On Fri, Feb 1, 2013 at 12:48 PM, Charles Mills <charl...@mcn.org> wrote:
> > Well, you'd *filter* those, eh? > > My feeling was that unstructured "human readable" messages -- many of them > historical "junk" such as I quoted* -- were not the best starting point > (although others might argue that point). > > I started from SMF data, which has, in real time, potentially > > - every RACF (or ACF2 or TSS) event, both bad and good > - every TCP/IP event, including mapping IP addresses to TN3270 addresses, > and client and server FTP sessions > - every job/TSO/STC/etc. event such as critical task ABENDs > - lots of great DB2 stuff (privileged user access, invalid access attempts, > critical table accesses) > - and more if you want it > > ... all in a nice (?) structured form that it is relatively easy for a > program to deal with in a definitive way. > > *I once was at a shop where there was a program that put out a console > message every day: > > INPUT TOTAL $237,584.68. OUTPUT TOTAL $237,584.68. IF AMOUNTS THE SAME > REPLY > Y, ELSE REPLY N > > I thought gee, if there is one task that computers do better than people, > it > is comparing two large numbers for equality ... Wow. That stories a keeper! Yeah, SMF might be better, but that wasn't the OP's question -- I just always resist telling someone "You're doing it wrong" until/unless I know what and why... -- zMan -- "I've got a mainframe and I'm not afraid to use it" ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN