This Knowledge Document describes security requirements for every CSF Command in ESP Workload Automation.
Solution:
CSF line cmd | Description | SAF_PROF_APPL | SAF_PROF_GROUP |
$A | Issues a JES RELEASE command on a z/OS job | APPLX-R | GROUPX-R |
$C | Cancels a z/OS job in JES | APPL-R | GROUP-R |
$CD | Cancels a z/OS job with a dump in JES | APPL-R | GROUP-R |
$CP | Cancels and purges a z/OS job in JES | APPL-R | GROUP-R |
$D | Displays the JES status of a job | APPL-R | GROUP-R |
$H | Issues a JES HOLD command on a z/OS job | APPLX-R | GROUPX-R |
A | Releases a job | APPLX-R | GROUPX-R |
AA | Releases an application from hold status | APPLX-R | GROUPX-R |
AH | Select predefined workload from an application. Allows for ad-hoc scheduling. | GROUP-U | GROUP-U |
AS | Releases a held subapplication | APPLX-R | GROUPX-R |
BC | Browses COPYJCL | GROUP-R | GROUP-R |
BD | Browses job documentation | GROUP-R | GROUP-R |
BE | Browses the Event that invoked the application | GROUP-R | GROUP-R |
BJ | Browses the last executed JCL | GROUP-R | GROUP-R |
BP | Browses ESP procedure | GROUP-R | GROUP-R |
BY | Bypasses a job | APPLX-R | GROUPX-R |
BYR | Bypasses a job | APPLX-R | GROUPX-R |
BYS | Bypasses a subapplication | APPLX-R | GROUPX-R |
C | Completes a job | APPLX-R | GROUPX-R |
CA | Completes an application and completes all the jobs in that application. You must remove any holds or waits on the application before ESP will complete it. | APPLX-R | GROUPX-R |
CS | Completes an entire subapplication | APPLX-R | GROUPX-R |
DD | Drops all predecessor dependencies | APPLX-R | GROUPX-R |
DIN | Displays an info record | GROUP-R | GROUP-R |
DR | Drops all resource dependencies | APPLX-R | GROUPX-R |
EC | Edits COPYJCL | GROUP-U | GROUP-U |
ED | Edits job documentation | GROUP-U | GROUP-U |
EE | Edits the Event that invoked the application | GROUP-U | GROUP-U |
EJ | Edits the last executed JCL | GROUP-U | GROUP-U |
EP | Edits ESP procedure | GROUP-U | GROUP-U |
H | Places a job into APPLHOLD status | APPLX-R | GROUPX-R |
HA | Places application in APPLHOLD status | APPLX-R | GROUPX-R |
HAR | Places application in APPLHOLD status | APPLX-R | GROUPX-R |
HR | Places a job into APPLHOLD status with a reason | APPLX-R | GROUPX-R |
HS | Places subapplication into hold status | APPLX-R | GROUPX-R |
IJ | Inserts a z/OS job into the application, IJ can be issued in Application Monitor | APPL-U | GROUP-U |
IJA | Inserts a job after a selected job | APPL-U | GROUP-U |
IJB | Inserts a job before a selected job | APPL-U | GROUP-U |
IW | Inserts a workload object into the application, IW can be issued in Application Monitor | APPL-U | GROUP-U |
JCL | Displays the JESJCL output spool file for the specified job in a JES2 or JES3 environment | GROUP-R | GROUP-R |
JES | Displays the JESMSGLG, JESJCL, and JESYSMSG output spool files for the specified job in a JES2 or JES3 environment | GROUP-R | GROUP-R |
L | Displays all predecessor dependencies | GROUP-R | GROUP-R |
LA | Lists the application | APPL-R | GROUP-R |
LAD | Lists the application dump. LAD lists control blocks ADXE and ATR and the AJQE control blocks. For more information, see the Programming Guide. | APPL-R | GROUP-R |
LI | Displays index entries | GROUP-R | GROUP-R |
LJ | Displays step-level statistics | GROUP-R | GROUP-R |
LJE | Lists detailed information about the specified job | APPL-R | GROUP-R |
LJO | Lists all output spool files for the specified z/OS job. Individual output spool files can be viewed by issuing the S or V command on the appropriate output spool file line in the list. This applies to JES2 and JES3 environments. | GROUP-R | GROUP-R |
LOG | Displays the JESMSGLG (job log) output spool file for the specified job in a JES2 or JES3 environment | GROUP-R | GROUP-R |
LR | Displays the job resources | GROUP-R | GROUP-R |
LS | Lists subapplication | APPL-R | GROUP-R |
ME | Modifies enqueues | GROUP-U | GROUP-U |
MR | Modifies resources | GROUP-U | GROUP-U |
MSG | Displays the JESYSMSG (job message) output spool file for the specified job in a JES2 or JES3 environment | GROUP-R | GROUP-R |
OUT | Displays all output spool files for the specified job in a JES2 or JES3 environment | GROUP-R | GROUP-R |
P | Issues a system STOP command on an executing z/OS job, if the job is programmed to do so | APPL-R | GROUP-R |
QS | Quiesces a z/OS job executing on a goal mode system. Requires ESP Workload Automation Service Governor. | APPL-R | GROUP-R |
R | Resubmits or restarts a job Note: | APPLX-R | GROUPX-R |
RD | Readies a job, removing all predecessors and submit time dependencies | APPLX-R | GROUPX-R |
RDS | Readies a subapplication | APPLX-R | GROUPX-R |
RM | Reruns multiple jobs in an active or complete application | APPLX-R | GROUPX-R |
RP | Replies to a Workload Automation Agent for i5/OS message | GROUP-U | GROUP-U |
RQ | Requests a job | APPLX-R | GROUPX-R |
RQS | Requests a subapplication | APPLX-R | GROUPX-R |
RR | Views the Workload Automation Restart Option EE panels or the Workload Automation Restart Option for z/OS Schedulers restart interface panel. Use RX if you want to exclude specific steps from the range of steps you want to rerun. RX is only available for jobs whose restart manager is Workload Automation Restart Option EE. | APPLX-R | GROUPX-R |
RS | Resumes the original service class of a z/OS job executing on a goal mode system. Requires ESP Workload Automation Service Governor. | APPL-R | GROUP-R |
RT | Resets one or more time dependencies | APPLX-R | GROUPX-R |
RX | Views the Workload Automation Restart Option EE panels | APPLX-R | GROUPX-R |
SUS | Sets the user status field for a job | APPL-R | GROUP-R |
TA | Completes an application immediately. ESP Workload Automation removes any holds and waits that are on the application, completes all the workload objects in the application, and completes the application. | APPLX-R | GROUPX-R |
UB | Unbypasses a bypassed job | APPLX-R | GROUPX-R |
UBS | Cancels the bypass of a subapplication | APPLX-R | GROUPX-R |
UIN | Updates an info record | GROUP-U | GROUP-U |
UR | Unrequests a requested job | APPLX-R | GROUPX-R |
URS | Cancel the requests of a subapplication | APPLX-R | GROUPX-R |
UW | Unwaits a job from job-ancestor wait (JANCWAIT) | APPLX-R | GROUPX-R |
UWA | Removes an application from APPLWAIT status. The application no longer waits for a previous generation of the application. | APPLX-R | GROUPX-R |
UWS | Removes subapplication from SANCWAIT status | APPLX-R | GROUPX-R |
W | Selects distributed job options | GROUP-U | GROUP-U |
WC | Cancels a PeopleSoft job | GROUP-U | GROUP-U |
WD | Withdraws an incomplete job. | APPLX-R | GROUPX-R |
WDS | Withdraws all incomplete jobs in a subapplication | APPLX-R | GROUPX-R |
WDA | Withdraws all incomplete jobs in an application. | APPLX-R | GROUPX-R |
WSF | Retrieves a distributed job spool file | GROUP-R | GROUP-R |
XP | Manually expedites a job with an associated expedite policy, waiting for execution or executing. Requires ESP Workload Automation Service Governor. | APPL-R | GROUP-R |
Note: For R, RR, RX commands, UPDATE access is needed to resubmit from a different JCLLIB; user mode 12 overwrites it.
The following table describes the security requirements for every CSF Command in ESP.
APPL-R means READ access to ESP.APPL profile
APPLX-R means READ access to ESP.APPLX profile
APPL-U means UPDATE access to ESP.APPL profile
GROUP-R means READ access to ESP.GROUP profile
GROUPX-R means READ access to ESP.GROUPX profile
GROUP-U means UPDATE access to ESP.GROUP profile