My code solves the issues with multiline msgs, allow search, and lookup of
task number to task name. see below, it is free!
/* MugiRexx For IronSphere V1.0 */
QIFLOGS:
Signal QIFLOGS.Config:
QIFLOGS.Doc:
/* ------------------------------------------------------------ */
/* QIFLOGS */
/* */
/* */
/* Function : Scan log file(s) for error and warnings. */
/* */
/* The program will scan syslog from SDSF and */
/* creates an array of consolidated msg lines. */
/* messages listed in MsgAlert will be printed */
/* */
/* Library : SQIFSAXR */
/* Input : None. */
/* */
/* Howto : Review config section below. */
/* */
/* 1. Update LogStartCond with a julian date */
/* */
/* 2. Add/Remove msg codes from MsgAlert to get */
/* alerted on messages in the log */
/* */
/* License : Free for Non-commercial use */
/* */
/* copyright SecuriTeam Software Ltd., 1999-2025, Israel */
/* ------------------------------------------------------------ */
/*%Include QIFCPYRT*/
QIFLOGS.Config:
MsgAlert = 'IEA311I ISG313I IAR048I IXL011I IXC520I' ,
'IXC255I ICH408I '
LogStartCond = '2025.118'
/* ============================================================ */
QIFLOGS.Main:
MsgList = '$HASP100' /* Identify jobnum */
lIndx = 0 /* Syslog Line */
sIndx = 0 /* Syslog Line marged */
tIndx = 0 /* task name index */
Call CollectLog
Call LogAlert
Return
/* ============================================================
*/CollectLog:
MakeEnv = ISFCALLS('ON') /* invoke SDSF interfa*/
ISFLOGSTARTDATE = LogStarCond
Address SDSF "ISFLOG READ"
Say 'QIF0200I (QIFLOGS) Log file size is' IsfLine.0 'lines.'
Do iIndx = 1 to IsfLine.0
RecType = substr(IsfLine.iIndx,1,1)
Select
When (WordPos(RecTYpe,'N W M O X') > 0) Then Do
/* --------------------------------------------------- */
/* N - Single-line messag */
/* W - Single-line message with a repl */
/* M - First line of a multiline message */
/* O - Log command input */
/* X - Entry from a source other than hardcopy or log */
/* command */
/* --------------------------------------------------- */
sIndx = sIndx +1
Log.sIndx = IsfLine.iIndx
If (RecType = 'M') Then Do
NumWords = Words(IsfLine.iIndx)
Log.sIndx = SubWord(IsfLine.iIndx,1,NumWords -1)
End
Call WhichTask
Call WhichCmd
End
When (WordPos(RecTYpe,'S L D E') > 0) Then Do
/* --------------------------------------------------- */
/* S - Continuation of previous line */
/* L - Label line of a multiline message */
/* D - Data line of a multiline messagee */
/* E - Data/end line of a multiline message */
/* --------------------------------------------------- */
Log.sIndx = Log.sIndx Substr(IsfLine.iIndx,57)
End
Otherwise Do
/* --------------------------------------------------- */
/* ? - Unknown message source */
/* --------------------------------------------------- */
Say 'QIF0200W (QIFLOGS) UNKNOWN MESSAGE TYPE:' RecType
End
End
End
Return
/* ============================================================ */
LogAlert:
Say 'QIF0200W (QIFLOGS) looking for messages to alert in' sIndx
'consolidated records'
Do Indx = 1 to sIndx
xMsg = Substr(Log.Indx,57)
Parse Var xMsg xMsg xTask .
If (WordPos(xMsg,MsgAlert) > 0) Then Do
jNum = Substr(Log.sIndx,38,8)
jNum = Strip(jNum)
Say '--Message='xMsg'--JOB NUM='jNum'--TASK NAME='||,
Num2Task.JNum'--'
Say Log.Indx
Say '---------------------------'
Say
End
End
Return
/* ============================================================ */
WhichTask:
xMsg = Substr(IsfLine.iIndx,57)
Parse Var xMsg xMsg xTask .
If (WordPos(xMsg,MsgList) > 0) Then Do
jNum = Substr(IsfLine.iIndx,38,8)
tIndx = tIndx +1
Task2Num.tIndx = xTask
Task2Num.xTask = jNum
Num2Task.tIndx = jNum
Num2Task.JNum = xTask
End
Return
/* ============================================================ */
WhichCmd:
/* reserved for future identifying cmds */
Return
/* ============================================================ */
*| **Itschak Mugzach | Director | SecuriTeam Software **|** IronSphere
Platform* *|* *Information Security Continuous Monitoring for Z/OS, zLinux
and IBM I **| *
*|* *Email**: [email protected] **|* *Mob**: +972 522 986404 **|*
*Skype**: ItschakMugzach **|* *Web**: www.Securiteam.co.il **|*
On Thu, Jul 24, 2025 at 2:20 AM Jon Perryman <[email protected]> wrote:
> On Tue, 22 Jul 2025 11:50:30 +0000, Lennie Bradshaw <
> [email protected]> wrote:
>
> >Does anyone have any advice on tools to scan SYSLOG and/or OPERLOG for
> multiple messages?
> >I am looking for something that understands continuation messages, and
> the structure of multiline messages.
>
> If I remember correctly, setting your screen width > 160, the line
> continuation problem goes away when viewing the log. 128 byte text plus
> flags, jobname, job/stc id and ... should be less than 160 thus avoiding
> the line wrap.
>
> As for solutions using SYSLOG or SDSF LOG, remember that there can be
> consistency problems with multi-line messages in multi-tasking address
> spaces (e.g. automation). For instance, you can't distinguish the task from
> which messages are being issued at the same time.
>
> Personally, when I received SYSLOG from customers, I would use ISPF VIEW,
> exclude all lines and "FIND ALL" for the messages I was interested. You can
> then easily show lines before and after. Delete uninteresting sections.
> Flip the results. Set labels.
>
> You also have an automation product that can collect messages as they
> produced.
>
> OPERLOG has programmatic interface very similar to the SSI that gives you
> detailed data about the message. I've never used OPERLOG but in theory you
> should be able to directly match MLWTO messages.
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to [email protected] with the message: INFO IBM-MAIN
>
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
