Thanks for Martin, Massimo, and Kolusu's help
As Massino mention that a multiline WTO
cannot be interrupted, we need to handle multiline messages in OPERLOG or
SYSLOG that cannot be interrupted.
for IBM manul
Each SYSLOG record is prefaced by a two-character record type field.
Valid first characters are:
N - single-line message
W - single-line message with reply
WTOR messages are not processed by Message Flood Automation.
M - first line of a multi-line message
Message Flood Automation can only react to the first line of a multiline
message, not to any of the label, data or end lines
L - multi-line message label line
D - multi-line message data line
E - multi-line message data/end line
S - continuation of previous line
O - LOG command input
X - non-hardcopy or LOG command source
There are at least three kinds of groups.
1. N single-line message
INREC IFTHEN=(WHEN=GROUP,BEGIN=(2,1,CH,EQ,C'N'),
END=(2,1,CH,EQ,C'N')
2. M - first line of a multi-line message
INREC IFTHEN=(WHEN=GROUP,BEGIN=(2,1,CH,EQ,C'M'),
END=(2,1,CH,EQ,C'E')
3. S - continuation of previous line
INREC IFTHEN=(WHEN=GROUP,BEGIN=(2,1,CH,EQ,C'N'),
END=(2,1,CH,EQ,C'S')
for example:
N C000000 CUK1 18179 16:07:33.83 00000090 HSAM5400I HISTO
N C000000 CUK1 18179 16:07:33.85 00000090 HSAM1003I ARM R
S
TYPE=HSAMGR RES
If we put them together, the output isn't what we need. Please see the
following statement.
OPTION VLSCMP
INREC IFTHEN=(WHEN=GROUP,BEGIN=(2,1,CH,EQ,C'M',OR,2,1,CH,EQ,C'N'),
END=(2,1,CH,EQ,C'E',OR,2,1,CH,EQ,C'S',OR,2,1,CH,EQ,C'N'),
PUSH=(140:ID=9))
Could you help us to handle multiline messages in syslog by dfsort ?
Any suggestions are greatly appreciated!
Thanks a lot!
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
