Does anyone have any experience inusing the CA0HIS and BCPii to set attributes from OPS/REXX using Address HWS?

[Marcel van Ek]

We're seeing all of the HWS* events in opslog, and we can doe the Address HWS "GETATTR" commands successful towards CPC's and LPARS, but we fail to succeed in doing any Address HWS "SETATTR" or Address HWS "SENDCMD" instruction. They fail with all kinds of returncodes and reason codes that are really not easy to track down :

If anyone could explain these X'11C40038' codes, we'd be very happy

24NOV 13:52:35 OPSOSF   OPS0997T >V>	SETATTR ATTR('LOADPARM') ATTRVAL(A55901M1) ENTITY(CPC('hidden') LPAR(hidden))
24NOV 13:52:35 OPSS006B OPS3092O OPS0341J HWS error : ADDRESSHWS - NONZERO RETURN CODE: - RC 12 ; RSC X'11C40038'

 

The OPS userid(s) have UPDATE access to the resources like HI$RV.USER.AUTH and HWI.TARGET.<cpcname>.<lparname>

Do we need ALTER maybe?

[Cesar_Molina]

Hello Marcel,

 

The Address HWS command processor relies on the Common Services r14.1 provided component Hardware Interface Service (HIS) to interface with IBM's Base Control Program internal interface (BCPii) to retrieve information from the Hardware Management Console (HMC). Based on the return code and reason code you are seeing the problem is related with the way security was setup at your site. A detailed discussion on how security should be setup, that depends on the SAF package you are running, is fully documented in the Seventh Edition of  Common Services r14.1  Installation Guide. In specific look at "Chapter 18: How to Install the Hardware Interface Service"  item "Configure Service User ID Security" starting at page 411. On the documentation you will see that read level access is enough as long as the setup is completed as documented.

 

If this does not help then feel free to open a Customer Support ticket, We can then go over your setup and identify the possible causes of the return code 12 and reason code x'11C40038' you are seeing once we review your security setup in detail.

 

Regards, Cesar  

[Marcel van Ek]

Thanks Cesar, I thought we did all that, however, meanwhile I added the task CAHIS itself with UPDATE access, and now the security errors are gone...

Looks like READ actually is not sufficient...

Still a challenge to set the ipladdress and loadparm, but getting there slowly

 

Regards,

 

Marcel van Ek

[Cesar_Molina]

No problem Marcel anytime

What is your security package and what resource definition you have to change to update to be able to set an attribute in the HMC?

Let me also know your site Id since I would like to open then close a case to have this documented.

Thanks for the feedback Marcel

Regards, Cesar

[Marcel van Ek]

Cesar, our siteid is 918841. Using RACF

To be able to use SETATTR we had to change HWI.TARGET.cpcname to ACCESS(UPDATE)  (to update Activation Profiles)

as well as HWI.TARGET.cpcname.lparname to ACCESS(UPDATE)  (to update image data)

We also applied UPDATE for the HISRV stc on HI$RV.USER.AUTH, as well as HI$RV.ENTITY.*

From a Share IBM session last August in Pittsburgh:

Choose SAF authority to a specific resource

listed above to allow BCPii service access:

• HWILIST, HWICONN, HWIDISC, HWIEVENT,

HWIQUERY

• At least READ access

• HWISET

• At least UPDATE access

• HWICMD

• At least CONTROL access

 

So that should be included in the doc...

 

regards,

 

Marcel van Ek

[Cesar_Molina]

Hello Marcel,

 

As promised the following ticket was open:

 

22000500-1 - P2 - ATOS ORIGIN - Update Required For Setattr

 

Marcel, also I have been in contact with our team members, including Common Services, and the documentation in the Common Services Installation Guide only covers the minimum security requirements for the CA OPS/MVS Address HWS get attribute to perform.

Documentation will be reviewed and decisions will be made on what product documentation set should include clarification on the level of access needed to perform changes in the HMC via the set attribute function.

 

I really do appreciate your willingness to work with us on this subject.

Open this communities post helps others members of this community to be aware,

The case is closed and internal tasks will be scheduled to cover this in our product guides.

 

No further actions are required from your side at this time Marcel.

Regards, Cesar