recommends that you move the z/OSMF user directory (sometimes also called the z/OSMF data directory) from under /var/zosmf to /global/zosmf.

Follow these steps:

  1. Find the current mount point for the z/OSMF user directory (sometimes called the data directory). The mount point is specified in the following locations:
    • MOUNT command for the z/OSMF user directory in the BPXPRMxx parmlib member
    • On the USER_DIR statement of the IZUPRMxx parmlib member
    • On the USERDIR parameter of the EXEC statement in the IZUSVR1 started procedure
  2. If the mount point is not already set to /global/zosmf, do the following:
    1. Create the directory /global/zosmf. You can find the command that is needed to do that in the IZUMKFS job in the SYS1.SAMPLIB data set.
    2. In the following places, change the mount point for the z/OSMF user directory to /global/zosmf:
      • MOUNT command for the z/OSMF user directory in the BPXPRMxx parmlib member
      • USER_DIR statement of the IZUPRMxx parmlib member
      • USERDIR parameter of the EXEC statement in the IZUSVR1.
    3. Stop the z/OSMF server address space, IZUSVR1.
    4. Unmount the z/OSMF user directory from /var/zosmf
    5. Mount the z/OSMF user directory on /global/zosmf
    6. Change the home directory for the user ID used to start the server address space to /global/zosmf/data/home/izusvr. For RACF, use the ALTUSER command: ALTUSER userID OMVS(HOME(/global/zosmf/data/home/izusvr))

      If you used the IBM sample to define the user ID, change userID to IZUSVR.

    7. Restart the z/OSMF server address space.
Note:

If you use more than one z/OSMF server in a sysplex at the same time, ensure that each server uses a different user directory. For example, you might have two autostart groups that are named ZOSMFG1 and ZOSMFG2. In this case, create two different directories under /global named /global/zosmfg1/zosmf and /global/zosmfg2/zosmf, and use one for each active server.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.1.4 : z/OSMF: Prepare for the removal of the policy data import function of NCA


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release in which the Network Configuration Assistant (NCA) plug-in of z/OSMF supports the policy data import function. This function allows the user to import existing Policy Agent configuration files into the Network Configuration Assistant.

After z/OS V2R4, it will not be possible to import policy configuration files for AT-TLS, IPSec, PBR, and IDS technologies.

Import of TCP/IP profiles into Network Configuration Assistant is not affected.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

See IBM United States Software Announcement "IBM z/OS Version 2 Release 4" dated July 23, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because importing Policy Agent configuration files into Network Configuration Assistant will not be supported in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you plan to import Policy Agent configuration files into the Network Configuration Assistant, perform this work in the current release of z/OS. This function will not be supported in a future release.

Otherwise, you have no action to take.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.2 : z/OSMF actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OSMF upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.12.2.1 : z/OSMF: Accommodate the use of IBM z/OS Liberty Embedded


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3, z/OSMF is changed to use IBM WebSphere Liberty Embedded, which is a new base element of z/OS V2R3. In previous releases, z/OSMF used a version of WebSphere Liberty Profile that was supplied with z/OSMF.

Related to this change are the following changes to z/OSMF:

  • With the installation of APAR PI88651, you can use an alternative name for the z/OSMF angel process (a named angel) by coding the name on the ANGEL_PROC parameter in the IZUPRMxx member.
  • WebSphere Liberty Profile is removed from the z/OSMF file system.

During initialization, the z/OSMF server attempts to connect to an angel process, which provides authorized services to the z/OSMF server. By default, the z/OSMF angel process is IZUANG1, which is recommended for most z/OS installations. However, you might choose to use a specific named angel with the z/OSMF server. If so, you must ensure that name of the angel is defined to your system, as described in "Steps to take."

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3 with APAR PI88651.

Applies to upgrade from:

z/OS V2R3 without APAR PI88651 and z/OS V2R2.

Timing:

Before IPLing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Ensure that you are using the z/OS V2R3 level of the z/OSMF started procedures from your installed PROCLIB data set, as they are different from prior releases. The started procedures are IZUANG1, IZUSVR1, and IZUINSTP. If you customized these procedures in a previous release, you must apply your customizations to the new procedures.
  2. If your installation uses an autostarted z/OSMF server, the angel is started internally during system initialization. If you plan to use a named angel (not IZUANG1), you must ensure that name of the angel matches the name of its started procedure. To do so, specify the angel name on the ANGEL_PROC parameter in the IZUPRMxx member. This parameter indicates both the name of the angel and its started procedure.
  3. If your installation starts the z/OSMF server through another means, such by operator command or through automation, you must ensure that the specified angel name matches the name of the angel started procedure. You can specify the angel name on the NAME parameter of the START command: START IZUANG1,NAME=proc-name. Or, you can specify the angel name on the NAME parameter of the PROC statement of the IZUANG1 started procedure before you enter the command START IZUANG1.
  4. For a named angel, ensure that the following authorizations are done:
    • z/OSMF user and z/OSMF administrator security groups are authorized to the started procedure name.
    • z/OSMF server started task user ID is authorized to the angel name.
Reference information

For more information, see IBM z/OS Management Facility Configuration Guide and the following topics in IBM Knowledge Center:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.2.2 : z/OSMF: Update z/OSMF for the new minimum Java requirement


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, the z/OSMF server requires the following level of Java:

  • IBM 64-bit SDK for z/OS, Java Technology Edition, V8 SR4 FP10 (5655-DGH)

If your IZUPRMxx parmlib member specifies an earlier level of Java, you must update the JAVA_HOME statement in IZUPRMxx.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your z/OSMF configuration currently uses an earlier level of Java.

Target system hardware requirements:

None.

Target system software requirements:

IBM 64-bit SDK for z/OS, Java Technology Edition, V8 (5655-DGH).

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Install IBM 64-bit SDK for z/OS, Java Technology Edition, V8 SR4 FP10 (5655-DGH).

For a new z/OSMF installation:

  • By default, the SDK resides in the directory /usr/lpp/java/J8.0_64 on your system. If you install it in another location, be sure to specify the location on the JAVA_HOME statement in your IZUPRMxx parmlib member.

For an existing z/OSMF installation:

  • If the JAVA_HOME statement in member IZUPRMxx specifies an earlier version of Java, update the JAVA_HOME statement to refer to the directory /usr/lpp/java/J8.0_64 on your system.

Note: If you installed Java V8 in the default Java directory, you do not need to specify the JAVA_HOME statement in IZUPRMxx. If JAVA_HOME is not specified, the z/OSMF server searches for Java files in the directory /usr/lpp/java/J8.0_64.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.2.3 : z/OSMF: Create security authorizations for z/OSMF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To accommodate z/OSMF autostart, you must create the appropriate authorizations in your security management product, such as RACF. The changes are needed to protect the resources that are used by z/OSMF, and to grant users access to the z/OSMF core functions.

The RACF requirements are listed in "Appendix A" of IBM z/OS Management Facility Configuration Guide. Sample RACF commands for setting up security for z/OSMF are supplied by IBM in the z/OSMF V2R3 level of SYS1.SAMPLIB(IZUSEC).

A new z/OSMF installation must add all of these authorizations to its security management product. An existing z/OSMF installation has most of these authorizations already, and thus has fewer changes to make.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before IPLing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

z/OSMF plug-ins and applications require more security setup. For the required authorizations, see IBM z/OS Management Facility Configuration Guide.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If this upgrade action is not followed, access failure messages result when the system attempts to start a z/OSMF server automatically. The messages describe required, but missing SAF authorizations.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To prepare for z/OSMF autostart, follow the steps that are described in this section.

For ServerPac full system replacement users, the ServerPac installation process creates the required z/OSMF security authorizations in RACF for you. You can use the ServerPac supplied jobs and documentation as a model for another external security product if you desire.

Installations that install z/OSMF from a Custom-Built Product Delivery Option (CBPDO) software delivery package, or from a ServerPac order by using the software upgrade method of installation, must perform the steps that are described in this section. The upgrade actions are different, depending on whether your installation currently uses z/OSMF.

For a new z/OSMF installation :
  • After you install z/OS V2R3, but before you IPL the system, you must create the SAF authorizations that are described in Appendix A of IBM z/OS Management Facility Configuration Guide. This action can be done before you install z/OS V2R3, if you add the authorizations to your security database manually, rather than by running the IBM-supplied job in the z/OSMF V2R3 level of SYS1.SAMPLIB (IZUSEC).
For an existing z/OSMF installation :
  • After you install z/OS V2R3, but before you IPL the system, you must create the SAF authorizations that are described in Table 2. RACF sample commands for the SAF authorizations in this table are provided in the z/OS V2R3 level of SYS1.SAMPLIB(IZUSEC).
    Table 2. New security setup requirements for existing z/OSMF installations

    Resource class

    Resource name

    Who needs access?

    Type of access required

    Why

    FACILITY

    BPX.WLMSERVER

    z/OSMF server user ID (IZUSVR1, by default).

    READ

    Allows the z/OSMF server to use WLM functions to create and manage work requests.

    SERVAUTH

    CEA.SIGNAL.ENF83

    z/OSMF server user ID (IZUSVR1, by default).

    READ

    Allows the z/OSMF server to use signal code ENF83 to indicate its status to other systems in the sysplex.

    SERVAUTH

    EZB.INITSTACK. sysname.tcpname

    z/OSMF server user ID (IZUSVR1, by default).

    READ

    Allows the z/OSMF server to access the TCP/IP stack during TCP/IP initialization.

    This authorization is needed if the TCP/IP profile activates Application Transparent Transport Layer Security (AT-TLS).

    SERVER

    BBG.ANGEL.IZUANG1

    z/OSMF server user ID (IZUSVR1, by default).

    READ

    Allows the z/OSMF server to use z/OS authorized services.

    STARTED

    IZUINSTP.IZUINSTP

    z/OSMF administrator group (IZUADMIN)

    READ

    Defines the started task for the z/OSMF dependent address space, which is used to determine whether z/OS UNIX and TCP/IP are available.

    The job name must be IZUINSTP. Otherwise, the z/OSMF dependent address space is not initialized during z/OSMF autostart processing.

    ZMFAPLA

    <saf-prefix>

    .ZOSMF. VARIABLES.SYSTEM. ADMIN

    z/OSMF administrator group (IZUADMIN)

    READ

    Allows the user to access the system variables in the Systems task.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.2.4 : z/OSMF: Remove commands or code that starts the z/OSMF server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

>

Starting in z/OS V2R3, the z/OSMF server is started by default at system IPL. This enhancement, which is referred to as z/OSMF autostart, means that z/OSMF is available for use as soon as the system is up.

For existing users of z/OSMF, the z/OSMF autostart capability means that it is no longer necessary for your installation to explicitly start the z/OSMF server after each system IPL, whether through automation or commands entered manually at the operations console. As part of your migration to z/OS V2R3, remove any methods you use to automate the start of the z/OSMF server. Otherwise, error messages result if START commands are issued against already-started z/OSMF servers.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before IPLing z/OS V2R4.

Is the upgrade action required?

Yes, if you automated the starting of z/OSMF in some way.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Error messages are encountered when START commands are issued against already-started z/OSMF servers.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation does not start z/OSMF automatically, you have no upgrade action to take.

Otherwise, you must review and, if necessary, modify or remove any methods that you currently use for starting the z/OSMF server.

For example:

  • Ensure that no START commands are issued for the z/OSMF started procedures in the COMMNDxx parmlib member.
  • Ensure that the z/OSMF started procedure names are not listed in the AUTOLOG statement in the TCP/IP profile (PROFILE.TCPIP). By default, the procedures are named IZUANG1 and IZUSVR1.
  • Verify that your automation products do not start z/OSMF.

If you prefer not to have z/OSMF started automatically during IPL, you must explicitly disable the autostart function. For more information, see the workflow step called "Define one or more z/OSMF autostart groups."

Reference information

For more information, see IBM z/OS Management Facility Configuration Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.2.5 : z/OSMF: Define one or more z/OSMF autostart groups


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Based on the planning you did in the workflow step "Prepare for z/OSMF autostart," you can create the desired number of z/OSMF autostart groups in your sysplex. This work involves modifying settings in the system libraries, parmlib and proclib.

For any systems for which you do not want to have z/OSMF started automatically, you must explicitly disable the autostart function.

An overview of these actions is provided in "Steps to take."

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before IPLing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

The first system to IPL in the sysplex starts a primary instance of z/OSMF. All other systems default to using the primary instance.

If you disable z/OSMF autostart, none of the z/OSMF capabilities is available on that system, unless you manually start z/OSMF.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For an overview of the autostart capability and autostart groups, see IBM z/OS Management Facility Configuration Guide.

If one autostart group is sufficient for your sysplex, it is recommended that you allow your systems to use the default autostart group (IZUDFLT). Otherwise, you can define more autostart groups, as needed for your environment. Doing so involves creating one or more IZUPRMxx parmlib members, setting the system parameter IZU=, and customizing the IZUSVR1 started procedure.

For ServerPac installers, if you select the ServerPac full system replacement installation type, z/OSMF is configured through a ServerPac post-installation job, using IBM defaults. The default configuration includes the parmlib and proclib member setup that is described in the steps that follow. Therefore, if you use the parmlib and proclib members from ServerPac, you do not need to perform the following steps. However, you might want to review the ServerPac provided members to ensure that they contain suitable values for your installation, or modify them, as you require.

To perform the parmlib updates, follow these steps:

  1. Create an IZUPRMxx parmlib member with the following statements specified as required for your environment:
    AUTOSTART( LOCALCONNECT)
    Specifies the capability for autostarting the z/OSMF server on this system.
    • AUTOSTART(LOCAL) indicates that the system can autostart a z/OSMF server.
    • AUTOSTART(CONNECT) indicates that the system cannot autostart a z/OSMF server. Instead, the system uses the z/OSMF server on another system in the same autostart group.

    For a monoplex, specify AUTOSTART(LOCAL).

    By default, AUTOSTART is set to LOCAL.

    AUTOSTART_GROUP( IZUDFLT'nnnnnnnn')
    Assigns a name to the autostart group. z/OSMF includes one autostart group name by default (called IZUDFLT). To associate a group of systems with a different autostart group, ensure that the IZUPRMxx member for each system specifies the same value for AUTOSTART_GROUP.

    The name can consist of 1-32 alphanumeric characters (A-Z, a-z, 0-9) or special characters (#, $, or @). Alphabetic characters are case insensitive.

    By default, AUTOSTART_GROUP is set to IZUDFLT.

    SERVER_PROC(proc-name)
    Specifies the started procedure that is used to start the z/OSMF server on this system. It is recommended that you use the default started procedure, IZUSVR1, which should be adequate for most z/OS installations. If you specify an alternative procedure name, such as IZUSVR2, ensure that the z/OSMF user and z/OSMF administrator security groups are authorized to the started procedure name.

    The name can consist of 1 to eight alphanumeric characters (A-Z, a-z, 0-9) or special characters (#, $, or @). This value is not case-sensitive; lowercase alphabetic characters are folded to uppercase.

    By default, SERVER_PROC is set to IZUSVR1.

    ANGEL_PROC(proc-name)
    Specifies the started procedure that is used internally to start the z/OSMF angel process on this system. It is recommended that you use the default procedure, IZUANG1, which should be adequate for most z/OS installations. If you specify an alternative procedure name, ensure that the z/OSMF user and z/OSMF administrator security groups are authorized to the started procedure name.

    The name can consist of 1 to eight alphanumeric characters (A-Z, a-z, 0-9) or special characters (#, $, or @). This value is not case-sensitive; lowercase alphabetic characters are folded to uppercase.

    By default, ANGEL_PROC is set to IZUANG1.

  2. Ensure that the IZU= specification is coded to include the suffixes of the appropriate IZUPRMxx members for each system in your sysplex. You can specify up to 38 member suffixes on the IZU= parameter in your IEASYSxx member.

To perform the proclib updates, follow these steps:

  1. Ensure that you are using the z/OS V2R4 level of the z/OSMF started procedures from your installed PROCLIB data set, as they are different from prior releases. The started procedures are IZUANG1, IZUSVR1, and IZUINSTP.

    The IZUINSTP procedure was added in z/OS V2R3; it is used by the z/OSMF server for communicating with z/OS components. Install IZUINSTP, but do not modify it.

    Place the started procedures (IZUANG1, IZUSVR1, and IZUINSTP) in a data set that is in the IEFPDSI concatenation that is used by the system to find started procedures before the primary subsystem (JES) initializes. It is recommended that this data set is the same data set that is used by JES to find started procedures after JES initializes.

    For existing z/OSMF installations, if you have older levels of the started procedures IZUANG1 and IZUSVR1, you must remove them. Otherwise, the z/OSMF server might not start on a z/OS V2R4 system.

    Note:

    Another started procedure, IZUSVR2, is provided in SYS1.SAMPLIB. If you choose not to autostart the z/OSMF server, the IZUSVR2 procedure can be used for starting the z/OSMF server manually.

  2. Modify the started procedure for the z/OSMF server, IZUSVR1, to control its start-up behavior, as follows:
    • On the parameter SERVER, specify either AUTOSTART or STANDALONE, as follows:
      • Specify AUTOSTART to have the server started automatically.
      • Specify STANDALONE if you want to start the server manually by using the START command.
    • If you specify SERVER=AUTOSTART, you can specify one of the following values on the parameter IZUPRM:
      PREV
      Use the IZUPRMxx suffixes, if any were used by the previous instance of z/OSMF within the current IPL. IZUPRM='PREV' is used as the default in the standard IZUSVR1 procedure. IZUPRM='PREV' behaves like IZUPRM='SYSPARM' when the system encounters it during the initial IPL time (the first use of the IZUSVR1 procedure) because there is no previous instance of z/OSMF to use.

      This setting is not valid if the SERVER parameter is set to STANDALONE.

      SYSPARM
      Use the IZUPRMxx suffixes that are specified on the IZU system parameter in IEASYSxx.

      This setting is not valid if the SERVER parameter is set to STANDALONE.

      NONE
      To indicate that no IZUPRMxx members are read at server start-up.
      xx(xx,...,zz)
      Specify the specific suffixes for the IZUPRMxx parmlib member or members that you want the procedure to use. If you specify a suffix, the member must exist in your parmlib concatenation. Otherwise, the procedure cannot be started. Multiple suffixes must be enclosed in parentheses.

      The following syntax forms are valid:

      • IZUPRM=(xx,yy,...)
      • IZUPRM=xx
      • IZUPRM=NONE

      This setting is not valid if the SERVER parameter is set to STANDALONE.

      Note:

      The IZUPRMxx suffixes you specify, explicitly or implicitly, in the IZUPRM parameter of the procedure override any suffixes that are defined in the IZU system parameter in IEASYSxx.

If you prefer not to have z/OSMF started automatically during IPL:

You can disable the autostart function for one or more z/OS systems, as follows:

  • To prevent a z/OS system from autostarting the z/OSMF server, ensure that the system uses a IZUPRMxx member that specifies AUTOSTART(CONNECT). This setting causes the system to connect to the autostart group that is specified on the AUTOSTART_GROUP statement, rather than autostarting its own server.
  • To prevent a z/OS system from connecting to an autostart group, specify the name of a group on the AUTOSTART_GROUP parameter that is not used by any autostart server in the sysplex. For example, AUTOSTART_GROUP('NEVERUSED').
  • Similarly, for each system for which you want to disable z/OSMF autostart, ensure that the AUTOSTART(CONNECT) and AUTOSTART_GROUP('NEVERUSED') settings are in effect.
  • In your IZU= specifications, verify that the IZU= parameter identifies the suffixes of the IZUPRMxx members that contain the desired settings.

If you disable autostart on a z/OS system, be aware that the JES2 Email Delivery Services (EDS) function in z/OS does not operate on that system with full function until you enable the z/OSMF autostart function, or allow the system to connect to a valid autostart group. Otherwise, JES2 cannot send e-mail notifications to users who submit jobs. For information about configuring JES2 EDS, see the topic JES2 Email Delivery Services in z/OS JES2 Initialization and Tuning Guide.

Note: Changing an AUTOSTART_GROUP name requires an IPL. You cannot change this option with a stop and restart of the z/OSMF server.

Reference information

For more information, see IBM z/OS Management Facility Configuration Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.3 : z/OSMF actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OSMF upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.12.3.1 : z/OSMF: Remove STGADMIN SAF authorization requirements for Software Management


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The z/OSMF Software Management plug-in can be used to manage the z/OS software inventory, deploy SMP/E packaged and installed software, and generate reports about your software.

With the installation of APAR PH26509 on your z/OS V2R3 or z/OS V2R2 system, it is recommended that you remove several SAF authorizations for the z/OSMF Software Management plug-in because they are no longer needed.

z/OSMF Software Management uses the services of DFSMSdss program ADRDSSU to copy, dump, and restore data sets during Software Management Deploy (Install) and Export actions. Currently Software Mangement uses the following COPY/DUMP/RESTORE options which require authorization to STGADMIN SAF FACILITY class resources:

  • BYPASSACS
  • IMPORT
  • TOLERATE(ENQFAILURE)

Because of the above options authorization is required to the following SAF FACILITY class resources to execute JCL generated by z/OSMF Software Management for Deploy (Install) and Export actions:

  • STGADMIN.ADR.COPY.BYPASSACS
  • STGADMIN.ADR.COPY.TOLERATE.ENQF
  • STGADMIN.ADR.DUMP.TOLERATE.ENQF
  • STGADMIN.ADR.RESTORE.BYPASSACS
  • STGADMIN.ADR.RESTORE.IMPORT
  • STGADMIN.ADR.RESTORE.TOLERATE.ENQF

Authorization to the above STGADMIN SAF resources are an uneccessary burden to the average user installing software using z/OSMF Software Management.  Therefore, z/OSMF Software Management is being updated to no longer use the BYPASSACS, IMPORT, and TOLERATE(ENQFAILURE) operands on the COPY, DUMP, and RESTORE commands for DFSMSdss program ADRDSSU. Hence, authorization to the above SAF FACILITY class resources will no longer be required by z/OSMF Software Management.

A consequence of removing the IMPORT operand on RESTORE operations is that users who install software using z/OSMF Software Management will require READ access to the originating data set names in the portable software instance being installed (the names of the data sets that are dumped when producing the portable software instance).

For IBM software, users require READ access to the data set names that are used by IBM during the creation of the ServerPac portable software instance. Specifically, your user ID requires READ access to data set names that begin with CB.OS* and CB.ST*.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R3 and z/OS V2R2, with APAR PH26509 installed.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, without APAR PH26509 installed.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended to remove the unnecessary SAF authorizations. However, one new SAF resource is required, as described in "Steps to take."

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Verify that APAR PH26509 is installed on your system. If so, the identified STGADMIN SAF resources are no longer required for running the JCL that is generated by z/OSMF Software Management. To see the service level of the Software Management plug-in, check the z/OSMF server "About page." Verify that APAR PH26509 is installed.

In your RACF database, check for authorization for z/OSMF Software Management users to any of the following SAF FACILITY class resources:

  • STGADMIN.ADR.COPY.BYPASSACS
  • STGADMIN.ADR.COPY.TOLERATE.ENQF
  • STGADMIN.ADR.DUMP.TOLERATE.ENQF
  • STGADMIN.ADR.RESTORE.BYPASSACS
  • STGADMIN.ADR.RESTORE.IMPORT
  • STGADMIN.ADR.RESTORE.TOLERATE.ENQF

If a user is authorized to any of the these SAF FACILITY class resources solely for the purposes of installing software using z/OSMF Software Management, then authorization to these resources may be removed.

In addition, to install software provided by IBM or another vendor using z/OSMF Software Management, users will require READ access to the originating data set names used by the vendor when producing the software order. That is, READ access is required to access the data sets in the Software Instance that is exported to create a Portable Software Instance.

IBM uses a single and consistent data set name prefix when producing Portable Software Instances to be installed by z/OSMF Software Management. This practice reduces the data set name variations a z/OSMF Software Management user must be authorized to READ in order to install software provided by IBM. Specifically, your user ID requires READ access to data set names that begin with CB.OS* and CB.ST*.

As an example, consider the order number CB.OSnnnnnn, where "nnnnnn" is a unique order number assigned to the customer's requested software content, such as CT.OT246095.SYS1.LINKLIB. Therefore, users will require READ access to SAF resources for data set names of the form CB.OS*.**.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.3.2 : z/OSMF: Use the Diagnostic Assistant to collect diagnostic data about z/OSMF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

APAR PH18776 removes the diagnostics page from the z/OSMF General Settings task. The diagnostic page is made obsolete with the addtion of the new z/OSMF Diagnostic Assistant, which is added by APAR PH11606. The new plug-in provides additional functions for collecting diagnostic data that were not availabe in the older diagnostics page.

Using the z/OSMF Diagnostic Assistant might require you to create user authorizations in your external security manager (ESM). This workflow step includes a sample RACF definition that you can use as a model for creating the user authorizations.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R3 and z/OS V2R2, with APAR PH18776 installed.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, without APAR PH18776 installed.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if users want to use collect diagnostic information about z/OSMF.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Verify that APARs PH18776 and PH11606 are installed on your system. If so, the z/OSMF Diagnostic Assistant is available and the older diagnostic page is removed from General Settings. To see the service level of the z/OSMF plug-ins, check the z/OSMF server "About page." Verify that APARs PH18776 and PH11606 are installed.

In your external security manager, create the authorizations for users of the z/OSMF Diagnostic Assistant task. The following example shows sample RACF statements for defining the resource profile and granting authorization to the z/OSMF administrators group (IZUADMIN):

RDEFINE ZMFAPLA IZUDFLT.ZOSMF.ADMINTASKS.DIAGNOSTIC_ASSISTANT UACC(NONE)PERMIT IZUDFLT.ZOSMF.ADMINTASKS.DIAGNOSTIC_ASSISTANT CLASS(ZMFAPLA) ID(IZUADMIN) ACCESS(READ)SETROPTS RACLIST(ZMFAPLA) REFRESH

Reference information

For information about the z/OSMF Diagnostic Assistant, see the online help that is included with z/OSMF.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.3.3 : z/OSMF: Ensure that workflow users are authorized to read workflow files


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

With the installation of APAR PH14511, the workflow user requires at least READ access to the workflow definition file and any related files that are needed to create a z/OSMF workflow. Previously, the workflow user could use files that could be read by the z/OSMF server identity.

To enhance the access control of files, the workflow user cannot create workflows from files that can be read only by the z/OSMF server identity.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R4 and z/OS V2R3, with APAR PH14511 applied.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, without APAR PH14511 applied..

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if users create workflows without specific user ID authorization to workflow files.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Users cannot create z/OSMF workflows if they lack READ access to the workflow files.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For users who create z/OSMF workflows, ensure that the related z/OS user IDs have READ access to the workflow definition file, the optional workflow input variable file, and other required workflow files.

Reference information

For information about creating z/OSMF workflow files, see IBM z/OS Management Facility Programming Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.3.4 : z/OSMF: Remove references to z/OSMF mobile notification service


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 removes support for z/OSMF mobile notification service. The other z/OSMF notification services, including the Notifications task and the email notification services remain available, and can be used in place of the mobile notification service.

Specifically, the following functions are removed from z/OSMF:

  • In the z/OSMF graphical user interface (GUI), the following pages are removed from the Notification Settings task:
    • Mobile Configuration page
    • z/OSMF mobile application entry in the User page

  • REST API that was used for z/OSMF mobile notifications:
    POST /zosmf/notifications/new

  • The following request body properties are removed from the z/OSMF notifications REST API:
    • "product”
    • “eventGroup”
    • “data”
    • “alert”

The change is related to the removal of the IBM zEvent mobile application and the Bluemix based push services.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS v2r4.

Is the upgrade action required?

Yes, if you use the z/OSMF mobile notification service.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

The following message is issued if a user or program attempts to use the z/OSMF mobile notification service on a z/OS V2R4 system:
IZUG608E: Notification property \"assignees\" is missing, or its value \"null\" is incorrect.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether any of your users or programs use the z/OSMF mobile notification service. If so, use the z/OSMF Notifications task or the z/OSMF email notification service as a replacement.

Reference information

For information about the z/OSMF notifications REST API, see IBM z/OS Management Facility Programming Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.12.3.5 : z/OSMF: Configure the optional services


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OSMF, a service is a collection of one or more system management tasks and REST APIs that add function to z/OSMF. When you configure a service, you make its tasks available to z/OSMF users.

Terminology Note:

In previous releases of z/OSMF, the z/OSMF services were referred to as z/OSMF plug-ins.

Depending on your operational goal, z/OSMF can be configured with various combinations of core and optional services. If your installation does not already use any of the z/OSMF optional services, it is recommended (not required) that you enable one or more of the following services:

  • Capacity Provisioning
  • Incident Log
  • ISPF
  • Network Configuration Assistant for z/OS Communications Server
  • Resource Monitoring
  • Software Management
  • Sysplex Management
  • Workload Management.

By default, z/OSMF does not include any of the z/OSMF optional services.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OSMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended if you want to extend the functional capabilities of z/OSMF.

Target system hardware requirements:

The z/OSMF server requires a minimum of 4 GB of system memory to be configured. Otherwise, the server might fail to start, or some functions of z/OSMF might not be available.

Target system software requirements:

The optional services of z/OSMF might require more software. See each service for its requirements.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If do you not configure the optional services, only the z/OSMF core functions are enabled by default, such as Workflows and the Workflow Editor.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation does not already use the z/OSMF optional services, choose one or more of the services to enable. Your decision on which services to enable depends in part on your installation's readiness to perform the various z/OS system customizations that are associated with each service. When you are planning for the services, review the system setup requirements for each service, as described in IBM z/OS Management Facility Configuration Guide.

Reference information

For more information, see IBM z/OS Management Facility Configuration Guide

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13 : Infoprint Server upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for optional feature Infoprint Server.


Step 4.13.1 : Infoprint Server actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Infoprint Server upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.13.1.1 : Infoprint: Upgrade web browser support for Infoprint Central


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the Infoprint Central component of Infoprint Server requires one of these web browsers:

  • Microsoft Internet Explorer 11.0
  • Microsoft Edge 40.15063 or later
  • Mozilla Firefox 52.0 Extended Support Release (ESR) or later

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use Infoprint Central.

Target system hardware requirements:

None.

Target system software requirements:

If you use Infoprint Central to work with IP PrintWay extended mode print jobs and printers, you need:

  • IBM HTTP Server - Powered by Apache base element of z/OS
  • The XML Toolkit for z/OS V1.10 (5655-J51)
  • One of these Java products:
    • IBM 31-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W43) or V8 (5655-DGG)
    • IBM 64-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W44) or V8 (5655-DGH)
  • One of the following web browsers on workstations with these tested operating systems:
    Windows 7 Professional, Windows 8.1, and Windows Server 2012
    • Microsoft Internet Explorer 11.0
    • Mozilla Firefox 52.0 Extended Support Release (ESR) or later
    Windows 10
    • Microsoft Internet Explorer 11.0
    • Microsoft Edge 40.15063 or later
    • Mozilla Firefox 52.0 Extended Support Release (ESR) or later

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Other browsers might work with Infoprint Central V2R4, but are not tested. Using untested browsers might result in some Infoprint Central functions that are unavailable.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Install one of these web browsers on a tested operating system (see "Target system software requirements" in the preceding table):

  • Microsoft Internet Explorer 11.0
  • Microsoft Edge 40.15063 or later
  • Mozilla Firefox 52.0 Extended Support Release (ESR) or later

Reference information

For more information, see z/OS Infoprint Server Operation and Administration, which describes how to start and stop Infoprint Server and how to use Infoprint Central.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13.1.2 : Infoprint: Upgrade Java support for IPP Server and Infoprint Central


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, the Internet Printing Protocol (IPP) Server that is used in Infoprint Server and Infoprint Central requires Java V7.1 or Java V8. If the JAVA_HOME environment variable specifies the location of an earlier version of Java than what you are using, you must update the JAVA_HOME environment variable.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use IPP Server or Infoprint Central and specify the JAVA_HOME environment variable. You are using IPP Server if start-daemons={ippd} is specified in the Infoprint Server configuration file. You are using Infoprint Central if the start-daemons={ssid} attribute is specified in the Infoprint Server configuration file. The configuration file's default location is /etc/Printsrv/aopd.conf. However, you might have specified a different location in environment variable AOPCONF.

Target system hardware requirements:

None.

Target system software requirements:

IBM 31-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W43) or V8 (5655-DGG); Infoprint Central can also use IBM 64-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W44) or V8 (5655-DGH).

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Install one of these:
    • IBM 31-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W43) or V8 (5655-DGG)
    • IBM 64-bit SDK for z/OS, Java Technology Edition, V7.1 (5655-W44) or V8 (5655-DGH)

    IPP Server requires the 31-bit version of Java V7.1 or V8.

  2. Do these to set the JAVA_HOME environment variable to /usr/lpp/java/J7.1, /usr/lpp/java/J8, or wherever you installed the Java release:
    • If you use the IPP Server, edit the aopstart EXEC or the aopdemon environment variables file.
    • If you use Infoprint Central, edit the HTTP server environment variables file (bin/envvars).

    Note: If you installed Java V7.1 or V8 in the default Java directories, you do not need to specify the JAVA_HOME environment variable. If JAVA_HOME is not specified, IPP Server or Infoprint Central looks for Java files in the /usr/lpp/java/J7.1 or /usr/lpp/java/J8 directory.

Reference information

For more information, see the following references:

  • For information about editing the aopstart EXEC, the aopdemon environment variables file, or the HTTP server environment variables file, see z/OS Infoprint Server Customization.
  • For information about Java products, see the Java Standard Edition Products on z/OS page at z/OS Java home page.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13.1.3 : Infoprint: Prepare for dynamic configuration


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In Infoprint Server for z/OS V2R4, dynamic configuration is always enabled.

Advantages of dynamic configuration include the following:

  • Authorized administrators can use the Infoprint Server ISPF panels or the Printer Inventory Definition Utility (PIDU) to view and change the dynamic attributes rather than editing the file /etc./Printsrv/aopd.conf
  • If you change an attribute in the system configuration definition, with a few exceptions, you do not need to stop and restart Infoprint Server for the change to take effect.
  • You can configure Infoprint Server to start and stop individual daemons.
  • You can benefit from new functions in Infoprint Server that require dynamic configuration. For example, you can use the MVS system logger function.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Infoprint Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether dynamic configuration is enabled on your system, use the following health check: IBMINFOPRINT,ZOSMIGV2R3_NEXT_INFOPRINT_DYNCFG

This check applies to both z/OS V2R3 and z/OS V2R2.

Steps to take

Follow the instructions in the workflow step "Using IBM Health Checker for z/OS for migration checking" to install and activate ZOSMIGV2R3_NEXT_INFOPRINT_DYNCFG.

Reference information

None.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMINFOPRINT,ZOSMIGV2R3_NEXT_INFOPRINT_DYNCFG.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".

This check applies to both z/OS V2R3 and z/OS V2R2.


Step 4.13.2 : Infoprint Server actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Infoprint Server upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.13.2.1 : Infoprint: Remount the Printer Inventory and copy files that were customized


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

When you migrate to the latest z/OS system, you must bring forward the customized data from your previous system.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Do the following:

aopstart EXEC
If you modified the aopstart EXEC, copy it to the z/OS V2R4 system.
Configuration file
If you are using the ServerPac Full System Replace option and you modified the Infoprint Server configuration file, copy the file to the z/OS V2R4 system. Its default location is /etc/Printsrv/aopd.conf. However, you might have specified a different location in environment variable AOPCONF.
  • If your previous installation used dynamic configuration, all attributes except these are ignored before and after this upgrade:
    • base-directory
    • inventory
    • jes-name
    • resolve-printway-printers
    • start-daemons
    • xcf-group-qualifier
  • If your previous installation did not use dynamic configuration, all attributes except the ones listed are converted to attributes in the system configuration definition when Infoprint Server V2R4 starts for the first time and ignored afterward.
Infoprint Central
If you are migrating from z/OS V2R2, and you are customizing the new script bin/envvars for IBM HTTP Server - Powered by Apache, you might want to refer to the old z/OS HTTP Server environment variables file as a reference. By default, the file was located in /etc/httpd.envvars.
IP PrintWay
If you currently use the IP PrintWay component of Infoprint Server, copy to the z/OS V2R4 system any IP PrintWay exit routines and data stream filters that you wrote. It is a good practice to recompile the exits and filters on z/OS V2R4.
NetSpool
If you currently use the NetSpool component of Infoprint Server, copy to the z/OS V2R4 system any NetSpool exit routines that you wrote. It is a good practice to recompile the exits and filters on z/OS V2R4.
Printer Inventory
  • Remount the /var/Printsrv directory from the earlier system on the z/OS V2R4 system. The /var/Printsrv directory contains the Printer Inventory and other Infoprint Server files. The default directory is /var/Printsrv. However, you might have changed the directory name in the base-directory attribute in the aopd.conf configuration file. Notes:
    1. After you start Infoprint Server on the z/OS system, you need to use the Infoprint Server pidu command to export the Printer Inventory on the z/OS V2R4 system so that you have a backup of the Printer Inventory.
    2. If /var/Printsrv is not mounted at a separate mount point, use the Infoprint Server pidu command to export the Printer Inventory on the original system; restore it on the z/OS V2R4 system after the first IPL. Do not use other copy commands to copy the Printer Inventory. (Mounting /var/Printsrv at a separate mount point can result in better management of disk space and easier migration.)
  • Configure the Infoprint Server environment variables (for example, AOPCONF, PATH, LIBPATH, NLSPATH, MANPATH) in /etc/profile.
Print Interface
If you currently use the Print Interface component of Infoprint Server, do these:
  • If you wrote any data stream filters, copy them to the z/OS V2R4 system. It is a good practice to recompile the exits and filters on z/OS V2R4.
  • If you run the SAP R/3 application server on the z/OS system, copy the SAP callback daemon configuration file to the z/OS V2R4 system. Its default location is /etc/Printsrv/aopsapd.conf. However, you might have specified a different location in environment variable AOPSAPD_CONF.

Reference information

For more information, see z/OS Infoprint Server Customization.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13.2.2 : Infoprint: Infoprint Central requires SSL connections by default


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R4, SSL connection is required by default for the Infoprint Central web browser GUI. In previous releases, the GUI worked with or without SSL.

This change requires your installation to specify enabled SSL for your IBM HTTP Server (IHS) powered by Apache 31-bit configuration. Doing so causes the httpd.conf.updates file to be updated with a rewrite directive that converts the HTTP links to HTTPS links. This action saves users from having to update their Infoprint Central bookmarks.

For users who do not want to change their IHS configurations to use SSL, an Infoprint Server configuration attribute and new ISPF field are provided. The new option has an attribute name of use-unencrypted-connection and an ISPF panel field name of “Use unencrypted connection.” Note that this connection type is less secure than HTTPS.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you are running Infoprint Central.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

The following health checks are provided by IBM:

  • IBMINFOPRINT, ZOSMIGV2R3_NEXT_INFOPRINT_IPCSSL.

    This check is intended for z/OS V2R2 and V2R3 systems. It indicates whether Infoprint Central uses SSL by default. You are prompted to set up SSL before upgrading to z/OS V2R4. If SSL is being used already, this check issues a message to confirm that this action is completed.

    This check issues the following exception messages:

    • AOPH1905I
    • AOPH1906E
  • IBMINFOPRINT, INFOPRINT_CENTRAL_SECURE_MODE.

    This best practice health check is intended for z/OS V2R4 and later. It is issued during the initialization of Infoprint Central and warns you to use an SSL connection for Infoprint Central to prevent security exposures. If SSL is already in use, this check issues a message to confirm that this upgrade action is completed.

    This check issues the following exception messages:

    • AOPH1907I
    • AOPH1908E

Steps to take

If SSL is not enabled in IHS and you are using Infoprint Central, follow these instructions.

To use an SSL connection for Infoprint Central, do the following:

  1. Follow the instructions to enable SSL in IBM HTTP Server on z/OS Migrating from Domino-powered to Apache-powered, which is available online: http://www.redbooks.ibm.com/redpapers/pdfs/redp4987.pdf.
  2. Uncomment the Rewrite directive in the httpd.conf.updates file provided by Infoprint Server before copying the Infoprint Central directives to the httpd.conf file.
  3. Test an Infoprint Central link or bookmark to ensure that Infoprint Central loads in the browser.

If you need to use an unencrypted connection, do the following:

  1. Use the Infoprint Server System Configuration ISPF panel or PIDU to set the use-unencrypted-connection attribute to yes in the printer inventory.
  2. Test an Infoprint Central link or bookmark to ensure that Infoprint Central loads in the browser.

Reference information

For more information, see the security chapter in IBM HTTP Server on z/OS Migrating from Domino-powered to Apache-powered, which is available online: http://www.redbooks.ibm.com/redpapers/pdfs/redp4987.pdf.

Instructions:

This portion of the Workflow will guide you in submitting jobs to run two IBM Health Checks that are associated with this upgrade action, IBMINFOPRINT,ZOSMIGV2R3_NEXT_INFOPRINT_IPCSSL and IBMINFOPRINT, INFOPRINT_CENTRAL_SECURE_MODE.

These checks will be activated if they are not already active. If the checks are activated, they will be deactivated at the end of the jobs. The checks will remain in the same state as they were found.

If the health checks run with no exceptions, this step will be marked "Complete" indicating that this upgrade action requires no further activity.

If either of the health checks find an exception, this step will be marked as "Failed". If so, further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output using any method that you use to view health check output, such as SDSF. Correct any situation, as appropriate. Then repeat this Workflow step to submit the health check jobs again, until the health checks no longer receive exceptions and the step is marked "Complete".


Step 4.13.3 : Infoprint Server actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Infoprint Server upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.13.3.1 : Infoprint: Configure Infoprint Server to use the sendmail to CSSMTP bridge


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, the sendmail program that IP PrintWay used with z/OS Communications Server is replaced with a sendmail bridge that uses Communications Server SMTP (CSSMTP) as the mail transport. If you use email printer definitions in Infoprint Server, you must configure Infoprint Server to use the sendmail to CSSMTP bridge.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use email printer definitions in Infoprint Server.

Target system hardware requirements:

None.

Target system software requirements:

Communications Server SMTP (CSSMTP) server.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

The sendmail bridge does not support these functions:

  • Email delivery to local TSO and UNIX System Services mailboxes. You must use a non-IBM product to do this function.
  • New alias files to be used with the sendmail bridge; only existing alias files are supported.
  • The –m option on the lp command.

Only a limited number of options are supported by the mailer-options system configuration attribute or AOPMAILER_OPTIONS environment variable that the sendmail bridge uses.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To configure Infoprint Server to use the sendmail to CSSMTP bridge, see Mail on z/OS in z/OS Communications Server: IP Configuration Guide and SMTP server in z/OS Communications Server: IP Configuration Reference.

Reference information

For information about using the sendmail bridge in Infoprint Server, see z/OS Infoprint Server Operation and Administration.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13.3.2 : Infoprint: Run aopsetup


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

When upgrading to z/OS V2R4, you must run the aopsetup shell script to establish the correct file permissions for Infoprint Server directories and files.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Run the aopsetup shell script from an rlogin shell, from an OMVS session, or with the BPXBATCH command. Specify the names of the RACF groups that you defined for Infoprint Server operators and administrators as arguments to aopsetup. For example, if you defined group AOPOPER for operators and group AOPADMIN for administrators, enter:

/usr/lpp/Printsrv/bin/aopsetup AOPOPER AOPADMIN

Rule: You must run aopsetup from a user ID with a UID of 0. You can use the su command to switch to an effective UID of 0 if you have READ access to the BPX.SUPERUSER profile in the RACF FACILITY class.

Tip: You can run aopsetup from the driving system (instead of the target system) if all of these are true:

  • You have the target system /var/Printsrv directory accessible.
  • You reference the target system /usr/lpp/Printsrv directory mounted under a /service directory as described in the comments at the beginning of the aopsetup shell script.
  • The RACF database groups for operators and administrators are the same on the driving and target system.

Reference information

For information about running aopsetup, see z/OS Infoprint Server Customization.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.13.3.3 : Infoprint: Edit the aopd.conf file


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R4, the attributes in the Infoprint Server configuration file are ignored, with the exception of the following attributes:

  • base-directory
  • inventory
  • jes-name
  • resolve-printway-printers
  • start-daemons
  • xcf-group-qualifier

Equivalent attributes in the system configuration definition are used instead. To avoid confusion, edit the Infoprint Server configuration file to remove the ignored attributes. The default location of this file is /etc/Printsrv/aopd.conf. However, you might have specified a different location in environment variable AOPCONF.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Infoprint Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

No.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Use a text editor to remove the ignored attributes from aopd.conf.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.14 : Integrated Security Services upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element Integrated Security Services, which is comprised of the following components:

  • Enterprise Identity Mapping (EIM)
  • Network Authentication Service
  • Open Cryptographic Services Facility (OCSF).


Step 4.14.1 : Integrated Security Services actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Integrated Security Services upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.14.2 : Integrated Security Services actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Integrated Security Services upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.14.2.1 : z/OS Network Authentication Service (Kerberos) requires ICSF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Before z/OS V2R3, the Network Authentication Service (Kerberos) did not require ICSF to perform encryption, decryption, and hashing. The product had both its own software implementation of the encrypt/decrypt/hashing functions and a hardware implementation through calls to ICSF CCA callable services. Starting with z/OS V2R3, Kerberos is removing the software implementation of encrypt/decrypt and some of the hashing functions and replacing with calls to ICSF PKCS#11 callable services. Kerberos calls ICSF CCA callable services to encrypt/decrypt/hash when not running in FIPS mode, and calls ICSF PKCS#11 callable services for encrypt/decrypt/hashing when running in FIPS mode.

This change allows Network Authentication Service to run with FIPS evaluated cryptographic functions and remove the need to maintain multiple implementations of the cryptographic functions on the platform. As a result of this change, ICSF is required to be running before any Kerberos components or applications are run on the z/OS system. Also, the default encryption and checksum (hash) types used when not explicitly set in the Kerberos configuration files are changed from weak and non-collision proof types to stronger, more secure types.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Network Authentication Service

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you do not already have ICSF active.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Ensure that ICSF is started and completes initialization before starting the z/OS KDC or any application that is enabled for Kerberos on the system. ICSF needs to be running during use of all Kerberos functions. (KDC, application servers, application clients, commands, and utilities).
  2. If the CSFSERV class is active, ensure the z/OS KDC user ID and all user IDs that use Kerberos commands or applications that are enabled for Kerberos that are running on z/OS systems have READ access to the following ICSF resources:
    • When FIPS is enabled:
      CSFRNG, CSFOWH, CSF1TRC, CSF1TRD, CSF1SKD and CSF1SKE
    • When FIPS is not enabled:
      CSFRNG and CSFOWH
  3. The default KDC ticket encryption types are changed from weak DES encryption types to more secure encryption types (AES and DES3). If the former default encryption types are to continue to be used, they must be explicitly set in the z/OS KDC environment variable file (/etc/skrb/home/kdc/envar by default) by specifying:
    SKDC_TKT_ENCTYPES=des-cbc-crc
  4. The runtime environment variable _EUV_HW_CRYPTO no longer has any meaning since ICSF PKCS#11 services now make the determination whether cryptographic hardware is available and is used. Therefore, its use is deprecated.
  5. The default encryption types for Kerberos commands and applications are changed from weak DES encryption types to more secure encryption types (AES and DES3). If the former default encryption types are to continue to be used, they must be set explicitly in the Kerberos configuration files (/etc/skrb/krb5.conf by default) by specifying:
    default_tgs_enctypes = des-cbc-crc,des-cbc-md5 default_tkt_enctypes = des-cbc-crc,des-cbc-md5
  6. The default checksum types for Kerberos commands and applications are changed from weak checksum types to more secure checksum types. If the former defaults values are to continue to be used, they must be set explicitly in the Kerberos configuration files (/etc/skrb/krb5.conf by default) by specifying:
    ap_req_checksum_type = rsa-md5 kdc_req_checksum_type = rsa-md5 safe_checksum_type = rsa-md5-des
Reference information

For more information, see z/OS Integrated Security Services Network Authentication Service Administration and z/OS Integrated Security Services Network Authentication Service Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.14.2.2 : Network Authentication Service: RACF Kerberos password settings and changing requires ICSF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The RACF database can be used by the Network Authentication Service as the database for Kerberos user principals, the Ticket Granting Service (TGS), and foreign realm definitions. When the RACF database is used by Network Authentication Service, RACF commands are used to administer Kerberos principals. Kerberos principals and the TGS must maintain a set of encryption keys that are based on or derived from a password. These keys are used to encrypt and decrypt information that is sent over a network to ensure the security and privacy of the information.

When a user who has been defined to contain Kerberos information changes their password, a Network Authentication Service API is called from the RACF password change logic to generate a new set of encryption keys that are based on or derived from the new password. The local and foreign Kerberos realm definitions are similar to user profiles because they also maintain a set of encryption keys that are based on or derived from a password that is associated with the REALM class profile.

Starting with z/OS V2R3, the Network Authentication Service component is updated to use the ICSF CSFBOWH function in the key generation process. Due to this requirement:

  1. ICSF must be started and initialization complete prior to changing the password of a user that has a KERB segment or changing a password for a REALM class profile.
  2. If the CSFSERV class is active and a protection profile exists for the CSFOWH resource (which protects the CSFBOWH function), READ access is required to this resource. An alternative to permitting access to the CSFOWH resource, the authorization checks for the CSFOWH resource can be disabled by defining the CSF.CSFSERV.AUTH.CSFOWH.DISABLE resource profile in the XFACILIT class.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS Network Authentication Service (Kerberos)

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you do not already have ICSF active.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Determine whether Kerberos profiles are in use on your z/OS system. Check for the following indications:
    • RACF REALM class is defined and has profiles
    • User IDs are defined with KERB segments.
  2. Update and run this sample job to identify which users have a KERB segment:
    // JOB CARD ... //***************************************************************** //* FIRST, USE IRRDBU00 (DB UNLOAD) ON A NON-LIVE BACKUP COPY //* OF THE RACF DATABASE. IF THE RACF DATABASE IS SPLIT INTO //* MULTIPLE DATA SET, ADD AN ADDITIONAL INDDn FOR EACH DATA SET. //* UPDATE THE SPACE FOR THE OUTDD BASED ON THE SIZE OF YOUR //* INPUT RACF DATABASE. //***************************************************************** //DBUNLOAD EXEC PGM=IRRDBU00,PARM=NOLOCKINPUT //SYSPRINT DD SYSOUT=* //INDD1 DD DISP=SHR,DSN=SYS1.RACF.BACKUP.D2016266 //OUTDD DD DISP=(NEW,PASS),DSN=&&RACFFLAT,SPACE=(CYL,(10,5)), // UNIT=SYSALLDA,DCB=(RECFM=VB,LRECL=4096,BLKSIZE=27998) //***************************************************************** //* THEN RUN ICETOOL (DFSORT) AGAINST THE UNLOADED RACF DB //* OF THE RACF DATABASE. //***************************************************************** //DFSORT EXEC PGM=ICETOOL,PARM='MSGPRT=ALL' //TOOLMSG DD SYSOUT=* //PRINT DD SYSOUT=* //DFSMSG DD SYSOUT=* //DBUDATA DD DSN=*.DBUNLOAD.OUTDD,DISP=(OLD,DELETE) //TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(CYL,(20,5,0)), // UNIT=SYSALLDA //TOOLIN DD * SORT FROM(DBUDATA) TO(TEMP0001) USING(KERB) DISPLAY FROM(TEMP0001) LIST(PRINT) - PAGE - TITLE('USERS WITH A KERB SEGMENT') - DATE(YMD/) - TIME(12:) - BLANK - ON(010,08,CH) HEADER('USER ID') - ON(019,60,CH) HEADER('PRINCIPAL') //KERBCNTL DD * SORT FIELDS=COPY INCLUDE COND=(5,4,CH,EQ,C'02D0')
  3. Perform the required migration if Kerberos profiles are used on your z/OS system.

    The affected users include:

    1. Users who have a KERB segment that change their password during logon - for example: TSO logon, rlogin, telnet, and so forth. (Provided an RRSF local node that has been defined.)
    2. A user with a KERB segment who submits a job that changes their password with the job card (PASSWORD=(pw1,pw2)).
    3. A user who has a KERB segment that issues the RACF PASSWORD or PHRASE command to change the password.
    4. An administrator who issues the RACF ALTUSER command to reset the password of a user who has a KERB segment.
    5. An administrator who issues the RACF RDEFINE command to define a profile in the REALM class.
    6. An administrator who issues the RACF RALTER command to change a profile in the REALM class.
  4. Ensure that ICSF is started and completes initialization.
  5. If CSFSERV class is active and profiles exist, continue to Step 6 and Step 7.
  6. Either disable the SAF authorization check of the CSFOWH resource or give individual users access to the CSFOWH resource.
    • To disable the SAF authorization check:
      RDEFINE XFACILIT CSF.CSFSERV.AUTH.CSFOWH.DISABLE SETR RACLIST(XFACILIT) REFRESH (if the XFACILIT class is raclisted)
    • To give individual users access:
      RDEFINE CSFSERV CSFOWH UACC(NONE) PERMIT CSFOWH CLASS(CSFSERV) ID(<id>) ACCESS(READ) SETR RACLIST(CSFSERV) REFRESH (if the CSFSERV class is raclisted)

    For cases a and b, the user ID to specify in the PERMIT command is the RACF address space user ID. For case c., from Step 3, the user ID to specify in the PERMIT command is the user ID that issues the PASSWORD or PHRASE command. For cases d., e, and f., from Step 3, the ID to specify in the PERMIT command is the RACF administrator user ID.

  7. Optionally, give these user IDs READ access to the CSFIQA resource in the CSFSERV class. Otherwise, the informational message ICH408I (which indicates insufficient authorization) can be issued to the console. However, this action does not affect the password change processing.

Reference information

For more information, see z/OS Integrated Security Services Network Authentication Service Administration and z/OS Integrated Security Services Network Authentication Service Programming.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.14.3 : Integrated Security Services actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Integrated Security Services upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.15 : ISPF upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element ISPF.


Step 4.15.1 : ISPF actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes ISPF upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.15.1.1 : ISPF: Accommodate the ISPF Gateway access change from HTTP to HTTPS


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R4, the ISPF Gateway uses HTTPS connections by default. The change from HTTP to HTTPS is intended to allow for more secure communication with the ISPF Gateway. One example of a program that accesses the ISPF Gateway is the installation verification program (IVP) that is included with ISPF.

If you use the ISPF Gateway through the HTTP protocol, you must update your configuration to enable SSL for your ISPF gateway traffic.

Although not recommended, a configuration option is provided to allow you to override the default, for fall back to non-secure HTTP if needed.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

ISPF

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use the ISPF Gateway through the HTTP protocol.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether the ISPF Gateway is being accessed on your system through non-secure HTTP, use the following health check:
IBMISPF,ZOSMIGV2R3_Next_ISPF_GW_HTTPS

This health check is available for z/OS V2R3 and z/OS V2R2 with APAR OA58151 applied.

Steps to take

Determine whether the ISPF Gateway is being accessed on your system through non-secure HTTP. IBM provides the following IBM Health Checker health check:

  • On a z/OS V2R3 or z/OS V2R2 system, run health check IBMISPF,ZOSMIGV2R3_Next_ISPF_GW_HTTPS. For a non-secure connection to the ISPF Gateway, this health check issues the following message:
    ISTM040E The ISPF Gateway is being accessed using non-secured HTTP

If this exception condition is detected, message ISTH040E is followed by message ISTH900I, which indicates the date and time that the ISPF Gateway was last accessed using non-secured HTTP. You can use message ISTH900I to determine whether a new non-secured HTTP access of the ISPF Gateway has been detected or the exception condition is related to an earlier access.

This health check is available for z/OS V2R3 and z/OS V2R2 with APAR OA58151 applied.

Update your configuration to enable SSL for your ISPF gateway traffic, as described in the topic “Customizing IBM HTTP server powered by Apache” in ISPF Planning and Customizing.

Although not recommended, you can override the default by adding environment variable CGI_SECURECONN to your HTTP configuration and setting it to FALSE.

Reference information

For more information about how to update the ISPF configuration, see the topic “Configuring the CIM server HTTPS connection using AT-TLS” in ISPF Planning and Customizing.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMISPF,ZOSMIGV2R3_Next_ISPF_GW_HTTPS.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.15.1.2 : ISPF: Plan for the removal of Workstation Agent


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is planned to be the last release to support the ISPF Workstation Agent (WSA), also known as the ISPF client/server component. WSA is an application that runs on your local workstation and maintains a connection between the workstation and the ISPF host. It is primarily used to transfer files between the workstation and the host.

IBM recommends the use of more current file transfer solutions, such as those provided by z/OS FTP, the sftp utility of OpenSSH, or another file transfer mechanism. These solutions have more capabilities, including the ability to provide secure communications.

Note:

The communication between ISPF and the ISPF Workstation Agent is not secure. Therefore, avoid using the ISPF Workstation Agent. If you must use ISPF Workstation Agent on a z/OS V2R4 system, it is recommended that you define the SAF resource ISPF.WSA in the FACILITY class and grant users READ access to the resource, as described in "Steps to take."

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

ISPF

When change was introduced:

See the "Statement of General Direction" in Preview: IBM z/OS Version 2 Release 4, IBM United States Software Announcement 219-013, dated February 26, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because support for this function is being removed in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether the ISPF Workstation Agent is being used on your system, use health check IBMISPF,ISPF_WSA.

This health check is added by ISPF APAR OA56980, which is applicable to z/OS V2R2 and later.

Steps to take

Determine whether any of your users or programs use the ISPF Workstation Agent (WSA), also known as the ISPF client/server component. If so, IBM recommends the use of more current file transfer solutions, such as those provided by z/OS FTP, the sftp utility of OpenSSH, or another file transfer mechanism. These solutions have more capabilities, including the ability to provide secure communications.

If you must use ISPF Workstation Agent on a z/OS V2R4 system, take the following actions to secure it:

  • Use the following commands to define the resource ISPF.WSA in the FACILITY class with a universal access (UACC) of READ. Doing so allows users to initiate a connection to the ISPF Workstation Agent.
    RDEFINE FACILITY ISPF.WSA UACC(READ) SETROPTS RACLIST(FACILITY) REFRESH
  • Use the following commands to define the resource ISPF.WSA in the FACILITY class with a universal access (UACC) of NONE and to permit individual users READ access to the resource. Doing so allows individual users to initiate a connection to the ISPF Workstation Agent.
    RDEFINE FACILITY ISPF.WSA UACC(NONE) PERMIT ISPF.WSA CLASS(FACILITY) ID(user_id) ACCESS(READ) SETROPTS RACLIST(FACILITY) REFRESH
Reference information

For more information, see the following references:

  • Statement of General Direction in IBM United States Software Announcement 219-013, dated February 26, 2019
  • The topic Prohibiting connections to the ISPF Workstation Agent in z/OS ISPF Planning and Customizing.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMISPF,ISPF_WSA.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.15.2 : ISPF actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes ISPF upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.15.3 : ISPF actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes ISPF upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.16 : JES2 upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element JES2.


Step 4.16.1 : JES2 actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES2 upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.16.1.1 : JES2: Activate z22 mode


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is planned to be the last release in which JES2 supports the z11 level for checkpoint data sets. z22 mode was introduced in z/OS V2R2. IBM recommends that you activate JES2 in z22 mode, if you have not done so. When you switch to z22 mode, the system upgrades the JES2 checkpoint.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

JES2.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because z11 mode will not be supported in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

You are able to fall back to z11 mode, if necessary.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To determine whether the z11 level is used for checkpoint data sets, use IBM Health Checker for z/OS check IBM_JES2, JES2_UPGRADE_CKPT_LEVEL_JES2 .

Steps to take

Follow these steps:

  • On all of the systems in your MAS, determine your z22 checkpoint activation readiness, as follows:
    1. Enter the $D ACTIVATE command to verify that activation to z22 mode can succeed.
    2. If you enter the $ACTIVATE,LEVEL=z22 command, activation of CYL_MANAGED support is required.
    3. You might see that z22 mode requires an extra nnn 4K records for CKPT1.
  • Enter the JES2 $ACTIVATE command to verify non-configuration changes that must be accommodated before you go to z22, and to activate z22 mode. See the considerations for this command in z/OS JES2 Commands.

By default, JES2 restarts in the same mode as the other members of the MAS (if any are active) or the mode of the last active JES2 member when it was shut down. To restart JES2 in z11 mode during a COLD start, specify UNACT on PARM=. On a cold start, JES2 starts in z22 mode, unless overridden by the OPTSDEF COLD_START_MODE or UNACT parameter.

Reference information

For more information, see z/OS JES2 Commands.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMJES2,JES2_UPGRADE_CKPT_LEVEL_JES2.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.16.2 : JES2 actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES2 upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.


Step 4.16.2.1 : JES2: Accommodate the changed default for the EXECUTABLE keyword on $GETMAIN


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R3 added the EXECUTABLE= keyword on the $GETMAIN macro to indicate whether the obtained storage is marked as executable for systems that run on an IBM z14 server or later. For more information about non-executable memory, see the description of the EXECUTABLE= keyword on the STORAGE macro.

When the EXECUTABLE= keyword was added to the $GETMAIN macro in z/OS V2R3, the default was YES. Starting with z/OS V2R4, the default on $GETMAIN is changed to NO. This change implies that, by default, any storage that is obtained in a supported subpool does not support executable code on a z14 server. Any attempt to run code in the storage results in an 0C4 abend.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS JES2.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have any affected JES2 exit routines or user modifications.

Target system hardware requirements:

IBM z14 server.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If EXECUTABLE=NO is used and YES is needed, any attempt to run code in the storage results in an 0C4 ABEND occurs.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review your exits for instances of the $GETMAIN macro that obtains storage for executable code. In particular, check for DCB exit stubs that might be obtained and pointed to by the EXLST area. When appropriate to do so, convert the $GETMAIN and its associated $FREMAIN to specify EXECUTABLE=YES. On a z/OS V2R3 system, you can perform this change before you upgrade to z/OS V2R4.

If in doubt, you can change all $GETMAIN and $FREMAIN macros to specify EXECUTABLE=YES.

Reference information

For more information, see z/OS JES2 Installation Exits.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.16.2.2 : JES2: Checkpoint versions are moving to 64-bit storage


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Applications and exits that do not run in the JES2 address space can access checkpoint version data from the IAZDSERV data area, which provides a stable copy of the data. To access the IAZDSERV data area, applications can use subsystem interface call (SSI) 71, subfunction SSJIFOBT, and JES2 exits can use the $DSERV macro.

Before z/OS V2R4, the data returned by these services was in a 31-bit storage data space. Starting in z/OS V2R4, the returned data might reside in 64-bit storage.

z/OS V2R4 adds version 10 of the IAZDSERV data area, which supports 64-bit pointers and ALETs for use in accessing the checkpoint version data. Version 10 is the only IAZDSERV version that is supported by z/OS V2R4.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS JES2.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your JES2 exit routines or applications use the IAZDSERV macro with the SSI call 71 or the $DSERV macro.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check for applications and exits that access checkpoint version data from the IAZDSERV data area. Determine whether this code must access the checkpoint data blocks directly.

As an alternative to using the IAZDSERV data area directly, your code can use an SSI call to access checkpoint version data. IBM recommends that you evaluate the use of SSI calls, such as SSI 80 (extended status) or SSI 82 (JES property SSI). Determine whether you can use these services to obtain the data that you require. Otherwise, you must upgrade your code to accept the 64-bit data pointers that are returned in the version 10 IAZDSERV data area.

If you use the $DSERV macro in an exit, be aware that the IAZDSERV data area it returns is at the version 10 level and therefore contains 64-bit pointers. All JES2 services that use the $DSERV macro as input are upgraded in z/OS V2R4 to accept the version 10 of the IAZDSERV data area.

In general, unless your code must reference individual fields in the $DSERV mapping, it should not require changes. However, it your code references fields in the $DSERV, you must upgrade your code to use the 64-bit fields and run in 64-bit addressing mode.

Reference information

For more information, see z/OS JES2 Installation Exits.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.16.2.3 : JES2: Accommodate changes in NJE input phase processing for multi-object job streams


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Before z/OS V2R4, if an NJE job stream contained more than one job or job group, the stream and all jobs within it would fail input phase processing. Starting with z/OS V2R4, JES2 now supports multiple job and job group objects in an NJE job transmission stream. This is done by keeping all the jobs in the stream busy in the INPUT phase of processing until the job trailer (end of the job stream) is received. When received, the jobs complete input phase processing and are queued to the next phase. If an error occurs on the connection and the job trailer is not received, all of the jobs are purged from the receiving system. When the NJE connection is reestablished, the entire job stream is sent again.

This change implies a number of subtle changes in how input phase processing works:

  • Multiple jobs and job groups can be marked busy on a job receiver at the same time
  • Final processing for the jobs is delayed until the job trailer is received. This includes exits 20 and 50 (end of input exits) and exit 51 (queue change). As a result, the end of input exit for the first job in the stream is not given control until all other input exits (job statement, accounting string, JCL statement) are called for all of the jobs. The environment in which the end of input exit is called is the same as in prior releases, however, the order is changed.
  • When a connection drops, because multiple jobs can exist on the NJE job receiver, all of these jobs must be purged. Prior releases would only have at most one job that needed to be purged.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS JES2.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have exits or processes that are impacted

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review these changes to NJE input phase processing and evaluate suitable changes to your system. For example, if you have any exits or procedures that rely on only one job or job group being active on a particular NJE job receiver at a time, review and update those exits and procedures. Similarly, if you have an end of input exit or a queue change exit that relies on being called immediately after other input exits for a particular job, review those exits and change them appropriately.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.16.2.4 : JES2: Review changes applicable to exit routines and user modifications


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Changes to your JES2 exit routines and user modifications might be necessary, depending on which JES2 functions are used and which JES2 data areas are referenced.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS JES2.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have any affected JES2 exit routines or user modifications.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

See the JES2 exit migration considerations topic in z/OS JES2 Installation Exits. This topic describes the changed information that you might need to accommodate. Generally, assembly errors in JES2 exits indicate that you were affected by a JES2 data area change.

Note:

As a recommended practice, use the $MODULE macro to include JES2 macros within your exit routines and user-supplied modules. By doing so, you allow the $MODULE macro to manage macro dependencies. For a list of the control block mappings (DSECTs) that can be specified on the $MODULE macro, see the tables in the $MODULE topic in z/OS JES2 Macros.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.16.3 : JES2 actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES2 upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.17 : JES3 upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element JES3.


Step 4.17.1 : JES3 actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES3 upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.17.1.1 : JES3: Plan for migration to JES2 in a future release


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The release that follows z/OS V2R4 is planned to be the last release of z/OS that will include JES3 as a feature. If you are one of the clients who remains on JES3, IBM encourages you to start planning your migration.

In IBM United States Software Announcement 217-246 IBM z/OS Version 2 Release 3 - Engine for digital transformation, dated July 17, 2017, IBM announced that JES2 is the strategic Job Entry Subsystem (JES) for the z/OS Operating System and that JES3 would continue to be supported and maintained.

To date, IBM has made significant investment in JES2 by delivering unique functions, such as email support in JCL, spool migration and merge, and dynamic checkpoint expansion and tuning to make management easier. In z/OS V2R4, IBM adds JES2 Spool Encryption and a new user exit alternative, based on defining policies that allow exit programs to be implemented in a parameterized rule-based approach.

To help JES3 to JES2 migration efforts, JES2 adds functions, including dependent job control, deadline scheduling, 8-character job classes, and interpreting JES3 JECL control statements. For z/OS V2R4, more function to aid in migrations is added, including Disk Reader capability and enhanced JES3 JECL support in JES2 (ROUTE XEQ).

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

JES3

When change was introduced:

See the "Statement of General Direction" in IBM United States Software Announcement 219-013, dated February 26, 2019.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended to receive the added functionality of future releases of JES2.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you are one of the clients who remains on JES3, IBM encourages you to start planning your migration. For questions, contact jes3q@us.ibm.com.

Reference information

For more information, see the Statement of General Direction in IBM United States Software Announcement 219-013, dated February 26, 2019.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.17.2 : JES3 actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES3 upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.


Step 4.17.2.1 : JES3: Check for program references to the JDAB in IATYJDA


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting in z/OS V2R3 JES3, the fixed area of the Job Data Accounting Block – JDAB (IATYJDA) is extended to accommodate more fields. As the JDAB is maintained on JES3 spool, a version field JDABVER is added to identify when fields in the extended area are available. Equate JDABVER0 is defined for JDABs created by a JES3 global previous to V2R3. Equate JDABVER1 is defined for JDABs created by a JES3 global at V2R3 and later.

JDABVER DS X Version ID JDABVER0 EQU 0 Version 0 (pre-V2R3) JDABVER1 EQU 1 Version 1 (Starting with V2R3) JDABCVER EQU JDABVER1 Current version

An eight-character field JDABNTF8 is added to accommodate user IDs from the NOTIFY= parameter of the JOB JCL statement with up to 8 characters. Existing seven-character field JDABNTFY is used for JDABs created by a JES3 global previous to V2R3 (JDABVER0). New field, JDABNTF8, is used for JDABs created by a JES3 global at V2R3 and later (JDABVER1). JDABNTFY continues to be set when the NOTIFY= user ID is 7 characters or less. Otherwise, it is set to blanks.

JDABNTF8 DS CL8 NOTIFY= 8-character user id

Extending the fixed area might impact customer modifications and user exits that access existing field JDABNTFY (seven-character user ID) or access the JDAB scheduler elements, JDABNTRY DSECT, which follows the fixed area. Examples of user exits that might access the JDAB are IATUX14, IATUX27, IATUX29, and IATUX36.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

JES3.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4

Is the upgrade action required?

Yes, if code exists, especially JES3 user exits, that refer to IATYJDA, referencing any of the following fields or equates from IATYJDA: JDABFEND, JDABFSIZ, or JDABNTFY.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  • Check for code that uses field JDABFEND or equate JDABFSIZ to establish the address of a JDAB scheduler element, JDABNTRY DSECT. The address of the first JDABNTRY DSECT immediately follows the JDAB fixed area. For example:
    USING JDABSTRT,R8 Addressability to JDAB LA R7,JDABFEND Address first S.E. USING JDABNTRY,R7 Addressability to S.E.
  • Search for code that references the seven character user ID in JDABNTFY. Then:
    • Use existing field JDABFIXL, length of fixed portion to establish the address of the first JDAB scheduler element, JDABNTRY DSECT. For example:
      USING JDABSTRT,R8 Addressability to JDAB LR R7,R8 Copy JDAB start address AH R7,JDABFIXL Address first S.E. USING JDABNTRY,R7 Addressability to S.E.
    • Use field JDABVER to determine which notify user ID field to access. When JDABVER equals JDABVER0, then use the existing seven character field JDABNTFY. Otherwise, use the eight character field JDABNTF8. JDABNTFY continues to be set when the NOTIFY= user ID is 7 characters or less. Otherwise, it sets to blanks.
Reference information

For more information about the Job Data Accounting Block (IATYJDA) control block, see z/OS JES3 Data Areas in z/OS Internet library.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.17.3 : JES3 actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes JES3 migration actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.18 : Language Environment upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element Language Environment.


Step 4.18.1 : Language Environment actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Language Environment upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.18.1.1 : Language Environment: Verify user access to formatted CEEDUMP and DYNDUMP dump reports


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3 (and APAR PI54392 on prior releases), access to formatted CEEDUMP and DYNDUMP dump reports can be restricted to certain users.

As a result of this change, CEEDUMP and TRANSACTION DUMP dump reports might be restricted without the following messages being issued:

CEE3880I dump-type HAS BEEN SUPPRESSED - USER IS NOT AUTHORIZED CEE3880I dump-type HAS BEEN SUPPRESSED - PROGRAM IS RUNNING IN AN AUTHORIZED KEY CEE3880I dump-type HAS BEEN SUPPRESSED - PROGRAM IS RUNNING WITH JSCBPASS ON

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Language Environment.

When change was introduced:

z/OS V2R2 with APAR PI54392 applied.

Applies to upgrade from:

z/OS V2R2 without APAR PI54392 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

  1. If you have Program Facility Language Environment applications, identify programs that are under program control. For a RACF installation, you can use the following command:
    RLIST PROGRAM *
  2. Ensure that users who must be able to obtain Language Environment dumps are permitted to the IEAABD.DMPAUTH resource.
  3. For authorized key Language Environment applications, look for Language Environment programs that have a PPT entry that assigns the program a protection key of less than 8.
  4. Ensure that users who must be able to obtain Language Environment resources are permitted to the IEAABD.DMPAKEY resource.
  5. For JSCBPASS Language Environment applications, look for authorized programs that:
    • Have a PPT statement that specifies NOPASS, or
    • Explicitly set JSCBPASS when the programs are not running as started tasks.

    As an alternative, these applications can use recovery routines to produce an SVC dump or IEATDUMP for diagnostic purposes. If a dump is needed, and one is not produced, a SLIP trap can be set to get an SVC dump.

Reference information

For more information about how to restore the previous behavior for generating dumps, see APAR PI69521.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.18.2 : Language Environment actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Language Environment upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.18.2.1 : Language Environment: Update the CSD based on the newest CEECCSD


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Each release, Language Environment adds or deletes load modules in the CICS system definition (CSD) file. Therefore, the CSD file must be updated every release, based on the sample CSD program definitions in members CEECCSD and CEECCSDX in the SCEESAMP data set. The CSD samples from the latest release of z/OS can be used for earlier releases of z/OS that can co-exist with the current release.

If your installation is running CICS Transaction Server for z/OS 4.2 or earlier, you must update the CSD file with the program definitions in member CEECCSD and member CEECCSDX. For later releases of CICS TS, you can skip this step if your installation uses the automatic update function that was provided in APARs PI60389 and PI73184.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Language Environment.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you use:

  • CICS TS 4.2 or earlier
  • CICS TS 5.1, 5.2, or 5.3, and you do not allow program definitions to be updated automatically.

Target system hardware requirements:

None.

Target system software requirements:

For CICS TS 5.1, 5.2, and 5.3, the optional, but recommended, approach is not to add the Language Environment required program resource definitions to the CSD. Instead, allow the program resource definitions to be automatically updated by CICS through its system autoinstall functionality, which installs the program definitions when they are required.

For CICS TS 5.4 and later, use of the automatic update function is required.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Failure to perform this upgrade action can result in several various program ABENDs, such as ABENDU4093 RC=3EC. Which ABEND you see depends on the programming language, and the level of the programming language, that you use.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation is running CICS TS 4.2 or earlier, you must update the CSD file with the program definitions in member CEECCSD and member CEECCSDX. These members are contained in the data set hlq.SCEESAMP.

Note: The group that contains the Language Environment runtime routines must be in the group list that is used during CICS startup.

For CICS TS 5.1, 5.2, and 5.3, you can skip this step, if you allow CICS to install the program definitions automatically. This function was provided in APARs PI60389 and PI73184. Otherwise, you must update the CSD file manually.

For CICS TS 5.4 and later, use of the CICS automatic update function is required. This function ensures that the Language Environment definitions are installed with the same program attributes as was used previously.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.18.2.2 : Language Environment: Update load modules in the LPA


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Each release you must update the Language Environment load modules that you make accessible through the link pack area (LPA). In addition, each release you should review your list of Language Environment load modules in the LPA to determine if it is still suitable.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Language Environment.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you need to make modules accessible through the link pack area (LPA).

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review Language Environment load modules in the LPA.

To move load modules into the LPA, use the following sample members in the CEE.SCEESAMP data set:

  • AFHWMLP2 : This is a sample of all Language Environment Fortran component modules eligible for the LPA.
  • CEEWLPA : This is a sample of a PROGxx member of SYS1.PARMLIB that includes all Language Environment CEE-prefixed runtime modules eligible for the LPA (that is, all Language Environment base modules) except the callable services stubs.
  • CELQWLPA : This is a sample for AMODE 64 runtime support.
  • EDCWLPA : This is a sample of a PROGxx member of SYS1.PARMLIB that includes all Language Environment EDC-prefixed and CEH-prefixed runtime modules eligible for the LPA (that is, all z/OS XL C/C++ component modules) except locales and code page converters.
  • IBMALLP2 (or IBMPLPA1 for Enterprise PL/I for z/OS) : This is a sample of all Language Environment PL/I component modules eligible for the LPA.
  • IGZWMLP4 : This is a sample of all Language Environment COBOL component modules eligible for the LPA.

To see which modules are eligible for the LPA, refer to z/OS Language Environment Customization. The modules listed there can be put in the LPA or extended LPA (ELPA) depending on their RMODE value:

  • If the RMODE is ANY, the module can reside in the LPA or in the ELPA (above or below the 16 MB line).
  • If the RMODE is 24, the module can reside only in the LPA (below the 16 MB line).

If you are considering placing the modules listed in z/OS Language Environment Customization in the LPA or the ELPA, then IBM recommends that you place the SCEELPA data set in the LPA list (LPALSTxx). SCEELPA contains Language Environment load modules that are reentrant, that reside above the 16 MB line, and that are heavily used by z/OS.

In z/OS Language Environment Customization you will also see tables of modules eligible for the LPA and the ELPA above and beyond what is found in the SCEELPA data set. You will need to use the dynamic LPA or MLPA approach to move these modules into the LPA or ELPA. You do not need to include recommended modules if they contain functions your installation does not use. Language Environment modules not listed in these tables can be moved into the LPA or ELPA at your discretion.

Reference information

For more information, see the table Language Environment sample IEALPAnn or PROGxx members in hlq.SCEESAMP for the list of sample members and their changed content in z/OS Language Environment Customization. The table contains a list of eligible load modules for:

  • Language Environment base modules
  • Language Environment z/OS XL C/C++ component modules
  • Language Environment COBOL component modules
  • Language Environment Fortran component modules
  • Language Environment PL/1 component modules

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.18.3 : Language Environment actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Language Environment upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.19 : Library Server upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element Library Server.


Step 4.19.1 : Library Server actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Library Server upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.19.1.1 : Stop using Library Server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 removes support for the Library Server element. IBM recommends that you use IBM Knowledge Center for z/OS, which was introduced in z/OS V2R2, to create your own local repositories and manage content.

Knowledge Center is the IBM platform for delivering product documentation. IBM Knowledge Center for z/OS is the replacement for both BookManager READ and Library Server on z/OS.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

Library Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

IBM recommends that you use IBM Knowledge Center for z/OS for maintaining local repositories of Knowledge Center documentation and serving this content.

Reference information

For more information, see IBM Knowledge Center for z/OS Configuration and User Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.19.2 : Library Server actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Library Server upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.19.3 : Library Server actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Library Server upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.20 : Open Systems Adapter/Support Facility (OSA/SF) upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element Open Systems Adapter/Support Facility (OSA/SF).


Step 4.20.1 : OSA/SF actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes the OSA/SF upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.20.1.1 : OSA/SF: Stop using Open Systems Adapter/Support Facility (OSA/SF)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 removes support for the OSA Support Facility (OSA/SF) element. IBM recommends that you stop using this element.

No change to the OSA cards' strategic importance to z/OS is meant by this change. z/OS continues to support the networking operational use of OSA adapters.

OSA Support Facility (OSA/SF) is used to configure devices on Open Systems Adapter (OSA) cards that are used for the SNA protocol and to support and manage all OSA features. OSA/SF in z/OS has both a graphical user interface and a REXX API. On EC12/BC12 systems, IBM introduced support to configure these devices on the latest generation OSA adapters (OSA Express5S) and to support and manage these adapters exclusively using the Hardware Management Console (HMC), with no capability to configure or manage devices on these adapters provided in the z/OS OSA/SF application. The OSA/SF on the HMC functionality can be used to configure and manage OSA-Express4S and newer generation adapters.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

OSA/SF.

When change was introduced:

z/OS V2R3. Announced as a Statement of Direction in IBM Software Announcement 218-472, dated November 13, 2018.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

IBM recommends that you stop using OSA Support Facility (OSA/SF) before installing z/OS V2R4.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.20.2 : OSA/SF actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes OSA/SF upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.20.3 : OSA/SF actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes OSA/SF upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.21 : RMF upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for optional feature Resource Measurement Facility (RMF).


Step 4.21.1 : RMF actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes RMF upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.21.1.1 : RMF: Remove XP Support for Windows Server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, RMF no longer includes cross-platform (XP) monitoring support for Microsoft Windows Server. In previous releases, the RMF XP monitoring function required the IBM Systems Director platform agent for Windows to be installed on the Windows endpoints. In z/OS V2R3, the Windows agent is removed from IBM Systems Director. The Windows agent is no longer available for download from IBM, nor does IBM provide a replacement for this function.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

RMF

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use RMF XP for Microsoft Windows Server.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation currently uses the Windows agent, it is recommended that you stop using this program and remove it from your system.

To do so, follow these steps:

  1. Stop the GPM4CIM servers for Windows.
  2. Uninstall the IBM Systems Director platform agent for Windows from the Windows endpoints.

If your installation chooses to continue using the Windows agent, be aware that IBM no longer provides service updates or support for it.

Reference information

For more information, see z/OS RMF User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.21.2 : RMF actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes RMF upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.21.3 : RMF actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes RMF upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.21.3.1 : RMF: Use a Monitor III reporter version equal to or later than your Monitor III gatherer


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To avoid problems when reporting Monitor III data, use an RMF reporter version that is equal to or later than the latest RMF gatherer version used to collect the data to be reported. For example, it is safe to use an RMF reporter version from z/OS V2R4 for data that is collected with an RMF gatherer from z/OS V2R2, but not vice versa.

Mixed (and therefore problematic) levels of collected data can occur in the following scenarios:

  • Single system : You install and test a new release, then fall back to an earlier one; your data sets might contain data that is collected with different versions of the RMF gatherer.
  • Sysplex : You migrate to a new release on one system in a sysplex but try to use an earlier reporter version from another system to report on the migrated system's data.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

RMF.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you had planned to use an earlier level RMF reporter on data that was collected with a later level RMF gatherer.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

See "Steps to take."

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Always use an RMF Monitor III reporter version that is equal to or later than the gatherer version used to collect the data from which you want to produce a report.

Note: Monitor III notifies users by issuing information message ERB948I when a reporter session is started on a system in a sysplex that is not running with the highest RMF level available in the sysplex. The message helps users to avoid reporting problems.

Reference information

For more information, see z/OS RMF User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.21.3.2 : RMF: Configure AT-TLS to enable secure communication with the RMF distributed data server


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, the following parameters are added to GPMSRVxx parmlib member to support secure incoming HTTP connections for the RMF distributed data server (DDS):

  • HTTPS
  • CLIENT_CERT

In GPMSRVxx, the HTTPS parameter defaults to the setting ATTLS. Therefore, as of z/OS V2R4, the DDS requires that incoming connections are secured by AT-TLS. Otherwise, the connection is refused.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

RMF.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if the DDS accepts unsecure incoming connections.

Target system hardware requirements:

If the DDS GPMSRVxx parmlib member option uses HTTPS(ATTLS), which is the default, DDS incoming connections must be secured through AT-TLS.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To allow the DDS to accept insecure connections, you can specify the option HTTPS(NO) in your active GPMSRVxx parmlib member. However, this setting is not recommended because it is not secure.

Information about how to set up AT-TLS communication is provided in z/OS Communications Server: IP Configuration Guide and z/OS Security Server RACF Security Administrator's Guide. For other security management products, refer to the corresponding security product documentation.

The following example shows a rule that enables secure communication with the DDS:

# RMF Distributed Data Server Rule TTLSRule DDSServerRule { LocalPortRange 8803 Jobname GPMSERVE Direction Inbound Priority 1 TTLSGroupActionRef DDSServerGRP TTLSEnvironmentActionRef DDSServerENV } TTLSGroupAction DDSServerGRP { TTLSEnabled On Trace 1 } TTLSEnvironmentAction DDSServerENV { HandshakeRole Server TTLSKeyringParms { Keyring DDSServerKeyring } TTLSEnvironmentAdvancedParms { ServerCertificateLabel RMFDDS } }

The example rule is described, as follows:

TTLSRule: Jobname
The name value specifies the job name of the application. GPMSERVE is the job name of the DDS
TTLSRule: LocalPortRange
The local port the application is bound to for this rule's action to be performed. 8803 is the default HTTP Port of the DDS.
TTLSRule: Direction
Specifies the direction from which the connection must be initiated for this rule's action to be performed. In this example, Inbound is specified, which means that the rule applies to connection requests that arrive inbound to the local host.
TTLSRule: Priority
An integer value in the range 1 -2000000000 represents the priority that is associated with the rule. The highest priority value is 2000000000. If you use multiple rules for the DDS server, the more specific a rule is, the higher its priority should be. Generic rules without detail specifications of the incoming connections should have a low priority.
TTLSEnvironmentAction: HandshakeRole
Specifies the SSL handshake role to be taken for connections in this AT-TLS environment. In this example, Server is specified which means that the SSL hand shake is performed as a server.
TTLSKeyringParms: Keyring
Specifies the path and file name of the key database z/OS® UNIX file, the ring name of the SAF key ring, or the name of the z/OS PKCS #11 token. In this example, the RACF key ring DDSServerKeyring is specified.
TTLSEnvironmentAdvancedParms: ServerCertificateLabel
Specifies the label of the certificate for a server application to authenticate the server. In this example, the DDS Server certificate with the label RMFDDS is used.

Reference information

For more information, see the topic "DDS options" in Resource Measurement Facility User's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.22 : SDSF upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for optional feature SDSF.


Step 4.22.1 : SDSF actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SDSF upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.22.1.1 : SDSF: Enable the SDSF class for RACLIST processing


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2.3, if you activate the RACF SDSF class, you must also enable this class for RACLIST processing. This change is needed to allow the command RACROUTE REQUEST=FASTAUTH to be used with the SDSF class.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have the RACF SDSF class active and have not yet enabled the SDSF class for RACLIST processing.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

If you already have the RACF SDSF class active, performing RACLIST processing on the SDSF class causes the class to be RACLISTed on the other systems that share the RACF database.

Restrictions:

None.

System impacts:

If you do not enable the SDSF class for RACLIST processing:

  • For older SDSF functions, return code 4 is returned for VERIFY requests, as is done when the SDSF class is not active. Instead, SDSF uses the non-SAF-based ISFPARMS security.
  • For new SDSF functions, the default is to fail the request; the functions are not authorized.

You can change this behavior by specifying AUXSAF(NOFAILRC4) in the ISFPRMxx member, which results in all requests being allowed.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. If your RACF SDSF class is active, enable the SDSF class for RACLIST processing. To do so, enter the command SETROPTS RACLIST(SDSF).
  2. Whenever SDSF class profiles are changed, you must refresh the class. To do so, enter the command SETROPTS RACLIST(SDSF) REFRESH.
Reference information

For more information about the SDSF class, see Supplied class descriptor table entries in z/OS Security Server RACF Macros and Interfaces.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.22.1.2 : SDSF: Verify that the SDSF address spaces are started at IPL


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, SDSF requires the SDSF and SDSFAUX address spaces to be active for full functionality. The SDSF address space manages connections, processes ISFPRMxx statements, handles operator commands, and starts and stops SDSFAUX. The SDSFAUX address space is used for data gathering requests.

Usually, the SDSF address space is started during IPL using COMMNDxx. During SDSF initialization, the SDSFAUX address space is started.

When a user accesses SDSF, the SDSF client program attempts to connect to the SDSF address space (also referred to as the SDSF server). To connect to the SDSF server, the user must have READ access to the ISF.CONNECT.system resource in the SDSF class.

If the SDSF address space is not active, SDSF provides limited functionality. The user must have READ access to the SERVER.NOPARM resource in the SDSF class so that ISFPARMS can be used instead of ISFPRMxx. Panels that require the use of the SDSFAUX data gatherers (such as APF, LPA, and LNK) are not available.

If the SDSF address is active, but no ISFPRMxx is in effect (such as a syntax error during startup), SDSFAUX is not started. The user requires access to the SERVER.NOPARM resource to fall back to ISFPARMS and requires READ access to the ISF.CONNECT.system resource to continue. Panels that require the use of SDSFAUX are not available.

If the SDSF address space is active, but the SDSF class is not active or not RACLISTed, the SDSF server allows requests based on the ISFPRMxx CONNECT definition. When AUXSAF(FAILRC4) is in effect (the default), the request is denied. The user cannot connect to the SDSF server and the SDSFAUX related panels are not available. SDSF falls back to ISFPARMS because access to the SERVER.NOPARM resource results in a return code 04 (indeterminate result).

When AUXSAF(NOFAILRC4) is in effect, the server allows the request, but access to the panel is controlled through the definitions in ISFPARMS.

IBM recommends that you start the SDSF server. Although V2R4 provides limited functionality when the server is not active, this might not be the case in subsequent releases.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you do not already start the SDSF and SDSFAUX address spaces.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

If the SDSF address space is not active and the user does not have access to the SERVER.NOPARM resource, the user is not permitted to access SDSF. Instead, message ISF452E is issued, for example:

ISF452E SDSFAUX communications failed, return code 0x00000008,reason code 0x00370801, function "connect". SDSFAUX not available ISF024I USER NOT AUTHORIZED TO SDSF, SERVER NOT AVAILABLE

SDSF falls back to ISFPARMS if the SDSF address space is not active and the user is authorized to the SERVER.NOPARM resource.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether the SDSF and SDSFAUX address spaces are started during IPL by doing either of the following:

  • From SDSF, enter the WHO command. Verify that the response contains the SERVER=YES keyword.
  • Enter the command F SDSF,D to verify that the SDSF address space is active.

If your installation already starts the SDSF server and SDSFAUX address spaces, no action is necessary.

Otherwise, if the WHO response is SERVER=NO or the MODIFY command results in job not found, the server address space must be started.

Reference information

For more information about configuring the SDSF server and SDSFAUX, see z/OS SDSF Operation and Customization.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.22.2 : SDSF actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SDSF upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.22.2.1 : SDSF: Remove the entry for ISFHCTL from SCHEDxx


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, the SDSF server program, ISFHCTL, is changed to run in program protect key 4. In previous releases, this program ran in program protect key 1.

Your installation might currently specify a key for ISFHCTL by using parmlib member SCHEDxx to update the program properties table (PPT). If so, it is recommended that you remove the entry from SCHEDxx. Because ISFHCTL is defined in the PPT in all levels of z/OS, you no longer need to define this program in member SCHEDxx.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you specify ISFHCTL in a SCHEDxx parmlib member.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

During system initialization, SDSF verifies that it is running in the correct key. If the key is incorrect, SDSF initialization fails with the following message:

ISF517E SDSF SERVER WAS NOT STARTED DUE TO INVALID EXECUTION ENVIRONMENT, POSSIBLE MISSING PPT ENTRY.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation does not use parmlib member SCHEDxx, no action is necessary.

Otherwise, check SCHEDxx for the PPT entry for program ISFHCTL. If SCHEDxx contains an entry for ISFHCTL, remove the entry.

Tip:

To determine what key value is in effect, enter the command D PPT,NAME=ISFHCTL and check the response message IEF386I.

Reference information

For more information about parmlib member SCHEDxx and the PPT, see z/OS MVS Initialization and Tuning Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.22.2.2 : SDSF: Review and reassemble user exit routines


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

If you have written user exit routines, review them to ensure they are still appropriate for the current environment, and make changes as necessary. All user exit routines must be reassembled with the z/OS V2R4 level of the SDSF macro library.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if user exit routines are in use.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Review user exit routines to ensure they are appropriate for z/OS V2R4. Make changes as necessary. Regardless of whether you have made changes, reassemble the user exit routines with the z/OS V2R4 level of the SDSF macro library.

Tip:

A PROPLIST statement, along with PROPERTY statements, both in the ISFPRMxx parmlib member, defines customized values for certain SDSF properties. It provides an alternative to writing user exit routines to customize those properties. A user exit routine that customizes the same property as a PROPERTY statement overrides the value on the PROPERTY statement.

Reference information

For more information, see z/OS SDSF Operation and Customization.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.22.2.3 : SDSF: Use dynamic statements for ISFPARMS to avoid reassembly


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

ISFPARMS in SDSF is used for specifying global options, the format of panels, and security for SDSF functions. SDSF provides two alternatives for ISFPARMS:

  • Assembler macros that you define, assemble, and then link into the SDSF load library. This is the original format for defining ISFPARMS and it continues to be supported for compatibility.
  • Dynamic statements, which are in parmlib member ISFPRMxx. Dynamic statements are the recommended format. They are easier to code and are more dynamic than the assembler macros; they can be updated without reassembling or link-editing. The statements are processed by an SDSF server, which is controlled by MVS operator commands.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

No, but recommended to avoid the upgrade action of reassembling your customized ISFPARMS for each z/OS release. (If you do not use dynamic statements for ISFPARMS, reassembly of your customized ISFPARMS is required on each release.)

If you still use ISFPARMS, it is strongly recommended that you convert to ISFPRMxx and use an external security manager, such as RACF, for your security definitions.You can use the ISFACP utility to convert your ISFPARMS to ISFPRMxx statements. The reason for this recommendation is that using ISFPRMxx is planned as a requirement in a future release.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

While moving to ISFPARMS on one system, you can still specify SDSF options with your customized ISFPARMS using assembler macros on another coexisting system, until such time as all systems are using the dynamic statements. Take care to assemble the correct macros with the corresponding z/OS level on which SDSF will run. Toleration APARs are provided to allow sharing of a higher level ISFPRMxx on down level systems such that you can share the same ISFPRMxx member on all systems in your sysplex.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To verify that SDSF dynamic statements in ISFPRMxx are being used rather than the assembler macros, use check IBMSDSF,SDSF_ISFPARMS_IN_USE. If the check determines that the assembler macro ISFPARMS is in use instead, and that it has been modified, the check generates an exception. If the assembler macro ISFPARMS is in use but it has not been modified, so that all defaults are in effect, the check does not generate an exception.

SDSF registers this check with the IBM Health Checker for z/OS infrastructure when the SDSF server address space is initialized. However, one of the items this check verifies is that the SDSF server itself is in use, so you have to manually add this check (particularly if you do not use the SDSF server) so that the IBM Health Checker for z/OS infrastructure invokes the check. To add the check, put the following statement in your PROGxx parmlib member: EXIT ADD EXITNAME(HZSADDCHECK) MODNAME(ISFHCADC).

SDSF health checks are distributed in ISF.SISFLOAD for installations running SDSF in the LNKLST. The checks are also distributed in ISF.SISFLINK for installations that do not run SDSF in the LNKLST. For those installations, ISF.SISFLINK must be added to the LNKLST.

Note:

To avoid a possible ABEND 290 with reason code 02014007 issued by HZSADDCK:

  • Specify the proper check routine name. The check routine module must be in an APF-authorized library. The system must be able to locate the check routine within the joblib, the steplib of the IBM Health Checker for z/OS address space, the LPA, or the LNKLST.
  • Specify the proper message table name. The message table module must be in an APF-authorized library. The system must be able to locate the message table within the joblib, the steplib of the IBM Health Checker for z/OS address space, the LPA, or the LNKLST.
Steps to take

If you are already using dynamic statements for ISFPARMS, there is no upgrade action to perform.

If you are using assembler macros for ISFPARMS, do one of the following:

  • Convert your existing ISFPARMS to dynamic statements by using a conversion utility that you invoke with the ISFACP command.
  • Reassemble your customized ISFPARMS for use with z/OS V2R4. Reassembly must be done whenever you change your z/OS release. Before reassembling ISFPARMS, you might want to update it for new function. The assembler ISFPARMS cannot be shared with any other release of SDSF. Only use ISFPARMS for the release on which it is assembled. Note:

    If you have an SMP/E usermod that specifies modifications to assembler macro ISFPARMS, change the usermod to indicate that module ISFPARMS is now owned by the z/OS base V2R4 SDSF FMID (HQX77C0). The correct SMP/E syntax is ++VER(Z038) FMID(HQX77C0).

    Also, in the SMP/E usermod, change the distlib to reference DISTLIB(AISFSRC). The correct SMP/E syntax is ++VER(Z038) FMID(HQX77C0). Your ++SRC or ++SRCUPD statement must specify DISTLIB(AISFSRC).

Reference information

For more information about invoking the conversion utility with the ISFACP command, and the ISFPARMS and the ISFPRMxx parmlib members, see z/OS SDSF Operation and Customization.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMSDSF,SDSF_ISFPARMS_IN_USE.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.22.3 : SDSF actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SDSF upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.22.3.1 : SDSF: Modify programs that post-process SDSF panels


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R3, the main panel of SDSF is restructured to use a scrollable table. This change allows new commands to be added, regardless of the screen depth. Entries in the table can be located, sorted, and filtered to help with selecting commands.

As part of this change, the title line of the main panel is changed. In previous releases, the main panel title contained the string “SDSF PRIMARY OPTION MENU.” In z/OS V2R3, the title line contains the string “SDSF MENU” in the upper left corner.

A compatibility mode is provided, which causes SDSF to use the older format. This mode can be enabled, either by using a custom property or a special DDNAME allocated to the user’s session.

A new SDSF custom property Panel.Main.DisableTable is implemented. When set to false (the default), the SDSF main panel is rendered as a table.

When the special ddname ISFMIGMN is allocated (typically to a dummy data set) or the Panel.Main.DisableTable custom property is set to true, the panel is rendered in the older style two-column layout. However, only the options that fit within the older screen depth are shown.

Note:

All SDSF options are available, even if not visible due to insufficient screen depth.

If your installation has programs that post-process SDSF screen output and the programs rely on the SDSF main menu title “ SDSF PRIMARY OPTION MENU”, you must modify your programs to check for the new SDSF main menu title line.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

SDSF.

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your installation uses programs that rely on the older SDSF main format.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you do not have scripts that post-process SDSF screen output, no action is necessary.

Otherwise, modify your scripts to check for the new SDSF main menu title line.

Tip:

If you use SDSF batch or AFD scripts, convert them to SDSF/REXX, which is not sensitive to SDSF screen layouts and is thus independent of changes to the panel formats.

If it is not practical to change your scripts, use the Panel.Main.DisableTable custom property or allocate special DDNAME ISFMIGMN to revert to the old main panel format.

Reference information

For more information, see z/OS SDSF Operation and Customization.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23 : Security Server upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for optional feature z/OS Security Server.


Step 4.23.1 : Security Server actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Security Server upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.23.1.1 : Security Server: Plan for removal of support for RACF database sharing with z/VM


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

The next release of z/OS will be the last release in which it is possible to share RACF databases between z/VM and z/OS systems. Though databases might be compatible, sharing them between operating systems is discouraged due to potential differences in the security and administration requirements of the different platforms.

In a future release, z/OS will be updated to detect whether a database is flagged as a z/VM database and reject its use if so marked.

Sharing of databases between z/OS systems is not affected by this statement.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 220-226, dated June 16, 2020

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended if you share a RACF databse between z/OS and z/VM.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

Because the RACF database will no longer be shared with z/VM, consider using separate z/VM security processes.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If your installation currently shares a RACF databse between z/OS and z/VM system, plan for maintaining separate databases in a future release of z/OS. In the future, it might be neccessay for you to maintain separate copies of the RACF database for each computing platform.

Reference information

For more information, see z/OS Security Server RACF Security Administrator's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.1.2 : Security Server: Check for previously defined classes HBRADMIN, HBRCONN, or HBRCMD


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, RACF adds the following general resource classes in support of the product, IBM Operational Decision Manager (ODM) for z/OS:

  • HBRADMIN
  • HBRCONN
  • HBRCMD

If your installation defined any of these classes in a previous release of z/OS, be aware that the profiles in these classes will not function properly after z/OS V2R4 is installed and IPLed.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have IBM Operational Decision Manager (ODM) for z/OS installed and you defined RACF dynamic classes HBRADMIN, HBRCONN, and HBRCMD.

Target system hardware requirements:

None.

Target system software requirements:

IBM Operational Decision Manager (ODM).

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

This action is required only if you are using the Operational Decision Manager (ODM) and have defined the HBRADMIN, HBRCONN, or HBRCMD classes in the RACF dynamic class descriptor table. You can determine whether the class is defined in the dynamic CDT by looking for HBRADMIN, HBRCONN, or HBRCMD in the output of the following command:

SEARCH CLASS(CDT)

This action changes the current POSIT number of the HBRADMIN, HBRCONN, and HBRCMD classes to match the value of the IBM class of the same name, which is added when the system is next IPLed.

Between steps 4 and 5 of the procedure that follows, the HBRADMIN, HBRCONN, and HBRCMD classes are not active on the systems that share the RACF database.

This procedure should be performed at a time of low ODM activity on all systems that share the RACF database. Alternatively, the ODM server, and all applications that use it, can be stopped on all systems that share the RACF database until step 5 is performed.

  1. Enter the following command to list the SETROPTS options for all classes.
    SETROPTS LIST

    Record all active system options for the HBRADMIN, HBRCONN, and HBRCMD classes.

  2. Record the current POSIT value of the HBRADMIN, HBRCONN, and HBRCMD classes, which can be displayed by using the following command.
    RLIST CDT HBRADMIN CDTINFO NORACF RLIST CDT HBRCONN CDTINFO NORACF RLIST CDT HBRCMD CDTINFO NORACF
  3. Change the POSIT value.
    RALTER CDT HBRADMIN CDTINFO(POSIT(603)) RALTER CDT HBRCONN CDTINFO(POSIT(603)) RALTER CDT HBRCMD CDTINFO(POSIT(603))

    Ignore the IRR52190I message that is issued by RALTER.

  4. Refresh the CDT class on all systems that share the RACF database and which use the HBRADMIN, HBRCONN, and HBRCMD class.
    SETROPTS RACLIST(CDT) REFRESH

    Ignore the following ICH14079I message that is issued by SETROPTS:

    • ICH14079I RACF detected an error in the dynamic class descriptor table entry HBRADMIN, HBRCONN, or HBRCMD, error code 08.

    This message is also issued during IPL on any earlier system until step 10 is performed. These IPL messages can also be ignored.

  5. Activate the desired SETROPTS options by using the SETROPTS LIST output from step 1 as reference. This example assumes that the SETROPTS options CLASSACT, RACLIST, GENERIC, and GENCMD were previously active for the HBRADMIN, HBRCONN, and HBRCMD classes.
    SETROPTS CLASSACT(HBRADMIN) RACLIST(HBRADMIN) GENERIC(HBRADMIN)
  6. Examine all dynamic and static CDT entries to see whether any other existing classes share the previous POSIT value of the HBRADMIN, HBRCONN, and HBRCMD classes. If another existing class shares the current POSIT value, continue at step 10.

    If no other existing classes share the previous POSIT value, continue with step 7 to ensure that any new class does not have unexpected options if you add a class with that POSIT value in the future.

  7. Add a new, unique, temporary dynamic class and assign it the previous POSIT value of the HBRADMIN, HBRCONN, and HBRCMD classes. For example, if the class name $TEMPCLS is not in use, and the previous POSIT value of the HBRADMIN, HBRCONN, and HBRCMD classes was 200, enter the following command.
    RDEFINE CDT $TEMPCLS CDTINFO(POSIT(200))

    Followed by the command:

    SETROPTS RACLIST(CDT) REFRESH
  8. Deactivate the SETROPTS settings that you recorded in Step 1. For example, if the SETROPTS options CLASSACT, RACLIST, GENERIC, and GENCMD were active for the HBRADMIN, HBRCONN, and HBRCMD classes, you would enter the following command to deactivate those options.
    SETROPTS NOCLASSACT($TEMPCLS) NORACLIST($TEMPCLS) NOGENERIC($TEMPCLS) NOGENCMD($TEMPCLS)
  9. Delete the temporary class.
    RDELETE CDT $TEMPCLS

    Followed by the command:

    SETROPTS RACLIST(CDT) REFRESH
  10. After all of the systems that share the RACF database are IPLed with z/OS V2R4 and you have no plans to fall back to a prior z/OS release, you can delete the installation-defined dynamic version of the HBRADMIN, HBRCONN, and HBRCMD classes. Delete the CDT class profile that defines the HBRADMIN, HBRCONN, and HBRCMD classes by using the following command:
    RDELETE CDT HBRADMIN RDELETE CDT HBRCONN RDELETE CDT HBRCMD

    Followed by the command:

    SETROPTS RACLIST(CDT) REFRESH

    Important: Do not delete the installation-defined dynamic class until all of the systems that share the RACF database are IPLed with z/OS V2R4. If you plan to propagate changes to the CDT class by using the RACF remote sharing facility (RRSF), this guidance also applies to systems on remote RRSF nodes.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.1.3 : Security Server: Accommodate the removal of default passwords on RACF commands


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

With APAR OA48667, the RACF commands ADDUSER, ALTUSER, and PASSWORD no longer set a default password for the target user ID. In previous releases, these commands used the user's default group name as the password by default.

Specifically, the commands are changed as follows to remove the generation of default passwords:

  • Command ADDUSER defaults to PROTECTED when no password or phrase is specified.
  • Commands ADDUSER, ALTUSER, and PASSWORD no longer set a default password for the target user ID.

The following table summarizes the new RACF command behavior with APAR OA48667 applied.

Command

Condition

New behavior with APAR OA48667 applied

ADDUSER user

PASSWORD keyword is omitted.

The user is defined as a PROTECTED user, unless a PHRASE or OIDCARD value is specified. Also, message ICH01024I is issued, stating that the user is defined as PROTECTED.

ADDUSER user

PASSWORD

PASSWORD keyword is specified, but its value is omitted.

PASSWORD keyword is ignored with message ICH01025I and the user ID is defined as PROTECTED.

ALTUSER user

PASSWORD

PASSWORD keyword is specified, but its value is omitted.

PASSWORD keyword is ignored with message ICH21045I.

PASSWORD

USER(user)

INTERVALNOINTERVAL keyword is omitted.

USER keyword is ignored and message ICH08027I is issued.

Notes:

  1. As in previous releases, when a new RACF database is initialized through the IRRMIN00 utility, the IBMUSER user ID is created with a password value of 'SYS1'
  2. In previous releases, if the ADDUSER command was issued without the PASSWORD keyword:
    • RACF common command exit (IRREVX01) received the ADDUSER command with the PASSWORD keyword, but without a value for PASSWORD. With APAR OA48667, the PASSWORD keyword is not passed to the exit.
    • Type 80 record for the ALTUSER event code indicated that the PASSWORD keyword was specified. With APAR OA48667, the Type 80 record no longer indicates that the PASSWORD keyword was specified.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

z/OS V2R2 with APAR OA48667 applied.

Applies to upgrade from:

z/OS V2R2 without APAR OA48667 applied.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you rely on RACF to create a default password.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Follow these steps:

  1. Identify any programs or jobs that issue RACF commands with the following conditions:
    • ADDUSER command that does not specify the PASSWORD keyword.
    • ADDUSER and ALTUSER commands that specify the PASSWORD keyword, but omit an explicit password value.
    • Programs that call the ADMN_RUN_COMD function of the R_admin SAF callable service (IRRSEQ00) on the ADDUSER, ALTUSER, or PASSWORD commands, as described here.
    • Programs that call the ADMN_ADD_USER or ADMN_ALT_USER functions of the R_admin SAF callable service (IRRSEQ00) with input parameter lists that are functionally equivalent to the ADDUSER, ALTUSER, or PASSWORD commands, as described here.
  2. Depending on the condition listed above, either remove the command, change it to one that specifies an explicit password value, or leave it as-is and tolerate the change of behavior, as appropriate.

Example: Before APAR OA48667, the following ALTUSER command would reset the password for user BECKYH to the user's default group name: ALTUSER BECKYH PASSWORD. In z/OS V2R4, the PASSWORD operand is ignored. To reset a password, you must provide a temporary password explicitly: ALTUSER BECKYH PASSWORD(TEMP1234).

Reference information

For more information, see z/OS Security Server RACF Command Language Reference.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.2 : Security Server actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Security Server upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.23.2.1 : Security Server: Ensure that the ECC master key is activated in the CCA coprocessor


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In RACF, the RACDCERT command is used to manage RACF digital certificates. When you specify RACFDCERT with the RSA(PKDS) keyword for an RSA private key, RACF stores the RSA private key in the ICSF PKA key data set (PKDS).

Starting in z/OS V2R4, the RSA private key is stored in PKDS under a more secure master key that is called the ECC master key (32 bytes). In previous releases, the RSA private key was stored in PKDS under a 24-byte master key called the RSA master key. With this change, you must ensure that the ECC master key is activated in the CCA coprocessor. Otherwise, the RACDCERT command that attempting to store an RSA key in PKDS fails with an error.

This change is intended to help maintain strong security in your enterprise. It also supports the generation of a new signature algorithm on certificates that are used for TLS1.3, which is introduced in z/OS V2R4.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if your installation uses the RACF RACDCERT command with the RSA(PKDS) keyword and you did not activate the ECC master key in the CCA coprocessor.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

The RACDCERT command fails with reason code x'00002B08' and the following message:

IRRRD117I Unexpected ICSF CSNDPKG return code x'00000008 ' and reason code x'00002B08'. The request is not processed.

Related IBM Health Checker for z/OS check:

To detect an active ECC master key and the availability of a coprocessor CCA-5.3 or above, use health check IBMICSF,ICSF_PKCS_PSS_SUPPORT.

Based on this status, the health check indicates whether PKCS-PSS algorithms can be used under current conditions.

This health check is available with APAR OA56837.

Steps to take

Look for uses of the RACDCERT command specified with the RSA(PKDS) keyword. For example:

RACDCERT GENCERT...RSA(PKDS(...)) RACDCERT REKEY...RSA(PKDS(...)) RACDCERT ADD ...PKDS(...)

If so, verify that the ECC master key is activated before these commands are used on a z/OS V2R4 system. You can use either of the following approaches:

  • Open ICSF panel option 1 and check the CCA coprocessor ECC master keys status.
  • Run the ICSF ECC master key health check.

Reference information

None.

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMICSF,ICSF_PKCS_PSS_SUPPORT.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.23.2.2 : Security Server: Accommodate the removal of certain CA certificates from RACF


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R3, the following CA certificates were removed from RACF:

  • VeriSign Class 1 Public Primary Certificate Authority
  • VeriSign Class 2 Public Primary Certificate Authority
  • VeriSign Class 3 Public Primary Certificate Authority
  • VeriSign Class 1 Public Primary Certificate Authority Generation 2 (G2)
  • VeriSign Class 2 Public Primary Certificate Authority - G2
  • VeriSign Class 3 Public Primary Certificate Authority - G2
  • VeriSign Class 4 Public Primary Certificate Authority - G2
  • VeriSign Class 1 Public Primary Certificate Authority - G3
  • VeriSign Class 2 Public Primary Certificate Authority - G3
  • VeriSign Class 3 Public Primary Certificate Authority - G3
  • VeriSign Class 3 Public Primary Certificate Authority - G4
  • VeriSign Class 3 Public Primary Certificate Authority - G5
  • VeriSign Class 4 Public Primary Certificate Authority - G3
  • VeriSign Universal Root Certification Authority
  • Thawte Server Certification Authority
  • Thawte Premium Server Certification Authority
  • Thawte Personal Basic Certification Authority
  • Thawte Personal Freemail Certification Authority
  • Thawte Personal Premium Certification Authority
  • Integration Certification Authority Root
  • Entrust Secure Server Root Certificate Authority
  • Equifax Secure Certificate Authority
  • ICP-Brasil Certificate Authority - Version 1

In previous releases, these certificates were provided as a convenience, so that you would not need to define them. As shipped, the certificates were not connected to any key ring and were defined as untrusted, by default.

However, some z/OS installations preferred not to have extra CA certificates in their systems. Though it is possible to delete the unwanted CA certificates, RACF recreated the default list of CA certificates after every system IPL. Therefore, to delete the CA certificates, it was necessary to delete them after each IPL.

In z/OS V2R3, the number of RACF supplied CA certificates is reduced to the following set:

STG Code Signing Certificate Authority certificate
Issued by IBM for RACF program signature verification for V2R1 and earlier.
STG Code Signing Certificate Authority – G2 certificate
Issued by IBM for RACF program signature verification for V2R2 and later.
GeoTrust Global Certificate Authority certificate
Required for the SMP/E process.

If your installation uses one or more of the removed CA certificates, you might have a upgrade action to perform. See "Steps to take."

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

z/OS V2R3

Applies to upgrade from:

z/OS V2R2.

Timing:

Before IPLing z/OS V2R4

Is the upgrade action required?

Yes, if you depend on certain CA certificates that RACF added at each system IPL.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For an existing RACF database:

  • If you want to keep the shipped CA certificates in your RACF database, there is no action to take. The certificates remain in your RACF database until you delete them.
  • If you do not want the previously shipped CA certificates (other than the STG and GeoTrust certificates) to be automatically added to your RACF database, and you have deleted them, there is no action to take. You no longer need to delete the certificates after every IPL.

If you are creating a new RACF database for a z/OS V2R4 system, and you want to include the previously shipped CA certificates in the new RACF database, you can do either of the following:

  • Download the certificates from the appropriate certificate authority websites.
  • Copy the certificates from your existing RACF database to your new database by doing the following:
    1. Use the RACDCERT EXPORT command to export the certificates from your existing RACF database.
    2. Use the RACDCERT ADD command to add the certificates to your new RACF database.

Reference information

For more information, see z/OS Security Server RACF Security Administrator's Guide.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.2.3 : Security Server: Check for duplicate class names


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

When new classes are shipped with RACF, you should verify that any installation-defined class names that have been added to the class descriptor table (CDT) do not conflict with the new classes.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have user-defined classes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Verify that any installation-defined class names that have been added to the class descriptor table (CDT) do not conflict with the new classes.

  • If you have duplicate class names, RACF issues the following message and enters failsoft mode:
    ICH564A RACF DETECTED AN ERROR IN THE INSTALLATION CLASS DESCRIPTOR TABLE, ENTRY class_name, ERROR CODE 7
  • If a conflict in class names occurs, resolve it as follows:
    1. Delete the profiles in the installation-defined class with the conflicting name.
    2. Delete the CDT entry for the class.
    3. Add a CDT entry with a different name.
    4. Redefine the profiles.

Reference information

For a list of the new classes that are shipped with RACF, see Summary of changes for z/OS Version 2 Release 4 (V2R4) in the IBM publication Security Server RACF Macros and Interfaces.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.2.4 : Security Server: Accommodate the increase of the maximum length of JESJOBS class profiles


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, and previous releases with RACF APAR OA57721 applied, the maximum length of profiles in the RACF JESJOBS class is increased from 39 to 246. This change is intended to accommodate new resource names for the JES2 encryption of spool data sets.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

z/OS V2R3 and z/OS V2R2, with APAR OA57721 applied.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2, without APAR OA57721 applied.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have programs that are affected by the increase of the maximum length of JESJOBS class profiles in RACF.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Check your programs to determine whether they are affected by the increase of the maximum length of JESJOBS class profiles in RACF. Look for programs that retrieve RACF profiles in the JESJOBS class by using the RACROUTE REQUEST=EXTRACT macro with the following keyword values specified:

  • TYPE=EXTRACTN or MATCHGN=YES
  • ENTITY=, or ENTITYX= with a buffer size of less than 246 bytes

If any such programs exist, change the programs to use the ENTITYX= keyword with a buffer length of at least 246 bytes. If possible, use the maximum size buffer of 255.

Reference information

For information about the RACROUTE REQUEST=EXTRACT ENTITY, ENTITYX, TYPE=EXTRACTN, and MATCHGN=YES keywords, see z/OS Security Server RACROUTE Macro Reference.

For information about the MAXLENX keyword of the ICHERCDE macro, see z/OS Security Server RACF Macros and Interfaces.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.23.3 : Security Server actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes Security Server upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.23.3.1 : Security Server: Update database templates


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

To ensure that the RACF utilities function properly, use the IRRMIN00 utility to update the test and production RACF databases with the database templates for the current release level.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

Security Server.

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

After the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

To install the database template updates, run the IRRMIN00 utility with PARM=UPDATE.

Tip: The RACF database templates are updated for z/OS V2R4. The templates initially contain a version string with the value HRF77C0 00000223.00000050.

Note: If IRRMIN00 produces a return code of 4 and message IRR8025 PARM=UPDATE specified, but template update not required, you do not necessarily have a problem. Check that your JCL refers to the new level of IRRMIN00. If so, you can ignore the return code and warning message. Possibly, a previous PTF already updated your templates to the current level for the new release. Otherwise, if your JCL refers to an old copy of IRRMIN00, correct the JCL and run IRRMIN00 again.

Reference information

For more information, see the following references:

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.24 : SMP/E upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element System Modification Program/Extended (SMP/E).


Step 4.24.1 : SMP/E actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SMP/E migration actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.24.1.1 : SMP/E: Accommodate the removal of Planning and Migration Assistant


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, the Planning and Migration Assistant (PMA) function is removed from SMP/E. This change affects programs that use the ISPF tables that are generated by PMA, and users who use PMA when they order IBM products.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

SMP/E

When change was introduced:

z/OS V2R4. Announced as a Statement of Direction in IBM United States Software Announcement 218-236, dated May 15, 2018.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you use the PMA functions.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether you have users or programs who use the PMA functions. If not, you have no action to take.

Otherwise, for programs that use the PMA-generated ISPF tables, update the programs to use another method for retrieving information about installed products. Programs can use a combination of the SMP/E programming interface (GIMAPI) and z/OSMF Software Management REST APIs to retrieve this information.

Note:

Data from the CustomPac order inventory is no longer available.

Instead of PMA, users can use the following:

  • Functions available on Shopz to create the orders for replacement sets of products
  • SMP/E LIST commands to retrieve information about installed products and features
  • z/OSMF Software Management to display information about defined software instances.
Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.24.2 : SMP/E actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SMP/E upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.24.3 : SMP/E actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes SMP/E upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.25 : TSO/E upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element Time Sharing Option/Extensions (TSO/E).


Step 4.25.1 : TSO/E actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes TSO/E upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run once they are made.


Step 4.25.1.1 : TSO/E: Check for programs that expect RC 0 for invalid command invocations


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Usually, when a command is not found or fails, TSO/E command processing responds with return code 12 (RC12). However, for one type of command error, in which the command name exceeds 8 characters or contains an invalid character, TSO/E command processing responds with return code zero (RC 0).

In z/OS V2R4, this behavior is corrected. TSO/E command processing is updated to return RC 12 for situations in which the command name exceeds 8 characters or contains an invalid character.

This change in behavior applies to the following types of processing:

  • CLIST processing in which the return code is checked in the &LASTCC variable
  • Batch TMP jobs that use conditional processing that is based on return code.

For example, in previous releases, the command ABCDEFGH# receives return code 0 and the message:

IKJ56621I INVALID COMMAND NAME SYNTAX

As of z/OS V2R4, the command ABCDEFGH# receives return code 12 and the same message.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

TSO/E

When change was introduced:

z/OS V2R4.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you have programs that create command names based on user input or file input.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

In some rare situations, a CLIST or multi-step background TMP job might expect return code 0 from a syntactically incorrect command name. Check for any programs that might issue a syntactically incorrect command name as a result of creating the command name based on user input or file input. If so, update the programs so that they correctly handle return code 12 for such errors.

Reference information

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.25.1.2 : TSO/E: Stop using the Server-Requester Programming Interface (SRPI)


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

As of z/OS V2R4, the Server-Requester Programming Interface (SRPI) is no longer supported. This API was introduced in TSO/E in the 1980s to provide a programming interface that enhances the environment of IBM workstations communicating with IBM mainframes running z/OS.

Support related to SRPI will be discontinued in TSO/E by removing the MVSSERV command and associated interfaces and functions. Documentation for SRPI-related functions, such as the MVSSERV command, are planned to be removed.

If your applications use SRPI, IBM recommends that you migrate to TCP/IP for z/OS for similar function.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

TSO/E

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement 217-085, "IBM z/OS Version 2 Release 3 - Engine for digital transformation," dated February 21, 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

Yes, if you are using the SRPI function.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Identify any applications that are using the SRPI functions, and modify them to use TCP/IP for z/OS.

Look for references to the MVSSERV command or the following macros in your programs:

  • CHSCED
  • CHSDCPRB
  • CHSTRACE
  • DEFSERV
  • INITTERM
  • SENDREC

With TSO/E APAR OA50655 on z/OS V2R2, you can use the generic tracker facility to track the usage the MVSSERV command. Specifically, the generic tracker can check for EVENTDESC: 'MVSSERV CALL'.

The following is an example of the generic tracker output:

INSTANCE: 1 COUNT: 1 EVENTDESC:'MVSSERV CALL' OWNER: IBMTSO SOURCE: MVSSERV EVENTDATA: x0000000000000000 x0000000000000000 PROGRAM: CHSTCPS PROGRAMOFFSET: x0000000000000000 HOMEJOB: IBMUSER HOMEASID: x0022 EVENTJOB: IBMUSER EVENTASID: x0022 AUTHORIZED:NO FIRST TIME: 2016-06-09 06:13:02

Reference information

For information about the generic tracker facility, see z/OS MVS Diagnosis: Tools and Service Aids.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.25.2 : TSO/E actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes TSO/E upgrade actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.25.3 : TSO/E actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes TSO/E upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.26 : XL C/C++ upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for optional feature XL C/C++.


Step 4.26.1 : XL C/C++ actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes XL C/C++ upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.26.1.1 : XL C/C++ Review the Compiler and Runtime Migration Guide for the Application Programmer


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

For any z/OS XL C/C++ upgrade actions, see the publication z/OS XL C/C++ Compiler and Runtime Migration Guide for the Application Programmer. It is written for application programmers, whereas the z/OS Upgrade Workflow is intended for z/OS system programmers. In some customer locations, job scope can overlap such that system programmers might find information in the z/OS XL C/C++ publication that is relevant to their responsibilities. For example, upgrade information related to the c89 utility in the z/OS XL C/C++ publication could be of interest.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS XL C/C++

When change was introduced:

General upgrade action not tied to a specific release.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before installing z/OS V2R3.

Is the upgrade action required?

No, but recommended if you use z/OS XL C/C++.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

For upgrade information that is relevant to your installation, see z/OS XL C/C++ Compiler and Runtime Migration Guide for the Application Programmer.

Reference information

For more information, see z/OS XL C/C++ Compiler and Runtime Migration Guide for the Application Programmer.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.26.2 : XL C/C++ actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes XL C/C++ upgrade actions that you can perform only before you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.


Step 4.26.2.1 : XL C/C++ Accommodate the changes to default ARCH and TUNE level


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, the default ARCH level is changed from ARCH(8) to ARCH(10), and the default TUNE level is changed from TUNE(8) to TUNE(10).

ARCH(10) produces code that uses instructions available on the 2827-xxx (IBM zEnterprise EC12 (zEC12)) and 2828-xxx (IBM zEnterprise BC12 (zBC12)) models in z/Architecture mode. Specifically, these ARCH(10) machines and their follow-ons add instructions that are supported by the execution-hint facility, the load-and-trap facility, the miscellaneous-instruction-extension facility, and the transactional-execution facility. More information about these facilities is provided in z/Architecture Principles of Operation, SA22-7832.

TUNE(10) generates code that is executable on all models, but is optimized for the 2827-xxx (IBM zEnterprise EC12 (zEC12)) and 2828-xxx (IBM zEnterprise BC12 (zBC12)) models.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS XL C/C++

When change was introduced:

z/OS V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you specify a lower ARCH level to generate code for lower hardware levels on other systems.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Users can still specify lower arch levels, as before. Only the default is changing. Using the TARGET option to target any OS level before V2R3 changes the default architecture level to the ALS for that OS level. For example, ARCH(8) for V2R2.

Reference information

For upgrade information that is relevant to your installation, see z/OS XL C/C++ Compiler and Runtime Migration Guide for the Application Programmer.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.26.3 : XL C/C++ actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes XL C/C++ upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.27 : z/OS OpenSSH upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for the base element z/OS OpenSSH.


Step 4.27.1 : z/OS OpenSSH actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS OpenSSH migration actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.27.2 : z/OS OpenSSH actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS OpenSSH migration actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed, but do not require it to be active.


Step 4.27.2.1 : OpenSSH: Accommodate a new level of OpenSSH


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

In z/OS V2R4, OpenSSH is upgraded to include the new open source version OpenSSH 7.6p1. This level is referred to as OpenSSH V2R4. The previous version of OpenSSH was Version 6.4p1.

With z/OS OpenSSH V2R4, significant new features include:

  • Elliptic-curve DSA keys are now supported in key rings and FIPS.
  • Support new key algorithms: ssh-ed25519 and ssh-ed25519-cert-v01@openssh.com
  • Support new key exchange algorithms: diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, curve25519-sha256, and curve25519-sha256@libssh.org.
  • Support new cipher algorithms: chacha20-poly1305@openssh.com
  • SMF Type 119 subtype 94 and 95 (ssh / sshd connection started) records include a section that identifies the IP addresses and ports for the connection.
  • Command ssh-proxyc is added, which can be used by the SSH client to connect through SOCKS5 proxy servers.

With z/OS OpenSSH V2R4, the following features are no longer available (they are deprecated by the Open Source community in OpenSSH 7.6p1):

  • SSH Version 1 protocol (also referred to as SSH1).
    • These options from ssh_config are removed: Cipher, CompressionLevel, RhostsAuthentication, RhostsRSAAuthentication, RSAAuthentication.
    • These options from sshd_config are removed: KeyRegenerationInteval, RhostsAuthentication, RhostsRSAAuthentication, RSAAuthentication, ServerKeyBits, UseLogin, and PAMAuthenticationViaKbdInt.
  • These options from sshd_config are removed: KeyRegenerationInteval, RhostsAuthentication, RhostsRSAAuthentication, RSAAuthentication, ServerKeyBits, UseLogin, and PAMAuthenticationViaKbdInt.
  • These options from sshd_config are removed: KeyRegenerationInteval, RhostsAuthentication, RhostsRSAAuthentication, RSAAuthentication, ServerKeyBits, UseLogin, and PAMAuthenticationViaKbdInt.
  • These options from sshd_config are removed: KeyRegenerationInteval, RhostsAuthentication, RhostsRSAAuthentication, RSAAuthentication, ServerKeyBits, UseLogin, and PAMAuthenticationViaKbdInt.
  • Support for Blowfish and RC4 ciphers and the RIPE-MD160 HMAC (Hash Message Authentication Code), specifically: blowfish-cbc, cast128-cbc, arcfour, arcfour128, arcfour256, hmac-ripemd160, hmac-ripemd160@openssh.com, and hmac-ripemd160-etm@openssh.com.
  • Support for Blowfish and RC4 ciphers and the RIPE-MD160 HMAC (Hash Message Authentication Code), specifically: blowfish-cbc, cast128-cbc, arcfour, arcfour128, arcfour256, hmac-ripemd160, hmac-ripemd160@openssh.com, and hmac-ripemd160-etm@openssh.com.

With z/OS OpenSSH V2R4, the following features are no longer enabled by default:

  • Support for the 1024-bit Diffie-Hellman key exchange, specifically diffie-hellman-group1-sha1
  • Support for DSA (ssh-dss, ssh-dss-cert-*) host and user keys
  • Support for MD5-based and truncated MD5 and SHA1 HMAC algorithms, specifically: hmac-md5, hmac-md5-96@openssh.com, hmac-sha1-96, hmac-sha1-96@openssh.com, hmac-md5-etm@openssh.com, hmac-md5-96-etm@openssh.com, hmac-sha1-96-etm@openssh.com
  • Support for MD5-based and truncated MD5 and SHA1 HMAC algorithms, specifically: hmac-md5, hmac-md5-96@openssh.com, hmac-sha1-96, hmac-sha1-96@openssh.com, hmac-md5-etm@openssh.com, hmac-md5-96-etm@openssh.com, hmac-sha1-96-etm@openssh.com

z/OS OpenSSH V2R4 also includes enhancements to existing keywords.

For a list of the z/OS OpenSSH V2R4 changes that might require upgrade actions, see "Steps to take" in this workflow step.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS OpenSSH.

When change was introduced:

z/OS V2R4. Also, see IBM United States Software Announcement "IBM z/OS Version 2 Release 3 enhancements and statements of direction," dated November 21, 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if any of the changes in "Steps to take" are applicable to your environment.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

IBM provides the following health checks:

  • Use health check ZOSMIGV2R4_SSH_CONFIG is to check the settings in the SSH config file. The default check path is /etc/ssh/ssh_config.
  • Use health check ZOSMIGV2R4_SSHD_CONFIG is to check the settings in SSH daemon config file. The default check path is /etc/ssh/sshd_config.
  • These checks are available for z/OS V2R3 and z/OS V2R2 with APAR OA57724 applied.

Steps to take

The following sections describe potential upgrade actions for the OpenSSH base element.

Changes to the ssh_config file

What Changed Customization action needed?

The BatchMode keyword

Previously, authentication without passphrase/password querying in batch mode did not includeSSH_ASKPASS. Now, match mode allows SSH_ASKPASS to be used for authentication.

No, SSH_ASKPASS is not listed as an available authentication option in the previous version.

The Ciphers keyword

Previously, chacha20-poly1305@openssh.com is not supported. Now chacha20-poly1305@openssh.com isadded to the default list. Also, preciously ‘+’ or ‘-’ character is not supported at the beginning of a specified value. Now ‘+’ or ‘-’ character is allowed to be used at the beginning of a specified cipher algorithm to append it to the default cipher list.

Yes, if you use the previous default list and do not want to allow the new cipher or the neworder of the preferred ciphers.

Action: Specify the previous default list without the deprecated ciphers blowfish-cbc, arcfour, arcfour128, arcfour256, and cast128-cbc.

The ControlPath keyword

Previously, ‘%%’ is not supported in the ControlPath argument. Now, if the argument contains‘%%’, it is interpreted as a literal percent sign (%).

No, ControlPath argument that contains ‘%%’ was not considered as a valid option in the previousversion.

The ControlPersist keyword

Previously, the argument ‘0’ is not supported. Now, if the argument is set to ‘0’, it is the same as setting the argument to ‘yes’ to allow the primary connection to remain in the backgroundindefinitely.

No, setting ControlPersist to 0 was not considered as a valid option in the previous version.

The HostKeyAlgorithms keyword

Previously, ssh-ed25519 and ssh-ed25519-cert-v01@openssh.com are not supported. Now, ssh-ed25519and ssh-ed25519-cert-v01@openssh.com are supported and these algorithms are added to the defaultlist. Also, preciously ‘+’ or ‘-’ character is not supported at the beginning of a specified value.Now ‘+’ or ‘-’ character is allowed to be used at the beginning of a specified cipher algorithm toappend it to the default list of host key algorithms.

The complete list of host key algorithms that are used by ssh can be found in ssh_config (seeHostKeyAlgorithms).

Yes, if you use the previous default list and do not want to allow the new host key algorithms orthe new order of the preferred host key algorithms.

Action: Specify the previous default list without the deprecated host key algorithms:ssh-dss-cert-v00@openssh.com and ssh-rsa-cert-v00@openssh.com.

The HostName keyword

Previously, ‘%%’ is not supported in the HostName argument. Now, if the argument contains ‘%%’,it is interpreted as a literal percent sign (%).

No, HostName argument that contains ‘%%’ was not considered as a valid option in the previousversion.

The IdentityFile keyword

Previously, the default list of SSH protocol version 2 did not contain Ed25519 authenticationidentity ~/.ssh/id_ed25519. Now ~/.ssh/id_ed25519 is added and the default list of identities is~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519, and ~/.ssh/id_rsa.

Previously ‘%%’ was not supported in the IdentityFile argument. Now, if the argument contains‘%%’, it is interpreted as a literal percent sign (%).

Yes, if you use the previous default list and do not want to allow the new identity file or thenew order of the preferred identity file.

Action: Specify the previous default list but note that SSH protocol version 1 identity is no longer supported.

The KexAlgorithms keyword

Previously, the default list does not contain curve25519-sha256, curve25519-sha256@libssh.org,diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, and diffie-hellman-group18-sha512.Now, the default KEX list contains curve25519-sha256, curve25519-sha256@libssh.org,diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, and diffie-hellman-group18-sha512.Also, preciously ‘+’ or ‘-’ character is not supported at the beginning of a specified value. Now‘+’ or ‘-’ character is allowed to be used at the beginning of a specified KEX algorithm to appendit to the default KEX list.

Yes, if you use the previous default list and do not want to allow the new key exchange algorithmfile or the new order of the preferred key exchange algorithm file.

Action: Specify the previous default list.

The LocalCommand keyword

Previously, ‘%%’ is not supported in the LocalCommand argument. Now, if the argument contains‘%%’, it is interpreted as a literal percent sign (%).

No, LocalCommand argument that contains ‘%%’ or set to ‘none’ was not considered as a validoption in the previous version.

The LocalForward keyword

Previously, the argument does not contain the UNIX socket format[bind_address:]port:host:hostport, local_socket:host:hostport, and local_socket:remote_socket. Nowthe argument allows you to specify UNIX socket format [bind_address:]port:host:hostport,local_socket:host:hostport, and local_socket:remote_socket for local forward connection.

No, UNIX socket is not allowed to use for local forward connection in the previous version.

The ProxyCommand keyword

Previously, ‘%%’ is not supported in the argument. Now, if the argument contains ‘%%’, it isinterpreted as a literal percent sign (%).

Also, the argument ‘none’ is not supported. Now, if the argument is set to ‘none’, the ability of ProxyCommand to use command to connect to the server is unavailable. Further, ssh-proxyc was not available in the previous version. Now, ProxyCommand can be used with ssh-proxyc.

No. ProxyCommand argument that contains ‘%%’ or set to ‘none’ was not considered as a validoption in the previous version. And ssh-proxyc was not available in the previous version.

The RemoteForward keyword

Previously, the argument does not allow the UNIX socket format [bind_address:]port:local_socket,remote_socket:host:hostport, remote_socket:local_socket nor does it allow SOCKS 4 or 5 proxy format[bind_address:]port. Now, the argument allows you to use UNIX socket format[bind_address:]port:local_socket, remote_socket:host:hostport, remote_socket:local_socket. And[bind_address:]port format is allowed to let ssh act as a SOCKS 4 or 5 proxy and forward connections.

No, the newly added arguments were not valid in the previous version.

The SendEnv keyword

Previously, the TERM environment variable is not sent if TERM is not specified in sshd_configAcceptEnv keyword whenever the client requests a pseudo-terminal. Now, the TERM environment variableis always sent whenever a pseudo-terminal is requested, as it is required by the protocol.

Yes, if previously TERM was not specified as an environment variable for sshd_configAcceptEnv.

Action: Unset TERM unless you do not need it and do not want to send it. Otherwise, sshsends the TERM environment variable by default.

The StrictHostKeyChecking keyword

Previously, the argument ‘accept-new’ or ‘off’ is not supported. Now, the argument ‘accept-new’ is used to let ssh automatically add new host keys to the user known hosts files but refuse connections to hosts with changed host keys. The argument ‘off’ is used the same as ‘no’ to automatically add new host keys to the user known hosts files and allow connections to hosts with changed host keys to proceed.

No, setting StrictHostKeyChecking to ‘accept-new’ or ‘off’ was not considered as a valid optionin the previous version.

Changes to the sshd_config file

What Changed Customization action needed?

The AllowUsers keyword

Previously, the CIDR address/masklen format was not supported for the HOST criteria.

Now, HOST criteria can contain addresses to match in CIDR address/masklen format.

No. The CIDR address/masklen format is not valid in the previous version.

The AuthenticationMethods keyword

Previously, "any" as the string was not supported.

Now, “any” to indicate the default behavior of accepting any single authentication method.

No, “any” is not valid in the previous version.

The AuthorizedKeysCommand keyword

Previously, tokens (%%, %f, %h, %k, %t, and %u) were not supported for AuthorizedKeysCommand.

Now, arguments to AuthorizedKeysCommand accept the tokens. If no arguments are specified, the username of the target user is used.

No. Tokens were not valid in the previous version.

The Ciphers keyword

Previously, chacha20-poly1305@openssh.com algorithm is not supported by Cipher. Now the cipher supportschacha20-poly1305@openssh.com algorithm and added it into the default list.

Previously, ‘+’ character and ‘-’ character were not supported. Now, if the specified valuebegins with a ‘+’ character, the specified methods are appended to the default set instead ofreplacing them. If the specified value begins with a ‘-’ character, the specified methods (includingwildcards) are removed from the default set, instead of replacing them.

Yes, if you use the previous default list and do not want to allow the new cipher or the neworder of the preferred ciphers.

‘+’ character and ‘-’ character is not valid in the previous version.

Action: Specify the previous default list without the deprecated ciphers blowfish-cbc, arcfour, arcfour128, arcfour256, and cast128-cbc.

The DenyUsers keyword

Previously, address/masklen format was not supported for the HOST criteria. Now, HOST criteriacan additionally contain addresses to match in CIDR address/masklen format.

No, CIDR address/masklen format is not valid in the previous version.

The HostKey keyword

Previously, the default host key was /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_dsa_key, and/etc/ssh/ssh_host_ecdsa_key, for protocol version 2.

Now, the default host key is /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_dsa_key,/etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_ed25519_key.

Yes, if you want to use the previous default host key for protocol version 2 and don't want touse host key /etc/ssh/ssh_host_ ed25519_key.

Action: Specify the previous default host key.

The KexAlgorithms keyword

Previously, ‘+’ character and ‘-’ character were not supported. Now, if the specified valuebegins with a ‘+’ character, the specified methods are appended to the default set instead ofreplacing them. If the specified value begins with a ‘-’ character, the specified methods (includingwildcards) are removed from the default set, instead of replacing them.

Previously, the default KexAlgorithms List did not contain diffie-hellman-group14-sha256,diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, curve25519-sha256, and curve25519-sha256@libssh.org.Now the defaultKexAlgorithms list contains diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, curve25519-sha256, and curve25519-sha256@libssh.org.

Yes, if you use the previous default list and do not want to allow the new KexAlgorithms. Theprevious default list was ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1, diffie-hellman-group1-sha1.

‘+’ character and ‘-’ character is not valid in the previous version.

Action: Specify the previous default list.

The Match keyword

Previously, CIDR address/masklen format was not supported for the Address criteria. Now, addresscriteria can additionally contain addresses to match in CIDR address/masklen format.

Previously, the keywords that could be used on the lines that follow Match did not containAllowStreamLocalForwarding, AuthorizedPrincipalsCommand, AuthorizedPrincipalsCommandUser,ClientAliveCountMax, ClientAliveInterval, HostbasedAcceptedKeyTypes, IPQoS, LogLevel, PermitUserRC,PubkeyAcceptedKeyTypes, RevokedKeys, StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys.

RhostsRSAAuthentication and RSAAuthentication are contained in the keyword list that can be usedon the lines that follow Match.

Now, the keywords that can be used on the lines that follow Match includeAllowStreamLocalForwarding, AuthorizedPrincipalsCommand, AuthorizedPrincipalsCommandUser,ClientAliveCountMax, ClientAliveInterval, HostbasedAcceptedKeyTypes, IPQoS, LogLevel, PermitUserRC,PubkeyAcceptedKeyTypes, RevokedKeys, StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys,and do not contain RhostsRSAAuthentication and RSAAuthentication.

No. CIDR address/masklen format is not valid in the previous version. Similarly, the followingare not valid: AllowStreamLocalForwarding, AuthorizedPrincipalsCommand,AuthorizedPrincipalsCommandUser, ClientAliveCountMax, ClientAliveInterval,HostbasedAcceptedKeyTypes, IPQoS, LogLevel, PermitUserRC, PubkeyAcceptedKeyTypes, RevokedKeys,StreamLocalBindMask, StreamLocalBindUnlink, TrustedUserCAKeys.

The PermitOpen keyword

Previously, none and * was not supported. Now, none can be used to prohibit all forwardingrequests and the wildcard ‘*’ can be used for host or port to allow all hosts or ports.

No. None and * are not valid in the previous version.

The RevokedKeys keyword

Previously, none was not a supported value. Now, none is used to indicate not use one.

No. None is not valid in the previous version.

The TrustedUserCAKeys keyword

Previously, none is not a supported value. Now, none is used to indicate not use one.

No. None is not valid in the previous version.

The XauthLocation keyword

Previously, none is not a supported value. Now, none is used to indicate not use one.

No. None is not valid in the previous version.

Changes to the ssh command

What Changed Customization action needed?

The -c option

Previously, chacha20-poly1305@openssh.com is not supported. Now chacha20-poly1305@openssh.com isadded to the default list.

The complete list of ciphers that are used by ssh can be found in ssh_config (see Ciphers).

Yes, if you use the previous default list and do not want to allow the new cipher or the neworder of the preferred ciphers.

Action: Specify the previous default list without the deprecated ciphers blowfish-cbc,arcfour, arcfour128, arcfour256, and cast128-cbc.

The -i option

Previously, the default list of SSH protocol version 2 did not contain Ed25519 authenticationidentity ~/.ssh/id_ed25519. Now ~/.ssh/id_ed25519 is added and the default list of identities is~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519, and ~/.ssh/id_rsa.

Yes, if you use the previous default list and do not want to allow the new identity file or thenew order of the preferred identity file.

Action: Specify the previous default list but note that SSH protocol version 1 identity isno longer supported.

The -L option

Previously, the argument does not contain the UNIX socket format[bind_address:]port:host:hostport, local_socket:host:hostport, and local_socket:remote_socket. Now,the argument allows you to use UNIX socket format [bind_address:]port:host:hostport,local_socket:host:hostport, and local_socket:remote_socket for local forward connection.

No, UNIX socket is not allowed to use for local forward connection in the previous version.

The -O option

Previously, ‘forward’, ‘cancel’, ‘proxy’ and ‘stop’ arguments are not supported. Now ‘forward’ isused to request forwarding without command execution; ‘cancel’ is used to cancel forwarding; ‘proxy’is used to start multiplexing proxy mode; ‘stop’ is used to request the primary to stop acceptingfurther multiplexing requests.

No, the newly added arguments were not valid in the previous version.

The -Q option

Previously, the available arguments do not include ‘cipher-auth’, ‘key-cert’, ‘key-plain’ and‘protocol-version’. Now, ‘cipher-auth’ is used to query supported symmetric ciphers that supportauthenticated encryption, ‘key-cert’ is used to query certificate key types, ‘key-plain’ is used toquery non-certificate key types, and ‘protocol-version’ is used to query supported SSH protocolversions.

No, the newly added arguments were not valid in the previous version.

The -R option

Previously, the argument does not allow the UNIX socket format [bind_address:]port:local_socket,remote_socket:host:hostport, remote_socket:local_socket nor does it allow SOCKS 4 or 5 proxy format[bind_address:]port. Now, the argument allows you to use UNIX socket format[bind_address:]port:local_socket, remote_socket:host:hostport, remote_socket:local_socket. And[bind_address:]port format is allowed to let ssh act as a SOCKS 4 or 5 proxy and forwardconnections.

No, the newly added arguments were not valid in the previous version.

The ~C escape character

Previously, it does not allow cancellation of local forwarding. Now, -KL[bind_address:]port isallowed to cancel local forwarding in command line.

No, the added command is considered as invalid in the previous version.

Changes to the sshd command

What Changed Customization action needed?

The -h option.

Previously, the default host key was /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_dsa_key, and/etc/ssh/ssh_host_ecdsa_key, for protocol version 2.

Now the default host key is /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_dsa_key,/etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_ed25519_key.

Yes, if you want to use the previous default host key for protocol version 2 and don't want touse host key /etc/ssh/ssh_host_ed25519_key.

Action: Specify the previous default host key for protocol version 2.

Changes to the sftp command

What Changed Customization action needed?

The -f option for put and get subcommands.

Previously, sftp didn’t support fsync() calling.

Now a new option -f was added for fsync() calling. If the -f flag is specified, then it requeststhat files be flushed to disk immediately after transfer.

Yes. The sync() calling is only supported by servers that implement the "fsync@openssh.com"extension.

Action: If you want to use -f option, ensure that the server implements the"fsync@openssh.com" extension.

Changes to the ssh-keygen command

What Changed Customization action needed?

The -t option

Previously, ssh-keygen didn’t support key type ed25519.

Now, a new supported key type ed25519 was added.

No. Use this new key type as you need.

Changes to the ssh-keyscan command

What Changed Customization action needed?

The -t option

Previously, ssh-keyscan didn’t support key type ed25519.

Now, a new supported key type ed25519 was added.

No. Use this new key type as you need.

Changes to the ssh_config file that might require an upgrade action

What Changed Upgrade action needed?

The AFSTokenPassing keyword

Previously, this keyword indicated whether to pass AFS token to remote host when using SSHprotocol version 1. Now, AFSTokenPassing keyword is removed because SSH protocol version 1 is nolonger supported.

No. Because AFSTokenPassing is not supported on z/OS UNIX.

The Cipher keyword

Previously, this keyword specified the cipher to for encryption for SSH protocol version 1. Now,Cipher keyword is removed because SSH protocol version 1 is no longer supported.

Yes, if you are using any of the SSH protocol version 1 ciphers: 3des, blowfish, or des. If youspecify SSH protocol version 1 cipher in the ssh configuration file, a debug message “Deprecatedoption "Cipher"” is returned.

Action: Update your application. Do not specify to use SSH protocol version 1 and itsciphers. Use SSH protocol version 2 and its corresponding ciphers.

The Ciphers keyword

Previously, SSH protocol version 2 ciphers blowfish-cbc, arcfour, arcfour128, arcfour256,cast128-cbc, 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc are supported and listed in thedefault list. Now blowfish-cbc, arcfour, arcfour128, arcfour256, and cast128 are no longersupported; 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc are removed from the default cipherlist.

Yes, if you are using any of the listed ciphers: blowfish-cbc, arcfour, arcfour128, arcfour256,cast128-cbc, 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc.

Action: Do not specify to use blowfish-cbc, arcfour, arcfour128, arcfour256, orcast128-cbc. When specifying 3des-cbc, aes128-cbc, aes192-cbc, or aes256-cbc, specify the samecipher in sshd.

The CompressionLevel keyword

Previously, this keyword specified the compression level if compression is enabled when using SSHprotocol version 1. Now, CompressionLevel is removed because the compression level applies tocompression option in SSH protocol version 1 only and this version is no longer supported.

Yes, if you are using the SSH protocol version 1 and enabled compression option with a specifiedcompression level.

Action: Use SSH protocol version 2 without specifying compression option and itscompression level.

The HostKeyAlgorithms keyword

Previously, host key algorithms ssh-dss, ssh-dss-cert-v00@openssh.com,ssh-dss-cert-v01@openssh.com, and ssh-rsa-cert-v00@openssh.com are supported and listed in thedefault list. Now, ssh-dss-cert-v00@openssh.com ssh-rsa-cert-v00@openssh.com is no longer supported;ssh-dss and ssh-dss-cert-v01@openssh.com are removed from the default host key algorithms list.

Yes, if you are specifying ssh-dss, ssh-dss-cert-v00@openssh.com, ssh-dss-cert-v01@openssh.com orssh-rsa-cert-v00@openssh.com, or using the previous default host key algorithms list.

Action: Do not specify unsupported host key algorithms: ssh-dss-cert-v00@openssh.com andssh-rsa-cert-v00@openssh.com. When specifying ssh-dss or ssh-dss-cert-v01@openssh.com, specify thesame host key algorithm in sshd.

The IdentityFile keyword

Previously, SSH protocol version 1 identity ~/.ssh/identity is supported. Now SSH protocolversion 1 is no longer supported so ~/.ssh/identity or any other specified SSH protocol version 1identity is no longer available.

Yes, if you use the default identity list or SSH protocol version 1 identity such as~/.ssh/identity is specified. If specifying SSH protocol version 1 identity, error message “FOTS3785key_load_public: invalid format” is returned.

Action: Do not specify SSH protocol version 1 identity, use default SSH protocol version 2identities only.

The KeepAlive keyword

Previously, this keyword is kept for compatibility with versions of OpenSSH before 3.8.1p1 tospecify whether the system should send TCP keepalive messages to the other side. Now this keyword isno longer supported and is replaced by TCPKeepAlive.

Yes, if you are using this keyword to specify whether the system should send TCP keepalivemessages to the other side.

Action: Update your application. Use TCPKeepAlive instead of KeepAlive.

The KexAlgorithms keyword

Previously, the default list contains diffie-hellman-group1-sha1. Now, the default KEX list doesnot contain diffie-hellman-group1-sha1.

Yes, if you are specifying the use of diffie-hellman-group1-sha1. When specifyingdiffie-hellman-group1-sha1, an error message “no matching key exchange method found” isreturned.

Action: Do not use hellman-group1-sha1 as the only KEX algorithm.

The LocalForward keyword

Previously, IPv6 addresses could be specified with the syntax: [bind_address/]port/host/hostport.Now, the forward slash (/) is not supported as a separator in the format. IPv6 ad-dresses arespecified by enclosing the address in square brackets, such as[ipv6_bind_address:]port:host:hostport.

Yes, if you are using the previous format to specify the IPv6 address.

Action: Do not use the previous format, use [ipv6_bind_address:]port:host:hostport tospecify IPv6 address instead.

The MACs keyword

Previously, MAC algorithms hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are supported. Now, hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are no longer supported.

Also, the previous default MAC algorithm list contains hmac-ripemd160,hmac-ripemd160@openssh.com, hmac-ripemd160-etm@openssh.com, hmac-sha1-96,hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, andhmac-md5-96-etm@openssh.com.

Now the default list does not contain hmac-ripemd160, hmac-ripemd160@openssh.com,hmac-ripemd160-etm@openssh.com, hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5,hmac-md5-etm@openssh.com, hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Yes, if you specified any of the removed MAC algorithms: hmac-ripemd160,hmac-ripemd160@openssh.com and hmac-ripemd160-etm@openssh.com, or using MAC algorithms that aredisabled by default: hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com,hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Action: Do not specify unsupported MAC algorithms: hmac-ripemd160,hmac-ripemd160@openssh.com, and hmac-ripemd160-etm@openssh.com. To use hmac-sha1-96,hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, orhmac-md5-96-etm@openssh.com, specify the same MAC algorithm in sshd.

The Protocol keyword

Previously, this keyword specified the SSH protocol version to use. The available arguments are1 and 2. Now, because SSH protocol version 1 is no longer supported, argument ‘1’ is ignored andonly SSH protocol version 2 is used by default.

Yes, if you are specifying ‘1’ to use SSH protocol version 1. When ‘1’ is specified, thisargument is ignored and SSH protocol version 2 is used instead.

Action: Do not specify to use SSH protocol version 1, use the default SSH protocol version2.

The RemoteForwardkeyword

Previously, IPv6 addresses can be specified with a syntax: [bind_address/]port/host/hostport.Now, forward slash (/) is not supported as a separator in the format, IPv6 addresses are specifiedby enclosing the address in square brackets, such as [ipv6_bind_address:]port:host:hostport.

Yes, if you are using the previous format to specify the IPv6 address.

Action: Do not use the previous format, use [ipv6_bind_address:]port:host:hostport tospecify IPv6 address instead.

The RhostsRSAAuthentication keyword

Previously, this keyword indicated whether to try rhosts-based authentication with RSA hostauthentication in SSH protocol version 1. Now, this keyword is removed because SSH protocol version1 is no longer supported.

Yes, if you are using rhost-based authentication with RSA host authentication in SSH protocolversion 1. If specifying this keyword, error message “Unsupported option "RhostsRSAAuthentication"”is returned.

Action: Update your application. Do not specify the RhostsRSAAuthentication keyword.

The RSAAuthentication keyword

Previously, this keyword indicated whether to try RSA authentication in SSH protocol version 1.Now, this keyword is removed because SSH protocol version 1 is no longer supported.

Yes, if you are using RSA authentication in SSH protocol version 1. If specifying this keyword,error message “Unsupported option "RSAAuthentication"” is returned.

Action: Update your application. Do not specify the RSAAuthentication keyword.

The UsePrivilegedPort keyword

Previously, this keyword indicated whether to use a privileged port for outgoing connections.Now privileged port is not allowed to be used and this keyword is removed.

Yes, if you are using privileged port. If specifying UsePrivilegedPort, this keyword is ignored.

Action: Update your application. Do not specify the UsePrivilegedPort keyword.

Changes to the sshd_config file that might require an upgrade action

What Changed Upgrade action needed?

The AcceptEnv keyword

Previously, the TERM environment variable is not sent if TERM is not specified in the AcceptEnvkeyword whenever the client requests a pseudo-terminal.

Now, the TERM environment variable is always sent whenever the client requests apseudo-termina.l

Yes, if you specify TERM as an environment variable in AcceptEnv though ssh and sshd decidewhether TERM environment variable is copied into the session's environment.

Action: Avoid using TERM as the environment variable for SendEnv.

The AFSTokenPassing keyword

Previously, this keyword indicated whether to pass an AFS token to a remote host. It was notsupported in z/OS UNIX.

Now, AFSTokenPassing keyword is removed.

No. Because AFSTokenPassing is not supported on z/OS UNIX in previous version.

The Ciphers keyword

Previously, arcfour, arcfour128, arcfour256, blowfish-cbc, and cast128-cbc are supported byCipher. And 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc were in the default cipher list.

Now, arcfour, arcfour128, arcfour256, blowfish-cbc, and cast128-cbc algorithms are not supportedby Cipher and removed from the default list. And 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbcare removed from the default cipher list.

Yes, if you want to use any of the listed ciphers: arcfour, arcfour128, arcfour256, blowfish-cbc,cast128-cbc, 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc.

Action: Do not specify unsupported Cipher algorithm: arcfour, arcfour128, arcfour256,blowfish-cbc, and cast128-cbc.

Also, specify 3des-cbc, aes128-cbc, aes192-cbc, or aes256-cbc on the Ciphers keyword if you wantto use these cipher algorithms.

The Compression keyword

Previously, the default value is “no” and "delayed" means to enable delayed (zlib@openssh.com)compression only. Now, the default is “yes” and delayed is a legacy synonym for yes.

Yes, if you want to use the previous default value of compression and want to use delay to enabledelayed compression only.

Action: Specify no if you want to use the previous default value.

The HostKey keyword

Previously, the default host key is /etc/ssh/ssh_host_key for protocol version 1.

Now, the /etc/ssh/ssh_host_key is not supported because protocol version 1 is not supported.

Yes, if you want to use /etc/ssh/ssh_host_key as a file to contain a private host key.

Action: Do not specify /etc/ssh/ssh_host_key as a file for containing a private hostkey.

The KeepAlive keyword

Previously, this keyword specified whether the system should send TCP keepalive messages to theother side for OpenSSH version before 3.8.1p1.

Now, KeepAlive keyword is removed.

No. On systems that use OpenSSH 3.8.1p1 or later, use the keyword TCPKeepAlive instead.

The KexAlgorithms keyword

Previously, the default list contains diffie-hellman-group1-sha1.

Now, the default KexAlgorithms list does not contain diffie-hellman-group1-sha1.

Yes, if you want to use diffie-hellman-group1-sha1.

Action: Specify hellman-group1-sha1 on KexAlgorithms.

The MACs keyword

Previously, MAC algorithms hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are supported. Now, hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are no longer supported.

And previously, the default MAC algorithm list contains hmac-ripemd160,hmac-ripemd160@openssh.com, hmac-ripemd160-etm@openssh.com, hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5,hmac-md5-etm@openssh.com, hmac-md5-96, and hmac-md5-96-etm@openssh.com. Now the default list doesnot contain hmac-ripemd160, hmac-ripemd160@openssh.com, hmac- ripemd160-etm@openssh.com,hmac-sha1-96, hmac-sha1-96-etm@openssh.com,hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Yes, if you specified the unsupported MAC algorithms: hmac-ripemd160, hmac-ripemd160@openssh.comand hmac-ripemd160-etm@openssh.com, or are using MAC algorithms that are disabled by default:hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, andhmac-md5-96-etm@openssh.com.

Action: Do not specify unsupported MAC algorithms: hmac-ripemd160,hmac-ripemd160@openssh.com, and hmac-ripemd160-etm@openssh.com.

Specify hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, orhmac-md5-96-etm@openssh.com to MACs if you want to use these MAC algorithms.

The PAMAuthenticationViaKbdInt keyword

Previously, this keyword whether PAM challenge-response authentication is allowed and is notsupported on z/OS UNIX.

Now, PAMAuthenticationViaKbdInt keyword is removed.

No. Because PAMAuthenticationViaKbdInt is not supported on z/OS UNIX in previous version.

The PermitRootLogin keyword

Previously, prohibit-password is not a supported value for PermitRootLogin and the default valueis yes. Now, prohibit-password as a deprecated alias of without-password to indicate that passwordauthentication is disabled for root and the default value is prohibit-password.

Yes, if you use the previous default value of yes.

Action: Specify "yes” for this keyword if you want to use the previous default value.

The Protocol keyword

Previously, this keyword specified the protocol versions that sshd must support.

Now, this keyword is removed because protocol 1 is not supported. The protocol of sshd is always2.

Yes, if you want to use protocol 1.

Action: Update your application. Do not use this keyword to Specify protocol.

The RhostsAuthentication keyword

Previously, this keyword indicated whether authentication using rhosts or /etc/hosts.equiv filesis sufficient for OpenSSH version before 3.8.1p1.

Now, RhostsAuthentication keyword is removed.

No, because RhostsAuthentication is not supported on z/OS UNIX in the previous version.

The RhostsRSAAuthentication keyword

Previously, this keyword specified whether rhosts or /etc/hosts.equiv authentication togetherwith successful RSA host authentication is allowed and applied only to protocol version 1.

Now, RhostsRSAAuthentication is removed because protocol version 1 is not supported.

Yes, if you are using RhostsRSAAuthentication, an error message “Deprecated optionRSAAuthentication” is returned.

Action: Update your application. Do not use RhostsRSAAuthentication keyword.

The RSAAuthentication keyword

Previously, this keyword specified whether pure RSA authentication is allowed and applied only toprotocol version 1.

Now, RSAAuthentication is removed because protocol version 1 is not supported.

Yes, if you are using RSAAuthentication, an error message “Deprecated option RSAAuthentication”is returned.

Action: Update your application. Do not use RSAAuthentication keyword.

The ServerKeyBits keyword

Previously, this keyword determined the number of bits in the ephemeral protocol version 1 server key.

Now, ServerKeyBits is removed because protocol version 1 is not supported.

Yes, if you are using ServerKeyBits, an error message “Deprecated option ServerKeyBits” isreturned.

Action: Update your application. Do not use the ServerKeyBits keyword.

The UseLogin keyword

Previously, this keyword specified whether login is used for interactive login sessions.

Now, this keyword is removed.

Yes, if you use the UseLogin keyword to specify the interactive login sessions, an error message is returned: “Deprecated option UseLogin”

Action: Update your application. Do not use the UseLogin keyword.

The UsePrivilegeSeparation keyword

Previously, this keyword indicated whether sshd separates privileges by creating an unprivilegedchild process to handle incoming network traffic.

Now, sshd is changed so that APF authorization is not propagated to unprivileged childprocesses.

Yes, if you want to use UsePrivilegeSeparation to run without privilege separation for sshd,which is no longer supported. If you use this keyword, the following error message is returned:“Deprecated option UsePrivilegeSeparation”

Action: Update your application. Do not use the UsePrivilegeSeparation keyword.

The UseDNS keyword

Previously, yes was the default value.

Now, no is the default value. It indicates that only addresses and not hostnames can be used in~/.ssh/authorized_keys from and sshd_config Match Host directives.

Yes, if you use the previous default value and use hostnames in ~/.ssh/authorized_keys fromsshd_config Match Host directives. The previous default value was yes.

Action: Specify yes on this keyword if you want to use the previous default value.

The VerifyReverseMapping keyword

Previously, this keyword indicated whether sshd should try to verify the remote hostname andcheck that the resolved hostname for the remote IP address maps to the same IP address for OpenSSHversion before 3.8.1p1.

No. On systems that use OpenSSH 3.8.1p1 or later, use the keyword UseDNS instead.

Changes to the ssh command that might require an upgrade action

What Changed Upgrade action needed?

The -1 option

Previously, this option is used to specify the support of SSH protocol version 1. Now SSHprotocol version 1 is no longer supported and SSH protocol version 2 is used by default in OpenSSH 7.6p1.

Yes, if you force ssh to use SSH protocol version 1. If specifying -1 option, error message “SSH protocol v.1 is no longer supported” is returned.

Action: Update your application. Do not specify -1 option.

The -2 option

Previously, this option was used to request SSH protocol version 2. Now SSH protocol version 2 isused by default in OpenSSH 7.6p1 without any specification.

No. Specifying -2 option in the previous version is the same as using SSH protocol version 2 by default in OpenSSH 7.6p1.

The -c option

Previously, SSH protocol version 1 ciphers and version 2 ciphers blowfish-cbc, arcfour,arcfour128, arcfour256, cast128-cbc, 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc are supportedand listed in the default list. Now SSH protocol version 1 ciphers and blowfish-cbc, arcfour,arcfour128, arcfour256, and cast128-cbc are no longer supported. SSH protocol version 2 ciphers3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc are removed from the default cipher lists.

Yes, if you are using any of the SSH protocol version 1 ciphers or SSH protocol version 2 ciphers blowfish-cbc, arcfour, arcfour128, arcfour256, cast128-cbc, 3des-cbc, aes128-cbc, aes192-cbc, and aes256-cbc. If you specify a cipher that is no longer supported, an error message such as “Unknowncipher type '3des'” is returned.

Action: Do not specify no longer supported ciphers. To use 3des-cbc, aes128-cbc,aes192-cbc, and aes256-cbc, specify the same cipher on sshd.

The -C option

Previously, this option is used to specify whether to use compression in SSH protocol version 1.Now this option is removed because it applies to SSH protocol version 1 only and this version is nolonger supported.

Yes, if you are using compression option in SSH protocol version 1.

Action: Do not specify to use SSH protocol version 1 and enable compression option. UseSSH protocol version 2 without specifying compression option.

The -i option

Previously, SSH protocol version 1 identity ~/.ssh/identity is supported. Now SSH protocolversion 1 is no longer supported so ~/.ssh/identity or any other specified SSH protocol version 1 identity is no longer available.

Yes, if you use the default identity list or SSH protocol version 1 identity such as~/.ssh/identity is specified. If specifying SSH protocol version 1 identity, error message “FOTS3785key_load_public: invalid format” is returned.

Action: Do not specify SSH protocol version 1 identity, use default SSH protocol version 2identities only.

The -L option

Previously, IPv6 addresses were specified with a syntax: [bind_address/]port/host/hostport. Now,forward slash (/) is not supported as a separator in the format, IPv6 addresses are specified byenclosing the address in square brackets, such as [ipv6_bind_address:]port:host:hostport.

Yes, if you are using the previous format to specify the IPv6 address.

Action: Do not use the previous format. Instead, use[ipv6_bind_address:]port:host:hostport to specify a IPv6 address.

The -m option

Previously, MAC algorithms hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are supported. Now, hmac-ripemd160, hmac-ripemd160@openssh.com, andhmac-ripemd160-etm@openssh.com are no longer supported.

Also, the previous default MAC algorithm list contains hmac-ripemd160,hmac-ripemd160@openssh.com, hmac-ripemd160-etm@openssh.com, hmac-sha1-96,hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Now the default list does not contain hmac-ripemd160, hmac-ripemd160@openssh.com,hmac-ripemd160-etm@openssh.com, hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5,hmac-md5-etm@openssh.com, hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Yes, if you specified any of the removed MAC algorithms: hmac-ripemd160,hmac-ripemd160@openssh.com and hmac-ripemd160-etm@openssh.com, or using MAC algorithms that aredisabled by default: hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com,hmac-md5-96, and hmac-md5-96-etm@openssh.com.

Action: Do not specify unsupported MAC algorithms: hmac-ripemd160,hmac-ripemd160@openssh.com, and hmac-ripemd160-etm@openssh.com.

To use hmac-sha1-96, hmac-sha1-96-etm@openssh.com, hmac-md5, hmac-md5-etm@openssh.com,hmac-md5-96, or hmac-md5-96-etm@openssh.com, specify the same MAC algorithm in ssh daemon.

The -Q option

Previously, supported message integrity codes are specified as ‘MAC’ and key exchange algorithmsis specified as ‘KEX’. Now, message integrity codes are specified in lowercase ‘mac’ and the latteris also specified in lowercase: ‘kex’.

Yes, if you are specifying ‘MAC’ or ‘KEX’ as a protocol feature argument in the previousversion.

Action: Instead of using uppercase for specification, use lowercase ‘mac’ and ‘kex’instead.

The -R option

Previously, IPv6 addresses can be specified with a syntax: [bind_address/]port/host/hostport.Now, forward slash (/) is not supported as a separator in the format, IPv6 addresses are specifiedby enclosing the address in square brackets, such as [ipv6_bind_address:]port:host:hostport.

Yes, if you are using the previous format to specify the IPv6 address.

Action: Do not use the previous format. Instead, use[ipv6_bind_address:]port:host:hostport to specify a IPv6 address.

Changes to the sshd command that might require an upgrade action

What Changed Upgrade action needed?

The -b option

Previously, this option specified the number of bits in the ephemeral protocol version 1 serverkey.

Now, the -b option is removed because protocol version 1 is not supported.

Yes, if you want to use -b option to specify the number of bits, this option is ignored.

Action: Update your application. Do not use -b option.

The -h option

Previously, /etc/ssh/ssh_host_key was used for protocol version 1.

Now, /etc/ssh/ssh_host_key is removed from the supported host key because protocol version 1 isnot supported.

Yes. If you want to use /etc/ssh/ssh_host_key as the host key.

Action: Do not specify /etc/ssh/ssh_host_key host key file with this option.

The -k option

Previously, this option specified how often the ephemeral protocol version 1 server key isregenerated.

Now, the -k option is removed because protocol version 1 is not supported.

Yes, if you want to use -k option to specify how often the ephemeral protocol version 1 serverkey is regenerated, this option is ignored.

Action: Update your application. Do not use -1 option.

Changes to the scp command that might require an upgrade action

What Changed Upgrade action needed?

The -1 option.

Previously, -1 indicated protocol version 1.

Now, the –1 is removed because protocol 1 is not supported. The protocol of scp is always 2.

Yes. If you are using -1 option for protocol version 1, you need to change it to -2 or remove the-1 option.

Action: Update your application. Do not use -1 option.

Changes to the sftp command that might require an upgrade action

What Changed Upgrade action needed?

The -1 option.

Previously, -1 indicated protocol version 1.

Now, –1 is removed because protocol 1 is not supported. The protocol for sftp is always 2.

Yes. If you are using -1 option for protocol version 1, you need to change it to -2 or remove the-1 option.

Action: Update your application. Do not use -1 option.

Changes to the ssh-keygen command that might require an upgrade action

What Changed Upgrade action needed?

The –t option.

Previously, the key types that supported are rsa1, rsa, dsa, and ecdsa.

Now, the rsa1 key type was removed since the protocol version 1 is no longer supported.

Yes. Check whether you are still using key type rsa1.

Action: Replace the rsa1 key with an appropriate key type.

The -b option

Previously, for RSA keys, the minimum number of bits in the key to create is 768.

Now, the minimum RSA keys bits changed to 1024.

Yes. If you are still using 768 bits for RSA keys generating, change it to 1024 bits or higher.The maximum size is 16384 bits, and the default is 2048 bits.

Action: If you are still using 768 bits for RSA keys generating, change it to 1024 bits orhigher.

Changes to the ssh-keyscan command that might require an upgrade action

What Changed Upgrade action needed?

The –t option.

Previously, the key types that supported are rsa1, rsa, dsa, and ecdsa.

Now, the rsa1 key type was removed since the protocol version 1 is no longer supported.

Yes. Key type rsa1 is no longer supported in OpenSSH 7.6p1, as in z/OS V2R4.

Action: Check whether you are still having rsa1 type keys. If so, replace the rsa1 keywith an appropriate key type.

Changes to the /samples/ssh_smf.h and FOTSMF77 in SYS1.MACLIB that might require an upgrade action

What Changed Upgrade action needed?

/samples/ssh_smf.h and

SYS1.MACLIB(FOTSMF77)

Yes, if you use ssh_smf.h and FOTSMF77.

Action: Update your application.

For more information, see the topic on SMF Type 119 records in IBM Ported Tools for z/OS:OpenSSH User's Guide.

Reference information

For more information, seeOpenSSH User’s Guide.

Instructions:

This portion of the Workflow will guide you to submit jobs to run two health checks that are associated with this upgrade action, IBMSSH,ZOSMIGV2R4_SSH_CONFIG and IBMSSH,ZOSMIGV2R4_SSHD_CONFIG.

These checks will be activated if they are not already active. If the checks are activated, they will be deactivated at the end of the job, so that they remain in the same state as they were found.

If the health checks run with no exceptions, this step will be marked "Complete" indicating that this upgrade action requires no further activity.

If either of the health checks find an exception, this step will be marked as "Failed". If so, further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (using any method you use to view health check output, such as SDSF) and correct any situations as appropriate. You can then re-run this workflow step to submit the health check job again, until the health checks no longer receive exceptions and the step is marked "Complete".

NOTE: The successful running of these health checks only partially covers this upgrade action. Refer to the upgrade action text for the complete list of steps to take.


Step 4.27.3 : z/OS OpenSSH actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS OpenSSH migration actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.28 : z/OS UNIX upgrade actions


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes upgrade actions for base element z/OS UNIX System Services (z/OS UNIX).


Step 4.28.1 : z/OS UNIX actions to perform before installing z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS UNIX upgrade actions that you can perform on your current (old) system. You do not need the z/OS V2R4 level of code to make these changes, and the changes do not require the z/OS V2R4 level of code to run after they are made.


Step 4.28.1.1 : z/OS UNIX: Migrate from HFS file systems to zFS file systems


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

z/OS V2R4 is the last release of the z/OS operating system to support the hierarchical file system (HFS) data structure used by the z/OS UNIX environment. IBM provides equivalent if not superior functionality with the z/OS File System (zFS). Your installation should migrate from HFS to zFS. To convert your file system hierarchy to zFS, use the utilities that are provided in the operating system.

After z/OS V2R4, you can no longer mount a data structure that is DSNTYPE=HFS.

Before z/OS V1R7, the HFS file system was the primary hierarchical file system. As of z/OS V1R7, you can use any combination of HFS and zFS file systems. Because zFS has higher performance characteristics than HFS and is the strategic file system, you should migrate your HFS file systems to zFS.

The HFS and zFS file system types in mount statements and command operands are now generic file system types that can mean either HFS or zFS. Based on the data set type, the system determines which is appropriate. However, note that you must still specify a type (HFS or zFS and it cannot be defaulted). If the type you specify is not correct for the file system that is being mounted, any associated parameter string setting in the mount statement or command is ignored, even though the system sets the type correctly and processes the mount.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS UNIX.

When change was introduced:

See IBM United States Software Announcement 217-085, "Preview: IBM z/OS Version 2 Release 3 - Engine for digital transformation," dated February 21, 2017.

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before installing z/OS V2R4.

Is the upgrade action required?

No, but recommended because the release that is planned to follow z/OS V2R4 will not support the hierarchical file system (HFS). zFS is the strategic file system for z/OS UNIX and continues to be enhanced to provide superior performance, reliability, and data integrity.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

  • Understand the zFS recommendations and limits. For more information, see Minimum and maximum file sizes in z/OS File System Administration
  • The DDNAME() keyword of the BPXPRMxx ROOT and MOUNT statements is not supported by zFS. Use the FILESYSTEM(name) keyword instead.

System impacts:

None.

Related IBM Health Checker for z/OS check:

To verify that all file systems are mounted, use check IBMUSS,USS_HFS_DETECTED. This check issues exception message BPXH068E if any HFS file systems are found.

Steps to take

Follow these steps:

  1. Before beginning the migration, do the following:
    • Establish backout procedures.
    • Decide on naming conventions.
    • Decide on unavailability.
    • Understand any cloning or deployment changes that are required by zFS systems being linear data sets. Considerations would include any copy utility invocations, BPXPRMxx specifications for symbolics, and placement of zFS file systems on system volumes.
  2. Perform the conversion from an HFS to zFS file system.

    You can use the BPXWH2Z tool to perform the conversion. It is an ISPF-based tool that migrates HFS file systems to zFS file systems. Using its panel interface, you can alter the space allocation, placement, SMS classes, and data set names. A HELP panel is provided. With this tool, you can:

    • Migrate HFS file systems (both mounted and unmounted) to zFS file systems. If the HFS being migrated is mounted, the tool automatically unmounts it and then mounts the new zFS file system on its current mount point.
    • Define zFS aggregates by default to be approximately the same size as the HFS. The new allocation size can also be increased or decreased.
    • Have the migration run in TSO/E foreground or UNIX background.

    You can use the JCL sample ISPBTCH in SYS1.SAMPLIB to start BPXWH2Z as an ISPF batch job. Before you run the job, read the notes section. When you run BPXWH2Z on your z/OS system, make sure it uses that same z/OS level of the pax command. You can manually migrate from an HFS to zFS file system without using the tool. However, you would need to allocate and format the target zFS file systems.

    Requirement: The BPXWH2Z tool requires the zFS address space to be operational. Therefore, before attempting to migrate existing HFS to zFS file systems by using BPXWH2Z, ensure that the zFS address space is configured and initialized.

    Tip:

    You can dynamically migrate the HFS sysplex root in a shared file system configuration to zFS while the root is in use, without disrupting workloads. Although the shared file system configuration is required, the sysplex can be a single system.

    Note:

    As of z/OS V2R3, you can use the bpxwmigf shell command to migrate HFS file systems to zFS file systems without incurring any interruptions to running workloads. The HFS file system does not have to be unmounted first. bpxwmigf is also available as a TSO/E command or REXX system command. For more information about this command, see z/OS UNIX System Services Command Reference.

  3. Change policies and scripts, and so on, to reflect the change from the HFS file system to zFS file system. Use the RMF Monitor III option to report on zFS activity. Tip:

    Use the RMF Monitor III option to report on zFS activity.

  4. The DDNAME(name) keyword of the BPXPRMxx ROOT and MOUNT statements is not supported by zFS. If you use them. Change these statements to use the FILESYSTEM(name) keyword instead.

Migrating the sysplex root file system from HFS to zFS after IPLing your previous z/OS system:

Before you begin the migration:

  • Ensure that the following requirements are met:
    • All systems in the sysplex are at the V1R12 level.
    • The current sysplex root file system PFS, and the new sysplex root file system PFS, are up in all the systems in shared file system configuration.
  • Be aware of the following restrictions:
    • The current sysplex root file system must be mounted as a read-only file system.
    • The systems that do not meet the requirements for this upgrade action cannot join the sysplex during the sysplex root file system migration processing. However, these systems can join the sysplex after the sysplex root migration is completed.
    • The current sysplex root and the new sysplex root must be either HFS or zFS in any combination. If the new sysplex root is zFS, then it must be HFS-compatible.
    • The sysplex root or any directories on it cannot have been exported by the DFS or SMB server.
  • Note the following:
    • Remote NFS mounts of the sysplex root or any directories on it are considered active use of the current sysplex root file system.
    • During the migration, the new zFS sysplex root file system must not be HSM-migrated, mounted, or in use.
    • Mount parameters are preserved during the migration or replacement of the sysplex root file system of the same file system type (PFS). They are dropped if the file system type is different.
    • Directories, data, files, and links are not copied from one file system to another.

Perform the migration as follows:

  1. Ensure that a file system is mounted read-only as the current sysplex root file system. When the root is mounted read-only, there are no function-shipping clients if the physical paths to the DASD are available to each system. To verify that there are no function-shipping clients, enter:
    D OMVS,F,NAME=root_file_system_name

    You should see CLIENT=N on each system.

  2. Allocate and set up the new zFS sysplex root file system:
    1. Create a zFS file system to be used as the new sysplex root file system. z/OS File System Administration discusses creating and managing zFS file systems. Rules :
      • The UID, GID, and permission bits of the root directory in the new sysplex root file system must be same as the root directory in the current sysplex root file system.
      • If the SECLABEL class is active and the MLFSOBJ option is active, the security label for the new zFS file system must match the assumed security label of the current sysplex root file system.
    2. On the new sysplex root file system, set up the active mount points and the symbolic links. The mount points and symbolic links must be the same as the ones on the current sysplex root file system. You can set them up either (1) manually or (2) by using the pax shell command to populate the new sysplex root file system using the existing sysplex root as a source. To do it manually, create a mount point in the existing sysplex root (for example, /newroot) and mount the new sysplex root file system in the MODE(RDWR) on that mount point. After you mount the new sysplex root file system, manually enter MKDIRs and ln -s to create the mount point directories and symbolic links similar to the existing sysplex root file system. The new sysplex root file system must contain all active mount points and symbolic links exactly as on the existing sysplex root file system.
    3. Use the pax shell command to populate the new file system, using the existing sysplex root as a source. Example :
      cd / pax -wr -pe -XCM ./ /newroot

      For more information about using pax to copy data from an HFS file system to a zFS file system, see z/OS File System Administration.

    4. Unmount the new zFS file system.
  3. On any system in the shared file system configuration, issue:
    F OMVS,NEWROOT=new.root.file.system.name,COND=<YesNo>
    YES
    Proceed conditionally. The system checks for active usage in the current sysplex root file system and reports the active usage in a BPXF245I message. If file activity is found, the command fails with EBUSY return code and JrActivityFound reason code. If file activity is not found, the command continues processing to replace the sysplex root. YES is the default.
    NO
    Proceed unconditionally. The system checks for active usage in the current sysplex root file system and reports the active usage in a BPXF245I message. Replacement of the sysplex root file system continues.

    The migration of the sysplex root file system begins. During the migration, active connections to files and directories in the current sysplex root file system are broken.

    After the migration completes:

    • The root CWD ('/') is updated on all systems in the sysplex to point to the new sysplex root file system.
    • New opens go to the new sysplex root file system. The current sysplex root for the root directory is replaced for all processes in all systems. The current directory for root directory is replaced for any processes that use it
    • Old connections in the previous sysplex root file system might encounter EIO errors.
  4. Update the TYPE parameter and name of the sysplex root file system in the BPXPRMxx member of SYS1.PARMLIB. Because the DDNAME() keyword of the BPXPRMxx ROOT and CMOUNT statements is not supported by zFS, change these statements to use the FILESYSTEM(name) keyword instead.

Reference information

For more information, see the following references:

Instructions:

This portion of the Workflow will guide you to submit a job to run an IBM Health Check for z/OS associated with this upgrade action, IBMUSS,USS_HFS_DETECTED.

This check will be activated if it is not already active. If the check is activated, it will be deactivated at the end of the job, so that it remains in the same state as it was found.

If the health check runs with no exception, this step will be marked "Complete" indicating that this upgrade action requires no more activity.

If the health check finds an exception, this step will be marked as "Failed". This tells you that further investigation (and possibly more work) is necessary to complete this upgrade action. If the step is marked "Failed", you should review the health check output (via any method you use to view health check output, such as SDSF) and correct any situation that you find appropriate. You can then re-run this Workflow step to submit the health check job again, until the health check no longer receives an exception and the step is marked "Complete".


Step 4.28.2 : z/OS UNIX actions to perform before the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS UNIX migration actions that you can perform after you have installed z/OS V2R4, but before the first time you IPL. These actions might require the z/OS V2R4 level of code to be installed but do not require it to be active.


Step 4.28.2.1 : z/OS UNIX: Optionally delete the FORKCOPY(COW) option of BPXPRMxx


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Previously, with the FORKCOPY option in the BPXPRMxx parmlib member, copy-on-write (COW) mode could be specified for fork processing. The default was FORKCOPY(COW). In z/OS V2R4, the COW option is disabled. FORKCOPY(COPY) will always be used even if FORKCOPY(COW) is specified.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS UNIX

When change was introduced:

V2R4

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL.

Is the upgrade action required?

No, but recommended for clarity in the BPXPRMxx parmlib member because FORKCOPY(COPY) will always be used even if FORKCOPY(COW) is specified.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

Less ESQA will be used.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether your BPXPRMxx parmlib member specifies FORKCOPY(COW) mode. If so, remove it. FORKCOPY(COPY) is always used, even when FORKCOPY(COW) is specified.

Reference information

For more information about BPXPRMxx, see z/OS MVS Initialization and Tuning Reference .

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.28.2.2 : z/OS UNIX: Optionally delete the KERNELSTACKS option of BPXPRMxx


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Previously, with the KERNELSTACK option in the BPXPRMxx parmlib member, stacks could be allocated either above or below the bar. The default was KERNELSTACKS(BELOW). As of z/OS V2R4, stacks are always allocated above the bar. If KERNELSTACKS(BELOW) is specified, it is ignored and the stacks are allocated above the bar.

Information about this upgrade action

The following table provides more details about the upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS UNIX

When change was introduced:

V2R4

Applies to upgrade from:

z/OS V2R3 and z/OS V2R2.

Timing:

Before the first IPL.

Is the upgrade action required?

No.

Target system hardware requirements:

None.

Target system software requirements:

None.

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None.

Related IBM Health Checker for z/OS check:

None.

Steps to take

Determine whether your BPXPRMxx parmlib member uses the KERNELSTACK option. If so, remove it. The stacks will always be allocated above the bar.

Reference information

For more information about BPXPRMxx, see z/OS MVS Initialization and Tuning Reference .

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.28.2.3 : z/OS UNIX: Add the /global directory to the sysplex root file system


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

Description

Starting with z/OS V2R3, a new directory, /global, is available in the version root and sysplex root. It can be used to store and maintain a single copy of configuration files or mount points of program products that can be referenced by all members of the sysplex. Prior to z/OS V2R3, individual copies of the same configuration file had to be maintained in each member of the sysplex.

Information about this upgrade action

The following table provides more details about this upgrade action. Use this information to plan your changes to the system.

Element or feature:

z/OS UNIX System Services.

When change was introduced:

V2R3.

Applies to upgrade from:

z/OS V2R2.

Timing:

Before the first IPL of z/OS V2R4.

Is the upgrade action required?

Yes, if you have a sysplex root within a shared file system environment.

Target system hardware requirements:

None.

Target system software requirements:

Starting with z/OS V2R3, the IBM Knowledge Center for z/OS base element uses the /global directory for configuration information. See the related workflow step "IBM Knowledge Center uses /global by default."

Other system (coexistence or fallback) requirements:

None.

Restrictions:

None.

System impacts:

None. Usage of the /global directory is intended to have most value in a sysplex environment, but use in a single system environment (non-sysplex) is still supported and might be helpful in maintenance of the system.

Related IBM Health Checker for z/OS check:

None.

Steps to take

If you are using a sysplex root file system, take the following actions:

  1. Rerun the sample REXX EXEC SYS1.SAMPLIB(BPXISYS1) to update the sysplex root, making system installation-specific adjustments. Running the EXEC will create the /global directory in the sysplex root. You do not need to run any sample jobs to create /global in the version root (or root) for a non-sysplex environment because ServerPac will provide that directory during installation.
    1. Alternatively, a system programmer can run the MKDIR command to add the /global directory with permission bits 7,5,5 to an existing sysplex root.
    2. At this time, you can also remove an obsolete directory called /..., after verifying that it is an empty directory. This directory was used by DCE, which is no longer shipped in z/OS.
    3. If applicable, ensure that the same updates are also made to the alternate sysplex root.
  2. Create a file system that will be mounted on the /global directory.
  3. As necessary and as instructed, create additional mount points (and file systems) for exploitation by z/OS functions under /global.
Reference information

For other use cases of /global, such as convenient access to program products across the entire sysplex, see z/OS UNIX System Services Planning.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 4.28.3 : z/OS UNIX actions to perform after the first IPL of z/OS V2R4


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignednoFeedbackNo

Description:

This topic describes z/OS UNIX upgrade actions that you can perform only after you have IPLed z/OS V2R4. You need a running z/OS V2R4 system to perform these actions.

None.

Instructions:

This information was provided for your understanding and possible further action as dictated by your site policies


Step 5 : Provide feedback to IBM on your upgrade experience


Step State:Step Owner:Step Assignee:Step Feedback:Step Skills:Has called workflow:
UnassignedincompleteNo

Description:

IBM would like your feedback on your upgrade experience

Instructions:

In this example step, you generate a feedback summary file by selecting the workflow instance and clicking "Generate Feedback Summary" in the "Action" drop-own menu. The summary is based on the values that were entered previously. This step is optional.

You can edit the file as you wish after it has been produced. You can reproduce the file, if you change your feedback answers.

When you are ready to send it to IBM, attach the file in an email and sent it to zosmig@us.ibm.com. As you can see in the produced feedback file, only the information you wish to provide will be seen by IBM. No other information will be gathered.

Thank you for providing your feedback to IBM.