REXX script that extracts SYSLOG messages accordingly to one of the four selection criteria: Message ID, Job name, Job ID, Anywhere in text. All necessary instructions are provided in JCL code. If you want to search current SYSLOG in addition to the archived ones enter SDSF and issue: PRE SYSLOG --> ST --> XDC left to the SYSLOG --> Copy it with the same RECFM & LRECL as offloaded SYSLOGS --> add it to the concatenation in the job. Note that SYSLOG can be configured differently on various systems. Following script assumes that column with job name/job ID/console name starts near position 39 and column with message IDs starts near column 57. If your setting differs from this, change "P1" and "P2" variables in REXX code. P1 is start column position and P2 is a field length. As you can see below those values have margin for some differences and should work on most configurations. **************************************************************************************************** JCL CODE - MAIN VERSION: **************************************************************************************************** //*--------------------------------------------------------------------- //* SYSLOG MESSAGE EXTRACTOR //* //* BEFORE FIRST RUN: //* - ISSUE 'HI REXX' IN EDITOR //* - VERIFY IF 'OR' OPERATOR '|' IS HIGHLIGHTED. IF NOT, ISSUE 'HEX ON' //* TO CHECK ITS CODE AND REPLACE IT WITH '4F': "C X'5A' X'4F' ALL" //* - SUPPLY SYSLOGS & OUTPUT DATA SET NAME //* //*--------------------------------------------------------------------- //OUTPUT SET OUTPUT=&SYSUID..SYSLOG.MSGEXTR1 <-- OUTPUT //*--------------------------------------------------------------------- //DEL EXEC PGM=IEFBR14 //DELDD DD DSN=&OUTPUT,SPACE=(TRK,1),DISP=(MOD,DELETE) //*--------------------------------------------------------------------- //REXX EXEC PGM=IEBGENER //SYSPRINT DD SYSOUT=* //SYSIN DD DUMMY //SYSUT2 DD DSN=&&TEMP(LOGEXTR),DISP=(,PASS), // SPACE=(TRK,(1,1,2)),LRECL=80,RECFM=FB,BLKSIZE=8000 //SYSUT1 DD * PARSE ARG MODE MSG.1 MSG.2 MSG.3 MSG.4 MSG.5 MSG.6 . P1=1 P2=132 IF MODE="MSG" THEN DO P1=54 P2=26 END IF MODE="JOB" THEN DO P1=36 P2=16 END SAY "REXX WILL SEARCH FOR:" DO I=1 TO 6 IF LENGTH(MSG.I) < 2 THEN MSG.I="ZZXXZZXX" ELSE SAY MSG.I END MSGNUM=9999 NEWMSG=0 C=0 COUNTER=0 EOF=0 DO WHILE EOF=0 "EXECIO 1 DISKR IN" IF RC<>0 THEN EOF=1 ELSE DO PARSE PULL RECIN TEMP=SUBSTR(RECIN,P1,P2) IF POS(" "MSG.1,TEMP) <> 0 ! POS(" "MSG.2,TEMP) <> 0, ! POS(" "MSG.3,TEMP) <> 0 ! POS(" "MSG.4,TEMP) <> 0, ! POS(" "MSG.5,TEMP) <> 0 ! POS(" "MSG.6,TEMP) <> 0, THEN DO COUNTER=COUNTER+1 NEWMSG=0 MSGNUM = WORD(RECIN,WORDS(RECIN)) PUSH RECIN "EXECIO 1 DISKW OUT" END ELSE IF WORDPOS(MSGNUM,SUBSTR(RECIN,41,6)) <> 0 THEN DO PUSH RECIN "EXECIO 1 DISKW OUT" END C = C + 1 IF C//10000 = 0 THEN SAY TIME()" - "C" RECORDS PROCESSED" END NEWMSG=NEWMSG+1 IF NEWMSG > 50 THEN DO NEWMSG=0 MSGNUM=9999 END END SAY TIME()" - "C" RECORDS PROCESSED IN TOTAL" SAY "SYSLOG PROCESSED: "COUNTER" MESSAGES FOUND" RETURN 0 //*--------------------------------------------------------------------- //STEP1 EXEC PGM=IKJEFT01,REGION=6M //SYSEXEC DD DISP=SHR,DSN=&&TEMP //SYSTSPRT DD SYSOUT=* //IN DD DISP=SHR,DSN=SYSU.SYSLOG.G0022V00 <-- SYSLOGS // DD DISP=SHR,DSN=SYSU.SYSLOG.G0023V00 // DD DISP=SHR,DSN=SYSU.SYSLOG.G0024V00 //OUT DD DISP=(MOD,CATLG),DSN=&OUTPUT,RECFM=VB, // SPACE=(TRK,(150,150),RLSE),LRECL=137,BLKSIZE=27948 //*--------------------------------------------------------------------- //* PARAMETERS: //* //* 1 - (MSG,JOB,ALL) - DEFINIES IF YOU SERACH FOR SPECIFIC MESSAGE //* (E.G. ICH408I) OR MESSAGES FOR SPECIFIC ADDRESS SPACE //* (E.G. OPCC,JSADEK,TSU03392,JOB02231) OR SIMPLY //* THE ENTIRE RECORD (ALL) //* //* 2-7 - UP TO 6 MESSAGEID/JOBID/JOBNAME/PHRASE. ITS ALWAYS CONSIDERED //* AS PREFIX SO ICH=ICH* AND JSADEK=JSADEK* //* //*--------------------------------------------------------------------- //SYSTSIN DD * %LOGEXTR ALL FAIL ERROR //* %LOGEXTR JOB PL <--- ALL PL* USERS //* %LOGEXTR JOB JSADEKA TSU03928 <--- SPECIFIC USER AND HIS TSO SESSION //* %LOGEXTR MSG ICH <--- ALL ICH* MESSAGES //* %LOGEXTR MSG ICH408I EQQ *IEF099I <--- EQQ* PREFIX & 2 OTHER MSGS //* %LOGEXTR ALL FAIL ERROR <--- ALL RECORDS WITH GIVEN KEYWORDS **************************************************************************************************** REXX CODE - FOR TESTING AND IMPROVEMENTS: **************************************************************************************************** /* REXX */ SIGNAL ON SYNTAX SIGNAL ON ERROR SIGNAL ON FAILURE SIGNAL ON NOVALUE SIGNAL ON HALT /*********************************************************************/ /* MAIN - JES2 SYSLOG MSG EXTRACTOR */ /*********************************************************************/ ADDRESS TSO INPUTDS="JSADEK.MY.SYSLOG" OUTPUTDS="JSADEK.MY.SYSLOG.OUTPUT" "ALLOC F(IN) DSN('"INPUTDS"') SHR REU" "ALLOC F(OUT) DSN('"OUTPUTDS"') OLD REU" PARMS="MSG ICH408I IRR812I *IEF099I" PARMS="JOB PL" PARSE VAR PARMS MODE MSG.1 MSG.2 MSG.3 MSG.4 MSG.5 MSG.6 . P1=1 P2=132 IF MODE="MSG" THEN DO P1=54 P2=26 END IF MODE="JOB" THEN DO P1=36 P2=16 END SAY "REXX WILL SEARCH FOR:" DO I=1 TO 6 IF LENGTH(MSG.I) < 2 THEN MSG.I="ZZXXZZXX" ELSE SAY MSG.I END MSGNUM=9999 NEWMSG=0 COUNTER=0 EOF=0 DO WHILE EOF=0 "EXECIO 1 DISKR IN" IF RC<>0 THEN EOF=1 ELSE DO PARSE PULL RECIN TEMP=SUBSTR(RECIN,P1,P2) IF POS(" "MSG.1,TEMP) <> 0 ! POS(" "MSG.2,TEMP) <> 0, ! POS(" "MSG.3,TEMP) <> 0 ! POS(" "MSG.4,TEMP) <> 0, ! POS(" "MSG.5,TEMP) <> 0 ! POS(" "MSG.6,TEMP) <> 0, THEN DO COUNTER=COUNTER+1 NEWMSG=0 MSGNUM = WORD(RECIN,WORDS(RECIN)) PUSH RECIN "EXECIO 1 DISKW OUT" END ELSE IF WORDPOS(MSGNUM,SUBSTR(RECIN,41,6)) <> 0 THEN DO PUSH RECIN "EXECIO 1 DISKW OUT" END END NEWMSG=NEWMSG+1 IF NEWMSG > 50 THEN DO NEWMSG=0 MSGNUM=9999 END END SAY "SYSLOG PROCESSED: "COUNTER" MESSAGES FOUND" RETURN 0 /*********************************************************************/ /* Handled error routine */ /*********************************************************************/ TERMINATE: PARSE ARG ERROR_MSG SAY ERROR_MSG DELSTACK "EXECIO 0 DISKW INPUT (FINIS" "EXECIO 0 DISKW OUTPUT (FINIS" ADDRESS TSO "FREE F(SYSIN)" ADDRESS TSO "FREE F(SYSOUT)" EXIT RC /*********************************************************************/ /* Unhandled error routine */ /*********************************************************************/ SYNTAX: ERROR: FAILURE: NOVALUE: HALT: SAY "AN ERROR HAS OCCURRED ON LINE: "SIGL SAY "ERROR LINE: "SOURCELINE(SIGL) SAY "RETURN CODE: "RC CALL TERMINATE "ERROR TEXT: "ERRORTEXT(RC) EXIT RC