Outline

• Lock Manager
• Quiz
• Access Control
• Parallel Sysplex Environment

Introduction

• Last Thursday, we began consider how DB2 makes use of the services of z/OS.
• We talked about how we can have DB2 make use of z/OS System Managed Storage (SMS) and the associated z/OS subsystem the Data Facility Storage Management Subsystem (DFSMS).
• Today, we are going to look at other z/OS subsystems DB2 might make use of. We are also going to look at how DB2 can operate within a cluster of DB2
• In particular, we are going to look at locking and access control subsystems and the Parallel Sysplex Environment.

Concurrency Control

• The reason why DB2 might need to make use of locking is to handle concurrency control issues.
• A DB2 database might have requests coming in for the same data from multiple sources at the same.
• For example, you might have end-users making ad-hoc queries for data, applications requesting the same data, and utilities operating on this data.
• Locks on the data item, can be used to prevent reading from invalid data, or conflicting writes, and a variety of other possible problems.
• To do locking, DB2 makes use of the z/OS IRLM (Internal Resource Lock Manager) subsystem.
• DB2 uses locks on a variety of data objects, including rows, pages, tables, table space partitions, entire table spaces, and databases. When an application acquires a lock, the application "holds" or "owns" the lock.

IRLM

The IRLM can be regarded both as a separate subsystem and as an integral component of DB2:

• Integral component: each DB2 subsystem instance has its own IRLM address space, dedicated to its concurrency control.
• Separate subsystems: IRLM is a self-contained subsystem that not only works with DB2, but also works with other subsystems like IMS, CICS etc..

Types of Locks

They are there aspects of a lock which control its effect:

• Lock mode -- this can be one of Share, Update, or Exclusive.
• Lock compatibility -- how the different lock modes interact with each other
• Lock size -- a lock can be on a table space, partition, table, page, or row.

Lock Modes and Lock Compatibility

• Share lock (S-lock) -- The lock owner and any concurrent process can read, but cannot change, the locked object.
• Update Lock (U-lock) -- The lock owner can read, but not change, the DB2 object. It is possible to promote a U-lock into an X-lock.
• Exclusive lock (X-lock) -- The lock owner can read or change the locked data while a concurrent process cannot acquire share, update, or exclusive locks on that data.

Operations on IRLM

• Installation -- Install IRLM when DB2 is installed. Consider that locks take up storage. Adequate storage for IRLM is crucial to the performance of your DB2 system. Another important performance item is to make the priority of the IRLM address space above all the DB2 address spaces.
• Commands -- Some IRLM-specific z/OS commands enable you to modify parameters, to display status and storage use, and to start and stop IRLM.
• Tracing -- The DB2 Trace Facility enables you to trace the lock information.

Quiz

Which of the following statements is true?

1. DDL statements are processed by the RDS' Interpreter subcomponent.
2. Dynamic prefetches are a mainly controlled by the end-user of DB2.
3. The Data Facility Storage Management Subsystem is part of DB2

DB2 and the z/OS Security Server

• DB2 can make use of an external security server to do access control.
• Usually, DB2 for z/OS makes use of RACF
• RACF stands for Resource Access Control Facility andis an IBM security product for z System.

Aspects of DB2 Security

Each of the following can be handled for DB2 by using RACF:

• Authentication -- Checked at connection time
• Authorization -- Checked at object access (can be done internally to DB2 or using RACF)
• Prevention of "backdoor" access -- Checked at any access to DB2 data sets. These checks might occur when someone on a z/OS but outside DB2 tries to access DB2's data as it is stored in z/OS's storage system.

RACF DB2 Security

• Manages user ID and password
• Controls access with profile management
• Protects data sets

DB2 Internal Access Control

• The DB2 internal access control to DB2 resources is managed by a set of privileges.
• Each privilege allows an operation on a DB2 object.
• For example, to insert data into a table requires the insert privilege for that table.
• To execute a package requires the execute privilege for that package.
• DB2 uses native SQL statements "GRANT" and "REVOKE" to control access to DB2 objects.

Security Control Considerations: Direct versus Indirect Authorization

• When a user, say Mike, is granted a SELECT privilege for an ACCOUNT table. Mike has the direct authorization of the select operation over the table ACCOUNT.
• Mary, on the other hand, does not have the SELECT privilege over the ACCOUNT table. Mary is not authorized to SELECT from the ACCOUNT table.
• If Mike binds a program which contains a SELECT statement over the ACCOUNT table and he grants the execution privilege of the program package to Mary, then Mary can execute this program and run the SELECT from ACCOUNT table via this program package. In this scenario, we say that Mary has an indirect authorization of SELECT over the ACCOUNT table, because Mary can only query from the ACCOUNT table through this program.

Parallel Sysplex Environment

• A Parallel Sysplex is a cluster of z/OS systems that communicate and cooperate with each other.
• It consists of two key pieces of technology:
  • A Coupling facility -- this consists of specialized hardware, specialized high-speed links and adaptors, and a shared non-volatile electronic storage with fast intersystem data sharing protocols.
  • A Sysplex Timer -- this provides a common time source across all systems in the cluster, thereby delivering an efficient way to provide log-record sequencing and event ordering across the different systems.

Data Sharing in DB2

• A DB2 can be put into a DB2 data sharing group.
• Such a group consists of a collection of one or more DB2 subsystems that access shared DB2 data.
• Each DB2 subsystem that belongs to a particular data sharing group is a member of that group.
• All members of a group use the same shared DB2 catalog, directory, and User data.
• Each subsystem has its own CPU and memory, it own EDM and buffer pools.
• The synchronization of the memory pools are via the Coupling facility.
• DB2 works closely with the z/OS Workload Manager (WLM) to ensure that incoming work is optimally balanced across the cluster members.