Functional Usage Capabilities, Part 2

A reader comment from last week's blog asked the question: 

Where can I find detailed documentation that describes exactly what each of these FUNCTION IDs controls? Does one of the available function IDs allow me to control interactive SQL usage? I have some users (new programmers, support people, etc.) where I want to prohibit the DELETE, UPDATE, CREATE operations but allow a SELECT operation.

I'll answer the second part of the question first: No, function usage does not allow you to control interactive SQL use. You can control access to DB/SQL administration and monitoring facilities however; the DB/SQL function usage is new in the IBM i 7.1 release and Authority Options for SQL Analysis and Tuning describes the new function usage capabilities.

When I started to compose this article, I was thinking “This will be such an easy blog to write!” Was I wrong! I knew a lot of components had taken advantage of the function usage capability, but I didn't realize just how many. And of course, I also thought that the documentation on the various function IDs would be mostly a matter of pulling things together, but I was also wrong about that.

So where can you find some additional documentation?

Three places:

• If you use the Display Function Usage or Work with Function Usage commands, you can display information about each Function Usage ID. One piece of information is the Description, which provides a brief overview of what that Function Usage ID is for.
  
  However, the easier approach is to use the GUI. The Host Applications listed use the descriptive name which is much more meaningful than the QIBM... ID you find on the command-line interface. The screen capture below is an example of what you will see. Many of the functions are self-describing and you can pretty easily figure out what is controlled from the description.
  
  
  
  
  
• Search for the QIBM... string in the IBM i Information Center (I used 7.1). This search will return all the interfaces that check on the specified identifier and you will get a pretty good idea of what the function is for. However, it turns out that not all function IDs are documented in the Information Center, and those that are generally have information scattered.
  
  
• Internet search. Some of the functions have had articles written on them when they were first made available. An Internet search on the QIBM.... string may find some additional information beyond what is in the IBM i Information Center.
  
  

When I started to write this blog, my intent was to include the full set of documentation and chase down information on the IDs that are not documented in the Information Center. However, when the initial draft of this blog was at 16 pages (!). I realized this was a topic beyond what I can cover in the blog.

I will complete the documentation on the function IDs and it'll be published in some other way – either as an article here on the IBM Systems Magazine site, or perhaps something on the IBM i developerWorks site (or maybe both). I'll comment on this blog when that article is available.

Finally, there is an old Redbooks publication, Operations Navigator V5R1 Volume 1: Overview and More, that has a good chapter on Application Administration that is still applicable. Note that the Redbooks pub is based upon the Operations Navigator client, but the capabilities are the same, even in the browser (Director Navigator) added in 6.1.

 

Comments

[KRKA01]

Dawn,

I have used the Functional Usage Capabilities for several years, but there is a feature i miss or atleast i can't find it. An easy way to distribute these settings to another system. There is no copy, retrieve, save or restore what i am aware of. Is there a way to do this?

Thanks in advance.
Krister

[Kevin Wright]

Dawn,

One of the criticisms of moving from the "old" PDF documentation, that replaced the Library Manager manuals that replaced the even older paper manuals, to the InfoCentre is that there is so much that is seemingly arbitrarily not there. Such things as the documentation on the function IDs, to me, should go there, not some IBM Systems Magazine or DeveloperWorks article.

Regards,

Kevin

[Dawn May]

Hi Kevin,
The Information Center should be the one place to get all the Information, but there are three issues that I think will always exist:
- The Information Center is not dynamic - it's updated on a schedule and is controlled by IBM.
- The Information Center is very task-oriented - the documentation is geared to describing how to do something. It doesn't often go into conceptual information tell you WHY you want to do something.
- And there are pockets of information that are missing - the latest documentation on recent add function PTFs, for example. Or, as I discovered, the function usage ID documentation (which, by the way, I have asked to have added to a document such as the security reference, but I have no idea as to whether my request will be accepted).

Please use the reader feedback capability within the Information Center if you find something that is missing; IBM does read them; IBM may not make the requested change or update, but the request will be considered.

Just this week, Steve Will's You and i blog is on the IBM i Information Strategy - read it if you haven't already.
http://ibmsystemsmag.blogs.com/you_and_i/2012/08/ibm-i-information-strategy.html

And in case you haven't read my first blog, Why i Can, it deals with this very issue and why I write this blog every week.
http://ibmsystemsmag.blogs.com/i_can/2009/08/why-i-can.html

So - to summarize this long reply - I think we agree it should be better; developerWorks, blogs, and other sources of documentation exist because it isn't.

Dawn

[Dawn May]

Hi Krister,
I have found the information regarding saving/restoring the function usage information.

That information is saved by SAVSECDTA. It is restored by RSTUSRPRF USRPRF(*ALL) in combination with RSTAUT.

It may be possible to distribute this information at a more granular level with the user function registration APIs. I don't know if there are any applications/utilities that encapsulate these APIs into a distribution or save/restore function.

Here's the URL to the section in the 7.1 Information Center where this is documented -
http://publib.boulder.ibm.com/infocenter/iseries/v7r1m0/topic/rzarl/rzarlsavrst.htm

Also - I have forwarded your comment to the team that develops the Application Runtime Expert product - wouldn't it be nice if function usage and user exit program information were supported by that product?
http://www-03.ibm.com/systems/power/software/i/are/index.html

Dawn

(I need to thank the save/restore and security teams for assisting me with this answer).