IBM Mainframe Forum

Hi,
I am new to Z/OS system programming, so excuse me for a newbie question. What i want to do is:
1. At mid-night, copy(offload) SYSLOG (CONSOLE log) to a new dataset.
2. Clear the SYSLOG (or switch to a differnt dataset) at the point when copy(offload) is started.

All i want is keep copies of SYSLOG on daily basis for one week. I will appreciate if someone guide me. Thanks.

This is a two step process, but it is usually done together.

First, you need an external writer defined to write to what is usually a new (+1) generation of a GDG data set. This GDG index is usually defined as having a LIMIT as something like 7 or 8. A few extra generations is often a good idea.

Then, at midnight, some automated process issues an MVS WRITELOG command to queue the currently active SYSLOG to an output class (class L is often used) that your external writer will pick up, and start a new SYSLOG data set in JES2. The WRITELOG command effectively does both. This same automated process will start the external writer that will create the new GDG data set. Finally, your automated process will intercept the WTO message your external writer issues when it has processed all of the SYSLOG data sets that have been queued, and terminate the external writer.

Thanks a million for your kind guidance.

Hi,
I tried offloading but external writter job is doing nothing with message 'IEF176I WTR 0A97 WAITING FOR WORK, CLASS=L, DEST=LOCAL'
If someone, pls, help me what i am doing wrong.... below is what did:

1. Created a PROC SYSLOGL
//SYSLOGL PROC
//IEFPROC EXEC PGM=IASXWR00,PARM='PL',REGION=500K
//IEFRDER DD UNIT=SYSDA,DSNAME=TCHSFT.SYSLOG, X
// DISP=(NEW,CATLG),SPACE=(CYL,(40,10)), X
// DCB=(BLKSIZE=133,LRECL=133,BUFL=133,BUFNO=2,RECFM=FM)
2. Issued command.... No response from the command.... is it normal?
writelog l
3. Started External Writter job.... and job does nothing.... its jes log is below
s syslogl
J E S 2 J O B L O G -- S Y S T E M S Y S 1 -- N

05.06.09 STC00030 ---- SATURDAY, 28 AUG 2010 ----
05.06.09 STC00030 IEF695I START SYSLOGL WITH JOBNAME SYSLOGL IS ASSIGNED TO U
05.06.09 STC00030 $HASP373 SYSLOGL STARTED
05.06.09 STC00030 IEF403I SYSLOGL - STARTED - TIME=05.06.09
05.06.11 STC00030 IEF176I WTR 0A97 WAITING FOR WORK, CLASS=L, DEST=LOCAL
1 //SYSLOGL JOB MSGLEVEL=1
2 //STARTING EXEC SYSLOGL
3 XXSYSLOGL PROC
4 XXIEFPROC EXEC PGM=IASXWR00,PARM='PL',REGION=500K
5 XXIEFRDER DD UNIT=SYSDA,DSNAME=TCHSFT.SYSLOG,
XX DISP=(NEW,CATLG),SPACE=(CYL,(40,10)),
XX DCB=(BLKSIZE=133,LRECL=133,BUFL=133,BUFNO=2,RECFM=FM)
STMT NO. MESSAGE
2 IEFC001I PROCEDURE SYSLOGL WAS EXPANDED USING SYSTEM LIBRARY SYS1.TCHS
IEF695I START SYSLOGL WITH JOBNAME SYSLOGL IS ASSIGNED TO USER START2 , GROUP
IEF236I ALLOC. FOR SYSLOGL SYSDA
IGD100I 0A97 ALLOCATED TO DDNAME IEFRDER DATACLAS ( )
IEF237I JES2 ALLOCATED TO SYS00001

Thanks for all help.
Mike

Hi all,
Further info:
I also tried followings:
1. Changed destination
f a97,dest=
2. Issued WRITELOG CLOSE... which was not accdepted with message
- 05.49.45 writelog close
05.49.45 IEE532I SYSTEM LOG DEFINED AS HARDCOPY-WRITELOG CLOSE
CMND REJECTED


Mike

• Your WRITELOG command may not have specified an output class. If that's the case the output goes to some default class. You may be able to locate the output through SDSF.
• Check the class definition in JES2. You do not want it going to a class defined as dummy or a class that will automatically put it into hold.
• Check class A. That's the default if no other default is present. See http://publibz.boulder.ibm.com/cgi-bin/bookmgr_OS390/BOOKS/iea2g1b0/4.62.1?SHELF=iea2bkb0.bks&DT=20100630154301.
• Most places I've encountered seem to specify a class in the writelog command.

Looking at your SYSLOGL procedure:

• I think I'd specify RLSE in the SPACE parameter.
• In my opinion, your DCB parameters are very poor. I would specify RECFM=VBA,LRECL=137,DSORG=PS. This will use much less space, the SYSLOGL procedure will run much faster, and when you search the data set it will go much quicker.
• I thought you intended to use a GDG, but that's not how your data set name is specified.
• I would suggest you start SYSLOGL using a "S SYSLOGL.LOGWTR" command. You can replace LOGWTR with anything that tickles your fancy. This will make the command you issue when SYSLOGL issues its IEF176I message much easier: "P LOGWTR". Otherwise you have to parse out the unit address in the IEF176I message and issue "P unit-address" to terminate the writer.
• All you need in the WRITELOG command is the output class: "WRITELOG L".
• Using WRITELOG options like the CLOSE option add confusion, and will stop SYSLOG entirely (and restarting it is slightly tricky, too). It's just not worth the hassle.

There's a reason for my proposed DCB parameters. You'll probably find the average record in a SYSLOG is about 70 bytes excluding any trailing blanks. If you use RECFM=FBA,LRECL=133, that means the average record will have 43 excess blanks. This means a 1,000,000 line SYSLOG, which is pretty common, will have 43,000,000 trailing blanks, which equates to roughly 45 cylinders on a 3390. This means searches will have to spin pass an average of 22 1/5 cylinders. It's not really that bad, of course, since most of the time you'll get a search hit much more quickly than reading half way through the data set, but it does add up over time. Now if you write programs to analyze these records, you may find it more difficult to deal with RECFM=VBA than RECFM=FBA records. I've been reading and writing VBA type records for close to 40 years; it doesn't bother me because that's my normal way of doing business, but it is harder for many people.

I had an old SYSLOG laying around, and I wrote a little program to get the record lengths. I got these results -

260,298 LINES, 27,271,438 BYTES, AVERAGE LINE LENGTH IS 104 BYTES

The bytes and average line lengths include the RDWs. My estimate of 70 bytes was rather optimistic!