COMMLOG parameter

$Command login flags

Summary

Default value

X'00'

X'02' if an External Security Manager (ESM) is active (ACF2, RACF, or TOPSECRET)

Parameter type

System

Where set

User 0 CCAIN parameters

Related products

All

Introduced

Before Sirius Mods 6.7

Description

This is a bitmask parameter that affects the type of login performed by daemon threads when logged in by a $Comm function ($Command, $CommndL, or $CommBg), or by a New method for a Daemon class object.

The bits in this parameter mean:

X'01'

A login that bypasses external authorizer (RACF, ACF2, Top Secret) validation is performed.

X'02'

A trusted login is performed via the external authorizer.

X'04'

Activates support for daemon login improvements, if used in conjunction with the X'02' bit.

COMMLOG=6 activates an additional layer of processing between Model 204 and ACF2 for processing daemon logins (including $CommBg and related functions). With COMMLOG=6, each user that performs a login passing a password gets a UUP block, which is shared with any of its daemons.

X'80'

If this bit is set along with the X'04' bit, any CCASNAP will include extra information relating to the caching of external authorizer information.

X'20'

This bit activates diagnostic processing that can be fairly expensive. Set this option only if directed by Rocket technical support.

If COMMLOG is set to zero, Model 204 attempts to determine if the external authorizer (if any) supports trusted login (RACF, ACF2, and Top Secret all support trusted login):

• If the authorizer does, Model 204 sets COMMLOG to X'02', then does all trusted logins via the external authorizer.
• If the authorizer does not, the flag is set to X'01', and all logins for $Comm and Daemon objects do not use the external authorizer.

Generally, this parameter should be left as 0, though it might make sense to set it to X'01' for efficiency — there is considerable overhead in an external authorizer login, even a trusted one.

The downside of setting this parameter to X'01' is that no external authorizer logging will be performed for the daemon login (this might be viewed as a benefit), and things that required external authorizer validation (such as sequential file access) will not be correctly controlled by the external authorizer.