Unable to start VSMGUARD / SMAPI on z/VM 7.2

Products

• VM:Secure for z/VM

Issue/Introduction

After upgrading to z/VM 7.2 and configuring SMAPI-services in the same manner as for z/VM 7.1, it no longer starts.

When starting up VMSGUARD the below errors are shown.

Config looks okay and SMAPI workers have access to the VMANAGER 193 disk

Also verified the DMSSICNF COPY file on MAINT's 193 has the DM_exit set to VMXSIXDM.

ENV_INFO = No Directory Manager configured in DMSSISVR NAMES, rc: 4   
                                                                      
 * MSG FROM VSMGUARD: SMSTATUS issues a request to your directory     
 * MSG FROM VSMGUARD: manager.  If you see VM READ at the             
 * MSG FROM VSMGUARD: right bottom of your screen, please             
 * MSG FROM VSMGUARD: type your password and hit enter to             
 * MSG FROM VSMGUARD: allow SMSTATUS to continue processing.          
Execute rc:8 rx:3015                                                  
Error Data is:COMMAND_IN_ERR=DMSWSCHK EXEC,rc:20040                   
   210 +++ myrs = C2D(myrs)                                           
DMSREX475E Error 40 running DMSWSCHK EXEC, line 210: Incorrect call to routine
Routine DMSWSESM loaded at 07DFA420 size 00000BE0                     
R07DFA420  47F0F018 13C4D4E2 E6E2C5E2 D4F2F04B F6 *.00..DMSWSESM20.*

Environment

VM:Secure 3.2   running in z/VM 7.2 environment. 

Cause

Lacking VM:Secure Rules for DIAGD4 and DIAG88.

 

Resolution

You must add the following VM:Secure Rules for DIAGD4 and DIAG88;

• Allow each SMAPI servant ID to issue CP Diagnose code X’D4’. With no External Security Manager, privilege class "B" is needed in each directory entry. If you are using an External Security Manager, perform one of the following steps:

   
• For the 

  VM:Secure

   Rules Facility, add the following SYSTEM rule for each SMAPI servant ID:

   
  ACCEPT VSMWORKn DIAGD4
   
  ACCEPT VSMGUARD DIAGD4

• For another ESM, use the appropriate controls in the ESM to allow each SMAPI servant to issue the appropriate Diagnose codes.

• Allow each SMAPI request server ID and servant server ID to issue CP Diagnose code X’88’. With no External Security Manager, directory record OPTION DIAG88 is needed in each directory entry. If you are using an External Security Manager, perform one of the following steps:

   

• For the 

  VM:Secure

   Rules Facility, add the following SYSTEM rule for each SMAPI servant ID, and each of the SMAPI request servers:

   
  ACCEPT VSMWORKn DIAG88
   
  ACCEPT VSMGUARD DIAG88
   
  ACCEPT VSMEVSRV DIAG88
   
  ACCEPT VSMREQIN DIAG88
   
  ACCEPT VSMREQI6 DIAG88
   
  ACCEPT VSMREQIU DIAG88

• For another ESM, use the appropriate controls in the ESM to allow each SMAPI servant server ID and request server to issue the appropriate Diagnose codes.

   

Additional Information

The complete section for: 

Configuring the Server Environment

 

 

is found in the VM:Secure Adminstrators guide at:

 

https://techdocs.broadcom.com/us/en/ca-mainframe-software/traditional-management/ca-vm-secure-for-z-vm-with-security/3-2/administrators/systems-management-api-support.html