If you are writing to OPERLOG I consider using that, for each record, you'll have the type (Single-line message, First line of a multi-line message, Data line of a multi-line message , Data end line of a multi-line message) as well as the multiline ID to guarantee you are not mixing lines.
IBM has a sample to read the operlog on SAMPLIB(IEAMDBLG) Regards, Leonardo Vaz -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Vernooij, Kees (ITOP NM) - KLM Sent: Thursday, December 05, 2019 3:45 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Syslog Message Normalization I think there is a difference in multi-line messages (where each line is identified by an id, '808' in the example below) and long messages that are spread in syslog over more than 1 line. I think your example belongs to the latter. MR0000000 MVSC 19339 09:30:47.49 ACTWRK02 00000000 .HASP003 RC=(52),D 808 DR 808 00000000 .HASP003 RC=(52),D JOBQ - NO SELECTABLE ENTRIES FOUND MATCHING ER 808 00000000 .HASP003 SPECIFICATION Kees. -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Matt Hogstrom Sent: 05 December 2019 02:28 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Syslog Message Normalization I’m processing syslog messages and I’d like to combine multi-line messages into a single entry before processing the entries. For instance, these messages N 0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND PROGRAM FOR 02 SECONDS. === N 0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER 00 4 0 0.000020 0.000000 0.0 S 31 JES2 0 0 0 0 Would become 0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND PROGRAM FOR 02 SECONDS. === 0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER 00 4 0 0.000020 0.000000 0.0 31 JES2 0 0 0 0 Given there are a number of subtle rules I was wondering if anyone had written or was aware of a general purpose normalizer. Matt Hogstrom m...@hogstrom.org +1-919-656-0564 PGP Key: 0x90ECB270 Facebook <https://facebook.com/matt.hogstrom> LinkedIn <https://linkedin/in/mhogstrom> Twitter <https://twitter.com/hogstrom> “It may be cognitive, but, it ain’t intuitive." — Hogstrom ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ******************************************************** For information, services and offers, please visit our web site: http://www.klm.com. This e-mail and any attachment may contain confidential and privileged material intended for the addressee only. If you are not the addressee, you are notified that no part of the e-mail or any attachment may be disclosed, copied or distributed, and that any other action related to this e-mail or attachment is strictly prohibited, and may be unlawful. If you have received this e-mail by error, please notify the sender immediately by return e-mail, and delete this message. Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its employees shall not be liable for the incorrect or incomplete transmission of this e-mail or any attachments, nor responsible for any delay in receipt. Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch Airlines) is registered in Amstelveen, The Netherlands, with registered number 33014286 ******************************************************** ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
