Skip to main content
Version: v2.14.x LTS

zwe init

zwe init

zwe > init

zwe init [sub-command [sub-command]...] [parameter [parameter]...]



Init Zowe instance based on zowe.yaml configuration.

You can find an example zowe.yaml in Zowe runtime directory folder.

This command will run these sub-commands in sequence:

  • zwe init mvs
  • zwe init vsam
  • zwe init apfauth
  • zwe init security
  • zwe init certificate
  • zwe init stc

If you pass --skip-security-setup with this command, zwe init apfauth and zwe init security steps will be skipped.

If you pass --update-config with this command, these configurations could be written back to your Zowe YAML configuration file:

  • zowe.runtimeDirectory based on where your zwe command is located, and if it is not defined,
  • zowe.certificate based on your zowe.setup.certificate configuration,
  • java.home based on your current JAVA_HOME or automatic detection,
  • node.home based on your current NODE_HOME or automatic detection.

IMPORTANT, if you modify any of the values below, it's suggested to re-run relevant zwe init command to make them taking effect.

These Zowe YAML configurations showing with sample values are used:

product: RACF
type: PKCS12
validity: 3650
directory: /global/zowe/keystore
lock: true
name: localhost
password: password
caAlias: local_ca
caPassword: local_ca_password
name: ZoweKeyring
label: localhost
caLabel: localca
user: IZUSVR
mode: NONRLS
volume: VOL123
verifyCertificates: STRICT
port: 443
mode: VSAM
  • zowe.setup.dataset.prefix shows where the SZWEAUTH data set is installed.

  • zowe.setup.dataset.parmlib is the user custom parameter library. Zowe server command may generate sample PARMLIB members and stores here.

  • zowe.setup.dataset.jcllib is the custom JCL library. Zowe server command may generate sample JCLs and put into this data set.

  • zowe.setup.dataset.authLoadlib is the user custom APF LOADLIB. This field is optional. If this is defined, members of SZWEAUTH will be copied over to this data set and it will be APF authorized. If it's not defined, SZWEAUTH from zowe.setup.dataset.prefix data set will be APF authorized.

  • zowe.setup.dataset.authPluginLib is the user custom APF PLUGINLIB. You can install Zowe ZIS plugins into this load library. This loadlib requires APF authorize.

  • is security product. Can be RACF, ACF2, or TSS. This configuration is optional. Default value is RACF.

  • is the group for Zowe administrators. This configuration is optional. Default value is ZWEADMIN.

  • is the group for Zowe started tasks. This configuration is optional. Default value is ZWEADMIN.

  • is system programmer user ID/group. This configuration is optional. Default value is ZWEADMIN.

  • is the userid for Zowe started task. This configuration is optional. Default value is ZWESVUSR.

  • is userid for ZIS started task. This configuration is optional. Default value is ZWESIUSR.

  • is Zowe started task name. This configuration is optional. Default value is ZWESLSTC.

  • is ZIS started task name. This configuration is optional. Default value is ZWESISTC.

  • is ZIS auxiliary started task name. This configuration is optional. Default value is ZWESASTC.

  • zowe.setup.certificate.type is the type of certificate. Valid values are "PKCS12" (USS keystore) or "JCERACFKS" (z/OS keyring).

  • zowe.setup.certificate.dname is the distinguished name of the certificate. You can define caCommonName, commonName, orgUnit, org, locality, state, and / or country. These configurations are optional.

  • zowe.setup.certificate.validity is the validity days of the certificate. This is optional.

  • zowe.setup.certificate.san is the Subject Alternative Name(s) of the certificate if they are different from zowe.externalDomains. Please note, for JCERACFKS type, with limitation of RACDCERT command, this should contain exact one hostname (domain) and one IP address.

  • zowe.setup.certificate.importCertificateAuthorities is the list of certificate authorities will be imported to Zowe PKCS12 keystore or JCERACFKS keyring. Please note, for JCERACFKS type, only maximum 2 CAs is supported. If you are using PKCS12 certificate, this should be USS files in PEM format. If you are using JCERACFKS certificate, this should be certificate labels on the z/OS system.

For PKCS12 certificate users,

  • is the directory where you plan to store the PKCS12 keystore and truststore. This is required if zowe.setup.certificate.type is PKCS12.
  • zowe.setup.certificate.pkcs12.lock is a boolean configuration to tell if we should lock the PKCS12 keystore directory only for Zowe runtime user and group. Default value is true.
  • You can also define name, password, caAlias and caPassword under zowe.setup.certificate.pkcs12 to customized keystore and truststore. These configurations are optional, but it is recommended to update them from default values.
  • Define zowe.setup.certificate.pkcs12.import.keystore if you already acquired certificate from other CA, stored them in PKCS12 format, and want to import into Zowe PKCS12 keystore.
  • zowe.setup.certificate.pkcs12.import.password is the password for keystore defined in zowe.setup.certificate.pkcs12.import.keystore.
  • zowe.setup.certificate.pkcs12.import.alias is the original certificate alias defined in zowe.setup.certificate.pkcs12.import.keystore. After imported, the certificate will be saved as alias specified in

For JCERACFKS certificate (z/OS keyring) users,

  • zowe.setup.certificate.keyring.owner is the keyring owner. It's optional and default value is If it's also not defined, the default value is ZWESVUSR.

  • is the keyring name will be created on z/OS. This is required if zowe.setup.certificate.type is JCERACFKS.

  • If you want to let Zowe to generate new certificate,

    • You can also customize label and caLabel under zowe.setup.certificate.keyring if you want to generate new certificate. Default value of label is localhost and default value of caLabel is localca.
  • If you want to import certificate stored in MVS data set into Zowe keyring,

    • zowe.setup.certificate.keyring.connect.dsName is required in this case. It tells Zowe the data set where the certificate stored.
    • zowe.setup.certificate.keyring.connect.password is the password when importing the certificate.
    • The certificate will be imported with label defined in zowe.setup.certificate.keyring.label.
  • If you want to connect existing certificate into Zowe keyring,

    • zowe.setup.certificate.keyring.connect.user is required and tells Zowe the owner of existing certificate. This field can have value of SITE.
    • zowe.setup.certificate.keyring.connect.label is also required and tells Zowe the label of existing certificate.
  • If zowe.verifyCertificates is not DISABLED, and z/OSMF host ( is provided, Zowe will try to trust z/OSMF certificate.

    • If you are using RACF security manager, Zowe will try to automatically detect the z/OSMF CA based on certificate owner specified by zowe.setup.certificate.keyring.zOSMF.user. Default value of this field is IZUSVR. If the automatic detection failed, you will need to define indicates what is the label of z/OSMF root certificate authority.
    • If you are using ACF2 or TSS (Top Secret) security manager, is required to indicates what is the label of z/OSMF root certificate authority.
  • zowe.setup.vsam.mode indicates whether the VSAM will utilize Record Level Sharing (RLS) services or not. Valid value is RLS or NONRLS.

  • zowe.setup.vsam.volume indicates the name of volume. This field is required if VSAM mode is NONRLS.

  • zowe.setup.vsam.storageClass indicates the name of RLS storage class. This field is required if VSAM mode is RLS.

  • zowe.verifyCertificates indicates how Zowe should validate the certificate of services registered under Zowe APIML. Valid values are "STRICT", "NONSTRICT" or "DISABLED". If this is "STRICT", this command will try to validate the z/OSMF service certificate if z/OSMF is defined.

  • and zOSMF.port is the z/OSMF service information. This is required if you are using z/OSMF as authentication service.

  • indicates what storage Zowe Caching Service will use. Only if this value is VSAM, this command will try to create VSAM data set.

  • defines the VSAM data set name.


zwe init --allow-overwrite -c /path/to/zowe.yaml

zwe init apfauth -v -c /path/to/zowe.yaml

zwe init certificate -v -c /path/to/zowe.yaml


Full nameAliasTypeRequiredHelp message
--allow-overwrite,--allow-overwrittenbooleannoAllow overwritten existing MVS data set.
--skip-security-setupbooleannoWhether should skip security related setup.
--security-dry-runbooleannoWhether to dry run security related setup.
--ignore-security-failuresbooleannoWhether to ignore security setup job failures.
--update-configbooleannoWhether to update YAML configuration file with initialization result.

Inherited from parent command

Full nameAliasTypeRequiredHelp message
--help-hbooleannoDisplay this help.
--debug,--verbose-vbooleannoEnable verbose mode.
--trace-vvbooleannoEnable trace level debug mode.
--silent-sbooleannoDo not display messages to standard output.
--log-dir,--log-lstringnoWrite logs to this directory.
--config-cstringnoPath to Zowe configuration zowe.yaml file.
--configmgrbooleannoEnable use of configmgr capabilities.


Inherited from parent command

Error codeExit codeError message
100If the user pass --help or -h parameter, the zwe command always exits with 100 code.
ZWEL0101E101ZWE_zowe_runtimeDirectory is not defined.
ZWEL0102E102Invalid parameter %s.
ZWEL0103E103Invalid type of parameter %s.
ZWEL0104E104Invalid command %s.
ZWEL0105E105The Zowe YAML config file is associated to Zowe runtime "%s", which is not same as where zwe command is located.
ZWEL0106E106%s parameter is required.
ZWEL0107E107No handler defined for command %s.
ZWEL0108E108Zowe YAML config file is required.
ZWEL0109E109The Zowe YAML config file specified does not exist.
ZWEL0110E110Doesn't have write permission on %s directory.
ZWEL0111E111Command aborts with error.
ZWEL0112E112Zowe runtime environment must be prepared first with "zwe internal start prepare" command.
ZWEL0114E114Reached max retries on allocating random number.
ZWEL0120E120This command must run on a z/OS system.
ZWEL0121E121Cannot find node. Please define NODE_HOME environment variable.
ZWEL0122E122Cannot find java. Please define JAVA_HOME environment variable.
ZWEL0123E123This function is only available in Zowe Containerization deployment.
ZWEL0131E131Cannot find key %s defined in file %s.
ZWEL0132E132No manifest file found in component %s.
ZWEL0133E133Data set %s already exists.
ZWEL0134E134Failed to find SMS status of data set %s.
ZWEL0135E135Failed to find volume of data set %s.
ZWEL0136E136Failed to APF authorize data set %s.
ZWEL0137E137z/OSMF root certificate authority is not provided (or cannot be detected) with trusting z/OSMF option enabled.
ZWEL0138E138Failed to update key %s of file %s.
ZWEL0139E139Failed to create directory %s.
ZWEL0140E140Failed to translate Zowe configuration (%s).
ZWEL0142E142Failed to refresh APIML static registrations.
ZWEL0172EComponent %s has %s defined but the file is missing.
ZWEL0200EFailed to copy USS file %s to MVS data set %s.
ZWEL0201EFile %s does not exist.
ZWEL0202EUnable to find samplib key for %s.
ZWEL0203EEnv value in key-value pair %s has not been defined.
ZWEL0316ECommand requires zowe.useConfigmgr=true to use.