Can multiple people use profile exchange to exchange to the same alternate user profile?
Yes, they can. When multiple users exchange to the same profile, it can be a little harder to investigate which user made a specific change while using the profile. You need to refer to the Robot/SECURITY Activity List to determine which user was using Profile Exchange at that time to determine who was responsible for the change.

When a user has successfully exchanged to a profile with greater access privileges, can they use that authority to create new Robot/SCHEDULE jobs or other disruptive acts?
Yes, they could. However, if you use the security features of the Robot products correctly, you can prevent this type of mischief. For example, you can lock out alternate profiles from sensitive areas. If a user performs a malicious action while using Profile Exchange, Robot/SECURITY maintains a complete log of events to help you identify and prosecute the perpetrator.

During the time on the Access Schedule that a user is allowed to do a profile exchange, can they exchange as often as they want to?
Yes, users can exchange as many times as they wish within the times allowed on their access schedule.

Can you schedule profile exchanges within Robot/SCHEDULE jobs?
Yes, you can schedule profile exchanges as part of a Robot/SCHEDULE job by inserting the commands to start (RSESTREXC) and end (RSEENDEXC) profile exchange.

Note: This exchange affects only the batch job submitted by Robot/SCHEDULE; it has no effect on any interactive jobs.

SEQUEL ViewPoint provides grid control features that let you format your view results. You can:

• Choose contrasting colors for even/odd result rows
• Format different aspects of your results (such as headings, rows, and selection area) distinctively, including font attributes (style, size, weight, and color) and foreground/background colors.
• Use conditional formatting to highlight exceptions
• Use the Fast Group-and-Sum function for non-summarized data

Let’s look at how you might use some of these capabilities. Two sample order files, ORDHEAD and ORDLINE, are shipped with SEQUEL. Using these files, you can create a very simple SEQUEL view with the following statement:

SELECT cusno.1, ordno.1, prdno.2, quano.2, actsp.2, quano*actsp NAME(extprc)
COLHDG(”Extended” “Price”)
FROM sequelex/ordhead,sequelex/ordline
INNER JOIN ordno.1=ordno.2
ORDER BY cusno

Then, you can use ViewPoint to format the results. In this example, we grouped the results for each customer number, even though the statements creating the view do not contain any group or sum syntax.

Set user/desktop defaults
You can set default grid formatting at the user/desktop level, or you can apply formatting to a view. To apply formatting to a view, you must define the formatting during a ViewPoint Design View session. ViewPoint saves the formatting as part of the view definition. View formatting overrides the defaults set at the user/desktop level (for that view only).

Format view results
Here’s how you format view results:

1. Open an existing view in a ViewPoint Design View session. If you are creating a new view, do a Save or Save As operation first. Display your results.

2. In the results window, select the Format > Layout option to continue.

3. Open the Layout Format window. Select the General tab to specify whether you want to have alternating colors for even/odd rows and your color selections. Use the grid line drop-down menu to select a grid line format from the selection list.

4. Select the Grouping tab to specify whether you want to enable the automated grouping function. If this option is checked, the results may be grouped as shown in the first example. To use this feature, you simply drag-and-drop a column heading (such as Customer Number) to the top margin of the results window and SEQUEL groups the data by that value.

5. Use the Style Editor tab to pick one of the styles (sections) in the results and specify formatting.

6. If you are using a Design View session, SEQUEL enables the Column Editor tab. Use this tab to specify conditional highlighting for special occurrences of data in the view results. For example, we could highlight a value like a low inventory level. When this value occurs, the amount shows up in red. Use this feature when you are creating a SEQUEL dashboard with key performance indicators.

7. Finally, use the Printing Options tab to apply print settings when sending the results to a network printer.

See SEQUEL ViewPoint’s help text for additional examples and information about grid control options.

Contributed by Steven Smith, Technical Writer

I am planning an operating system (OS) upgrade. How do I find out what I need to do for Help/Systems products?
Call us before you update your OS to a new level. Some product versions may not be compatible with the upgraded OS. Each product needs to be reviewed to see if it needs updates before you update the OS.

What is the easiest way to set up a Report Set in Robot/REPORTS?
Use Robot/GUIDE. Robot/GUIDE ensures you don’t make typos when defining comparison information and prevents you from missing steps in the setup procedure.

When our System i was put into restricted state, several critical jobs did not run. We have monitor jobs that notify the operator if these jobs are not running, but since Robot/SCHEDULE was not active they didn’t work. How can I make sure that doesn’t happen again?
Robot/SCHEDULE provides two ways of working with jobs that are missed while it is inactive. On the General System Defaults panel there is an option called “Run Autowork at Startup of ROBOT.” When this is set to Y (Yes), Robot/SCHEDULE automatically runs all missed jobs for the current date (since 12:01 a.m.) as soon as it is restarted. If you want more control than running all missed jobs, you can run the Autowork function manually using Option 4 of the Control Menu. If you select the option to display missed jobs, you can control which ones to run and go back to the prior day as well.

I am using Robot/SAVE to back up the IFS. Can I omit QNTC servers from the backup?
Unfortunately, you cannot omit these servers. However, you can use the following command to expedite the process of connecting to the servers for SAV command processing:

ADDENVVAR ENVVAR(QZLC_SERVERLIST) VALUE(’1′) LEVEL(*SYS)

Note: You may want to to check with IBM before implementing this environment variable.

Send jobs Host-to-Host or Node-to-Node with Robot/NETWORK 10.0

If you haven’t discovered Robot/NETWORK packets, you are in for a treat. You can use Robot/NETWORK packets to centrally control and maintain:

* Robot/SCHEDULE job setups

* Robot/CONSOLE message sets, message tables, and message groups

* Robot/REPORTS report sets

Once you start using packets, you no longer have to sign on to multiple systems and create the same objects over and over. Not only do packets save you time, but they also reduce errors caused by repetition. You create an object once and use it many times.

Creating Robot/SCHEDULE packets
To access Robot/SCHEDULE packets, go into Robot/NETWORK 10.0 and click Product Master. Then, right-click Robot/SCHEDULE and select Explore. When the Robot/SCHEDULE 10.0 Explorer (graphical user interface) displays, you can create Robot/SCHEDULE jobs and other objects, such as date objects and OPAL objects, that you may need to complete your job setup. Use the same steps you would use if you were creating the job or object in a production Robot/SCHEDULE environment. Then you can send these jobs to remote Nodes. (Or, if you have a multi-Host environment, you can send these jobs to another Host’s Product Master.)

Note: Jobs or objects created in the Product Master library of Robot/SCHEDULE are not actually in production in the job setup of any system until you send them to a system.

Changing a packet that has been sent
If you send a job or object using packets and need to make changes to it, go into the Robot/SCHEDULE Product Master, make the changes, and send them. You can send the changes to all systems, or a selected group of systems. And, you can restrict the objects that will be sent with the job. For example, if you made changes to the environment only, you can avoid sending other objects that are attached to the job.

You can use the Product Master to remove or reverse changes you have made to jobs using a packet. If you move a change into production from the Product Master and it doesn’t work as expected, simply reverse that packet. Reversing a packet removes the changes made by that packet and returns the job to the way it was before the packet was applied. You even can delete a job created by a packet.

Sending an active job to the Product Master
Perhaps you have a production job set up on one system that you want to share with many systems. Use the command RBTNETNODE/RBNSNDRBT to send the job to the Robot/SCHEDULE Product Master. Once the job is in the Product Master, you can distribute it to as many systems as needed. In the future, you can make changes to it and distribute the changes to various sites.

Reviewing packet activity
When you send a packet from the Product Master, Robot/NETWORK keeps a record of the event. You can view this history online, or run the Packet History Report to see what objects have been sent from the Host to remote Nodes.

Sending jobs Node-to-Node
Using the Robot/SCHEDULE Explorer on the Robot/NETWORK Host, you also can send jobs Node-to-Node. When you right-click on a job on a Node system, a menu displays. When you select SEND, the job is sent directly to another Node system.

Note: When you send a job Node-to-Node, you bypass the Product Master and its benefits (such as the ability to share the job with other systems and the ability to maintain the job from a central site). Jobs sent Node-to-Node do not show up in the Packet History Report.

Working with green screen products
For green screen Robot products, such as Robot/REPORTS and Robot/CONSOLE, you create and send packets using the Robot/NETWORK 10 Product Master menu option on the Host system. From this option, you can create the Robot/CONSOLE and Robot/REPORTS objects you need to set up these products.

As with Robot/SCHEDULE, you create the object just as if you were in the actual product and distribute it to the remote Nodes from the Product Master. If your Report Set or Message Set contains OPAL, the remote system automatically compiles the code when the packet is applied.

Unlike working with Robot/SCHEDULE, you cannot send Robot/CONSOLE or Robot/REPORTS packets Host-to-Host or Node-to-Node. Distribution is limited to sending packets from the Robot/NETWORK Host to its attached Nodes.

You can send existing Message Sets and Report Sets from a remote system to the Product Master. For Robot/REPORTS, use the command RBTNETNODE/RBNSNDREP, and for Robot/CONSOLE use the command RBTNETNODE/RBNSNDRBC. These commands put the objects in the appropriate Product Master and let you change and distribute them to multiple systems.

Summary
Once you discover how easy it is to use packets, you’ll wonder why you haven’t been using them all along! Packets are a great way to maintain multiple products across multiple systems from a central site. And, with Robot/NETWORK’s security system, you can control access to the Product Master. You can limit access to a single user or a group of users who are allowed to create packets.

Contributed by Terri Preston, Technical Consultant

Here’s how to cut through the clutter in QAUDJRN and learn more

You hear the same complaints again and again: The security audit journal, QAUDJRN, contains too many entries. It’s too hard to make sense of all the details. Do you really care that you have 1592 program adopt entries one day, and only 450 the next? Do you need to copy the journal receiver to a database file every day? What exactly do all the different entry types mean?

The System i operating system provides commands that allow you to see the contents of the audit journal. The Display Audit Journal Entry (DSPAUDJRNE) command copies the entries to a display or report. However, the command has not been updated for a few years and it misses some of the newer entry types and formats. The Display Journal (DSPJRN) command can dump any journal receiver to an output file (database file). In both cases, the end result is an unformatted file that you can massage using your favorite query tool, such as SEQUEL.

The problem with both of these approaches is that they do not include other sources on the system that track jobs or users and their associated entries to create a complete audit trail.

To fully investigate a security event, you may need to look for information in QSYSOPR and QHST. In addition, the exit point history for critical servers such as FTP, ODBC, and JDBC, can provide valuable information. With all of these sources, you can more accurately piece together the trail for a job or user on the system.

Robot/SECURITY uncovers the transactions
Robot/SECURITY can take the security-related events for a date range, job, or user from multiple sources on the system and build exactly the output you desire. You can select from a list of potential system sources, such as QAUDJRN, QHST, and QSYSOPR (see Figure 1).

In addition, the Robot/SECURITY database contains usage data for common communication server exit points. It also maintains detailed log entries for user actions during profile exchange operations. You select the sources of information to include and your auditor gets a clear picture of what was accessed on the system.

From security sources to the detail
When you click Run, Robot/SECURITY interrogates your system to obtain the detailed entries. After all sources are checked, it displays the information in a graphical display directly on your PC. The entries are summarized by source type, including a counter of the number of entries from each source (see Figure 2).

(Click on screenshot above to see larger image.)

QAUDJRN is broken down by entry type for each audited area, such as PW (Password Failure) or AF (Authority Failure). Robot/SECURITY’s Forensics Analysis Utility offers a data filter that lets you limit the data shown to the entries that meet your criteria. For example, you can display only the entries related to a specific file or library.

Five-in-one convenience
Robot/SECURITY is really five security products in one package—forensics is just one part of the product. Give it a trial to see the other components: exit point monitoring, QAUDJRN monitoring, security auditing, and profile exchange.

Contributed by Tom Huntington, Vice President of Technical Services

When you use SEQUEL ViewPoint on your system, you can have it track who is using what and when. You can see if access paths are created, which files are queried, and how many records are retrieved. You can do all this with SEQUEL auditing.

What is SEQUEL auditing?
You access auditing through the ViewPoint Administrator. Auditing allows you to monitor your investment in SEQUEL. Its inquiries and reports help you get the most out of SEQUEL by showing you where SEQUEL is used most heavily and how it affects your system’s resources. Using the auditor’s inquiry and analysis tools, you can effectively manage the query environment.

There are three phases to the auditing process: collection, distribution, and analysis. SEQUEL collects data in a System i journal and its attached receiver. You turn on the auditing process through each user’s default data area, to collect auditing data selectively. After you collect some data, you can run the “Manage Audit Data” process to extract data from the receiver and distribute it to files in the audit database. Then, you can analyze the data using summary and detail inquiries and graphs.

Getting started
Data collection and distribution takes place “behind the scenes” and must be done before data analysis. To begin, go into the ViewPoint Administrator and select the SEQUEL Auditing option. Then, follow this easy, three-step process:

1. Choose the Set Audit Default option, to decide which users to audit. Check the box next to each user ID you want to audit.

2. Wait a day or two to allow information to collect.

3. Select the Manage Audit Data option (available only to administrators) to move the data from the journal receiver to the database. (In the future, you can schedule this option to run automatically.)

Once the submitted job completes, you are ready to analyze SEQUEL’s use.

Analysis
You can view the collected data as either summary or detailed information. To display SEQUEL requests by user, object, job name, and access path, choose Show Audit Data. Click User to display summary values of SEQUEL activity for each user you are auditing. Double-click a user to display detailed information about that user.

You can analyze information by object or job name; display a list of files, views, and reports used; or create a list by job name. To display detailed information, just double-click the item. The detail inquiry also shows a command summary that includes a graph.

The Access Path Detail window displays summary-level information about which access paths are used, by whom, and how often. You can drill into the access paths to show the specifics of when access paths were used.

Summary
The SEQUEL ViewPoint Administrator lets you access auditing features that help you keep track of the SEQUEL requests run on your system. It’s an easy way to show your management the importance of your investment in SEQUEL.

Contributed by Sheryl Quinlan, Technical Consultant

Not many companies can say they manufacture fun, but that’s exactly what Polaris Industries, Inc., does. A leader in the motor-sports industry, Polaris designs, engineers, and manufactures ATVs, snowmobiles, RANGER utility vehicles, and Victory motorcycles. The common denominator for these vehicles is that they let people escape from their busy lives to a world of freedom and fun. Since 1954, when the first Polaris snowmobile made its appearance, Polaris riders have been finding “The Way Out.”

Polaris is headquartered in Medina, Minnesota; with manufacturing facilities in Roseau, Minnesota; Spirit Lake, Iowa; Osceola, Wisconsin; and a distribution facility in Vermillion, South Dakota. Mark Haanpaa, the Lead System Administrator for Polaris, explains a little of their IT history. “In the early 1990s, Polaris brought in an IBM AS/400 and installed MAPICS. At about the same time we started using Help/Systems’ Robot products. Today, we’re on the IBM System i, running two systems with many partitions—including two production partitions that are replicated. One system houses our manufacturing Enterprise Resource Planning (ERP) Solution, and the other one houses our distribution facility.”

Robot/SCHEDULE, Help/Systems’ job scheduler and batch management system, was the first Robot product Polaris implemented. When they started using Robot/SCHEDULE, they used it primarily as a placeholder for all of their jobs. Mark explains, “With MAPICS, you have an ERP manufacturing environment that involves lots of Material Resources Planning (MRP) runs and forecasting, taking place weekly. It seemed to us that that kind of setup needed to be manual. Our operators would see the job, plug in a lot of values, and kick off the job manually.”

Mark admits they are a bit more savvy with their operations now. “We completely automated those jobs, both on the regular weekly schedule, and ad hoc in the middle of the week. We just select one job to run and, using group and reactive jobs, we run the entire MRP process, taking advantage of the event-driven scheduling available in Robot/SCHEDULE.”

By Mark’s calculation, Polaris has 350 to 400 jobs in Robot/SCHEDULE, including nightly, weekly, and end-of-the-month jobs. How automated does he feel their schedule is? Mark explains, “When I first came to work at Polaris, we had four operators at our manufacturing facility and two operators at our distribution facility. When we upgraded the system to a more robust infrastructure and got some operators more involved with the Robot tools, we eliminated four operators and moved them to a different part of the company. We now run those two systems with just two operators.”

For the last few years, Polaris has been running without a night operator. Mark explains, “We work a schedule from 5:30 a.m. to 5:00 p.m.; but jobs run around the clock. Using Robot/SCHEDULE, Robot/REPLAY, Robot/CONSOLE, and Robot/ALERT, we run our jobs and let our programmers know if something is wrong, so they can sign on to the System i and make corrections. If there is a standard solution for an error, we program the solution in Robot/CONSOLE to automate the response.”

Another benefit of automation was the ability to easily page Polaris programmers for problems without involving anybody else. “You don’t like to use your operators or your on-call staff as an answering service for your programmers.” Mark explains, “In the past, a problem would display a message on the QSYSOPR message queue, the operators would see it and call the programmers. Then, the programmers would tell the operators what to do. It was terribly inefficient and a waste of time. Now, with Robot/ALERT and Robot/CONSOLE, we go right to the source of the problem—the code.”

From an IT management perspective, moving operators into different roles is a positive step. Mark explains, “As the company expanded—since 2000, we have added more than 400 employees—administering our desktop systems and the more sophisticated equipment on the floors in the manufacturing facility has absorbed several of our former System i operators. We have reduced our System i administration overhead and redeployed our operations support to the desktop and the shop floor without having to increase our head count.”

In addition, errors from manual entries are down now that Polaris has automated their schedule. As Mark points out, “Certainly, there is always some human error when people manually enter values, variables, and so forth. By using Robot/REPLAY and Robot/SCHEDULE, we have been able to be more consistent and not have those errors.”

When asked what features of Robot/SCHEDULE they use the most, Marks thinks of group jobs, reactive jobs, and override codes. “As things juggle around on the weekends—a manufacturing line is going to be offline—using Robot/SCHEDULE’s Schedule Override Codes to omit and hold jobs is really useful. We use that a lot.”

As a publicly traded company, Polaris must deal with the compliance requirements of the Sarbanes-Oxley (SOX) Act, and Robot/SCHEDULE helps with that also. “I am the Sarbanes administrator for the System i and for a lot of the other IT functions,” Mark says. “We use Robot/SCHEDULE to run our daily Sarbanes matching report. We run a program that looks for changed objects and produces a report every day at 7:00. We match that against what should have changed based on our programmers’ project completion forms. If they don’t match, we have to reconcile the differences.”

As a final note, Mark encourages everyone to visit their Web site, www.polarisindustries.com, to look at the new Polaris products. “We’re very proud of our Victory motorcycle. JD Powers recently released their ratings for motorcycle manufacturers and the Victory ranks in the top five in every category listed.” It’s the latest in a line of products that help Polaris provide an escape into a world of freedom and fun. A line of products that offers ‘The Way Out’, courtesy of Polaris, Help/Systems, and Robot/SCHEDULE.

By Cheryl Lewis

I have two files on my System i. One is a parts list that includes prices. The other contains new prices. Is there an easy way to get the new prices into the parts list?

Use SEQUEL to do a JOIN UPDATE. When you do a JOIN UPDATE you automatically update a System i file with data from another System i file! (We believe this is unique in the System i world.) Here’s an example:

UPDATE SET((LSTPC.1 NEW_PRICE.2))
SQL(’FROM PARTMAST, NEWPRICE JOIN PRDNO.1 = PRDNO.2′)

Important note: The file you are updating must be the primary (first) file in the SQL statement.

The first parameter in the SET clause is the column name (field) to be updated. In this example, it is the LSTPC (List Price) field. The second parameter in the SET clause assigns the new value to the column name. In this example, we specify that another field, NEW_PRICE, will supply the value. Alternatively, the value parameter could contain a literal value or a derived character or numeric value, depending on your requirements. For instance, you might want to multiply LSTPC by a numeric value to come up with a new List Price.

The SQL FROM clause specifies the two database files required for the operation and the JOIN identifies the fields used to join the files together. The SQL statement in this example is fairly basic. It updates all LSTPC fields in the PARTMAST file. You also could use WHERE and CASE statements to apply conditional updates in your target file.

When you do a profile exchange in Robot/SECURITY, does the Security Audit Journal (QAUDJRN) show actions taken as being carried out by the “original” user profile or the “exchanged to” user profile?

Any changes made by a person using profile exchange show up in QAUDJRN as being carried out by the “exchanged to” or alternate user profile. If you need to investigate further, check the Robot/SECURITY Profile Exchange Activity List to determine who was using the alternate user profile at that time. The activity list also shows actions performed during the exchange.

Help/Systems recently conducted a survey of Robot/NEWS readers. Readers who completed the survey had the option of entering their names in a drawing for a Nintendo Wii game system. When the survey closed on November 16, the winner was:

Mike Kammer
Sunrise Senior Living, Inc.
McLean, VA

Our congratulations go out to Mike. We thank everyone who responded to the survey.

Four-step process can be totally automated

Monitoring and adjusting your IBM System i for maximum efficiency and operations can be time-consuming and difficult. Add the complexities of coordinating resource movements for business processes in a logically partitioned System i, and you can have difficult operational issues. What you need is an easy-to-use interface to your Hardware Management Console (HMC) that helps you move your partitioned resources for maximum performance. That interface is Robot/LPAR, the software package that works with the HMC to move processor, memory, and I/O devices among your partitions interactively or in batch mode.

You install Robot/LPAR on one or more i5/OS partitions on your System i and it communicates with the HMC to manage partitions and set, adjust, or move resources. Robot/LPAR is especially useful for system administrators who must share or provide resources across partitions because of Service Level Agreements (SLAs).

Robot/LPAR works with the HMC to move resources to meet your business needs. With Robot/LPAR, you can move shared resources based on critical batch processes and you can schedule these movements using Robot/SCHEDULE. You can eliminate guesswork, mistakes, and the need to have someone monitor your LPAR processes—through automation. Robot/LPAR helps you ensure that your memory, processor resources, and devices are where they need to be to minimize the costs and maximize the efficiency of your partitioned environment. Your System i processes run quickly because Robot/LPAR works with the HMC at the operating system (i5/OS) level so all resource movements are fast and efficient.

Instead of buying a larger System i to handle workload changes, or buying separate devices for each partition, you can save money by using Robot/LPAR to share your resources. You share your memory, processor, and device resources across several partitions by moving them as they are needed.

Let’s look at a common scenario. (This article assumes you have Robot/LPAR, Robot/SCHEDULE, and Robot/NETWORK installed on both partitions to completely automate this process.) You control the movement of resources from the Robot/LPAR Move Resources Menu.

Each day at the end of daytime processing on partition A, you want to perform a system backup and then start the nightly batch processing. To do so, you must move a shared tape device, known as TAP01, from partition B to partition A for the backup. Then, after the backup on partition A completes, you must move the device back to partition B for its backup.

1. Because partition B currently owns the device TAP01, you can use Robot/LPAR, Robot/SCHEDULE, and Robot/NETWORK (with cross-system reactivity), to issue a Put I/O Resource (LPRPUTIOR) command from partition B. (Note: Cross-system reactivity is the ability to perform dependent job processing across multiple systems using Robot/NETWORK and Robot/SCHEDULE. Robot/NETWORK tells Robot/SCHEDULE to start a job on one system based on the successful completion of a Robot/SCHEDULE job on another system.) Robot/LPAR automatically varies off the device, its IOP, and any attached devices before it moves them. Because this is an IOP device, you use the *IOP parameter to indicate that the device, its IOP, and any other devices attached on the IOP must be moved. (Note: If this were an IOP-less IOA device, you would specify *IOA, and only the device would be moved.)
2. After TAP01, its IOP, and any associated devices have been moved, you can have Robot/NETWORK tell Robot/SCHEDULE on Partition A to run a job to vary on the device and start the backup job(s).
3. After the daily backup completes on partition A, you react to move TAP01 back to partition B to start daily backups there. Because partition A now owns the tape device, you use another LPRPUTIOR command to move the device, its IOP, and its attached devices to partition B. Robot/LPAR varies off the device before moving it.
4. After the device(s) are moved successfully, you have Robot/NETWORK tell Robot/SCHEDULE on partition B to start a job to vary on the device in partition B and start the backup process.

Other functions
The Robot/LPAR Move Resources menu also allows you to:

• Adjust and set resource levels for processor capacity and memory size
• Display partition information about the managed system and partitions.
• Change the partition state to shut down or activate a partition.

Contributed by Anna Deuel, Product Manager