Special Edition, Using Microsoft BackOffice, Ch. 24

24 - The Role of the SNA Server Administrator

by Jim Marshbank

  • How to administer servers, connections, and logical units (LUs) - Learn how to start and stop SNA servers and their associated connections, reset LUs, copy and move different SNA services, and manage configuration files. Follow detailed procedures to perform daily SNA Server administrator connection management functions.

  • How to control access to SNA Server and host resources - Enhance your understanding of Window NT Server and SNA Server security features by walking through step-by-step procedures for granting access and permissions to users and groups. Learn how to monitor security-related events and change SNA Server administrative access ownership.

  • How to diagnose problems with SNA Server - Familiarize yourself with routine diagnostic tools available to the SNA Server administrator for viewing server and connection status. Learn how to use standard Windows NT Server monitoring tools for tracking response time, performance, and events.


The preceding SNA Server chapters explored, in detail, the steps necessary to install and configure the SNA Server. Critical activities such as planning the SNA Server installation, using the SNA Server Setup program to install and configure link services, and using the SNA Server Admin program to configure the connections and logical units (LUs) have now brought you to the important task of managing the SNA Server operational environment on a daily basis. The individual usually responsible for this management duty is called the SNA Server administrator.

The primary role of the SNA Server administrator in managing the SNA Server operational environment can be categorized into four main functions that are performed on a regular basis. These functions include:

  • Managing connectivity to host computer resources

  • Managing access to SNA Server and host resources

  • Diagnosing problems

This chapter explores each of these functions in detail and, where appropriate, outlines the step-by-step procedures necessary to perform specific tasks associated with them.

Managing Connectivity to Host Computer Resources

The productivity of users on the SNA network depends heavily on the daily management of the services, connections, LUs, and resources used to establish and maintain effective and efficient connectivity between the user, SNA Server, and host computer. The SNA Server administrator is the person who keeps this connectivity viable so that network productivity is maximized.

Connectivity management is a daily responsibility, not only from the perspective of monitoring the network for reduced efficiencies and problem identification, but also from the perspective of coping with the numerous enterprise changes that occur as a result of routine business dynamics. The SNA Server administrator uses the SNA Server Admin program and the SNA Server Setup program to accomplish most of these connectivity management responsibilities.

The following sections focus on the most common administrative procedures you will need to effectively administer your SNA Server and its associated connections. Bear in mind, however, to fully use these procedures and manage the connectivity between the SNA Server and the host computer, you must have full administrative privileges for the Windows NT Server on which the SNA Server resides. The following administrative functions are described:

  • Starting and stopping servers and connections

  • Resetting LUs

  • Changing the domain of focus

  • Using SNA Server additions

  • Copying and moving services

  • Deleting SNA resources

  • Working with configuration files

  • Changing the primary SNA Server

Starting and Stopping Servers and Connections

The SNA Server, and the connections that allow it to communicate with the client PCs and host systems, must be started before they can be of any use.


Connections have to be configured before they can be started. Refer to Chapter 22, "Building SNA Server," for detailed information on configuring connections.

You can start and stop all connections manually via the Servers and Connections window in SNA Server Admin. Additionally, you can make On Demand and Incoming connections available for use so that they start automatically when needed. On Demand connections have three states that you can control from the Servers and Connections window:

  • Inactive. Manually stopped; not available for automatic startup.

  • On Demand. Available for automatic startup when needed.

  • Active. Manually started; will remain active until manually stopped.

Incoming connections also have three states that you can control from the Servers and Connections window:

  • Inactive. Manually stopped; not available to receive incoming calls.

  • Incoming. Manually started; available to receive incoming calls.

  • Active. Currently in use due to an incoming call.

All other connections have two states that you can control from the Servers and Connections window:

  • Inactive. Manually stopped; not available for use.

  • Active. Manually started; available for use until stopped.

Stopping a connection frees up that connection (unless it is of the dedicated type) and makes it available for other possible uses. Connections can be stopped individually, or all the connections on a server can be stopped simultaneously by stopping the SNA Server itself. You may also need to stop the SNA Server to activate configuration changes. Although SNA Server Admin dynamically updates the running server when most configuration changes are made, stopping and restarting the server may still be necessary to activate certain changes.


You must ensure that all active users have logged off the remote host or peer system before stopping the SNA Server. Also ensure that active users on a particular connection have logged off before stopping the connection. Failure to ensure that each user has logged off could result in an unstable or nonfunctional remote host or peer system.

Starting SNA Servers and Connections

Follow these steps to start SNA servers and connections:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window (see fig. 24.1).

    Fig. 24.1 - The SNA Server Admin window with the Servers and Connections window active.

  5. Select the SNA Server or connection that you want to start. The SNA Server or connection selected remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Start Services to shift the following:

    • The SNA Server from the Inactive state to the Active state

    • An On Demand connection from the Inactive state to the On Demand state

    • An On Demand connection from the On Demand state to the Active state

    • An Incoming connection from the Inactive state to the Incoming state

    • A non-On Demand and Non-Incoming connection from the Inactive state to the Active state

Stopping SNA Servers and Connections

Follow these steps to stop SNA Servers and connections:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window (refer to fig. 24.1).

  5. Select the SNA Server or connection you want to start. The SNA Server or connection selected remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Stop Services to shift the following:

    • The SNA Server from the Active state to the Inactive state

    • An On Demand connection from the On Demand state to the Inactive state

    • An On Demand connection from the Active state to the Inactive state

    • An Incoming connection from the Incoming state to the Inactive state

    • A non-On Demand and Non-Incoming connection from the Active state to the Inactive state

  7. When the confirmation prompt appears, click Yes.

Resetting Logical Units (LUs)

You can eliminate minor problems with an LU by resetting it, or in other words, by stopping it and allowing it to restart as needed. If your system has APPC LUs configured on it, you can also deactivate individual LU-LU sessions when necessary. Only LUs in the Active, SSCP, or In Session states can be reset.

Resetting an LU

The procedure for resetting an LU is as follows:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window.

  5. Click the connection associated with the Active or In Session LU that you want to stop. This causes all the LUs associated with the highlighted connection to be listed in the right half of the Servers and Connections window, as shown in figure 24.2.

    Fig. 24.2 - The Servers and Connections window shows the LUs assigned to the connection named CHANNEL.

  6. Click the LU you want to reset. Remember that the status of the LU must be Active, SSCP, or In Session.

  7. In the SNA Server Admin menu, choose Services, Reset LUs.

  8. When the confirmation prompt appears, click Yes.

Resetting an LU in an LU Pool

To reset an LU in an LU pool, follow these steps:

  1. If the LU Pools window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the LU Pools window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the LU Pools icon in the SNA Server Admin window to restore the LU Pools window and make it the active window.

  5. Click the LU Pool containing the LU you want to reset. This causes all the LUs contained in the highlighted LU Pool to be listed in the right half of the LU Pools window, as shown in figure 24.3.

    Fig. 24.3 - The SNA Server Admin window with the LU Pools window active.

  6. Click the LU you want to reset. Remember that the status of the LU must be Active, SSCP, or In Session.

  7. In the SNA Server Admin menu, choose Pools, Reset LUs.

  8. When the confirmation prompt appears, click Yes.

Deactivating an APPC LU-LU Session

To deactivate an APPC LU-LU session, follow these steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window.

  5. Click the SNA Server containing the local APPC LU associated with the LU-LU session you want to deactivate. This causes all the LUs associated with the highlighted SNA Server name to be listed in the right half of the Servers and Connections window.

  6. Click the local APPC LU associated with the LU-LU session you want to deactivate. The local APPC LU selected remains highlighted (see fig. 24.4).

    Fig. 24.4 - SNA Server Admin with the Servers and Connections window active and the local APPC LU selected.

  7. In the SNA Server Admin menu, choose Services, Properties. This causes the APPC LU Properties dialog box to be displayed.

  8. Click the Status button to display the APPC LU Status dialog box containing the LU-LU pairs in which you are interested.

  9. Click the LU-LU pair involved in the LU-LU session you want to deactivate, and then click the Zoom button. This causes the Session Status dialog box to appear containing the LU-LU sessions for the selected pairing.

  10. Click the LU-LU session you want to deactivate and then click the Deactivate button.

  11. Click OK.

  12. Click Close or OK in each remaining dialog box until they are all closed or cleared. Clicking Cancel in any dialog box cancels the deactivation of the LU-LU session.

Changing the Domain of Focus

You may be required at some time to work with SNA servers in different domains. You can gain access to these other SNA servers (provided that you have sufficient privileges) by changing the domain of focus. To change to a different domain, follow these steps:

  1. If SNA Server Admin is running and its window is displayed, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose File, Select Domain to display the Select Domain dialog box shown in figure 24.5.


    There may be a short delay before the domain choices appear in the Select Domain dialog box. During this delay, the word "Working" appears in the Select Domain area of the Select Domain dialog box.

    Fig. 24.5 - The Select Domain dialog box lists all the available domains so that the desired one can be selected.

  5. In the Select Domain area of the dialog box, take one of the following actions:

    • Click the domain containing the other SNA server(s) you need to access. The domain name appears in the Domain box near the top of the Select Domain dialog box.

    • Double-click the domain containing the other SNA server(s) you need to access. This expands the domain to display a list of all the computers in the domain. You may then click the name of the computer where the SNA Server you need to access is installed. The network path and computer name appears in the Domain box.

  6. Click OK to obtain one of the following results:

    • If the domain name was present in the Domain box when you clicked this button, all SNA servers in the selected domain will be listed on the left side of the Servers and Connections window along with the connections installed and configured on each SNA Server.

    • If the SNA Server name (or the name of the computer where the SNA Server is installed) was present in the Domain box when you clicked OK, only that SNA Server will be listed on the left side of the Servers and Connections window along with the connections installed and configured on it.

  7. If the Servers and Connections window is not active, either double-click the Servers and Connections icon or click somewhere within the inactive Server and Connections window to make the Servers and Connections window active. Either the specific SNA server selected or all the SNA servers in the new domain of focus (if the domain was selected) will be listed on the left side of the window along with the connections installed and configured on the SNA Server(s).

Using SNA Server Additions

Certain software modules can be accessed through SNA Server Admin as additions to SNA Server. You can access these additions by following these steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window.

  5. Select the SNA Server to which you want the addition to apply. The SNA Server selected remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Properties to display to Server Properties dialog box.

  7. Click the Addons button in the Server Properties dialog box to display the SNA Server Additions dialog box shown in figure 24.6.

    Fig. 24.6 - The SNA Server Additions dialog box is used to identify all the available SNA Server additions from which the desired one may be selected.

  8. All the available additions are listed in the Available SNA Server Additions area of the dialog box. Click the desired addition and then click Select.

  9. The addition selected is immediately started through the SNA Server. The dialog boxes associated with the addition that is running are displayed as required.

  10. When you stop the execution of the addition - that is, close the dialog box(es) associated with it - the SNA Server Additions dialog box reappears.

  11. Click Close and Cancel as appropriate to clear the dialog boxes from the display.

Copying and Moving Services

SNA Server Admin provides a tremendous degree of flexibility and allows you to copy connection and LU properties instead of having to define them for each service. The Services menu (for the Servers and Connections window) and the Pools menu (for the LU Pools window) also allow you to easily move connections to different servers and/or LUs to different connections, servers, or LU Pools.

Copying Properties Between Connections and LUs

To copy properties between connections and LUs, perform the following steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window.

  5. Click the connection or LU from which you want to copy properties. The selection remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Copy Properties to display the Copy Properties dialog box shown in figure 24.7.

    Fig. 24.7 - The Copy Properties dialog box lists all the connections to which the properties can be copied.

  7. Click the connection or LU to which you want to copy the properties.

  8. Click OK.


Properties copied to an active connection or LU do not take effect until the connection or LU is stopped and restarted.

Using the Services Menu to Move Services

To use the Services menu to move a connection to a different server or to move an LU to a different connection or server, perform the following steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to restore the Servers and Connections window and make it the active window.

  5. If you want to move an LU to a different connection, or a local APPC LU to a different server, skip to step 9. Otherwise, continue with step 6 to move a connection to a different server.

  6. Click the connection you want to move. The selection remains highlighted.

  7. In the SNA Server Admin menu, choose Services, Move Connection to display the Move dialog box shown in figure 24.8.

    Fig. 24.8 - This Move dialog box is used to move a connection from one server to another.

  8. Click the To Server drop-down list box to expand the list box and display the list of available SNA servers to which the selected connection can be moved. Click the SNA Server to which you want the connection moved. Then skip to step 12.

  9. Click the LU you want to move. The selection remains highlighted.

  10. In the SNA Server Admin menu, choose Services, Move LU to display the Move dialog box.

  11. Click the To Connection drop-down list box to expand the list box and display the list of available connections to which the selected LU can be moved. Click the connection to which you want the LU moved.


    If you selected a local APPC LU to move, the     To Server drop-down list box appears instead of the To Connection drop-down list box. This is because local APPC LUs can only be assigned to SNA Servers, whereas all the other LUs can only be assigned to connections.

  12. Click OK to close the Move dialog box and display the Servers and Connections window.

Using the Pools Menu to Move Services

To use the Pools menu to move an LU between LU Pools, perform the following steps:

  1. If the LU Pools window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the LU Pools window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the LU Pools icon in the SNA Server Admin window to restore the LU Pools window and make it the active window.

  5. If necessary, click the LU Pool containing the LU you want to move. This causes all the LUs contained in the highlighted LU Pool to be listed in the right half of the LU Pools window.

  6. Click the LU you want to move. The selection remains highlighted.

  7. In the SNA Server Admin menu, choose Pools, Move to display the Move dialog box shown in figure 24.9.

    Fig. 24.9 - This Move dialog box is used to move an LU from one LU Pool to another.

  8. Click the To LU Pool drop-down list box to expand the list box and display the list of available LU Pools to which the selected LU can be moved. Click the desired LU Pool to which you want the LU moved.

  9. Click OK to close the Move dialog box and display the LU Pools window.

Using the Drag-and-Drop GUI Feature to Move Services

The drag-and-drop convenience provided through the GUI also makes it easy to move the following:

  • Connections to different servers

  • LUs to different connections, servers, users, groups, and LU Pools

  • LU Pools to different users or groups

This drag-and-drop feature is especially convenient when moving services between SNA Server Admin windows. As a matter of fact, you will probably find the drag-and-drop feature so quick and easy to use in moving services that you will use this method instead of the menu methods just described.

The basic procedure for performing the drag-and-drop method of moving services is the same regardless of what you are moving and where you are moving it. It also works equally well in a single window or when moving a service between two different windows (that is, moving an LU Pool in the LU Pools window to a user or group in the Users and Groups window). To use the drag-and-drop feature to move a service from one place to another, perform the following steps:

  1. Activate the SNA Server Admin windows containing the service to be moved and the place where you want to move the service. In many cases, you need to restore only one window (for example, to move an LU on the right side of the Servers and Connections window to a connection on the left side of the Servers and Connections window). However, moving an LU to a user or group requires you to restore both the Servers and Connections window and the Users and Groups window if the LU is not currently present in the Users and Groups window.

  2. Click the service you want to move. The selection remains highlighted.

  3. Position the mouse pointer over the highlighted selection. Then press the left mouse button and continue to hold down the button while "dragging" the mouse pointer to the target element (a server, connection, LU Pool, user, group, and so on). Note that as you move the mouse pointer, an icon representing the service you are moving appears in place of the mouse pointer. When you drag the icon over a place where you are not permitted to "drop" it, the icon changes to a slashed circle.


    If a plus (+) sign appears in the icon being dragged, it means the service (LU, connection, LU Pool, and so on) is really being copied, not moved. Therefore, when dropped on the target element, the service will appear in two different places. If the icon does not contain a plus (+) sign, the service is being moved and will disappear from the original location when it is dropped in the new location.

  4. When the icon (not the slashed circle) is over the desired element (whether in the same window or a different one), release the left mouse button to drop the icon on that element.

  5. If this is a move and not a copy (a plus sign was not present in the icon being dragged), a Confirm Mouse Operation message box appears asking you to confirm the move. Click OK in this message box to complete the move, or click Cancel to abort the move operation.


The drag-and-drop GUI feature is a handy alternative to using the Assign LUs command in the Users and Pools menus. Instead of highlighting a User/Group or LU Pool and clicking on the Users or Pools menu to access the Assign LUs command (which displays dialog boxes from which available elements can be selected), you can simply drag the LU to the desired user/group or LU Pool and drop it there.

Deleting SNA Resources

It is easy to delete SNA resources by simply using the Delete key on your keyboard. The resource will not be deleted until you confirm the deletion request by clicking Yes (or Yes To All if more than one item is being deleted simultaneously) in the confirmation message box.


You must stop servers and connections before deleting them. See "Starting and Stopping Servers and Connections" earlier in this chapter.

The following list identifies which resources can be deleted and how to do it:

  • To delete a server, select the server in the Servers and Connections window and press Delete on your keyboard.

  • To delete a connection, select the connection in the Servers and Connections window and press Delete on your keyboard.

  • To delete an LU, select the LU in the Servers and Connections window and press Delete on your keyboard.

  • To delete an SNA user/group, select the user/group in the Users and Groups window and press Delete on your keyboard.

  • To delete an LU or LU Pool assignment to a user/group, click the LU or LU Pool listed across from the user/group in the Users and Groups window and press Delete on your keyboard.

  • To delete an LU assignment to an LU Pool, click the LU listed across from the LU Pool in the LU Pools window and press Delete on your keyboard.

  • To delete an LU Pool, click the LU Pool in the LU Pools window and press the Delete key on your keyboard.

Working With Configuration Files

You can manipulate configuration files in many ways. Some of the more common administrative operations you can perform on configuration files include the following:

  • Saving the current configuration

  • Backing up the current configuration

  • Reopening the last saved configuration

  • Restoring a configuration from a backup configuration file

  • Copying configuration files between SNA servers

Saving the Current Configuration

To save the current configuration, follow these steps:

  1. If SNA Server Admin is running and its window is displayed, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose File, Save Configuration.


The configuration file is saved to the Primary SNA Server and reloaded the next time you start SNA Server. If the configuration file cannot be saved to the Primary SNA Server for any reason, you should back up the configuration file in accordance with procedures described in the next section so that the information is not lost.

Backing Up the Current Configuration

To back up the current configuration, perform these steps:

  1. If SNA Server Admin is running and its window is displayed, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose File, Backup to display the Save Configuration As dialog box shown in figure 24.10.

    Fig. 24.10 - The Save Configuration As dialog box provides all the information you need to select the disk drive, directory, and file name in which to save the backup data.

  5. This dialog box has the same functionality as the standard Windows Save As dialog box with which you are probably already familiar. You need to specify the drive (network or local), directory path, and file name for the configuration file. The default file name extension for a backup configuration file is .SNA.

  6. Click OK. The configuration file is saved in the specified path using the specified file name and file name extension.

Reopening the Last Saved Configuration

The procedure for reopening the last saved configuration is as follows:

  1. If SNA Server Admin is running and its window is displayed, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose File, Reopen Configuration. The "last saved" configuration immediately replaces the current configuration, and any changes that have been made, but not saved, will be lost.

Restoring a Configuration from a Backup Configuration File

To restore a configuration from a backup configuration file, follow these steps:

  1. If SNA Server Admin is running and its window is displayed, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose File, Restore. If you have not backed up the current configuration, a Backup Configuration dialog box appears (with Yes, No, and Cancel buttons), forcing you to click on one of the buttons in response to the question, "Do you want to back up the current configuration before restoring a previous configuration?" Take one of the following actions:

    • Click Yes to display the Save Configuration As dialog box (see "Backing Up the Current Configuration" earlier in this chapter).

    • Click Cancel to abort the Restore command and redisplay the SNA Server Admin window.

    • Click No to display the Restore Configuration From dialog box shown in figure 24.11.

    Fig. 24.11 - The Restore Configuration From dialog box provides all the information you need to select the disk drive, directory, and file name from which to restore the data.

  5. This dialog box has the same functionality as the standard windows File Open dialog box with which you are probably already familiar. You need to specify the drive (network or local), directory path, and file name of the configuration file you want to restore.

  6. Click OK, and the configuration file is restored.

Copying Configuration Files Between Servers

When you change and save the configuration file, the primary SNA Server is designed to replicate the configuration file to each of the SNA servers designated with "backup" roles. If this replication does not complete normally for any reason, you should use the following procedure for manually copying the configuration file to the backup servers:

  1. On the primary SNA Server, open a command prompt window such as MS-DOS, or start the Windows File Manager.

  2. Access the directory on the primary SNA Server hard drive containing the configuration file. On standard installations, this would be C:\SNA\SYSTEM\CONFIG.

  3. There will be a directory on the backup SNA Server that is shared so that the primary SNA Server can access configuration files on both the primary and backup SNA servers as necessary. This directory is commonly referred to as the share point directory and, on standard installations, is located at the network path \\servername\COMCFG where servername is the name of the backup SNA Server. You can access this share point directory on the backup SNA Server using standard network commands.

  4. Copy the COM.CFG file from the primary SNA Server directory path C:\SNA\SYSTEM\CONFIG to the backup SNA Server share point directory \\servername\COMCFG.

  5. Answer Yes (or click the Yes button) when the confirmation prompt appears.

Changing the Primary SNA Server

Earlier chapters discussed the SNA Server roles, which consist of the primary, backup, and member roles. The primary SNA Server has control over its portion of the Windows NT domain (called a subdomain) and is the keeper of the master configuration file for its subdomain. Therefore, only one primary SNA Server can be in each subdomain.

The backup SNA Server is supplied a copy of the last-saved configuration file so that it can assume primary responsibilities automatically in the event the primary SNA Server fails or its connection is lost. Within a single subdomain, 49 backup SNA servers can coexist, with each one having its own copy of the last-saved configuration file (as supplied by the primary SNA Server).

These primary and backup servers communicate with each other in two ways to ensure that configuration information and data pertaining to operational status is kept current:

  • Backup SNA servers replicate the SNA Server configuration file (COM.CFG) from the primary SNA Server each time the configuration is changed and saved by SNA Server Admin.

  • SNA servers send broadcast messages to each other to notify the other SNA servers of major status changes in the server, such as when the SNA Server service is started or stopped.

Thus, any backup server in the subdomain can automatically assume primary SNA Server responsibilities in the event the primary can no longer function in its role. This is only a temporary recovery measure, however, to allow user activity to continue, essentially uninterrupted, until the primary server comes back on-line or until the SNA Server administrator manually changes the roles of the servers in the subdomain. Of course, there could be less traumatic reasons for switching server roles. For example, you need to be able to change SNA Server roles when you acquire a "bigger and better" PC to replace the existing primary SNA Server. Another reason for a server role change might be the need to restructure an existing subdomain and use some of its resources to form a second subdomain. Regardless of the reason, there is certainly ample justification for the need to change SNA Server roles from time to time.

Perform the following steps to change the primary SNA Server:

  1. Use SNA Server Admin to back up the configuration file on the current primary SNA Server. See "Backing Up the Current Configuration" earlier in the chapter.

  2. Exit SNA Server Admin, and open a command prompt window in Windows NT Server on the primary SNA Server.

  3. At the command prompt, type net stop snabase and press Enter.

  4. Change the role of the current primary SNA Server to backup or member.

  5. Open a command prompt window on the server that will become the new primary SNA Server.

  6. At the command prompt, type net stop snabase and press Enter.

  7. On the server that will become the new primary SNA Server, use SNA Server Setup to assign the primary role to the new SNA Server.

  8. On the new primary SNA Server, double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  9. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server and display the SNA Server Admin window.

  10. In the SNA Server Admin menu, choose File, Restore and select the backup configuration file saved in step 1 of this procedure.

  11. Open a command prompt window on the server that used to be the primary SNA Server.

  12. At the command prompt, type net start snabase and press Enter.

See "Choosing a Server Role," (Ch. 21)

Managing Access to SNA Server and Host Resources

With the degree of dependence placed on automation and its associated resources in the normal operation of business enterprises today, obvious importance is placed on controlling who can see and use the programs, data, and resources of the enterprise network. In an era when the inability to retrieve and manipulate electronic data equates to a serious loss of productivity, businesses are willing to heavily invest time and capital to prevent the intentional, as well as accidental, destruction of critical data files and software components. Fortunately, SNA Server and the Windows NT Server environment in which it operates possess powerful security features that allow you to manage and control access to the SNA Server and host resources.

Using SNA Server Security Features

SNA security features are embodied within the security mechanisms of the Windows NT Server. When you first install SNA Server, a security foundation equivalent to that already present in the Windows NT Server domain is automatically established. When you configure the security features of SNA Server, you add to this basic security functionality. The configuration parameters you specify for this additional security are actually implemented through the design architecture of the Windows NT Server itself. For example, basic Windows NT Server security concepts such as domains, user accounts, user permissions, and logons are automatically extended into the SNA Server network by virtue of the Windows NT Server operating system under which the SNA Server was installed. The following sections take a closer look at some of the SNA Server security features that actually supplement the basic security provided through the Windows NT Server.

Windows NT File System

The NT file system (NTFS) provides a level of file security not possible with the file allocation table (FAT) or high performance file system (HPFS), which are prevalent on IBM and compatible PCs today. Files stored on FAT and HPFS partitions can be easily accessed and modified by anyone that can log on to the computer. This is not the case with files stored on NTFS partitions. Files (or entire directories) on NTFS partitions can be protected by setting security access permissions on them, which range from no access to full control. This is an important capability when you consider the critical nature of the SNA Server configuration file.

The configuration file, which is created by SNA Server Setup and stored on both primary and backup SNA servers, contains SNA access information such as SNA user and group names and the LUs they are permitted to use. If not properly protected, this file can be accessed by anyone who can log on to the system. The file can then potentially be modified to grant unauthorized users full control of system resources, or it could otherwise be tampered with to cause unreliable system performance or make system resources totally inaccessible to even authorized users. By installing SNA Server on an NTFS partition, this critical configuration file could easily be protected from this kind of unauthorized access and tampering.


Do not use administrative tools to set permissions on the SNA Server configuration file directly. Doing so may block necessary SNA Server access to this file, which is required when working across the network. Instead, use the SNA Server Admin Security menu commands, and the associated dialog boxes, to increase SNA Server security.

If you do install SNA Server on a FAT or HPFS file system, you can still use the Security menu of the SNA Server Admin program to restrict access to the administration programs that can view and modify the configuration file, but you cannot set access restrictions on the configuration file itself. You can also control Read and Change permissions on the share, which gives the SNA servers access to the configuration file, but again, you cannot protect the configuration file directly from unauthorized access. All things considered, it is certainly much better (and much safer) to install SNA Server software on NTFS partitions so that you can enjoy the configuration file protection afforded through file-level security controls.

Logon Process

Access control is enhanced by requiring users to successfully log on to the Windows NT Server domain as a first step in gaining access to any resources on the SNA Server network. It is essentially the first level of security for the SNA Server because the user is identified to the Windows NT domain and to the SNA servers through this logon process. If the user cannot be identified by the Windows NT Server during logon, the user will not be given access to any domain resources, SNA Server resources included.

SNA Server handles the logon process differently depending on the networking software being used. If Microsoft networking is being used, a single valid logon gains a user access to both the Windows NT domain and all the SNA servers in the domain. If non-Microsoft networking (such as NovelL NetWare, TCP/IP, and Banyan VINES) is being used, two logons are required - one for access to the Windows NT domain and one for access to the SNA servers in the domain. The same password for both logons can be used, if desired, but no information is sent from the SNA Server to the client system until both logons have been completed successfully.

Notice that in both cases, after the logon process for a particular SNA Server is completed successfully, the user is automatically granted access to the other SNA servers in the domain as well. This occurs without additional interaction between the SNA servers and the user. The other domain servers simply repeat the logon verification automatically without involving the user.

Other logon processes may be required by the host mainframe or AS/400 systems to more tightly control the resources on the host system. If the host logon process, by itself, provides sufficient access control over the required resources, it may make sense to ease access controls on the SNA Server and let the host logon process provide the necessary resource control. One way to do this is by allowing open-ended access to LUs instead of restricting access to LUs. You can create open-ended access to LUs through the standard built-in Guest account by following these steps:

  1. If the Users and Groups window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Users and Groups window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. Double-click the Users and Groups icon in the SNA Server Admin window to restore the Users and Groups window and make it the active window.

  5. In the SNA Server Admin menu, choose Users, New User to display the Add Users and Groups dialog box shown in figure 24.12.

    Fig. 24.12 - The Add Users and Groups dialog box for a sample domain called INTERNAL.

  6. In the List Names From drop-down list box, select the domain in which the built-in Guest account is located.

  7. In the Names list box, scroll as necessary to display the Guest account name. Then click the name Guest. The selection remains highlighted.

  8. Click Add to place the Guest account name in the Add Names box.

  9. Click OK to close the Add Users and Groups dialog box and redisplay the Users and Groups window. The new Guest account just added should be highlighted in the Users and Groups window.


    The title bar of the Users and Groups window will reflect that this window is out of date. Saving the configuration file makes the Users and Groups window current once again. Although you can save the configuration at any time, it is normally best to wait until you have finished making your changes to the Users and Groups window. Therefore, after all configuration modifications have been made in this window, choose File,     Save Configuration in the SNA Server menu to save the new configuration.

  10. In the SNA Server Admin menu, choose Users, Assign LUs to display the Assign User LU/Pool Sessions dialog box shown in figure 24.13.

    Fig. 24.13 - The Assign User LU/Pool Sessions dialog box lists all the LUs and Pools available for assignment to the specified user.

  11. Click the LU or LU Pool to be assigned to the Guest account. The selection remains highlighted.


    To assign multiple sequential LUs or LU Pools, click the first one in the sequence, press and hold down the Shift key, and click the last one in the sequence. All the LUs or LU Pools in the range are then highlighted. To assign multiple non-sequential LUs or LU Pools, press and hold down Ctrl while clicking on each LU or LU Pool to be assigned. Each selection remains highlighted.

  12. Click OK to close the Assign User LU/Pool Sessions dialog box and redisplay the Users and Groups window. The new LU(s) and/or LU Pool(s) are then displayed on the right half of the Users and Groups window.

  13. In the SNA Server Admin menu, choose File, Save Configuration to save the configuration and bring the Users and Groups window back up to date.

You can also create open-ended access to LUs through the account called Everyone by following the preceding steps to add the account to the list of users and groups recognized by SNA Server and assigning LU(s) and/or LU Pool(s) to the Everyone account.

Understanding Permissions

Permissions allow you to limit or totally restrict a user's ability to access and manipulate resources, files, or programs on the SNA Server. More specifically, you can use SNA Server Admin to establish administrative permissions for SNA Server, and thus control access to the configuration file (when using NTFS) and the SNA Server administration programs. Because these programs are used to modify the SNA Server configuration and to enable resources (servers, connections, services, and so on), administrative permissions should be judiciously applied and carefully managed on a continuing basis. The next few paragraphs detail the procedures for the following tasks:

  • Granting administrative access to users and groups

  • Changing currently assigned administrative permissions

  • Removing administrative access from users and groups

Granting Administrative Access

To grant administrative access, follow these steps:

  1. If SNA Server Admin is already active, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Security, Permissions to display the SNA Domain Permissions dialog box shown in figure 24.14.

    Fig. 24.14 - The SNA Domain Permissions dialog box is used to grant a specific level of access to groups or individual users for the domain specified.

    Note that the current domain of focus is listed in the SNA Domain box, and the Name list box displays the accounts (both groups and users) that currently have access permissions. The Type of Access box displays the type of access currently assigned to the entry highlighted in the Name list box. The Owner box lists the account name designated as the owner of the ability to grant or deny administrative access to the SNA Server. By default, this ownership status belongs to the Administrator group.


    The procedure for taking ownership is described later in this chapter.

  5. Click Add to display the Add Users and Groups dialog box, as reflected in figure 24.15.

    Fig. 24.15 - The Add Users and Groups dialog box showing groups and users in the INTERNAL domain.

  6. In the List Names From drop-down list box, select the domain to which the users or groups to be added belong. Only trusted domains are listed.

  7. From the list of users and groups displayed in the Names area of the dialog box, select the one to be added.

  8. If you want to search for a particular user or group, continue with step 9. Otherwise, skip to step 15.

  9. Click Search to display the Find Account dialog box.

  10. In the Find User or Group box, enter the name of the user or group for which you are searching.

  11. Select the search domain by doing one of the following:

    • Click Search All to search in all the domains.

    • Click Search Only In to search in a particular domain. If you select this option, you must also select one of the domains listed in the list box below the radio buttons. The Search button does not become available for activation until you do.


    If you want to select the Search     Only In option, click the desired domain in the list box below the search option radio buttons instead of clicking the Search Only In radio button. When you click one of the listed domains, SNA Server Admin automatically highlights the Search Only In radio button. Thus, you can reduce two required mouse clicks to only one.

  12. Click Search to start the search. When the search is completed, the results appear in the Search Results list box, or you are notified that the indicated search item could not be found in the selected domain.

  13. Repeat steps 10 through 12 as necessary.

  14. Highlight the desired search results in the Search Result list box, and click Add to place the selected search results in the Add Names list box of the Add Users and Groups dialog box. If you want to select more users and/or groups from the Names list box, continue with step 15. Otherwise, skip to step 18.


    To select multiple sequential search result entries, click the first one in the sequence, depress and hold down Shift, and click on the last one in the sequence. All the search result entries in the range are highlighted. To assign multiple nonsequential search result entries, depress and hold down Ctrl while clicking each search result entry. Each selection remains highlighted.

  15. In the Names list box, select the user(s) and/or group(s) to receive administrative permissions.


    To select multiple sequential users and/or groups, click the first one in the sequence, depress and hold down Shift, and click the last one in the sequence. All the users and/or groups in the range are highlighted.

    To assign multiple nonsequential users and/or groups, depress and hold down Ctrl while clicking each user and/or group. Each selection remains highlighted.

  16. Click Add to add the selected user(s) and/or group(s) to the Add Names box.

  17. In the Type of Access drop-down list box, select the type of access you want the account(s) listed in the Add Names box to have. The possible types of access are as follows:

    • No Access. Prohibits a user or group from running SNA Server Admin, the snacfg command-line program, or reading and writing the configuration file. This type of access overrides all other permissions that apply to a particular user. If the user belongs to a group that has full control, for example, the user will be denied administrative access because No Access will override the Full Control permissions. Other members of the group will still have full control.

    • Full Control. Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, to read and write the configuration file, and to change the administrative permissions assigned to other accounts. Assign this type of access to SNA Server administrators who will be starting and stopping SNA Server services, permanently changing the SNA Server configuration, managing other SNA Server user and group permissions, and removing SNA Server software from Windows NT Server controlled PCs.

    • Read (Manage Only). Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, and to read the configuration file. Users or groups are prohibited from permanently changing the SNA Server configuration because they cannot write to the configuration file. Assign this type of access to SNA Server administrators who will be viewing, starting, and stopping SNA Server services.

    • Read/Write. Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, and to read and write the configuration file. Assign this type of access to SNA Server administrators who will be starting and stopping SNA Server services and permanently changing the SNA Server configuration.

    • Special. Permits an SNA Server administrator to tailor a set of administrative permissions for a particular user or group of users. Administrative permissions can be selectively assigned for managing domains, reading domains, writing domains, viewing permissions, changing permissions, and changing owners.


    Creating special cases and permitting exceptions to the norm usually complicate management and control responsibilities and increase the risk of inadvertent or unauthorized access. Creating special permission sets also potentially increases risks. For this reason, limit the use of Special types of access and use the standard types of access whenever possible.

  18. Click OK to close the Add Users and Groups dialog box and redisplay the SNA Domain Permissions dialog box.

  19. Click OK to close the SNA Domain Permissions dialog box and redisplay the SNA Server Admin window.

Changing Currently Assigned Administrative Permissions

To change currently assigned administrative permissions, perform the following steps:

  1. If SNA Server Admin is already active, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Security, Permissions to display the SNA Domain Permissions dialog box (refer to fig. 24.14).

    Note that the current domain of focus is listed in the SNA Domain box, and the Name list box displays the accounts (both groups and users) that currently have access permissions. The Type of Access box displays the type of access currently assigned to the entry highlighted in the Name list box. The Owner box lists the account name that has been designated as the owner of the ability to grant or deny administrative access to the SNA Server. By default, this ownership status belongs to the Administrator group.


    The procedure for taking ownership is described in "Changing SNA Server Administrative Access Ownership" later in this chapter.

  5. In the Name list box, click the user or group for which you want to change the administrative permissions.

  6. In the Type of Access drop-down list box, select the type of access you want the account(s) listed in the Add Names box to have. The possible types of access are described as follows:

    • No Access. Prohibits a user or group from running SNA Server Admin, the snacfg command-line program, or reading and writing the configuration file. This type of access overrides all other permissions that apply to a particular user. If the user belongs to a group that has full control, for example, the user will be denied administrative access because No Access will override the Full Control permissions. Other members of the group will still have full control.

    • Full Control. Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, to read and write the configuration file, and to change the administrative permissions assigned to other accounts. Assign this type of access to SNA Server administrators who will be starting and stopping SNA Server services, permanently changing the SNA Server configuration, managing other SNA Server user and group permissions, and removing SNA Server software from Windows NT Server controlled PCs.

    • Read (Manage Only). Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, and to read the configuration file. Users or groups are prohibited from permanently changing the SNA Server configuration because they cannot write to the configuration file. Assign this type of access to SNA Server administrators who will be viewing, starting, and stopping SNA Server services.

    • Read/Write. Permits a user or group to run SNA Server Admin, to run the snacfg command-line program, and to read and write the configuration file. Assign this type of access to SNA Server administrators who will be starting and stopping SNA Server services and permanently changing the SNA Server configuration.

    • Special. Permits an SNA Server administrator to tailor a set of administrative permissions for a particular user or group of users. Administrative permissions can be selectively assigned for managing domains, reading domains, writing domains, viewing permissions, changing permissions, and changing owners.


    Creating special cases and permitting exceptions to the norm usually complicate management and control responsibilities and increase the risk of inadvertent or unauthorized access. Creating special permission sets also potentially increases risks. For this reason, limit the use of Special types of access and use the standard types of access whenever possible.

  7. Click OK to close the SNA Domain Permissions dialog box and redisplay the SNA Server Admin window.

Removing Administrative Access

You can deny a user or group administrative access by removing the user/group name from the Name list box of the SNA Domain Permissions dialog box or by assigning the No Access type of access to the user/group to be denied. Of these two methods, assigning No Access is usually the fastest and surest way of removing administrative access. Because the No Access option overrides all other administrative permissions, you do not have to worry about the user(s) gaining access through another group (with access) to which the user(s) may belong. On the other hand, if you deny access to a user by removing the user account from the Name list box in the SNA Domain Permissions dialog box, you must make sure that you have considered all the possible groups to which the user belongs. Otherwise, the user may be able to gain access through another group that you failed to consider. See the earlier section, "Changing Currently Assigned Administrative Permissions," to remove access by assigning the No Access option to the user or group.

To remove administrative access by removing the user account from the Name list box in the SNA Domain Permissions dialog box, follow these steps:

  1. If SNA Server Admin is already active, skip to step 4. Otherwise, continue with step 2 to start SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Security, Permissions to display the SNA Domain Permissions dialog box (refer to fig. 24.14).

    Note that the current domain of focus is listed in the SNA Domain box, and the Name list box displays the accounts (both groups and users) that currently have access permissions. The Type of Access box displays the type of access currently assigned to the entry highlighted in the Name list box. The Owner box lists the account name that has been designated as the owner of the ability to grant or deny administrative access to the SNA Server. By default, this ownership status belongs to the Administrator group.


    The procedure for taking ownership is described in "Changing SNA Server Administrative Access Ownership" later in this chapter.

  5. In the Name list box, click the user or group you want to remove.

  6. Click Remove. The highlighted account name is removed from the list in the Name list box.

  7. Click OK to close the SNA Domain Permissions dialog box and redisplay the SNA Server Admin window.

Changing SNA Server Administrative Access Ownership

Ownership is a concept implemented through the Windows NT Server operating system and applies to all server types operating in a Windows NT environment. Essentially, the owner of the ability to administer SNA Server (the Administrator account, by default) has greater administrative permissions than anyone else. As a matter of fact, the owner always has (or can always get) full administrative access. This is important to know in cases where administrative permissions may have been inadvertently removed or overly restricted in SNA Server Admin. In such cases, the owner can always go in and grant himself or herself Full Control and then reinstate removed access or relieve access restrictions as necessary.

Ownership normally includes owning all copies of the configuration file as well, even those on backup SNA servers. Because you must have an account on a server before you can own the configuration file for that server, there could be potential problems in domains where multiple SNA servers exist. Therefore, ownership must be restricted to accounts that exist on every SNA server in the domain, whether primary or backup servers. This is why the Administrator group account is the default owner - it is a built-in account on every Windows NT-based server.

Ownership of the ability to administer the SNA Server can be seized, however, by any user or group granted Full Control or Special access with Change Owner permissions. In multiple server domains, this user or group would have to have an account on every primary and backup SNA Server, or ownership could not be seized for the server where the account does not exist. Ownership would, instead, be retained by the previous owner. Ownership on servers where the accounts do exist, however, would pass to the user or group seizing ownership.

If a user takes ownership while being logged on in an account that is a member of the Administrator group, ownership will pass to the Administrator group, not the individual user attempting to seize ownership. Indeed, this is the recommended method of ensuring a successful transfer of ownership - through the Administrator group.

To take ownership, follow these steps:

  1. Log on to the Windows NT Server using the account you want to acquire ownership status.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  4. In the SNA Server Admin menu, click Security, Owner to display the Owner dialog box shown in figure 24.16. The SNA Domain box displays the current domain of focus, and the Owner box displays the current owner of the ability to administer SNA Server.

    Fig. 24.16 - The Owner dialog box is used to acquire ownership of the ability to administer SNA Server.

  5. Click Take Ownership. This closes the Owner dialog box and redisplays the SNA Server Admin window. If no messages to the contrary appear, ownership was successfully transferred.

Setting Up Auditing to Monitor Security-Related Events

Auditing is a feature provided through the Windows NT Server operating system. Auditing is performed by the system when specific events are recorded in an event log as they occur. When you set up the auditing feature, you can specify which events to audit. Then when the specified event occurs, such as a member of the Administrator Group changing the configuration file, for example, the system automatically records information concerning that event.

Auditing is also an important method of collecting security-related information. When auditing is used, however, system resources must be used for tracking and recording audited events. This means you pay a small price in performance overhead for each event audited. Additionally, if numerous events are audited, the size of the event log can quickly get very large. Therefore, you would be wise to carefully select which events should be audited so that useless event log entries are avoided and system performance is not unnecessarily impacted.


Installing SNA Server on FAT or HPFS partitions rather than NTFS partitions severely limits your possibilities for auditing. In these cases, the only event that will actually result in log entries is the starting of SNA Server Admin. Although this could still be helpful, it is certainly less useful than being able to log numerous types of SNA Server processes.

To set up auditing to monitor security-related events, perform the following actions:

  1. If auditing has already been turned on in the domain, and File and Object Access has been selected with the Success and Failure options activated, Skip to step 9. Otherwise, continue with step 2 to turn auditing on and select the required options.

  2. Double-click the Administrative Tools Group icon in the Program Manager window to restore the Administrative Tools Group window.

  3. Double-click the User Manager for Domains program-item icon in the Administrative Tools Group window to start User Manager and display the User Manager window.

  4. In the User Manager menu, choose Policies, Audit to display the Audit Policy dialog box shown in figure 24.17.

    Fig. 24.17 - The Audit Policy dialog box showing all the possible events to be audited.

  5. If Audit These Events is already turned on, skip to step 6. Otherwise, click the Audit These Events" button.

  6. Click the Success and Failure check boxes across from File and Object Access to select these options. Both these check boxes should be marked with an X when you finish to indicate that they are activated.

  7. Click OK to close the Audit Policy dialog box and redisplay the User Manager window.

  8. In the User Manager menu, choose User, Exit to close the User Manager window.

  9. If SNA Server Admin is already active, skip to step 12. Otherwise, continue with step 10 to start SNA Server Admin.

  10. Double-click the Microsoft SNA Server Group icon in the Program Manager window to restore the Microsoft SNA Server Group window.

  11. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to start SNA Server Admin and display the SNA Server Admin window.

  12. In the SNA Server Admin menu, choose Security, Auditing to display the SNA Domain Auditing dialog box shown in figure 24.18.

    Fig. 24.18 - The SNA Domain Auditing dialog box displays the Events to Audit as being unavailable until a user or group is added to the Name box.

  13. Click Add to display the Add Users and Groups dialog box shown in figure 24.19.

    Fig. 24.19 - The Add Users and Groups dialog box with the Show Users button present.

  14. In the List Names From drop-down list box, select the domain to which the users or groups to be added belong. Only trusted domains are listed.

  15. Click Show Users to display user and group accounts in the Names list box.

  16. If you want to search for a particular user or group, continue with step 17. Otherwise, skip to step 23.

  17. Click Search to display the Find Account dialog box.

  18. In the Find User or Group box, enter the name of the user or group for which you are searching.

  19. Select the search domain by doing one of the following:

    • Click Search All to search in all the domains.

    • Click Search Only In button to search in a particular domain. If you select this option, you must also select one of the domains listed in the list box below the radio buttons. The Search button does not become available for activation until you do.


    If you want to select the Search     Only In option, click the desired domain in the list box below the search option radio buttons instead of clicking the Search Only In button. When you click one of the listed domains, SNA Server Admin automatically highlights the Search Only In button. Thus you can reduce two required mouse clicks to only one.

  20. Click Search to start the search. When the search is completed, the results appear in the Search Results list box, or you are notified that the indicated search item could not be found in the selected domain.

  21. Repeat steps 18 through 20 as necessary.

  22. Highlight the desired search results in the Search Results list box, and click Add to place the selected search results in the Add Names list box of the Add Users and Groups dialog box. If you want to select more users and/or groups from the Names list box, continue with step 23. Otherwise, skip to step 25.


    To select multiple sequential search result entries, click the first one in the sequence, press and hold down Shift, and click the last one in the sequence. All the search result entries in the range are then highlighted. To assign multiple nonsequential search result entries, press and hold down Ctrl while clicking each search result entry. Each selection remains highlighted.

  23. In the Names list box, select the user(s) and/or group(s) whose actions you want to audit.

  24. Click Add button to add the selected user(s) and/or group(s) to the Add Names box.

  25. Click OK to close the Add Users and Groups dialog box and redisplay the SNA Domain Auditing dialog box. The Name list box should now display the users and groups for whom you can specify actions to be audited.

  26. In the Name list box, select a user or group.

  27. In the Events to Audit area of the SNA Domain Auditing dialog box, select the events you want to audit for the user or group selected.

  28. Repeat steps 26 and 27 for each of the users and groups listed in the Name list box. If no actions are specified for a user or group, that user or group is deleted from the Name list box when you perform step 29.

  29. Click OK to close the SNA Domain Auditing dialog box and redisplay the SNA Server Admin window.

Diagnosing Problems

The tight integration of SNA Server with the Windows NT-type operating systems has provided a number of tools that can be used to not only manage the network, but also perform diagnostic appraisals of the network functions and components. SNA Server and Windows NT Server both contain numerous diagnostic tools that are invaluable in determining why SNA Server configuration and/or network problems may be occurring. These diagnostic tools allow you to monitor and trace events and collect event information leading up to a specific problem occurrence. Some of the most commonly used diagnostic tools are the following:

  • SNA Server Admin

  • Windows NT Server Event Viewer

  • Windows NT Server Performance Monitor

  • NetView

  • 3270 Response Time Monitor (RTM)

  • SNA Server Trace

You can use these tools to gather information regarding problem events and system status related to servers, connections, LUs, interfaces, and general system events. The type of detailed troubleshooting information you need to gather dictates which specific tool, or combination of tools, you should use. When these tools are used properly, you should be able to tell the exact state of the system at the time the problem occurred.

The SNA Server administrator is normally responsible for keeping the SNA environment running at peak efficiency. These same tools can be used to do that. By properly monitoring critical events through such tools as the RTM and performance monitor, the SNA Server administrator can fine-tune the SNA Server and its network on a continuing basis.

The following sections explore the available diagnostic tools and describe the detailed procedures you must follow to use them. The major diagnostic tools to be covered are as follows:

  • SNA Server Admin for obtaining information about the status of servers, connections, and LUs

  • SNA Server Admin for setting up event log parameters

  • Windows NT Server Event Viewer for viewing logged information about application events on the SNA network

  • Windows NT Server Performance Monitor for obtaining real-time information on system performance

  • NetView for obtaining data about personal computer (PC) alerts (errors) via a mainframe host system

  • 3270 Response Time Monitor (RTM) for obtaining data about the amount of time it takes a host system to respond during 3270 sessions

  • SNA Server Trace for obtaining information about internal activities on the SNA network.

SNA Server Admin for Status Information

When it is apparent that a particular SNA service is experiencing some type of difficulty, it may be necessary to start, stop, reset, or completely modify the service. Before you take any of these actions, however, you will first want to gather some status information about the SNA Server itself, the connections it is using, and the assigned LUs. Apply the procedures described in the following paragraphs to perform these tasks:

  • View the status of an SNA Server

  • View the status of a connection

  • View the status of a non-Advanced Program-to-Program Communication (APPC) LU

  • View the status of an APPC LU-LU pair

  • View the active 3270 LUs

Viewing the Status of an SNA Server

The procedure for viewing the status of an SNA Server is as follows:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to open the Servers and Connections window and make it the active window.

  5. Select the SNA Server for which you want to view the status. The SNA Server selected remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Properties to display the Server Properties dialog box shown in figure 24.20.

    Fig. 24.20 - The Server Properties dialog box is used to specify SNA Network Control Point information as well as to provide server status information.

  7. The primary area of the dialog box you need to examine is at the bottom. Note that it displays several pieces of information about the current state of the SNA Server. It shows the number of LUA sessions, active users, APPC sessions, 3270 sessions, and downstream sessions. It also reflects one of the following for the current SNA Server status:

    • Active. When this status is reflected, the number of licensed users and sessions is also displayed.

    • Inactive. This status is reflected when the server is not connected to a host or when the server has been stopped.

    • Pending. This status appears temporarily whenever the server is in a transitional state such as when it is going from a stopped state to a started state.

    • Stopping. This is the status given when the server is stopping.

    • Active [Out of Date]. This status indicates that the SNA Server needs to be restarted so that internal parameters can be updated with the latest configuration changes.

    • Error. This status indicates that SNA Server Admin cannot access the SNA Server due to the occurrence of an unexpected condition.

  8. When you are finished viewing the information in the Server Properties dialog box, click Cancel to close the dialog box and redisplay the SNA Server Admin window.

Viewing the Status of a Connection

To view the status of a connection, perform these steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to open the Servers and Connections window and make it the active window.

  5. Look in the Status column (in the left half of the window) to obtain the current status of the desired connection:

    • Active. When this status is reflected, the number of licensed users and sessions is also displayed.

    • Inactive. This status is reflected when the connection is not operational or when the connection has been stopped.

    • Pending. This status appears temporarily whenever the connection is in a transitional state such as when it is going from a stopped state to a started state.

    • Stopping. This is the status given when the connection is stopping.

    • On Demand. This status, which is only possible when connections are configured as On Demand connections, indicates that the connection can be started whenever it is needed.

    • Incoming. This status, which is only possible when connections are configured as Incoming connections, indicates that the connection is ready to receive incoming calls.

Viewing the Status of a non-APPC LU

To view the status of a non-APPC LU, follow these steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to open the Servers and Connections window and make it the active window.

  5. Select the connection to which the LU you want to view the status of is assigned. Note the right half of the window changes to reflect the LUs assigned to the highlighted connection, as displayed in figure 24.21.

    Fig. 24.21 - The Servers and Connections window showing the LUs assigned to the connection named CHANNEL.

  6. Look in the Status column (in the right half of the window) to obtain the current status of the desired LU:

    • Inactive. This status indicates that the LU is not operational and is unavailable for use.

    • In Session. When this status is reflected, the LU is being used.

    • SSCP. This status indicates that the LU is in use but has not yet been bound to a specific host application.

    • Available. This status indicates that the host has recognized the LU as available for use.

    • Pending. This status indicates that a user is trying to use the LU but cannot access it because the connection is inactive or the host has not recognized the LU as being available.

    • Unavailable. This status is only possible on Downstream LUs.

Viewing the Status of an APPC LU-LU Pair

Perform the following steps to view the status of an APPC LU-LU Pair:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to open the Servers and Connections window and make it the active window.

  5. Select the server to which the local APPC LU you want to view is assigned. Note the right half of the window changes to reflect the local APPC LU assigned to the highlighted server. Click the local APPC LU.

  6. In the SNA Server Admin menu, choose Services, Properties to display the APPC LU Properties dialog box.

  7. In the APPC LU Properties dialog box, click the Status button to display the APPC LU Status dialog box shown in figure 24.22. Note that it contains any LUs that have been partnered with the local APPC LU (LU-LU pairs).

    Fig. 24.22 - The APPC LU Status dialog box showing LUs that have been partnered with the local APPC LU.

  8. You can click a particular partner entry in the APPC LU Status dialog box and then click Zoom to refine the partner display area so that it shows the user, computer, the executable using the session, and the starting time for the session.

  9. When you are finished viewing a particular dialog box, click Close or Cancel to clear that dialog box. Continue this process until all the dialog boxes have been closed and the Server and Connections window is displayed.

Viewing 3270 LUs in Use by an Active User

To view 3270 LUs in use by an active user, follow these steps:

  1. If the Users and Groups window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Users and Groups window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Users and Groups icon in the SNA Server Admin window to open the Users and Groups window and make it the active window.

  5. In the SNA Server Admin menu, choose View, Active Users to display the active users.

  6. Click the desired active user to highlight the user and cause the 3270 LUs being used by that user to be displayed on the right half of the window.

  7. View the LUs listed in the LU or LU Pool columns in the right half of the window.

SNA Server Admin for Event Log Parameters

SNA Server Admin is also used to set several parameters for capturing SNA Server event information. This captured event information is then recorded in one of three logs, depending on the nature of the event. Events related to system activities are recorded in the System Log; application-related events are recorded in the Application Log; and events related to security (such as accessing and/or modifying the SNA Server configuration file) are recorded in the Security Log. The following event log parameters can be manipulated through SNA Server Admin:

  • Specify the server on which the event logs will be stored.

  • Specify the general level of events to be recorded. The three levels available record all activities, general activities only, or significant system activities only. Each of these levels, in turn, generate a corresponding volume of log information. Naturally, the level that captures every possible recordable event accounts for the largest volume of data. Although this is good from a troubleshooting perspective, the size of the log file may become unwieldy.

  • Specify a server (in addition to the local server) to which pop-up error messages should be routed. These pop-up messages relate to activities on the SNA network and do not include SNA Server Admin messages.

SNA Server Admin provides you with a dialog box for setting these parameters. To access the dialog box and configure the parameters, follow these steps:

  1. If SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Users and Groups window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Options, Logs. The Error/Audit Logging and Popups dialog box displayed in figure 24.23 appears.

    Fig. 24.23 - The Error/Audit Logging and Popups dialog box is used to specify a level of logging detail as well as indicate where to send server popup messages.

  5. In the Centralized Event Log Server box, either accept the default, click the drop-down list box to select a server from the list, or manually type in the name of the desired server. This entry specifies the server on which the event logs should be stored. The local system default entry stores the logs on the server running SNA Server Admin.

  6. In the Default Audit Log Level area of the dialog box, click the desired button to specify one of the following logging levels:

    • Detailed Problem Analysis. This level captures all recordable events.

    • General Information Messages. This level only captures general activity events.

    • Significant System Events. This level only captures major events.

    • Audit Logging Disabled. This option turns off the logging feature altogether, and no data of any type is captured.

  7. In the Route All Server Popup Messages To box, either accept the default entry of Local System, click the drop-down list box to select a remote server from the list, or manually type in the name of the desired remote server. This entry specifies the server on which the event logs should be stored. The local system default entry prevents the pop-up messages from being displayed on any of the remote SNA servers.


    Pop-up messages are always displayed on the local SNA Server regardless of the server specified in the     Route All Server Popup Messages To box. The remote server specified in this box, if any, displays pop-up messages at the same time they are displayed on the local SNA Server.

  8. Click OK to accept the settings and exit the Error/Audit Logging Popups dialog box, or click Cancel to exit the dialog box without accepting the settings.

Windows NT Server Event Viewer

The event logs discussed in the preceding section can tell you the sequence and types of events that took place up to a selected point in time and, therefore, are very useful to product support technicians who may be working with you to solve a particularly stubborn problem. Before they can be useful, however, you must be able to view them. This is what the Windows NT Server Event Viewer allows you to do. It is designed to provide you with flexible options for controlling the display and viewing of captured event data (specifically SNA Server event data in this case). By selecting appropriate commands from the Log, View, and Options menus in the Event Viewer, you can tailor the log views from many computers in many different ways. Additionally, because event log data are recorded in log files (with the default dot extension of EVT) and stored in SYSTEM32\CONFIG of the WINNT root directory, they can be copied and printed like any other text file. This is useful when a remote support technician requests a copy of the log files for your server to assist in troubleshooting a problem.

See "A Survey of Windows NT Server's Administrative Tools," (Ch. 6)

Windows NT Server Performance Monitor

The Performance Monitor is a Windows NT Server graphical tool that allows you to measure the performance of computers on the network and display that performance measurement as a continuously plotted line(s) on a graph. Because the measurements are plotted on a continuous basis, the line graph is an excellent performance monitoring tool.

See "A Survey of Windows NT Server's Administrative Tools," (Ch. 6)

To monitor performance on your SNA Server, follow these steps:

  1. Double-click the Administrative Tools Group icon in the Program Manager window to open the Administrative Tools Group window.

  2. Double-click the Performance Monitor program-item icon in the Administrative Tools Group window to open the Performance Monitor window.

  3. In the Performance Monitor menu, choose Edit, Add To Chart to display the Add To Chart dialog box shown in figure 24.24.

    Fig. 24.24 - The Add To Chart dialog box is used to tailor the view and specify measuring parameters for the Performance Monitor.

  4. In the Computer box, enter the name of the SNA Server computer you want to monitor. If you are currently operating on the SNA Server computer you want to monitor, you do not need to do anything here because the computer on which you are currently operating always appears as the default computer. If you are not operating on the SNA Server you want to monitor, click the drop-down list box to select an SNA Server computer from the list or manually type in the name of the desired SNA Server computer.

  5. In the Object box, click the drop-down list box and select one of the following objects from the list depending on what you want to monitor:

    • SNA connections

    • SNA Logical Unit sessions

    • SNA Adapter X where X is your specific SNA adapter name

  6. In the Counter box, click the drop-down list box and select one of the counters from the list, depending on what you want to monitor. If you do not know what a particular counter measures, highlight the counter and click Explain. A definition for the counter appears at the bottom of the dialog box. The following counters should be available:

    • Data bytes received/sec

    • Data bytes transmitted/sec

    • Throughput bytes/sec

    • Adapter failures (only for SNA Adapter X object)

    • Connection failures (only for SNA Adapter X object)

    • Frames Received/Sec (only for SNA Adapter X object)

    • Frames transmitted/sec (only for SNA Adapter X object)

    • Successful connects (only for SNA Adapter X object)

    • Throughput frames/sec (only for SNA Adapter X object)

  7. Click Add to add the counter's tracking line to the graph. If multiple counters are added to the graph, each counter's tracking line will have a different appearance.

NetView

IBM's NetView is a network management system that runs on the IBM host. It is helpful to the network administrator because it receives alerts from the Windows NT system, or NT-based applications and forwards these alerts to the host computer and the network administrator. It also is helpful in diagnosing problems and improving performance on the network. The NetView service that provides this functionality is called NVAlert. A companion service of NetView, NVRunCMD, runs as a background process on the SNA Server and is a command-line interface to the Windows NT Server. It is extremely useful in responding to NVAlert messages for diagnostic querying or for providing simple fixes to problems. For example, if a NetView operator receives an alert indicating an application could not find a particular file, the NetView operator could intervene by executing a command (via NVRunCMD) on the Windows NT Server to copy the file to an area where it could be found by the application needing it.

NetView alerts can be sent through any host connection except a Distributed Function Terminal (DFT) connection. You can specify which host connection the NetView data should be sent by doing the following:

  1. If SNA Server Admin is already running, skip to step 4. Otherwise, continue with step 2 to activate SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Options, NetView to display the NetView Options dialog box shown in figure 24.25.

    Fig. 24.25 - The NetView Options dialog box is simply used to specify a connection to which the management data should be sent.

  5. In the Send NetView Management Data to Connection drop-down list box, select a non-DFT host connection.

  6. Click OK to accept the connection and clear the NetView Options dialog box.

3270 Response Time Monitor (RTM)

The RTM, an IBM NetView function that measures response time between a host and a 3270 session, is another valuable diagnostic tool. But to use it, your 3270 emulator must be capable of supporting it. SNA Server Admin allows you to tailor the RTM by specifying such things as when the collected data should be sent and what triggers will cause the RTM to register responses from the host computer. Perform the following actions to configure 3270 RTM settings:

  1. If SNA Server Admin is already running, skip to step 4. Otherwise, continue with step 2 to activate SNA Server Admin.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. In the SNA Server Admin menu, choose Options, RTM Triggers to display the 3270 Response Time Monitor (RTM) dialog box shown in figure 24.26.

    Fig. 24.26 - The 3270 Response Time Monitor (RTM) dialog box allows you to specify when RTM data should be sent, how long the timers should run, and the threshold intervals.

  5. In the RTM Data Sent At area of the dialog box, select the appropriate option(s) by clicking the check box to mark it with an X. If you want to disable one of the options, click the marked check box to unmark it (remove the X). The options are as follows:

    • Counter Overflow. Select this option if you want RTM data sent to the host when the number of responses from the host exceeds the size of the available counter.

    • End of Session. Click this check box if you want RTM data sent to the host at the end of each LU-LU session.

  6. RTM timers start running automatically when the local computer starts to send data. The point at which the timers stop, however, depends on the option selected in the RTM Timers Run Until area of the dialog box. This setting determines when the RTM will recognize the host as having responded, and therefore stop the timers. Click one of the following options to establish the timer stopping point:

    • First Data Reaches Screen. Select this option if you want RTM timers to stop when data reaches the local screen.

    • Host Unlocks Keyboard. Select this option if you want RTM timers to stop when the host unlocks the local keyboard.

    • Host Lets User Send. Select this option if you want RTM timers to stop when the host lets the local computer send more data.

  7. RTM threshold settings are defined as intervals (in tenths of a second) at which the RTM will save its count of host responses and restart the count. The permissible range of values is from 1 to 1,000 tenths of a second. The default values of 5, 10 ,20, and 50 will cause the RTM to save the count of host responses during the intervals from 0.0 to 0.5 seconds, from 0.5 to 1.0 seconds, from 1.0 to 2.0 seconds, and from 2.0 to 5.0 seconds. Either accept these defaults or enter new interval values in the interval number boxes provided.

  8. Click OK to accept the settings and close the 3270 Response Time Monitor (RTM) dialog box.

SNA Server Trace

The SNA Server Trace program, which can be executed without stopping the SNA Server, collects information on the activity between and within the SNA Server components. This information can be extremely valuable in diagnosing configuration problems and improving performance. The SNA Server Trace program-item icon in the Microsoft SNA Server Group window activates the snatrace utility and starts the tracing function for SNA Server or Windows NT-based client computers. Tracing is possible on client computers running other operating systems as well (Microsoft Windows, MS-DOS, or OS/2), but it has to be activated with special commands or with lines in an initialization file.

The result of the SNA Server Trace utility is a file, with a file name extension of TRC, which is stored in the TRACES subdirectory of the SNA Server root directory. These files can be manipulated like any other text file and are often requested by support technicians for troubleshooting purposes when log files alone prove inadequate.


When you begin to gather information for troubleshooting suspected system problems, start with event log data instead of SNA Server trace data. Event log information is much easier to understand and interpret than trace information and is usually adequate in diagnosing the cause of common system ailments. If the logs prove inadequate for discovering root causes for stubborn system problems, however, do not hesitate to start collecting trace data. It will provide much more detail on the SNA Server components possibly involved in the problem. Solicit the assistance of qualified technical support personnel, if necessary, to interpret the trace data.

The remainder of this chapter discusses procedures for running the SNA Server Trace utility for SNA Server and Windows NT-based client systems. For details on how to set up and activate the trace utility for other client computers running Windows, MS-DOS, or OS/2, refer to your Microsoft SNA Server Administration Guide.

Determining Software Components and Tracing Types

Before you begin to set up the tracing activity, you must first determine which SNA software component(s) would most likely provide the best diagnostic data for the problem being investigated. The choices you have available for tracing include the following:

  • SNA applications

  • SnaServer, the SNA Server software component that functions as a Physical Unit (PU) 2.1 node and interacts with clients and other nodes on SNA network

  • SnaBase, the SNA Server software component that maintains service name and status lists

  • Link services installed with SNA Server Setup

After you select the software component(s), you must then decide which type of tracing to perform on the component(s). The tracing types available are described in the following list:

  • Internal. This type traces activity inside SNA Server software components. This type of tracing is primarily suited to product support technician use because the difficulty of interpreting internal tracing data is beyond the knowledge base of the typical SNA or network administrator.

  • Message. This type traces messages passed into and out of particular SNA Server software components and includes messages sent to and received from the SNA network.

  • Application Programming Interface (API). This type traces information passed into and out of an SNA Server DLL communicating with an application. API traces only apply to SNA Applications. They do not apply to the other three SNA Server software components mentioned earlier.

Starting the SnaTrace Utility Locally or Remotely Through SNA Server Admin

To start the SnaTrace utility locally or remotely through SNA Server Admin, follow these steps:

  1. If the Servers and Connections window in SNA Server Admin is already active, skip to step 5. Otherwise, continue with step 2 to activate the Servers and Connections window.

  2. Double-click the Microsoft SNA Server Group icon in the Program Manager window to open the Microsoft SNA Server Group window.

  3. Double-click the SNA Server Admin program-item icon in the Microsoft SNA Server Group window to open the SNA Server Admin window.

  4. Double-click the Servers and Connections icon in the SNA Server Admin window to open the Servers and Connections window and make it the active window.

  5. Select the SNA Server for which you want traces. The SNA Server selected remains highlighted.

  6. In the SNA Server Admin menu, choose Services, Properties to display the Server Properties dialog box.

  7. Click the Addons button to display the SNA Server Additions dialog box shown in figure 24.27.

    Fig. 24.27 - The SNA Server Additions dialog box lists the additional utilities available for the SNA Server.

  8. In the Available SNA Server Additions box, click SNA Server Trace Options if two or more utilities are listed.

  9. Click Select to display the SNA Server Trace Options dialog box shown in figure 24.28.

Fig. 24.28 - The SNA Server Trace Options dialog box allows you to define the tracing parameters.


You can also start the SnaTrace utility remotely by typing snatrace \\servername at the command prompt on an SNA server, or you can start it locally on a Windows NT-based client by typing snatrace at the command prompt. After entering both commands, the SNA Server Trace Options dialog box appears.

Enabling or Disabling Trace Options with the SnaTrace Utility

After starting the SnaTrace utility and displaying the SNA Server Trace Options dialog box as described in the preceding section, follow these steps to configure the trace options:

  1. In the Service Name drop-down list box, select a service from the list. The service list contains the four SNA Server software components mentioned earlier in this chapter, with a service entry for each link service configured during installation and setup. Additionally, a service called SNA Server Admin will be listed to trace activity generated by the SNA Server Admin interface.

  2. In the Internal Tracing area of the dialog box, drag the box to the desired level of internal tracing for the service selected. Because internal tracing is typically activated only when requested by a product support technician, the required level of internal tracing is usually Full Tracing. Disabling internal tracing does not affect other trace options.

  3. In the Message Traces area of the dialog box, select options for message tracing by clicking the appropriate check box(es) to mark the box(es) (with an X) to enable message tracing, or click a marked check box (removes the X) to disable tracing for that message type.

  4. In the Client API Tracing area of the dialog box, which is available only if the selected service is SNA Applications, select options for API tracing by clicking the appropriate check box(es) to mark the box(es) (with an X) to enable API tracing, or click a marked check box (removes the X) to disable tracing for that API type.

  5. In the Minimize Disk Access by Buffering Writes check box, either mark the check box with an X (by clicking it when it is unmarked) to minimize disk access, or unmark the check box (by clicking it when it is marked with an X) to cause information to be written to disk as soon as it is generated. The default selection is to minimize the writing of trace information to disk by holding it in memory until it can be efficiently written to disk. Holding the data in memory for longer periods of time before writing it to disk is more risky from a data protection perspective because data in memory will be lost if the system goes down. On the other hand, writing tracing information to the disk as soon as it is generated saves the data in the event of system failure, but the tracing activity runs slower because of the frequent writes to the disk.

  6. Repeat steps 1 through 5 for each service being traced.

  7. Click OK.

From Here...

This chapter detailed the routine procedures necessary to administer and manage connectivity and access to SNA Server and host computer resources. It also discussed the various diagnostic tools available to the SNA Server administrator and how these tools should be used.

  • To review basic SNA concepts and SNA Server installation procedures, see Chapter 21, "SNA Server Preparation and Installation."

  • To review information on building the SNA Server and establishing the connections between the SNA Server and the host mainframe or AS/400 system, see Chapter 22, "Building SNA Server."

  • To review information on configuring the logical units and downstream connections so that clients can access network resources, see Chapter 23, "Implementing SNA Server."

  • For information on using the Windows NT Server administrative tools as the SNA Server administrator, see Chapter 6, "The Role of the Network Administrator."

Table of Contents

23 - Implementing SNA Server

25 - Preparing for SMS