IBM Mainframe Forum

Hello,

I'm still feeling lost . . .

If the syslog copy is already being processed ("and have it in the flat file."), why is there a desire to go back into the "real" syslog? Is what you want not already in the flat file and already located?

dick scherrer wrote:Hello,

I'm still feeling lost . . .

If the syslog copy is already being processed ("and have it in the flat file."), why is there a desire to go back into the "real" syslog? Is what you want not already in the flat file and already located?

DIck makes a great point, if you've already copied the syslog to a flat file then look at that file for the info you need, is this copy the same as the current log? if you hilte a message in the flat file, the info is......right there correct

Dear Scherrer & Peter,

Thanks for addressing the post.

Peter wrote: , is this copy the same as the current log?

I have already stated that the copy contains the messages/errors that i need to filter from the whole log. ( Which means it has got the content of the syslog but not exactly the same.)

Reason for not having the full syslog into the flat file : It occupies more space for 2 or 3 days of records it counts around 15 to 20 lakh lines. So I decided to read the log filter only the lines with the Keyword/Messages given in the filter part of the code. So In this case I would need to go back to the log and find what happened. Instead of doing a wild search in the log for errors I found this as a simple way to get my target achieved. Hope I'm clear.


Regards,
Viswa

So what kind of mapping between your extract and the actual syslog do you retain? The most obvious choices are storing the line number of the log record in your extract, or storing the date / time of the log record in your extract. If you have neither, then what you want cannot be achieved since there must be SOME way to get from your extract to the actual log records.

Viswanathchandru wrote:Dear Scherrer & Peter,

Thanks for addressing the post.

Peter wrote: , is this copy the same as the current log?

I have already stated that the copy contains the messages/errors that i need to filter from the whole log. ( Which means it has got the content of the syslog but not exactly the same.)

Reason for not having the full syslog into the flat file : It occupies more space for 2 or 3 days of records it counts around 15 to 20 lakh lines. So I decided to read the log filter only the lines with the Keyword/Messages given in the filter part of the code. So In this case I would need to go back to the log and find what happened. Instead of doing a wild search in the log for errors I found this as a simple way to get my target achieved. Hope I'm clear.


Regards,
Viswa

No! in your original post you never mentioned selective data in this flat file....
Quoting your original post "After a huge strugle I was able to capture the syslog of the system through REXX and thanks to all the experts guiding me through. The current catpured syslog gets into a Flat file and I have highlighted some of the important messages"
that's why all the confusion and questions as to why go off into the current log, how do you know the data in the flat file is actually in the current syslog?

Dear Peter:

My Apologize for not being clear.

how do you know the data in the flat file is actually in the current syslog?

I can't understand this. I execute the script the moment I need to trace the Log. So, It obviously means I have the current log if I'm not wrong.


Dear Robert,

Thanks for addressing the post.

Yes I choose to have Time stamp as the key between the Syslog and the extracted (tailored according to requirements) log.


Regards,
Viswa

Search this website for ZOOM. I think it will do what you want.

I execute the script the moment I need to trace the Log. So, It obviously means I have the current log if I'm not wrong.

For some sites, the syslog information is offloaded at particular intervals. It might be possible for you to make your extract at 16:59 and then when you press your PF key at 17:01, the information might not be there anymore. Unlikely, but possible.

I execute the script the moment I need to trace the Log.

So why waste time extracting data from the syslog, browsing the extract to find something and then go back to the syslog? If you have a reason to find the information then just do it there and then - within the syslog.

Hello,

If you have a reason to find the information then just do it there and then - within the syslog.

Which is why i continue to stay lost . . .

Every time i've ever used the syslog as input to some tracking process, i always used the current log or the backup from the time-frame of interest. Never saw an "opportunity" / need to do as this topic mentions.