Jason,
you can try this:
OPTION VLSCMP
INCLUDE COND=(6,1,SS,EQ,C'NXWM',AND,
7,1,CH,EQ,C' ',AND,
64,1,SS,EQ,C'ABCDEFGHIJKLMNOPQRSTUVWXYZ')
INREC PARSE=(%00=(ABSPOS=64,ENDBEFR=C' ',FIXLEN=15)),
BUILD=(1,4,%00,X'00000001')
SORT FIELDS=(5,15,BI,A)
SUM FIELDS=(20,4,BI)
OUTFIL FNAMES=SORTOUT,VTOF,
HEADER1=('MSGID NUMREC'),
OUTREC=(5,15,X,20,4,BI,EDIT=(IIIIIIIIIIIT)),
TRAILER1=('---->DISTINCT COUNT:',COUNT)
My syslog dataset is VBM so modify accordingly to your definition.
It assumes a max length for message of 15, starting with a capital letter
and a blank as separator from the message text itself.
>From the manual:
"
Each SYSLOG record is prefaced by a two-character record type field.
Valid first characters are:
- N - single-line message
- W - single-line message with reply
- WTOR messages are not processed by Message Flood Automation.
- M - first line of a multi-line message
- Message Flood Automation can only react to the first line of a
multiline message, not to any of the label, data or end lines
- L - multi-line message label line
- D - multi-line message data line
- E - multi-line message data/end line
- S - continuation of previous line
- O - LOG command input
- X - non-hardcopy or LOG command source
Valid second characters are:
- C - command issued by operator
- R - command response message
- I - internally issued command
- U - command from unknown console ID (z/OS® R8 and above)
"
Best regards.
Max
Il giorno mer 26 lug 2023 alle ore 10:19 Jason Cai <[email protected]> ha
scritto:
> Dear All,
>
> I am writing to inquire about how to use the sort program on the
> mainframe to extract and count msgid from a day's operlog. I would
> appreciate your guidance and advice on this matter.
>
> Msgid is a keyword that identifies system messages. It usually consists of
> 7 letters and a number, such as IEA001I or CSV003E. However, some msgid may
> have up to 10 characters.
>
> I need to extract all msgid from the operlog, and remove any duplicates.
> Then, I need to count the number of occurrences of each msgid and generate
> a report.
>
> I have tried to use the following statement to extract msgid, and it seems
> to work well. However, I am not sure if there is anything missing or if it
> can be written more simply.
>
> SORT FIELDS=(58,7,CH,A)
> INCLUDE COND=((58,7,SS,NE,C' ',AND,
> 65,1,CH,EQ,C' ',AND,
> (63,1,SS,EQ,C'0,1,2,3,4,5,6,7,8,9'),AND,
> (64,1,SS,EQ,C'ABCDEFGHIJKLMNOPQRSTUVWXYZ')),OR,
> (58,8,SS,NE,C' ',AND,
> 66,1,CH,EQ,C' ',AND,
> (64,1,SS,EQ,C'0,1,2,3,4,5,6,7,8,9'),AND,
> (65,1,SS,EQ,C'ABCDEFGHIJKLMNOPQRSTUVWXYZ')),OR,
> (58,9,SS,NE,C' ',AND,
> 67,1,CH,EQ,C' ',AND,
> (65,1,SS,EQ,C'0,1,2,3,4,5,6,7,8,9'),AND,
> (66,1,SS,EQ,C'ABCDEFGHIJKLMNOPQRSTUVWXYZ')),OR,
> (58,10,SS,NE,C' ',AND,
> 68,1,CH,EQ,C' ',AND,
> (66,1,SS,EQ,C'0,1,2,3,4,5,6,7,8,9'),AND,
> (67,1,SS,EQ,C'ABCDEFGHIJKLMNOPQRSTUVWXYZ'))
>
> But I do not know how to count the number of occurrences of each msgid and
> eliminate duplicates.
>
> Thank you for your time and attention.
>
> Sincerely,
>
> Jason Cai
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to [email protected] with the message: INFO IBM-MAIN
>
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
