We got from customers some questions related to this new Top Secret Control Option:
Q1. Are there any performance issues if we specify FACSTOR(YES) ? Our control options parameter file contains thousands lines.
Q2. When FACSTOR is set to OFF, if a facility control option has an error, then the option is ignored but CA Top Secret can still initialize. Is that also true if we use FACSTOR(YES) ?
Q3. Are changes to the facility control options automatically stored on the security file (and logged to the recovery file)?
What can be said:
A1. No, there is no performance issue. With FACSTOR(YES), the CA Top Secret facility matrix in storage is built from the VSAM companion file.
With FACSTOR(NO), the CA Top Secret facility matrix in storage is built from the CA Top Secret parameter file. There is no real difference in terms of performance.
The benefit of FACSTOR(YES) is that any modifications done via TSS MODIFY FAC(facname=...) are now done permanently. (The CA Top Secret parameter file does not have to be updated.)
Once CA Top Secret has been started with FACSTOR(YES), the facility definitions in the CA Top Secret parameter file are no longer used and can be removed.
Be careful though if you want to fall back to FACSTOR(NO): If the facility definitions are no longer there, they will need to be added back into the CA Top Secret parameter file. Falling back or switching back and forth is not recommended because the control option definitions will be likely out of sync.
A2. If a facility control option is wrong or obsolete, it won't be copied into the VSAM companion file and it will take the default for that facility control option.
A3. Yes. Any changes are written to the VSAM companion file and logged to the recovery file.
Note:
KB Article ID : TEC1463154 is the correspondent technical article.