OnDemand User Group

Support Forums => z/OS Server => Topic started by: htees on May 16, 2019, 05:46:27 AM

Title: System Log query
Post by: htees on May 16, 2019, 05:46:27 AM

Good day Folks;  We are curious to find a way to take the Message column of the system log and make it more broken down by the data it contains. Has anyone updated that application group and application to do so? We are wanting to use the log data to feed a performance monitor we are looking into. Thanks for any help you can offer.

HT

Title: Re: System Log query
Post by: jsquizz on May 16, 2019, 07:42:51 AM

Hi harold, I did something like this a few years ago to capture some retrieval metrics.

Granted this was on AIX, maybe it will be of some value. I actually used ARSDOC get, piped it to a file, then used a combo of sed/awk to parse it out.. Maybe that could help you instead of a database query? I did something like -i "where msg_num in ('66', 65') ... etc.

This was actually suggested by someone at IBM.

Title: Re: System Log query
Post by: scottnys on May 16, 2019, 01:28:31 PM

I would probably go with jsquizz's recommendation.  Using ARSDOC to retrieve the data transcends the various Segments associated to the System Log.  If you are looking at LOAD data (87 records), then you could build the SYSTEM LOAD application group.  (similar to building the system log).  It very nicely breaks out the data for type 87 records.

Title: Re: System Log query
Post by: htees on May 17, 2019, 12:57:03 PM

Thanks for the input !  Has anyone found a way to break up the msg_text in Application Group and as an extra, has anyone added the Foldername as a field/filter?

Thanks again

Title: Re: System Log query
Post by: jsquizz on May 19, 2019, 04:04:58 PM

Quote from: htees on May 17, 2019, 12:57:03 PM

Thanks for the input !  Has anyone found a way to break up the msg_text in Application Group and as an extra, has anyone added the Foldername as a field/filter?

Thanks again

I believe I have in the past and I did it with SED/AWK... Scrape the text after ( and between ) ?

Also side note - we don't currently have anything setup to monitor our logs. So in the event of a production issue - I usually just copy everything from the system log and do a text to columns on ( and ). This has also proven to be life saving when troubleshooting prod issues, asked for load metrics..or etc..in a flash. Not really practical for your use case, but worth noting.