Frequently Asked Questions: Consolidated audit, NetView, and z/OS log (Canzlog)
The IBM developerWorks Service Management Connect (SMC) / SystemZ / Wikis/ Tivoli NetView for z/OS/ 'Canzlog Information' link contains the following information, questions and answers regarding Canzlog.
The NetView logging and browsing functions are enhanced to provide consolidated access to all NetView, system, and job messages.
A consolidated audit, NetView, and z/OS log (Canzlog) browser includes expanded access to message attributes on individual messages, which provides improved visibility of system activities. You can easily apply robust filtering to retrieve specific log records that are based on a large selection of factors, including time range, job name, job ID, message ID, address space type, domain, authorization identities and groups, automation token, user-defined attributes, or combinations of these factors.
To significantly reduce problem determination time, you can use the Canzlog function to filter messages from various logs around a certain time frame or to filter messages from a specific domain or job. This filtering provides improved availability and overall control. The Canzlog data can be automatically archived. The archived data is available to the browser and to the REXX and pipe programming interface to provide increased management and reporting of system activities.
Enhanced Automation and Problem Diagnostics via Canzlog in NetView for z/OS V6.1: This document describes the significant automation and message logging enhancements provided in IBM Tivoli NetView for z/OS v6.1, including information about the Canzlog feature.
Frequently Asked Questions:
Q) Does Canzlog include suppressed messages? If so, can it be customized to remove them?
A) Suppressed messages ARE included. Even deleted/non-logged messages are included, if they are automatable. No, they cannot be removed.
Q) If the Message Revision Table (MRT) changes a messages, what is displayed in the Canzlog? The “before”? The “after”? Both?
A) For each command echo, an audit record is written prior to MRT processing. All other records are “as modified” after MRT.
Q. What v6.1 fixes are important to install for Canzlog?
A. Canzlog fixes of importance:
APAR PTF Available
OA39616 PTF UA65655
OA39785 PTF UA66189
OA40082 PTF UA66226
Q. Do I need to IPL in order to run NetView v6.1?
A. Yes. Prior releases have included in their documentation the requirement to IPL for installation of each new release (for example, see the section "Restarting the Target System with the CLPA Option" in the "Preparing the MVS System" chapter of the NetView for z/OS V5.4 Installation: Getting Started publication at http://pic.dhe.ibm.com/infocenter/tivihelp/v3r1/topic/com.ibm.itnetviewforzos.doc_5.4/inql0mst48.htm?path=65_35_0_0_4_5#clpa). However, some releases made no changes or additions to system-level definitions in the SYS1.PARMLIB data sets, and so in practice some customers were able to continue to use definitions in old SYS1.PARMLIB members with the new NetView release. However, with NetView V6.1, the Canzlog log consolidation capability requires an IPL to ensure the proper system-level definitions are in place for its data space support. The Development team understands the impact and is looking at ways to remove this requirement in the future.
Q.Canzlog has a fixed 2G memory size. Can I customize that in my site?
A. This size may be changed to a 500M value (TINYDS) as documented in APAR OA38553.
The development team is aware that greater flexibility may be required by customers. Let development know your requirements by opening a Request For Enhancement (RFE).
Q. Is there a way to turn off the Canzlog function?
A. No, the Canzlog function itself cannot be turned off. However, you can turn off its archiving function. See the ARCHIVE.WRITE statement in your stylesheet and in the NetView for z/OS Administration Reference
Q. Can I delete archive data sets that are no longer required?
A. Yes, but only the message data sets, not the index data sets. Upon determination that it's time to delete some message data sets (perhaps, for example, upon trapping or automation of a DWO090A message), follow these steps:
1) Get a list of message data sets (TSO LISTCAT command output, or IEHLIST utility output) that can be examined.
2) Delete message data sets that are determined to be no longer required, perhaps by using TSO DELETE or some flavor of allocation with a disposition of DELETE.
3) Issue the DEFAULTS CZTOPDAT command to update the perceived "top of the log" data and time. See the DEFAULTS command in the NetView for z/OS Command Reference, volume 1,
Note: allocating data sets with an expiration data (EXPDT) or retention period (RETPD) (which can be specified in a management class) does not work.
Q: How do I determine how much DASD to set aside for archiving
A. Refer to the Tivoli NetView for z/OS Tuning Guide in the Canzlog Archive Storage Requirements section of the Additional Tuning Considerations chapter.