`zOS-SYSLOG-SDSF`

For z/OS® SYSLOG data sources of type zOS-SYSLOG-SDSF, the log file splitter zOS-SYSLOG-SDSF-Split breaks up the data into log records. The log record annotator zOS-SYSLOG-SDSF-Annotate annotates the log records.

For data sources of type zOS-SYSLOG-SDSF, the log data is rendered by the System Display and Search Facility (SDSF) and can be ingested in batch mode by using the IBM® Operations Analytics - Log Analysis Data Collector client.

File format

The following output is sample output from the SYSLOG. The line numbers are added for illustrative purposes and are not in the actual output.

1| MRC000000 TVT7007  13234 10:33:19.20 INTERNAL 00000290
  IXC467I STOPPING PATH STRUCTURE IXCSTR1 151
2| ER                                        151 00000290
          RSN: SYSPLEX PARTITIONING OF LOCAL SYSTEM

Table 1 describes the fields in the sample output. Some of these fields are not annotated. For information about which fields are annotated, see zOS-SYSLOG-SDSF-Annotate annotations.

Table 1. Fields in sample output from SYSLOG for `zOS-SYSLOG-SDSF` data source
Line	Component value	Value description
1	`M`	Record type
1	`R`	An indication of whether the line was generated because of a command
1	`C000000`	Hexadecimal representation of routing codes 1 - 28
1	`TVT7007`	System name
1	`13234`	Julian date
1	`10:33:19.20`	Time stamp
1	`INTERNAL`	Job identifier for the task that issued the message
1	`00000290`	Installation exit and message suppression flags
1	`IXC467I`	Message identifier
1	`STOPPING PATH STRUCTURE ICSTR1`	First line of message text
1	`151`	Multi-line identifier
2	`E`	Record type
2	`R`	An indication of whether the line was generated because of a command
2	`151`	Multi-line identifier
2	`00000290`	Installation exit and message suppression flags
2	`RSN: SYSPLEX PARTITIONING OF LOCAL SYSTEM`	Last line of message text

If the message is a DB2® or WebSphere® MQ message, a command prefix might be present, as shown in the following example:

M 8000000 SYSL     13237 14:00:20.23 STC21767 00000294  DSNR031I  :D91A... 
                                                                  |
                                                                  DB2 Command
                                                                  Prefix

If the message is a CICS® message, an Application ID might be present, as shown in the following example:

N FFFF000 MV20 14071 20:16:14.27 JOB21691 00000090 DFHPA1101  CMAS51 ...
                                                              |
                                                              CICS 
                                                              ApplID