IBM Z9, Руководство по планированию

Страница: 238 / 274

System z9 PR/SM Characteristics
v There is a Hardware Management Console (HMC) and Support Element (SE)
from which the system can be operated. Therefore the system administrators of
the system must be cleared for the highest security classification of work being
performed on the system.
v
Hardware-related operations for each logical partition will be conducted from the
HMC or SE. Operations are invoked by selecting the CPC image icon for the
desired logical partition, and dragging/dropping it on a task icon for the desired
operation.
v
For enhanced integrity of execution, locking of partitions is recommended. The
partition must then be unlocked before other disruptive operations can be
performed on that partition. Lock a logical partition (LP) by double-clicking on the
CPC image icon representing the LP to open its Detail page. Set the Lockout
disruptive tasks radio button to Yes and click the OK button. You can use this
same procedure to unlock an LP by setting the Lockout disruptive tasks radio
button to No and saving the setting. Locking an LP can prevent accidentally
performing disruptive tasks on an LP.
v
When entering values on an HMC or SE panel, values are not recognized by the
system until you save the data and confirm the changes appearing on the
screen.
v The Security Log records system operator actions and responses for operations
that are security relevant. The entries are in chronological order and provide an
audit log. Entries also include a user (system administrator) identifier when
appropriate.
v
The Security Log, when full, will be pruned to 2/3 of its capacity. The pruned
records, the oldest 1/3 of the log, are discarded. Care should be taken to
periodically off load the security log to insure that no records are lost.
v
When the security log is successfully off loaded to removeable media, the active
log is pruned so that it does not exceed 20% of it’s capacity. If the active security
log is below 20%, then no entries are removed. If it is above 20%, then enough
active security log entries are removed (from oldest to newest) to reduce the size
of the active security log to 20%. The oldest entries are still in the offloaded log.
v The security log on both the HMC and SE is 10 megabytes. Entries range from
40 bytes to 400 bytes.
v
Access to the security log is achieved by selecting
″
View Security Logs
″
from the
list of console actions. This is available on both the SE and HMC. Access to the
Security Log from a logical partition is impossible (this capability does not exist).
Central and Expanded Storage
Throughout this document there are statements that announce
″
Sharing of allocated
central/expanded storage among multiple logical partitions is not allowed
″
.,
″
... it
becomes available to the logical partition if no other logical partition is using the
same storage.
″
, and
″
No other logical partition has this expanded storage address
range on line.
″
This is because PR/SM* has a mechanism that detects conditions
where sharing was defined (where address ranges overlap), and rejects such
requests. PR/SM* licensed internal code (LIC) and hardware rigidly enforce the
″
no-sharing
″
rule at logical partition definition, during logical partition activation,
during logical partition reconfiguration, and during logical partition execution.
PR/SM* monitors each instruction’s storage accesses for validity; accesses outside
the logical partition’s defined storage are not permitted to proceed. Only storage
increments within the logical partition’s storage allocation as defined in the
activation profile can be placed offline. Storage is varied off and on line by using the
B-4
PR/SM Planning Guide