Operator privilege : to checkin tapes

[ramohi]

Hi,

we want our operators to checkin tapes for us. They have "Operators Privilege". Can they
do it for us.
We are not willing to give them system rights. is there any other way.

Please let me know.
Regards
Ram

 

[marclant]

Have you tested it?

Here's the list of the authority classes with what each can do: http://www-01.ibm.com/support/knowl...m.itsm.srv.doc/r_mgclinod_adminauthclass.html

Looks like you are good to go.

 

[ramohi]

Hi Marclant,

Thanks for the reply, yes the operator has "operator privilege" and his check-in command failed:

He is running a script in tsm called checkintapes

02/23/16 11:24:02 ANR2017I Administrator XXXXX issued command: CHECKIN LIBVOLUME LIBTSM search=BULK checklabel=barcode
status=SCRATCH WAITTIME=0 (SESSION: 57184)
02/23/16 11:24:02 ANR2035E CHECKIN LIBVOLUME: Administrator XXXX is not
authorized to issue this command. (SESSION: 57184)

02/23/16 11:24:02 ANR2035E RUN: Administrator XXXXX is not authorized to
issue this command. (SESSION: 57184)
02/23/16 11:24:02 ANR2017I Administrator XXXXX issued command: ROLLBACK
(SESSION: 57184)

As per the manual : if I grant auto to the operator will it work ?

Operator:
grant authority bill classes=operator

Control the immediate operation of the server and the availability of storage media.

• Manage the IBM Tivoli Storage Manager server
• Manage client sessions
• Manage tape operations

 

[marclant]

Thanks for the reply, yes the operator has "operator privilege" and his check-in command failed:

As per the manual : if I grant auto to the operator will it work ?

Those 2 statements are contradicting. Does the admin XXXXX have operator or not?

 

[ramohi]

Thanks for the reply.
Yes Marclant,

tsm: TSMServ>q admin XXXXX f=d

Administrator Name: XXXXX
Last Access Date/Time: 02/23/16 11:41:53
Days Since Last Access: <1
Password Set Date/Time: 01/15/11 09:36:03
Days Since Password Set: 1,595
Invalid Sign-on Count: 0
Locked?: No
Contact: wayne
System Privilege:
Policy Privilege:
Storage Privilege:
Operator Privilege: Yes
Client Access Privilege:
Client Owner Privilege:

 

[marclant]

Was it granted after the checking failure or before? If after, does the checkin work now?

02/23/16 11:24:02 ANR2035E RUN: Administrator XXXXX is not authorized to
issue this command. (SESSION: 57184)

I also see the word RUN, which would indicate that a script was run. There could be other commands in the script an operator is not allowed to run. Try just the checkin by itself, not from a script.

 

[ramohi]

Thanks Marclant,

command in script:
Command: CHECKIN LIBVOLUME TSMLIB search=BULK
checklabel=barcode status=SCRATCH WAITTIME=0

02/23/16 11:24:02 ANR2017I Administrator XXXXX issued command: RUN checkin_LOT5 (SESSION: 57184)
02/23/16 11:24:02 ANR2017I Administrator XXXXX issued command: CHECKIN
LIBVOLUME TSMLIB search=BULK checklabel=barcode
status=SCRATCH WAITTIME=0 (SESSION: 57184)

 

[ramohi]

The rights were before the run command

 

[marclant]

Try the checkin alone, no script.

 

[marclant]

According to this technote: http://www-01.ibm.com/support/docview.wss?uid=swg21447761, it should work. If not, you may want to consider opening a problem ticket with IBM.

 

[ramohi]

Thanks Marclant,

The operator did try to checkin again, only with the command in tsm app..failed again.

Thank you for all your help.

Regards

 

[marclant]

No problem. You can try storage, but the docs seem to indicate it should work with operator.

 

[ramohi]

Hi Marclant,

Thanks for all your help.

Just wanted to updated you.

Give full access to tapepools to the operator.... checkin still failed.

So wrote a script to run the check-in command from ksh shell and porting the tsmpwd from a separate file....

it worked.

 

[smajl]

Operator privileges are not sufficient to use 'run scriptname'.