Specific Control Options › DB2FAC—Group and Protect DB2 Subsystems

DB2FAC—Group and Protect DB2 Subsystems

Valid on z/OS.

Use the DB2FAC control option to:

• Logically group DB2 subsystems under different facility names for protection under the CA Top Secret Option for DB2
• Control whether the resources in a DB2 subsystem is protected using the CA Top Secret Option for DB2

All entry methods are supported.

This control option has the following format:

DB2FAC(ssid=facility|NONE)

ssid

Identifies the name of the DB2 subsystem

facility

Indicates the facility name to which the DB2 subsystem is associated.

NONE

Removes the assignment of a facility from the specified DB2 subsystem. Required when using the TSS MODIFY command to remove the facility assignment for a subsystem temporarily. To remove the assignment of a facility, remove the ssid=facility definition from the CA Top Secret startup parameter file permanently.

Examples: DB2FAC control option

This example indicates that DB2 subsystems DB2A and DB2B are grouped under DB2PROD, while DB2 subsystems DB2C and DB2D are under DB2TEST:

DB2FAC(DB2A=DB2PROD)
DB2FAC(DB2B=DB2PROD)
DB2FAC(DB2C=DB2TEST)
DB2FAC(DB2D=DB2TEST)

This example indicates that DB2 subsystems DB2A is no longer assigned to the DB2PROD facility:

DB2FAC(DB2A=NONE)

Protect DB2 Subsystem Resources

The mode on the facility that is defined for the DB2 subsystem controls the protection of the DB2 subsystem resources. Specifying a non‑DORMANT mode for the facility that is associated with the DB2 subsystem protects its resources. A mode of DORMANT indicates that neither CA Top Secret for DB2 or native DB2 protects the resources in the DB2 subsystem. DORMANT indicates no DB2FAC control option specification for a DB2 subsystem. For information, see the Implementation:DB2 Guide.

This example allows the protection of DB2 resources:

DB2FAC(DB2A=DB2PROD)
DB2FAC(DB2B=DB2PROD)

This example of a specified mode allowing protection of DB2 resources:

FACILITY(DB2PROD=MODE=FAIL)

The settings of the DB2PROD facility (LOG, ABEND/NOABEND) determine the mode for the checks and other facility options. For example, if the user is logged on to TSO the MODE and all other facility control options are determined by the DB2PROD facility but only for DB2 resource checks. All other normal functions of TSO continue to occur under the TSO facility.