CSV_APF_EXISTS

Description:

Checks to see if data sets described by entries in the APF list are consistent with data sets that exist on the system.

Reason for check:

A potential system integrity risk exists when a data set cannot be allocated using the criteria specified in the system APF list.

z/OS® releases the check applies to:

z/OS V1R4 and later.

Parameters accepted:

Yes

• MIGRATEDOK(NO) specifies that a migrated APF authorized data set is always an exception.
• MIGRATEDOK(YES) specifies that a migrated APF authorized data set is never an exception.
• MIGRATEDOK(SYSTEM) specifies that a migrated APF authorized data set is an exception unless the data set is SMS-managed (that is its catalog entry contains a storage class) and has an "SMS" APF entry. This is the default."

User override of IBM values:

The following sample shows the defaults for customizable values for this check. Use this sample to make permanent check customizations in an HZSPRMxx parmlib member used at IBM Health Checker for z/OS startup. If you just want a one-time only update to the check defaults, omit the first line (ADDREPLACE POLICY) and use the UPDATE statement on a MODIFY hzsproc command. Note that using non-POLICY UPDATEs in HZSPRMxx can lead to unexpected results and is therefore not recommended.

ADDREPLACE POLICY[(policyname)] [STATEMENT(name)]
UPDATE
CHECK(IBMCSV,CSV_APF_EXISTS)
PARM('MIGRATEDOK(SYSTEM)')
SEVERITY(LOW) INTERVAL(04:00) DATE('date_of_the_change')
REASON('Your reason for making the update.')

Debug support:

Yes, the check provides additional error detail in debug mode. You can put a check into debug mode using any of the following:

• UPDATE,filters,DEBUG=ON parameters on either the MODIFY command or in a POLICY statement in an HZSPRMxx parmlib member
• Overwrite the OFF value with the ON value in the DEBUG column of the CK panel in SDSF.

Reference:

For more information, see:

• z/OS MVS Programming: Authorized Assembler Services Guide
• z/OS MVS Initialization and Tuning Guide

Messages:

This check issues the following exception messages:

• CSVH0957E

See the CSVH messages in z/OS MVS System Messages, Vol 4 (CBD-DMO).

SECLABEL recommended for MLS users:

SYSLOW

Output:

The report that CSV_APF_EXISTS produces is shown below:

VOLUME is the volume specified in the APF entry or *SMS*
DSNAME is the data set name specified in the APF entry
ERROR is the problem that was detected by the check


CSVH0955I A problem was found with each APF list entry displayed

VOLUME DSNAME                                 ERROR

TMPSTG ANY.ALIAS                              DS not found
*SMS*  ANY.DATASET                            DS not SMS-managed
BADVOL ANY.DATASET                            Volume not found
*SMS*  ANY.SMS.ALIAS                          DS is alias
ALL001 ANY.SMS.DATASET                        DS is SMS-managed

In the output:

VOLUME

The volume specified in the APF entry or *SMS*

DSNAME

The data set name specified in the APF entry

ERROR

The problem that was detected by the check