DataStage Restricted Mode
DataStage Restricted Mode
We need to be able to put DataStage in a restricted mode when we perform upgrades and/or import/exports. This will lock all users out except for the "admin" user.
Re: DataStage Restricted Mode
Please contact me directly to give me more detail on this requirement. I am especially interested in the workflow around this.1stpoint wrote:We need to be able to put DataStage in a restricted mode when we perform upgrades and/or import/exports. This will lock all users out except for the "admin" user.
Cheers
Steve
-
- Premium Member
- Posts: 141
- Joined: Tue Mar 16, 2004 8:22 am
- Location: HSBC - UK and India
- Contact:
This is closely related to the inability of Datastage to have 'read-only' access to jobs. Its very annoying when you try to open a job, get the annoying message 'locked by another user' and then you have to wait a minute for the control to be returned to your screen. Read-only of locked jobs would be very useful. Assuming you can make jobs read-only you could then go on to allow admin to lock jobs this way as in the enhancement required above.
agreed.Its very annoying when you try to open a job, get the annoying message 'locked by another user'
1stpoint, you'll need to get the developers off the jobs when you want to export/import, and i believe the only way is to ask them to get off the server jobs (ok, perhaps not the only way).
a possible way to go around implementing the restricted mode is have the administrator restrict the permissions of the group of developers to <none> for the particular project in DS administrator. I dont know what will happen should this change occur while they are developing (perhaps this is not a good time to do the change!), but will definitely prohibit them from going into the project once attempting to reconnect. This will give you time to do the import/export.
you should propose downtime if this is a recurring event, communicate it to the developers and have them agree that it is the best way forward.
dnzl
"what the thinker thinks, the prover proves" - Robert Anton Wilson
"what the thinker thinks, the prover proves" - Robert Anton Wilson
refinement of what I meant
That is not exactly what I am requesting. What I would like to see is a lockout capability so that we can perform an upgrade and lockout the developers until we decide the environment is ready.1stpoint, you'll need to get the developers off the jobs when you want to export/import, and i believe the only way is to ask them to get off the server jobs (ok, perhaps not the only way).
You should manage this via user groups. Let Unix level admin persons take a group out of access, because as DataStage has ZERO functionality in this regard. The closest you have is to use Admin and revoke all of the groups with access. Then, you have to go back and add them again when you're finished.
Kenneth Bland
Rank: Sempai
Belt: First degree black
Fight name: Captain Hook
Signature knockout: right upper cut followed by left hook
Signature submission: Crucifix combined with leg triangle
Rank: Sempai
Belt: First degree black
Fight name: Captain Hook
Signature knockout: right upper cut followed by left hook
Signature submission: Crucifix combined with leg triangle
-
- Participant
- Posts: 54607
- Joined: Wed Oct 23, 2002 10:52 pm
- Location: Sydney, Australia
- Contact:
That admitted, I think what 1stpoint is seeking is something like Prime INFORMATION's MAXUSERS command, where an administrator can limit the maximum number of logins to a particular number, including zero.
This was never implemented in UniVerse (for reasons never satisfactorily explained). Some UniVerse administrators implemented it themselves, by replacing the uv command with a uv shell script that was earlier in everyone's command search path, thereby providing whatever functionality was required before (maybe) invoking the real uv command.
Renaming the true uv and placing the uv shell script in the UV account's bin directory was sufficient to thwart those who elected to invoke the command using its full pathname.
This was never implemented in UniVerse (for reasons never satisfactorily explained). Some UniVerse administrators implemented it themselves, by replacing the uv command with a uv shell script that was earlier in everyone's command search path, thereby providing whatever functionality was required before (maybe) invoking the real uv command.
Renaming the true uv and placing the uv shell script in the UV account's bin directory was sufficient to thwart those who elected to invoke the command using its full pathname.
IBM Software Services Group
Any contribution to this forum is my own opinion and does not necessarily reflect any position that IBM may hold.
Any contribution to this forum is my own opinion and does not necessarily reflect any position that IBM may hold.
-
- Participant
- Posts: 54607
- Joined: Wed Oct 23, 2002 10:52 pm
- Location: Sydney, Australia
- Contact:
Because uvcs processes bypass UV.LOGIN afaik. Plus, you don't really want to have to get into the UV environment only to be kicked out; far better to prevent getting in at all.
You could, of course, simply stop or pause the RPC daemon; it would have a similar effect, but prevent your using the Administrator client.
You could, of course, simply stop or pause the RPC daemon; it would have a similar effect, but prevent your using the Administrator client.
IBM Software Services Group
Any contribution to this forum is my own opinion and does not necessarily reflect any position that IBM may hold.
Any contribution to this forum is my own opinion and does not necessarily reflect any position that IBM may hold.
What about Windows?
This is a nice solution for, say Unix/Linux. How about a platform-independent solution?You should manage this via user groups. Let Unix level admin persons take a group out of access, because as DataStage has ZERO functionality in this regard. The closest you have is to use Admin and revoke all of the groups with access. Then, you have to go back and add them again when you're finished.
DSXchange commandment #7:
Since most DS installs are on Unix, I gave you a reasonable response. You can handle access via the DS Administrator route as I suggested for Windoze.Thou shalt fill out all of the fields when posting a question, so that responders can give specific answers to thine own platforms.
Kenneth Bland
Rank: Sempai
Belt: First degree black
Fight name: Captain Hook
Signature knockout: right upper cut followed by left hook
Signature submission: Crucifix combined with leg triangle
Rank: Sempai
Belt: First degree black
Fight name: Captain Hook
Signature knockout: right upper cut followed by left hook
Signature submission: Crucifix combined with leg triangle
-
- Participant
- Posts: 54607
- Joined: Wed Oct 23, 2002 10:52 pm
- Location: Sydney, Australia
- Contact: