WebSphere Application Server for z/OS V7.0 customization instructions:

The deployment manager and application server nodes will be configured with:

The Profile Management Tool has created a response file based on the information you provided. These instructions tell you how to convert this response file into a set of customization jobs and how to run the jobs to customize WebSphere Application Server for z/OS. When you upload the customization jobs to the target system, a text version of these instructions will be written to:

 
    ${zTargetHLQ}.CNTL(BBODMINS)

Guidelines

• Create the customization jobs and upload them to the following data sets on the target system:

      ${zTargetHLQ}.CNTL
      ${zTargetHLQ}.DATA
  

  Use the Process action to create the customization jobs and upload them to the target z/OS system.

• You need to use these instructions on your target system.

Manual configuration updates

The Profile Management Tool does not attempt to update configuration data for your base operating system or existing subsystems. You need to perform the following manual steps prior to running the WebSphere for z/OS configuration jobs.

1. Update BLSCUSER. To use the IPCS support provided by the product, append the following contents to the BLSCUSER member in your IPCSPARM or system PARMLIB dataset.

   Alternatively, once the customization jobs are uploaded to the target z/OS system, you may append the contents of the following partitioned data set member to the BLSCUSER member:

       ${zTargetHLQ}.CNTL(BBOIPCSP)
   

   
   
   
   
   
2. Update SCHEDxx. To set the correct program properties for the WebSphere for z/OS run-time executables, append the following contents to the SCHEDxx member in your system PARMLIB concatenation.

   Alternatively, once the customization jobs are uploaded to the target z/OS system, you may append the contents of the following paritioned data set member to the SCHEDxx member:

       ${zTargetHLQ}.CNTL(BBOSCHED)
   

   Note: When you are finished updating SCHEDxx, issue the command SET SCH=xx to activate SCHEDxx and load a new program properties table. This action does not need to be performed if the target z/OS system is at z/OS 1.9 or above, as the BPXBATA2 entry that the BBOSCHED member contains already exists in the IBM-supplied PPT table at those z/OS levels.
   
   
   
   
   
3. Update SMFPRMxx. To collect the SMF120 records created by the run-time servers, update SMFPRMxx to include record type 120, as in the following example:
   
   

          SUBSYS(STC,EXITS(IEFU29,IEFACTRT),INTERVAL(SMF,SYNC),TYPE(0,30,70:79,88,89,120,245))
   

   
   
   For details on the SMF records, see related topics in the WebSphere for z/OS Information Center.
   
   
   
   
4. 
   
   
   
   
5. 
   
   
   
   
6. Update your active BPXPRMxx member to have the following WebSphere Application Server for z/OS configuration file system:
   ${zConfigHfsName} and ${zAppServerConfigHfsName} mounted at: ${zConfigMountPoint} and ${zAppServerConfigMountPoint} in read/write mode.
   
   Example:
   MOUNT FILESYSTEM('${zConfigHfsName}') MOUNTPOINT('${zConfigMountPoint}') TYPE(${zFilesystemType}) MODE(RDWR) MOUNT FILESYSTEM('${zAppServerConfigHfsName}') MOUNTPOINT('${zAppServerConfigMountPoint}') TYPE(${zAppServerFilesystemType}) MODE(RDWR) If you are configuring in a sysplex environment, you may wish to use the NOAUTOMOVE parameter as follows:
   MOUNT FILESYSTEM('${zConfigHfsName}') MOUNTPOINT('${zConfigMountPoint}') TYPE(${zFilesystemType}) MODE(RDWR) SYSNAME(${zSystemName}) NOAUTOMOVE MOUNT FILESYSTEM('${zAppServerConfigHfsName}') MOUNTPOINT('${zAppServerConfigMountPoint}') TYPE(${zAppServerFilesystemType}) MODE(RDWR) NOAUTOMOVE Note: The NOAUTOMOVE parameter prevents the configuration file system from being mounted on a different z/OS system in a shared file system configuration, which could cause performance problems.
   
   
   
   
7. Update TCP/IP by reserving the following ports for WebSphere Application Server for z/OS:
   
   Deployment Manager Ports
   

   Type	Number
   SOAP JMX Connector port	${zSoapPort}
   Cell Discovery Address port	${zCellDiscoveryPort}
   ORB port	${zOrbListenerPort}
   ORB SSL port	${zOrbListenerSslPort}
   Administrative console port	${zAdminConsolePort}
   Administrative console secure port	${zAdminConsoleSecurePort}
   Admin local port	${zAdminLocalPort}
   High Availability Manager Communications port	${zHighAvailManagerPort}

   
   Node agent ports

   Type	Number
   SOAP JMX Connector port	${zNodeAgentJmxSoapConnectorPort}
   Node Discovery port	${zNodeAgentNodeDiscoveryPort}
   Node Multicast Discovery Port	${zNodeAgentNodeMulticastDiscoveryPort}
   Node IPv6 multicast discovery port	${zNodeAgentNodeIPv6MulticastDiscoveryPort}
   ORB port	${zNodeAgentOrbPortName}
   Admin local port	${zNodeAgentAdminLocalPort}
   High Availability Manager Communication port	${zNodeAgentHamCommPort}
   ORB SSL port	${zNodeAgentOrbSslPortName}

   
   
   Application server ports
   

   Type	Number
   SOAP JMX Connector port	${zAppServerSoapPort}
   ORB port	${zAppServerOrbListenerPort}
   ORB SSL port	${zAppServerOrbListenerSslPort}
   Admin local port	${zAppServerAdminLocalPort}
   High availability manager communication port	${zAppServerOrbListenerSslPort}
   Service Integration port	${zAppServerServiceIntegrationPort}
   Service Integration Secure port	${zAppServerServiceIntegrationSecurePort}
   Service Integration MQ Interoperability port	${zAppServerServiceIntegrationMqPort}
   Service Integration MQ Interoperability Secure port	${zAppServerServiceIntegrationSecureMqPort}
   Session Initiation Protocol (SIP) port	${zAppServerSessionInitiationPort}
   Session Initiation Protocol (SIP) secure port	${zAppServerSessionInitiationSecurePort}

   
   
   Daemon ports
   

   Type	Number
   Daemon IP port	${zDaemonPort}
   Daemon SSL port	${zDaemonSslPort}

   
   

   Add the following contents to the PORT section of the TCP/IP profile that is used by the TCP/IP start procedure.

   Alternatively, once the customization jobs are uploaded to the target z/OS system, you may append the contents of the following partitioned data set member to the PORT section of the TCP/IP profile:

       ${zTargetHLQ}.CNTL(BBOTCPIC)
   

   Attention: If another application has already reserved any of these ports for its own use, you must resolve the resulting conflict before you continue. If you use the Profile Management Tool to update the port specifications, be sure to upload the updated customization jobs.

   Note: It is recommended that the IPCONFIG, UDPCONFIG, and TCPCONFIG RESTRICTLOWPORTS be defined in your TCP/IP profile to only allow super users or APF-authorized user applications to bind to privileged ports (1-1024), unless the SAF keyword is specified and the user ID binding to the port is permitted to the SAF resource. It is left up to the users' discretion to determine whether this is viable course of action given the users' specific application/port requirements. For more information please consult: z/OS Communication Server IP Configuration Guide.

   
   
   
   
8. WebSphere Application Server for z/OS customization assumes that the following system data sets are in the system link list: Language Environment SCEERUN SCEERUN2 System SSL SIEALNKE Support for 64-bit SCLBDLL2

   See the Language Environment Customization manual and the System SSL Programming manual for your z/OS release for advice on placing members from the libraries into the system link pack area.

   Placing these data sets in the link list insulates your WebSphere Application Server for z/OS configuration from changes in data set names (for example, when migrating to newer releases of z/OS).

   If the Language Environment or System SSL load module libraries are not in your system link list, you need to perform the following steps before starting any WebSphere Application Server for z/OS servers:

   • Check that the data sets are APF-authorized
   • Complete the optional step below to add the data sets to STEPLIB in the server JCL and setupCmdLine.sh script(s).
   
   If you regenerate server cataloged procedures at any point, make sure the data sets are added to the new cataloged procedures.
   
   
   
   

Running the customized jobs

The Profile Management Tool built a number of batch jobs with the variables you supplied. You need to run the jobs in the order listed below, using user IDs with the appropriate authority.

1. Run job BBOSBRAK
   
   User ID requirement: RACF special authority.
   
   
   • This job excutes the RACF commands to create common WebSphere Application Server for z/OS groups and user IDs. These commands are located in
     ${zTargetHLQ}.DATA(BBOSBRAC)
     

     Type	Group/userid	GID/UID
     Administrator user ID	${zAdminUserid}	${zAdminUid}
     Control user ID	${zControlUserid}	${zControlUid}
     Servant user ID	${zServantUserid}	${zServantUid}
     Configuration group	${zConfigurationGroup}	${zConfigurationGroupGID}
     Servant group	${zServantGroup}	${zServantGroupGID}
     Local user group	${zLocalUserGroup}	${zLocalUserGroupGID}

     "*" denotes that the system will assign a GID/UID.

     Carefully review these definitions with your security administrator.

   
   If the group and user IDs named above have already been created during a previous WebSphere Application Server for z/OS configuration and are in all target system RACF databases, you do not need to rerun this job.
   
   Note: This job creates the WebSphere administrator ID ${zAdminUserid} without a password (or password phrase). You must assign this user ID a password (or password phrase) that complies with your institution standards. This is also the password (or password phrase) that will be used when logging on to the WebSphere Application Server administrative console.
   
   Enter the following RACF command to assign a password:
   
   

   	ALTUSER ${zAdminUserid} PASSWORD(password) NOEXPIRED
   

   
   Enter the following RACF command to assign a password phrase:
   

   	ALTUSER ${zAdminUserid} PHRASE('password phrase') NOEXPIRED 
   

   
   If you are using a different security system, make sure that the ${zAdminUserid} has a password or password phrase.
   
   To use RACF password phrase support, your target system must be at z/OS Version 1.9 or above
   

   Result: You may receive errors, such as INVALID USER messages, from this job because a user ID, group or profile is already defined. Make sure the existing user ID, group, or profile has the same characteristics as the user ID, group, or profile being created by BBOSBRAK. If not, then change the values in the Profile Management Tool, which are causing the conflict. Then upload the updated customization jobs and restart the process.

   When this step is complete, all groups and user IDs listed above for job BBOSBRAK should be defined in the RACF database on each target system for the cell.
   
   Note: The WebSphere Application Server administrator user ID ${zAdminUserid} must have the WebSphere Application Server configuration group ${zConfigurationGroup} as its default OMVS group.

   
   
   
   
   
2. Run job BBOSBRAM

   • User ID requirement: File system update authority (see above).

     This job creates home directories for WebSphere Application Server for z/OS user IDS. These home directories will be subdirectories of ${zUserIDHomeDirectory}

     This job will create the following directories:
     

      
         ${zUserIDHomeDirectory} 
                                                    
              ownership:       (any)                                         
              permission bits: 755                                     
                                                                         
         ${zUserIDHomeDirectory}/${zConfigurationGroup} 
                                          
              ownership:       ${zControlUserid}:${zConfigurationGroup}                             
              permission bits: 770                                     
                                                                      
         ${zUserIDHomeDirectory}/${zServantGroup}
                                           
              ownership:       ${zControlUserid}:${zServantGroup}                                    
              permission bits: 770                                     
                                                                          
         ${zUserIDHomeDirectory}/${zLocalUserGroup} 
                 
              ownership:       ${zControlUserid}:${zLocalUserGroup}                             
              permission bits: 770
     

     This job should be run on each z/OS system that will host WebSphere Application Server nodes using these WebSphere Application Server for z/OS common groups and owner user ID. After execution, verify that the directories have been created with the correct permissions on each system.

     If these directories already exist with the specified ownership and permission on a target system, then this job does not need to be run on that system.

     Attention: If the directory ${zUserIDHomeDirectory} is used by applications other than WebSphere Application Server, make sure that the permissions set by BBOSBRAM (755) are appropriate, or change them manually. This directory must be world-readable for Websphere Application Server to run correctly.

   
   
   
   
   
     


3. Run job BBODBRAK
   
   User ID requirement: RACF special authority.

   
   This job executes the RACF commands to create RACF users and profiles required by this WebSphere for z/OS cell. These commands are located in
   

   ${zTargetHLQ}.DATA(BBODBRAC)
   Carefully review these definitions with your security administrator.
   
   Result: You may receive errors, such as INVALID USER messages, from this job because a user ID, group or profile is already defined. Make sure the existing user ID, group or profile has the same characteristics as the user ID, group or profile being created by BBODBRAK. If not, then change the values in the Profile Management Tool which are causing the conflict, upload the updated customization jobs, and restart the process.
   
   
   
   
4. Run job BBOCBRAK
   
   User ID requirement: RACF special authority.

   
   This job executes the RACF commands to create RACF users and profiles required by this WebSphere for z/OS cell. These commands are located in
   

   ${zTargetHLQ}.DATA(BBOWBRAC) The following user ID(s) will be created:
   

   Type	Userid	UID
   Asynch admin user ID	${zAdminAsynchTaskUserid}	${zAdminAsynchTaskUid}
   Unauthenticated user ID	${zAdminUnauthenticatedUserid}	${zAdminUnauthenticatedUid}
   Daemon user ID	${zDaemonUserid}	${zDaemonUid}
   Adjunct user ID	${zAdjunctUserid}	${zAdjunctUid}

   "*" denotes that the system will assign a UID.

   Carefully review these definitions with your security administrator.
   
   Result: You may receive errors, such as INVALID USER messages, from this job because a user ID, group or profile is already defined. Make sure the existing user ID, group or profile has the same characteristics as the user ID, group or profile being created by BBOCBRAK. If not, then change the values in the Profile Management Tool which are causing the conflict, upload the updated customization jobs, and restart the process.
   
   
   
   

5. Run job BBOMSGC
   User ID requirement: Update authority for data set SYS1.MSGENU and/or SYS1.MSGJPN.
   
   Attention: This is optional unless you require message translation.
   
   This job sets up MMS to translate messages for WebSphere Application Server for z/OS.
   
   Before running this job, update the INPUT DD statements to point to the SBBOMSG dataset for your installation.
   
   There are two steps to update: One that performs a copy to SYS1.MSGENU and one that performs a copy to SYS1.MSGJPN. Remove the unneeded step and if necessary, change the target libraries.
   
   
   
6. Check user ID authorization

   Make sure the ${zConfigurationGroup} group has read access to all WebSphere product data sets, as well as to any other data sets which will be placed in WebSphere Application Server for z/OS cataloged procedure STEPLIB concatenations.

   Make sure the following user IDs have read access to the resolver configuration file in use on your system. Depending on your IP setup, this file may be /etc/resolv.conf, SYS1.TCPPARMS(TCPDATA), or another data set.

   ${zControlUserid} ${zServantUserid}

   See the z/OS eNetwork Communication Server IP Configuration manual for the resolver search order.

   Ensure the following user ID has read access to the data sets in your system parmlib concatenation:
   
   

   ${zControlUserid}

   Attention: If operator commands are protected by the z/OS security server at your installation, you must ensure that sufficient authority is given to WebSphere tasks to control operations.

   The Deployment Manager and Application Server controller user ID (${zControlUserid}) needs the ability to perform operations on started tasks belonging to WebSphere Application Server for z/OS.

   The asynchronous administrator user ID, and any user ID used to run the federation job when the node agent is started automatically, need the authority to issue the MVS START command.

   If you are currently controlling MVS console command authority with SAF OPERCMDS profiles, grant the following authorities as indicated, substituting your own profile names:

   PERMIT START_profile_name CLASS(OPERCMDS) ID (${zControlUserid} ${zAdminAsynchTaskUserid}) ACCESS(UPDATE) PERMIT STOP_profile_name CLASS(OPERCMDS) ID (${zControlUserid}) ACCESS(UPDATE) PERMIT MODIFY_profile_name CLASS(OPERCMDS) ID (${zControlUserid}) ACCESS(UPDATE) PERMIT CANCEL_profile_name CLASS(OPERCMDS) ID (${zControlUserid}) ACCESS(UPDATE) PERMIT FORCE_profile_name CLASS(OPERCMDS) ID (${zControlUserid}) ACCESS(UPDATE)

   You need to also grant the appropriate console command authority to any user ID that executes the startServer.sh or stopServer.sh script.

   
   
   
   
   
7. Run job BBOCCPY1
   User ID requirement: File system update authority (see above), and the authority to update the cataloged procedure library
   ${zProclibName}
   
   This job copies the tailored cataloged procedures to your procedure library.
   
   Attention: Be aware that you may overlay existing members in the above data set.
   
   
   
   
   
8. Run job BBOCCFS
   User ID requirement: File system update authority (see above), and the authority to allocate ${zConfigHfsName} ${zAppServerConfigHfsName}

   Before running this job: Verify that the DD statements which define the data sets are valid for the storage rules defined on the target system.
   This job:

   Creates the following mount point directories

   ${zConfigMountPoint} ${zAppServerConfigMountPoint}

   Allocates the following configuration file system(s) using the Hierarchical File System (HFS)

                                                                                    
                   ${zConfigHfsName}                                                
                                                              
                   ${zAppServerConfigHfsName}                                                
   
   
   

   Allocates the following configuration file system(s) using the z/OS Distributed File Service zSeries File System (zFS)

                                                                                    
                   ${zConfigHfsName}                                                
                                                              
                   ${zAppServerConfigHfsName}                                                
   
   

   Allocates the following configuration file system using the Hierarchical File System (HFS) ${zAppServerConfigHfsName}

   Allocates the following configuration file system using the z/OS Distributed File Service zSeries File System (zFS) ${zAppServerConfigHfsName}
   and mounts them at the above mount points.

   Do not run this job if:
   1. The configuration file systems already exist and are mounted at the desired mountpoints, or if
   2. The mount point directories are controlled by automount. Either disable the automount rule for the configuration mount points while running this job, or perform the following steps manually:
      • Allocate the configuration file system data sets.
      • Issue the following shell commands, which will also cause automount to mount the file systems chmod 775 ${zConfigMountPoint} chmod 775 ${zAppServerConfigMountPoint} chown ${zAdminUserid}:${zConfigurationGroup} ${zConfigMountPoint} chown ${zAdminUserid}:${zConfigurationGroup} ${zAppServerConfigMountPoint}
   Before you begin: The BBOCCFS job assumes your root file system is mounted in read/write mode. If the root file system is not mounted in read/write mode, manually create the directories
   
   ${zConfigMountPoint} ${zAppServerConfigMountPoint}
   and any needed higher directories. Set file permissions to 775 and set the owning user ID and group to ${zAdminUserid} and ${zConfigurationGroup} before running BBOCCFS
   
   Example: If you plan to use /wasv7config as your directory, issue the following commands from within the OMVS shell: mkdir -p -m 775 /wasv7config chown -R ${zAdminUserid}:${zConfigurationGroup} /wasv7config
   
   
   
   
   
9. Run job BBOCHFSA
   User ID requirement: File system update authority (see above).
   
   This job populates the previously-created configuration file systems and prepares them for profile creation.
   
   Note: If the SCEERUN data set is not in the system link list, add that data set to STEPLIB for the CHECKV step in BBOCHFSA.
   
   When this completes, examine the job output. Success is indicated with a RC=0 in the job output.
   
   
   
   
   
10. Run job BBOWWPFC
    User ID requirement: File system update authority (see above).
    
    This job creates a profile (set of configuration files for a node) in the configuration file system.
    
    Note: If the SCEERUN2 data set is not in the system link list, add that data set to STEPLIB for the LIBVSCRP, CELPROFD and CELPROFN steps in BBOWWPFC
    
    Upon completion, examine the job output. Success is indicated by rc=0.
    
    Note: If the BBOWWPFC (profile creation) job fails, you must perform the following steps to clean up the partially-built profiles for both the deployment manager and application server:

                
             cd ${zConfigMountPoint}/${zWasServerDir}
             
             ./bin/manageprofiles.sh -deleteAll
             
             rm -R profiles
             
             cd ${zAppServerConfigMountPoint}/${zAppServerWasServerDir}
             
             ./bin/manageprofiles.sh -deleteAll
             
             rm -R profiles
    

    Then correct the problem that caused BBOWWPFC to fail and re-run the job.
    
    
    
    
    
    
11. All WebSphere Application Server processes require access to the Language Environment and System SSL load modules.
    
    
    If the SCEERUN, SCEERUN2 and System SSL load module libraries are not in the system link list, add them to the STEPLIB DD concatenation in each of the following cataloged procedures in ${zProclibName}: ${zControlProcName} ${zServantProcName} ${zAppServerControlProcName} ${zAppServerServantProcName} ${zAppServerAdjunctProcName} ${zDaemonProcName}
    Also, add the full data set names, separated by colons (:), to the STEPLIB variable in the following shell scripts:
    

                                                                                     
                    ${zConfigMountPoint}/${zWasServerDir}/profiles/default/bin/setupCmdLine.sh          
                    
                    ${zAppServerConfigMountPoint}/${zAppServerWasServerDir}/profiles/default/bin/setupCmdLine.sh   
    

    When modifying the setupCmdLine.sh script, do not remove lines or comment them out, as this may cause problems with automated updates to the script.
    
    Add only those data sets which are NOT in the link list.
    
    
    
    
    
    
12. Resource Recovery Services (RRS)
    Make sure Resource Recovery Services (RRS) is active.
    
    (See the online information center for setup instructions if necessary.) Look for the following console message to verify that RRS was successfully started:
    
    ASA2011I RRS INITIALIZATION COMPLETE. COMPONENT ID=SCRRS
    
    
    
    
    
13. Start the Deployment Manager
    
    
    Issue the MVS command START ${zControlProcName},JOBNAME=${zServerShortName},ENV=${zCellShortName}.${zNodeShortName}.${zServerShortName}
    
    Result: The following message appears on the console and in the job log of ${zServerShortName} BBOO0019I INITIALIZATION COMPLETE FOR WEBSPHERE FOR z/OS CONTROL PROCESS ${zServerShortName}
    
    
    
    
    
14. Start the Node agent server.
    
    Issue the MVS command:
    
    START ${zAppServerControlProcName},JOBNAME=${zNodeAgentServerShortName},ENV=${zCellShortName}.${zAppServerNodeShortName}.${zNodeAgentServerShortName}
    Result: The following message appears on the console and in the job log of ${zNodeAgentServerShortName}.
    BBOO0019I INITIALIZATION COMPLETE FOR WEBSPHERE FOR z/OS CONTROL PROCESS ${zNodeAgentServerShortName}.
    
    
    
    
    
15. Start the Application Server
    
    
    Note: You need to start the node agent before you start the Application Server, if the node agent has not already been started.
    
    Issue the MVS command START ${zAppServerControlProcName},JOBNAME=${zAppServerServerShortName},ENV=${zCellShortName}.${zAppServerNodeShortName}.${zAppServerServerShortName}
    
    
    Result: The following message appears on the console and in the job log of ${zAppServerServerShortName} BBOO0019I INITIALIZATION COMPLETE FOR WEBSPHERE FOR z/OS CONTROL PROCESS ${zAppServerServerShortName}
    To run these servers in reusable address spaces, add ",REUSASID=YES" to the end of the START commands. See the article "Reusable address space" in the WebSphere Application Server for z/OS Information Center for more information, and important restrictions.
    
    To access the administrative console, point a Web browser at:
    
    http://${hostName}:${zAdminConsolePort}/ibm/console