A new tool has just been added to the CICS portfolio. The all shiny and new CICS Deployment Assistant. Congratulations to Grant and everyone else involved on releasing a great new tool!

CICS Deployment Assistant can discover, model, visualize, and deploy new and existing CICS regions, using automation and policy-driven advice built on your own and IBM’s knowledge and experience, giving you access to the latest IBM CICS technology faster and easier than ever before.

Two interesting new APAR (CICS APAR PM15583 and CICSPlex SM APAR PM15214) have also been released for CICS TS V4.1. When applied together, they provide access to the cold-start CICS SIT parameters via the CICSPlex SM API and the CICS Management Client Interface (CMCI). They will allow you to find out not only what value each regions SIT parameters were set to but also where they were set. Very handy for problem determination or just keeping track of your environment.

If you read z/Journal you may have spotted CICSPlex SM developer Dave Williams 3 excellent articles:

• An Implementation Fast Path for CICSPlex SM
• CICS Task History Recording
• CICS Sysplex Optimized Workload Routing

You might notice there are some new sharing options on the blog now as well. At the bottom of every post you should now be able to simply click a button to share the post to twitter or Facebook.

Finally, a new blog focussing on WebSphere and CICS support has also just been created over on developerWorks. I’ve also added the blog to our bookmarks below.

Version 2.0 can be used to independently view status of multiple Gateway daemons (z/OS or Multiplatforms) and does not require a connection to a CICS TS 4.1 region, or CICSPlex SM, as was the case in version 1.0.

What’s new in version 2.0

• This latest version of the SupportPac provides the following new or revised views:
  • CICS Transaction Gateway Explorer view
  • Gateway daemons view
  • CICS connections view
  • Console view
• Other features are a customizable Resource column layout for Gateway daemons, CICS connections and Property views, and support for CICS Transaction Gateway for Multiplatforms.

Note: CS05 V2.0 requires CICS Explorer Version 1.0.0.5, which is available to all existing CICS TS V3 and CICS TS V4 license holders.

Please refer to the link above for further details.

So why are they so great? Well let’s just skip over the fact that they are free full-day seminars for the moment. They are also being taught by the IBM Hursley UK lab team, so you can be sure you are going to be in the hands of the experts (infact I see that CICS Distinguished Engineer Ian Mitchell will be one of the main speakers at the seminar, which is about as good as it gets). The seminar is based around the new CICS TS V4.1 release and won’t just be covering the new functionality in the new release but will also be showing you how to extract real value from your CICS regions.

The seminar is split into 3 sessions:

1. Revitalizing Business
2. Revitalizing Applications
3. Simplifying your IT Environment

This is a seminar that is going to introduce you to what I consider to be the most consumable CICS Transaction Server to date. Part of this is about taking your existing assets and very quickly extracting new value without having to change them. The data inside your CICS regions is now more accessible and readily available than ever before, helping your business to be much more pro-active, flexible and adaptable to new opportunities and challenges that may come your way. To help you get there even faster, the CICS tools are there to help analyze and configure your CICS regions so those opportunities and challenges can be identified with ease.

There is a huge amount of new functionality in CICS TS V4.1, from the CICS Explorer, Event Processing, Atom support, SCA and a whole lot more. If you want to find out how to take advantage, then register for the seminar today so you don’t miss out. These are just the first two dates scheduled, look out for more seminars in April!

Full information on the seminar and registration can be found here:
http://www-01.ibm.com/software/info/lmi/cics/index.html

There is also a little more information in the PDF for the seminar here:
2010 Revitalizing your CICS

India CICS Developers Conference 2009 - Chennai

The second conference based in Bangalore, will start on December the 10th. If you hurry, you might still have time to register. (Note that this link will only be available until the end of the week).

Also launched was the India CICS User Group developerworks space. If you want to find out more, go here and get involved.

Dave arrived last week and spent some time before the conference with his TXSeries team in IBM Bangalore. If you want to see part of the team responsible for producing and supporting TXSeries, here you can see them all in an all-hands meeting with Dave:

TXSeries Team in Bangalore

So what is new in CICS IA 3.1 ?

• CICS TS V4.1 support
• CICS Explorer plugin
• Command Flow
• Natural/Adabas support
• Concurrent Dependency and Affinity data collection
• … and lots more

CICS IA 3.1 is planned to be available on Friday the 4th of September.

However, depending on your site, this might be easier said than done – not because installing Explorer is hard, but because people will probably start worrying about security now that this easy to use CICS tool is available.

The point of this post is to try explain a little about CICS Explorer and security, so that you can be primed to answer any questions that may arise.

Passwords

A user can opt to save their password for a connection in Explorer. If this option is used, the password is stored, encrypted, in the workplace used by Explorer.

The default workplace is c:\Documents and Settings\username\.cicsexplorer (Windows) or ~/.cicsexplorer (Linux). The default location can be changed with the -data option when starting Explorer. See here for details. Despite the password being encrypted, this location needs to be protected – especially if it is on a network drive.

Depending on the type of connecton in use, SSL may be used on the conversation, this may stop passwords being transferred in clear text over the network.

For CMCI or Data Interface connections to CICSPlex SM, the PTFs for CICSPlex SM APARs PK87387 (4.1) and PK87334 (3.2) allow you to specify the acceptable cipher suites used for the conversation. For CMCI connections to an SMSS, or CICS CM, you can specify the cipher suites on the CICS TCPIPSERVICE manually.

Note: At present, the server certificates on an SSL connection are not validated, you won’t be prompted to accept an expired certificate etc.

Access

The access you have with CICS Explorer depends on the type of connection and plugins you are using. The basic answer to the question is, if you have access to the equivalent function using a ‘traditional’ interface, then you will have the same access under CICS Explorer.

CMCI Connections…

CMCI requests will run under the transaction CWWU by default. So use transaction security on CWWU to control who is allowed to use the CMCI.

.. to CICSPlex SM

As the requests will be processed by CICSPlex SM, the normal CICSPlex SM security controls are in place. e.g. CICSPlex SM Object security (CPSMOBJ) and Simulated CICS Command and Resource security.

.. to a Single System(SMSS)

Normal CICS Command and Resource Security is used. The IBM supplied CWWU transaction has CMDSEC=YES and RESSEC=YES.

Data Interface Connection to CICSPlex SM

This connection is read only. The transaction invoked on the CICSPlex SM Web User Interface (WUI) server will be COVA, so you can protect this transaction to control access to the WUI. Note that the user could also access the WUI via a browser using the normal WUI interface, where actions / updates are permitted. So you should implement CICSPlex SM Object security (CPSMOBJ) and possibly simulated Command and Resource security.

CICS Configuration Manager

The CICS CM ‘user’ Transactions, typically CCVA,CCVC,CCVR and CCVT are used. Again CICS Transaction Security may be used to control who can run these. The CICS Configuration Manager security settings are the same as used by other CICS CM interfaces, e.g. you can activate CICS CM security checking on the CICS CM commands and resource definitions.

CICS Interdependancy Analyser

CICS IA uses DB2 for its data. So the user needs to be granted access to the appropriate DB2 tables.

CICS Performance Analyser

CICS PA information is based on SMF data or a CICS PA Historical Database (HDB). Normal z/OS data set security can be used to control access to the SMF or HDB data. Once the information is in an HDB, users can export from the HDB to to two different places for use by CICS Explorer:

1. DB2 – so the user needs to be granted access to the appropriate DB2 tables.
2. CSV file – the user would need access to the generated CSV file to download to the workstation, so access can be controlled witn normal z/OS dataset protection.

New and Exciting Commands

When you are installing CICS TS 4.1 make sure you understand that there are potentially new exciting CICS SPI commands that can give you access to things which may have been protected by other means in previous releases.

What I am trying to refer to is the EXEC CICS CSD commands added by CICS TS 4.1. Normally you would use transaction security to control access to the CEDA, CEDB or CEDC transactions. Now that the CSD can also be accessed via EXEC CICS CSD, you may need to make sure that CICS Command security for the ‘CSD’ resource is defined appropriately and that command security is active for transactions that may issue this command. For example, CECI, or CWWU.

Summary

So to summarise, CICS Explorer isn’t about to let users alter their salaries on the Payroll CICS, nor order a new Hi-Def TV from the Web Ordering system, – Well not unless the user had access to do these sorts of things already!

In general if you are protecting your CICS resources today, they will be protected under CICS Explorer, using the same controls you always used.

If you have any questions about Security and CICS Explorer, please comment in this post, or ask away over on Developerworks.

I have two equal LPARs but CICSPlex SM workload balancing only routes to one of them?

This is a really common question that we get asked a lot. The answer is that CICSPlex SM workload balancing does not actually round-robin the workload across all available target regions. What it does do is try to route to the best available region at all times.  This is commonly the region we routed to last time.  Once that region starts to become heavily loaded CICSPlex SM will begin to route work away into a different region.

Another potential factor here is the utilization of routing regions. CICSPlex SM will always try to route locally if possible, as remote routing goes through slower links. So if you are constantly using the routing regions on LPAR1 you will find that the target regions on LPAR1 are the most frequently used.

Can I associate a routing region with more than one workload?

No. This also means that if you are considering switching to distributed routing from dynamic routing you should be careful that your target regions also do not appear in more than one workload.  When you switch to distributed routing, your target regions need to be able to route as well (i.e. a requesting region). So these new requesting regions can also only be associated with one workload at a time.

Does CICSPlex SM work out the affinities for me?

No. This is a bit of a manual task I’m afraid, although the excellent CICS Interdependency Analyzer is certainly able to help you detect them. The aim over a period of time should be to make sure no new applications are created with affinities without good reason. Work should also be done on the current affinities to see if their lifetime could be reduced or if the affinity could be removed all together.

Is it possible to move a Maintenance Point (MP) CMAS from LPAR1 to LPAR2 if for instance LPAR1 goes down?

Yes, this is possible.  Simply bring the MP CMAS up in LPAR2 without any changes. Note that although it is possible to rename your maintenance point, this is a lot more tricky.

That’s your lot for the moment. If you have other questions you would like to know the answer to then feel free to add them to the new “Ask a question” section available from the top navigation.