RE: BRMS Authorities

You don't have to, that's the point behind *SAVSYS.

That said, I always advise my customers to never use IBM supplied profiles
except in very specific cases. Backups are not one of those times. By
creating your own profile to run the backups, backup reporting and
centralize the messages for backups, you'll make your life easier in the
end.

--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Gord
Hutchinson
Sent: Friday, February 06, 2015 7:21 AM
To: Midrange Systems Technical Discussion
Subject: Re: BRMS Authorities

Thanks Jim & Charles.

I could have sworn that at some point years we had problems with QSYSOPR
running the backup and not having authority to libraries in order to save
them. It must have been something else in the process they didn't have
authority too.

I was really loath to give QSYSOPR additional authority.




Gord




On Thu, Feb 5, 2015 at 3:57 PM, Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx

wrote:

I create a user profile called backup and give it *SAVSYS, *JOBCTL,
and *SERVICE (so it can order PTFs if you want to).
Use that profile to start the console monitor job.
Create message queue called BACKUP
Create an output queue called BACKUP
Create a job description called BACKUP and point it to QUSRNOMAX job
queue, and use BACKUP job description and outq.

Schedule the job with user profile BACKUP.
Point your save while active messages at BACKUP message queue.

Now everything is where it needs to be. Don't give QSYSOPR any
authority it does not have from IBM

--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Gord Hutchinson
Sent: Thursday, February 05, 2015 1:31 PM
To: Midrange Systems Technical Discussion
Subject: BRMS Authorities

I am in the process of implementing BRMS. Daily backups will be
scheduled batch jobs and the weekly full backup (including *SAVSYS)
will be a scheduled job started in batch with the backups being run at
the console using console monitoring.

What authority level is needed for the user profile which will be
running the saves? Does BRMS assume higher authority or does the user
profile need *ALLOBJ? I really don't like the idea of giving QSYSOPR
*ALLOBJ nor do I want to have to create a user profile with *ALLOBJ
just to start the console monitor. This will only end up being used
for other things once someone realizes it has *ALLOBJ.

Our current backups are done with the save commands in a CL which is
owned by QSECOFR and has USRPRF(*OWNER). This gives the operators the
authority to run the backup.



Gord



--
Gord Hutchinson
TST Overland Express
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
Gord Hutchinson
TST Overland Express
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.