Better support for multiple master catalogs in a sysplex

There are a growing number of system data sets which have sysplex scope, but which are VSAM. When z/OS sysplexes are configured with a single master catalog shared across all sysplex LPARs this does not present any issue. However, such a sysplex is vulnerable to a failure of that catalog or the volume on which it resides. If either fail then a sysplex wide outage can ensue.

Many customer sites have either more than one master catalogs for each sysplex, or in many cases a master catalog for each LPAR in the sysplex.

Recently the RACF database has become eligible to be a VSAM data set. Previously of concern were the ICSF key stores (CKDS, PKDS and TKDS) which are also VSAM.

Each of these data sets can be shared with multiple master catalogs, but only for finding and processing the data set. Any requirement to ALTER its entry or RENAME the entry has to be performed through the original (owning) catalog. (I believe the VVDS entry on the volume where the data set reside has a pointer back to that owning catalog.)

The new RACF VSAM data set is processed by the IRRUT200 utility using the new RENAMEACTIVATE parameter. In a situation with multiple master catalogs this must be run on the system with the owning master catalog.

ICSF has a process to change master keys, which is documented here, https://www.ibm.com/docs/en/zos/3.1.0?topic=keys-performing-coordinated-change-master-key

This process also has to be run on the system that owns the CKDS.

Unix System Services file systems must now be placed in zFS data sets which are also VSAM. These data sets need to be manipulated via the owning master catalog.

In each of the above cases, the VSAM data set could be catalogued in a shared user catalog. However, this is not approved by IBM as there are some potential issues that generate messages such as,

IEFA109I CATALOG <catname> IS ALLOCATED BY JOBNAME MSTJCL00 FOR DATASET <primary RACF database>

Additionally, of course, placing the RACF database or the CKDS in a user catalog simply moves the single point of failure down to that user catalog.

I believe IBM needs a new approach to the handling of these situations. Either there needs to be a formally agreed process for having 2 or more master catalogs in a sysplex, or there needs to be a way for VSAM data sets to be “multiply-owned” by more than one catalog.