Decommissioning a member of SSI

Products

• VM:Secure for z/VM

Issue/Introduction

Will be decommissioning member 3 of a 3-member SSI and following instructions in IBMs doc for decommissioning a member.

Two questions:

First, are the any special requirements from a VM:Secure perspective that need to be performed when removing a system from a SSI?

Second, per the z/VM doc, we need to update the User Directory and remove any SUBCONFIG statements from any user Identity's. Aside from issuing VMSECURE ULIST command and going through the list one by one, is there a VM:Secure option / command to filter IDENTITY configs containing 'BUILD ON VW3T" as well as the the associated SUBCONFIG configs?

Environment

Release : 3.2

Resolution

You will need to update the DIRECT record in VM:Secure's PRODUCT CONFIG to remove the volser entry for the SSI you are removing.

Also remove the SSINODE XX3T record.

 

You may want to use the VMSECURE SCAN command to find the SUBCONFIGs and the IDENTITY's using them for the XX3T SSI you want to decommission.

The SCAN command is documented at:

 

https://techdocs.broadcom.com/us/en/ca-mainframe-software/traditional-management/ca-vm-secure-for-z-vm-with-security/3-2/reference/command-reference/scan-command.html

 

 

 

Also, assuming you “followed the rules” for building the SSI cluster initially, the things we mention for helping you ADD a new member, can help here as well. For example, the MAP command to list all the “MEMBER-n” SUBCONFIG entries to build a list of them (also the DIRMAINT satellite USER entries that are likely on the volume that will need to be deleted). 

 

The MAP command is documented at:

 

https://techdocs.broadcom.com/us/en/ca-mainframe-software/traditional-management/ca-vm-secure-for-z-vm-with-security/3-2/reference/command-reference/map-command.html

 

 

 

Additional Information

Also keep in mind you can use commands like VMSECURE ADMIN profile and VMSECURE DELENTRY if/when deleting USER, IDENTITY, SUBCONFIG or PROFILE directory.