ca.portal.admin

Re:question about numbered user exits

Discussion created by ca.portal.admin on Oct 18, 2010
I am reading Chris Hoelscher's article on z/IIP exploitation in the
September 2010 ""IUA Connections"" with great interest as our site
experienced the problem that he describes. Chris indicates that the
numbered user exits can contribute to TCB/SRB swapping. We use exit 28
(security pre-processing) and I am wondering if this could account for
some of the high swapping rate that we saw.

Here is my question: Is there any way to determine how many times a
numbered user exit is actually being executed?

Kay Rozeboom
State of Iowa
Information Technology Enterprise
Department of Administrative Services
Telephone: 515.281.6139 Fax: 515.281.6137
Email: Kay.Rozeboom@Iowa.Gov

*****JuliusBaer Disclaimer***** This e-mail is for the intended
recipient only and may contain confidential or privileged information.
If you have received this e-mail by mistake, please contact us
immediately and completely delete it (and any attachments) and do not
forward it or inform any other person of its contents. If you send us
messages by e-mail, we take this as your authorization to correspond
with you by e-mail, however, we will not accept the electronic
transmission of orders/instructions without a specific agreement being
in place to govern the same. If you do not wish to receive any further
e-mail correspondence please let us know. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, amended, corrupted, lost, destroyed, arrive late or
incomplete, or contain viruses. Neither the Julius Baer Group nor the
sender accept liability for any errors or omissions in the content of
this message which arise as a result of its e-mail transmission. Please
note that all e-mail communications to and from the Julius Baer Group
may be monitored. This communication is for informational purposes only.
It is not intended as an offer or solicitation for the purchase or sale
of any financial instrument or as an official confirmation of any
transaction.
"
IDMS Public Discussion Forum
IDMS-L@LISTSERV.IUASSN.COM
SMTP
IDMS-L@LISTSERV.IUASSN.COM
IDMS-L@LISTSERV.IUASSN.COM
SMTP








Normal

Normal
Reminder - UK IDMS User group meeting - 2 sleeps
"There are only two sleeps remaining between now and the UKIUA Meeting on We=
dnesday 20th October.

There are a lot of interesting sessions on the agenda (See here: http://tin=
yurl.com/ukiua2010 )

The location is Ditton Manor, a wonderfully restored Manor House set in 200=
acres of Ditton Park. Directions can be found here: http://tinyurl.com/dit=
tonmanor
=20
The technical sessions, the education sessions and the friendly IDMS people=
will make it a worthwhile event.

To register, you must send an email to steve.cannon@ca.com

Hope to meet you there.
Don't miss it.

Oh! Did I mention it's free?=20



Regards

Steve Rundle
Chair: UKIUA
"
IDMS 3rd-party providers forum
IDMSVENDOR-L@LISTSERV.IUASSN.COM
SMTP
IDMSVENDOR-L@LISTSERV.IUASSN.COM
IDMSVENDOR-L@LISTSERV.IUASSN.COM
SMTP








Normal

Normal
Reminder - UK IDMS User group meeting - 2 sleeps
"There are only two sleeps remaining between now and the UKIUA Meeting on Wednesday 20th October.

There are a lot of interesting sessions on the agenda (See here: http://tinyurl.com/ukiua2010 )

The location is Ditton Manor, a wonderfully restored Manor House set in 200 acres of Ditton Park. Directions can be found here: http://tinyurl.com/dittonmanor

The technical sessions, the education sessions and the friendly IDMS people will make it a worthwhile event.

To register, you must send an email to steve.cannon@ca.com

Hope to meet you there.
Don't miss it.

Oh! Did I mention it's free?



Regards

Steve Rundle
Chair: UKIUA
"
IDMS Public Discussion Forum
IDMS-L@LISTSERV.IUASSN.COM
SMTP
IDMS-L@LISTSERV.IUASSN.COM
IDMS-L@LISTSERV.IUASSN.COM
SMTP








Normal

Normal
Re: question about numbered user exits
"What I always used is to define the exit as a program first in development=
=2E Then I dcmt d pro exit to see the called count=2E This is the real n=
umber of times that IDMS actually invokes the exit=2E It is failsafe, and =
absolute number that you can bank on=2E If the called count was high when =
running the apps, then i would consider linking it in, in production=2E Si=
nce user exits are user written code, you need to debug it anyway=2E And f=
or that, there is no other alternative, unless you enjoy a cv crash and rea=
ding through a system dump to debug your exit=2E So, to get the exit start=
ed, you define it as a program anyway=2E Then you see how often it's used=
=2E Then you make wise decisions from there=2E AND you comment the exit s=
ource with the called loaded count, so that your suceessors who didn't writ=
e the exit, have some idea of the footprint of the exit, and it's effect=2E=
=0D=0A=0D=0ALutz Petzold=0D=0ADBSS DB2 LUW/IDMS Support=0D=0A401-782-2265=
=0D=0APage 860 366 0865 or Telalert=0D=0A=0D=0A=0D=0A=0D=0A =0D=0A=0D=0A---=
Original Message---=0D=0AFrom: IDMS Public Discussion Forum =0D=0A[mail=
To:IDMS-L@LISTSERV=2EIUASSN=2ECOM] On Behalf Of Trayler, Christopher=0D=0AS=
Sent: Monday, October 18, 2010 11:38 AM=0D=0ATo: IDMS-L@LISTSERV=2EIUASSN=2E=
COM=0D=0ASubject: Re: question about numbered user exits=0D=0A=0D=0AEven if=
you BALR it instead of #CALL you would still get a swap=2E=0D=0APerformanc=
e issues are relative=2E If the advantages of having =0D=0Athe flexibility =
of Enable/Disable=2E Vary new copy and easy =0D=0Atesting are desirable in =
terms of administration=2E i=2Ee RHDCUXIT =0D=0Ain the IDMS arena created b=
y SMP/E and the actual exits in the =0D=0AApplication arena managed by CA-E=
ndevor=2E A slight performance =0D=0Ahit to achieve those goals is definite=
ly worth it in my case=2E=0D=0A=0D=0AWhat about Presspack? Is that SRB mode=
or just COMP/DCOM? I =0D=0Amight convert a few records back to COMP/DCOM i=
f Presspack isn't zIIP=0D=0Aeleigible=2E =0D=0A=0D=0A-----Original Messag=
e-----=0D=0AFrom: IDMS Public Discussion Forum [mailTo:IDMS-L@LISTSERV=2EIU=
ASSN=2ECOM]=0D=0AOn Behalf Of Siraco, John A=0D=0ASent: Montag, 18=2E Oktob=
er 2010 17:16=0D=0ATo: IDMS-L@LISTSERV=2EIUASSN=2ECOM=0D=0ASubject: Re: que=
stion about numbered user exits=0D=0A=0D=0AHi Chris,=0D=0A=0D=0AYou are cor=
rect=2E IDMSCOMP and IDMSCOM are allowed to run in SRB mode=2E=0D=0AAll oth=
ers require TCB mode=2E (It has nothing to do with the =0D=0Aname=2E In oth=
er words, you couldn't name a DB proc IDMSCOMP and =0D=0Ahave it run in SRB=
mode)=2E The majority of ""overhead"" when using =0D=0Athe zIIP option comes=
from swapping back and forth so the less =0D=0Aswapping the better=2E=0D=
=0A=0D=0AIn my opinion, with respect to the question related to =0D=0Aperfo=
rmance=2E I would suggest you hard link RHDCUXIT exits with =0D=0ARHDCUXIT =
as opposed to defining them as programs and having =0D=0Athem called using =
Standard DC services=2E A simple BALR is a lot =0D=0Afaster than having the=
RHDCCXIT module issue a #CALL to a =0D=0Aprogram=2E The call and the code =
path is a lot longer than the =0D=0ABALR=2E In a sense this is a lot like l=
inking ""BIFS"" with ADS=2E=0D=0AI've heard of and seen some fairly impressiv=
e numbers on this subject=2E=0D=0AAs far as SRB/TCB/SRB swapping, we will a=
lways swap to TCB mode =0D=0Awhen calling an RHDCUXIT exit=2E=0D=0A=0D=0AIf=
you want to see where swaps are occurring you could specify =0D=0A""CSATST4=
9"" in your SYSIDMS file=2E I would only do this on a non =0D=0Aproduction s=
ystem simply because in addition to counting the =0D=0Aswaps there are some=
WTORs produced which might not amuse the =0D=0Aoperators=2E Don't get me w=
rong, we can use this in production =0D=0Asystems if the situation warrants=
but as a simple matter of =0D=0Agathering information over a period of tim=
e it might be a bit =0D=0Amuch=2E It is fine for TEST, QA, Pre-Production, =
development =0D=0Asystems or whatever your site refers to them as=2E=0D=0A=
=0D=0A""DCMT D SUBT"" will report on the swaps=2E Here's a sample:=0D=0A=0D=
=0A D SUBT=0D=0A=0D=0A *** Display all subtasks ***=0D=0A=0D=
=0A Work Task dispatch=0D=0A=0D=0A Name Nr =
type Status count Wakeup count Total=0D=0ACPU time =
=0D=0A ---- -- ---- ------ ------------- ------------=0D=
=0A-------------- =0D=0A MAINTASK 01 IDMS BUSY 1,327 =
1,228=0D=0A00:00:01=2E4315 =0D=0A =0D=0A=0D=0A CHGEMODE table=
display=0D=0A=0D=0A Address Program Offset Call cnt TCB->SRB =
SRB->TCB=0D=0A=0D=0A -------- -------- -------- ---------- --------=
-- ----------=0D=0A=0D=0A 3D4B28EA RHDCWAIT 000032EA 1 =
1 0=0D=0A=0D=0A 3D554058 RHDCTSKI 00000458 22 =
0 22=0D=0A=0D=0A 3D54C514 RHDCMSTR 00000114 =
1 1 0=0D=0A=0D=0A 3D52B8F2 RHDCWTL 00001AF2 =
84 0 84=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=0D=0A=0D=
=0A-----Original Message-----=0D=0AFrom: IDMS Public Discussion Forum [mail=
To:IDMS-L@LISTSERV=2EIUASSN=2ECOM]=0D=0AOn Behalf Of Trayler, Christopher=
=0D=0ASent: Monday, October 18, 2010 10:46 AM=0D=0ATo: IDMS-L@LISTSERV=2EIU=
ASSN=2ECOM=0D=0ASubject: Re: question about numbered user exits=0D=0A=0D=0A=
I'm losing my memory now but I seem to recall that when I was =0D=0Aworking=
with John Siraco on this he said that User DB =0D=0AProcedures would swap =
but that CA had managed to get COMP/DCOM =0D=0Aand Presspack to z/IIP=2E Bu=
t I can't find the old mails now=2E =0D=0APerhaps John is reading the IDMS =
List? I mght be able to dig =0D=0Aout the old issue if I look hard enough=
=2E=0D=0A=0D=0AChris Trayler =0D=0A=0D=0A-----Original Message-----=0D=0AF=
From: IDMS Public Discussion Forum [mailTo:IDMS-L@LISTSERV=2EIUASSN=2ECOM]=
=0D=0AOn Behalf Of peter=2Eg=2Echarles@BT=2ECOM=0D=0ASent: Montag, 18=2E Ok=
tober 2010 16:32=0D=0ATo: IDMS-L@LISTSERV=2EIUASSN=2ECOM=0D=0ASubject: Re: =
question about numbered user exits=0D=0A=0D=0AKay,=0D=0A=0D=0AYes DB proced=
ure are considered user code and they are called =0D=0Ain TCB mode so a swa=
p is required whenever they are called=2E=0D=0A=0D=0APete =0D=0A=0D=0A---=
Original Message---=0D=0AFrom: IDMS Public Discussion Forum [mailTo:IDM=
S-L@LISTSERV=2EIUASSN=2ECOM]=0D=0AOn Behalf Of Rozeboom, Kay [DAS]=0D=0ASen=
Sent: 18 October 2010 15:22=0D=0ATo: IDMS-L@LISTSERV=2EIUASSN=2ECOM=0D=0ASubje=
ct: Re: question about numbered user exits=0D=0A=0D=0AOuch, I forgot about =
database procedures=2E We use those to =0D=0Adeath=2E Does anyone know wh=
ether they are considered ""user =0D=0Acode"" and thus require a swap?=0D=0A=
=0D=0A=0D=0A-----Original Message-----=0D=0AFrom: IDMS Public Discussion Fo=
rum [mailTo:IDMS-L@LISTSERV=2EIUASSN=2ECOM]=0D=0AOn Behalf Of David E Matth=
ews (DHL CZ)=0D=0ASent: Monday, October 18, 2010 8:49 AM=0D=0ATo: IDMS-L@LI=
STSERV=2EIUASSN=2ECOM=0D=0ASubject: Re: question about numbered user exits=
=0D=0A=0D=0AIn a wholly uninformed and speculative way, I wonder about this=
=2E =2E =2E=0D=0AThat is, I have no idea how to count user-exit calls, but=
=2E=2E=2E=0D=0AIf a user-exit is in SYSTEM mode, would it swap from TCB to=
PRB mode?=0D=0AAnd anyway, wouldn't the ADSO volume of swaps swamp a user-=
exit?=0D=0AWe use Exits 2, 21, 20, 22, but all of them only in specialized =
=0D=0Asituations, not-for-every-task, but fairly often =2E=2E=2E and what =
=0D=0Aabout the Exit 17 & 18 stubs? Would those cause a swap =0D=0Aeverytim=
e? What about Database Procedures, too?=0D=0A=0D=0AIt's a poser, alright=2E=
=0D=0A=0D=0A-----Original Message-----=0D=0AFrom: IDMS Public Discussion Fo=
rum [mailTo:IDMS-L@LISTSERV=2EIUASSN=2ECOM]=0D=0AOn Behalf Of Rozeboom, Kay=
[DAS]=0D=0ASent: Monday, October 18, 2010 3:36 PM=0D=0ATo: IDMS-L@LISTSERV=
=2EIUASSN=2ECOM=0D=0ASubject: question about numbered user exits=0D=0A=0D=
=0AI am reading Chris Hoelscher's article on z/IIP exploitation in =0D=0Ath=
e September 2010 ""IUA Connections"" with great interest as our =0D=0Asite ex=
perienced the problem that he describes=2E Chris =0D=0Aindicates that the =
numbered user exits can contribute to =0D=0ATCB/SRB swapping=2E We use exi=
t 28 (security pre-processing) and =0D=0AI am wondering if this could accou=
nt for some of the high =0D=0Aswapping rate that we saw=2E=0D=0A=0D=0AHere =
is my question: Is there any way to determine how many =0D=0Atimes a numbe=
red user exit is actually being executed?=0D=0A=0D=0AKay Rozeboom=0D=0AStat=
e of Iowa=0D=0AInformation Technology Enterprise=0D=0ADepartment of Adminis=
trative Services=0D=0ATelephone: 515=2E281=2E6139 Fax: 515=2E281=2E6137=
=0D=0AEmail: Kay=2ERozeboom@Iowa=2EGov=0D=0A =0D=0A*****JuliusBaer Disclai=
mer***** This e-mail is for the intended =0D=0Arecipient only and may conta=
in confidential or privileged information=2E=0D=0AIf you have received this=
e-mail by mistake, please contact us =0D=0Aimmediately and completely dele=
te it (and any attachments) and =0D=0Ado not forward it or inform any other=
person of its contents=2E =0D=0AIf you send us messages by e-mail, we take=
this as your =0D=0Aauthorization to correspond with you by e-mail, however=
, we =0D=0Awill not accept the electronic transmission of =0D=0Aorders/inst=
ructions without a specific agreement being in place =0D=0Ato govern the sa=
me=2E If you do not wish to receive any further =0D=0Ae-mail correspondence=
please let us know=2E E-mail transmission =0D=0Acannot be guaranteed to be=
secure or error-free as information =0D=0Acould be intercepted, amended, c=
orrupted, lost, destroyed, =0D=0Aarrive late or incomplete, or contain viru=
ses=2E Neither the =0D=0AJulius Baer Group nor the sender accept liability =
for any =0D=0Aerrors or omissions in the content of this message which aris=
e =0D=0Aas a result of its e-mail transmission=2E Please note that all =0D=
=0Ae-mail communications to and from the Julius Baer Group may be =0D=0Amon=
itored=2E This communication is for informational purposes only=2E=0D=0AIt =
is not intended as an offer or solicitation for the purchase =0D=0Aor sale =
of any financial instrument or as an official =0D=0Aconfirmation of any tra=
nsaction=2E=0D=0AThis e-mail may contain confidential or privileged informa=
tion=2E If=0Ayou think you have received this e-mail in error, please advis=
e the=0Asender by reply e-mail and then delete this e-mail immediately=2E=
=0AThank you=2E Aetna
"
IDMS 3rd-party providers forum
IDMSVENDOR-L@LISTSERV.IUASSN.COM
SMTP
IDMSVENDOR-L@LISTSERV.IUASSN.COM
IDMSVENDOR-L@LISTSERV.IUASSN.COM
SMTP








Normal

Normal
Re: question about numbered user exits
"What I always used is to define the exit as a program first in development. Then I dcmt d pro exit to see the called count. This is the real number of times that IDMS actually invokes the exit. It is failsafe, and absolute number that you can bank on. If the called count was high when running the apps, then i would consider linking it in, in production. Since user exits are user written code, you need to debug it anyway. And for that, there is no other alternative, unless you enjoy a cv crash and reading through a system dump to debug your exit. So, to get the exit started, you define it as a program anyway. Then you see how often it's used. Then you make wise decisions from there. AND you comment the exit source with the called loaded count, so that your suceessors who didn't write the exit, have some idea of the footprint of the exit, and it's effect.

Lutz Petzold
DBSS DB2 LUW/IDMS Support
401-782-2265
Page 860 366 0865 or Telalert

Outcomes