For the Liberty runtime
environment on the z/OS® platform, there are two types of
process: the server process and the angel process.
- Server process (bbgzsrv)
- The server process is a Java™ virtual machine (JVM) running
the Liberty code in much the same way as it
does on any other operating system. You can start the server process either from the MVS™ operator console (see
Administering Liberty manually) or
from the shell. How a user identity is associated and validated depends on how you start the server:
- If you start the server from an operator console, the identity that is associated with the
STARTED profile created by using a z/OS security product such
as RACF® is used to control server access: start
bbgzsrv,parms='defaultServer'
- If you start the server from the shell, you must also stop the server from the shell. The
identity of the shell is used for the server:
-
The JVM start options for the server process can come from various sources. For more information,
see Administering Liberty on z/OS.
- Angel process (bbgzangl)
- The angel process runs in an authorized key and provides facilities to server process to load
and access system services in a way that protects the integrity of the operating system. You start
the angel process from the MVS console by using a proc.
-
The angel exists independently of the server.
All Liberty servers that are running on a
z/OS image can share a single angel. However, ensure that the
angel process is running at or later than the latest installed level of Liberty server that is using the angel. If a Liberty server instance connects to an angel that
is running at an earlier service level, some features of the server might not be available.
Whenever possible, keep all Liberty
servers at the same product level and aligned with the corresponding angel version. Upgrade the Liberty server product levels and the angel
version at the same time.
Use this MODIFY command to give a
list of all the servers that are using a particular angel process.
MODIFY [jobname.]identifier,display,servers
Use the following
MODIFY command to
give a list of all the angel processes that are running on the
system.
MODIFY [jobname.]identifier,display,angels
Use the following
MODIFY command to
get the version of the angel process that is running on the system.
MODIFY [jobname.]identifier,version
The following table provides a list of angel version
numbers and the product level in which each angel first occurred.
Angel version |
Product level |
1 |
8.5.0.1 |
2 |
8.5.5.2 |
3 |
8.5.5.9 |
4 |
16.0.0.2 |
5 |
16.0.0.4 |
6 |
17.0.0.1 |
7 |
17.0.0.2 |
8 |
18.0.0.2 |
9 |
18.0.0.3 |
10 |
18.0.0.4 |
11 |
19.0.0.3 |
12 |
19.0.0.9 |
13 |
19.0.0.10 |
14 |
20.0.0.5 |
15 |
20.0.0.9 |
16 |
21.0.0.2 |
17 |
21.0.0.6 |
18 |
22.0.0.5 |
19 |
22.0.0.8 |
20 |
22.0.0.9 |
21 |
23.0.0.6 |
22 |
24.0.0.3 |
- If no z/OS system authorized services are enabled for any
server on a system, the angel does not need to be active. The angel process is not required for the
command processing services (the command processing services uses unauthorized z/OS services for command support).
- If the server is configured to attempt to use authorized services but either the angel is not
available, or if the effective owner of the process is not authorized to use the angel, the
authorized service is not available to be used on that server. In some cases, an unauthorized
service might be used instead. See Unauthorized
services used by the SAF registry.
-
You can prevent
Liberty from starting in
the absence of an angel process by adding the following statement to the
${server.config.dir}/bootstrap.properties file of your server:
com.ibm.ws.zos.core.angelRequired=true
With the com.ibm.ws.zos.core.angelRequired property set to true, Liberty aborts startup on detecting that it has
not connected to an angel process. Similarly, when an angel process is running and connects to a Liberty process during Liberty startup, that Liberty process continues to start as usual. In
this case, the property has no effect.
The
com.ibm.ws.zos.core.angelRequiredServices
property specifies a list of required
services. Only these services, when properly specified, are the ones used by the server. Lack of
access to the angel process itself or any of these listed required services causes a server startup
failure. The value for this property must be a comma-separated list of valid angel process services.
Angel process services can be found in Enabling z/OS authorized services on Liberty for z/OS. All service names must be 8
characters or less and symbols are not valid. This property must be specified with
com.ibm.ws.zos.core.angelRequired
property set to true.
You can configure Liberty to register to the angel process
with specific services by adding the following statements to the
${server.config.dir}/bootstrap.properties file of your
server:
com.ibm.ws.zos.core.angelRequiredServices=SAFCRED,ZOSWLM,TXRRS,ZOSDUMP
com.ibm.ws.zos.core.angelRequired=true
For more information, see Administering Liberty on z/OS.