No, 31 is the continuation of the message text. The id is always 3 digits and
is more to the left. "808" in the example below.
MR0000000 MVSC 19339 09:30:47.49 ACTWRK02 00000000 .HASP003 RC=(52),D 808
DR 808 00000000 .HASP003 RC=(52),D JOBQ
- NO SELECTABLE ENTRIES FOUND MATCHING
ER 808 00000000 .HASP003
SPECIFICATION
Met vriendelijke groet,
Kees Vernooij
KLM Information Services
z/OS Systems
Tel +31 6 10 14 58 78
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of ITschak Mugzach
Sent: 05 December 2019 05:26
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Syslog Message Normalization
"31" in your sample is the correlation id of the original message. I can't see
it in the original line in your sample, but it is there. it is not part of the
message and you have to drop it from the concatenated line.
ITschak
On Thu, Dec 5, 2019 at 3:28 AM Matt Hogstrom <m...@hogstrom.org> wrote:
> I’m processing syslog messages and I’d like to combine multi-line
> messages into a single entry before processing the entries. For
> instance, these messages
>
> N 0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND
> PROGRAM FOR 02 SECONDS. ===
> N 0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER
> 00 4 0 0.000020 0.000000 0.0
> S 31 JES2
> 0 0 0 0
>
>
> Would become
> 0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND PROGRAM
> FOR 02 SECONDS. ===
> 0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER
> 00 4 0 0.000020 0.000000 0.0 31 JES2 0
> 0 0 0
>
> Given there are a number of subtle rules I was wondering if anyone had
> written or was aware of a general purpose normalizer.
>
>
> Matt Hogstrom
> m...@hogstrom.org
> +1-919-656-0564
> PGP Key: 0x90ECB270
> Facebook <https://facebook.com/matt.hogstrom> LinkedIn <
> https://linkedin/in/mhogstrom> Twitter <https://twitter.com/hogstrom>
>
> “It may be cognitive, but, it ain’t intuitive."
> — Hogstrom
>
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions, send
> email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
--
ITschak Mugzach
*|** IronSphere Platform* *|* *Information Security Contiguous Monitoring for
Legacy **| *
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to
lists...@listserv.ua.edu with the message: INFO IBM-MAIN
********************************************************
For information, services and offers, please visit our web site:
http://www.klm.com. This e-mail and any attachment may contain confidential and
privileged material intended for the addressee only. If you are not the
addressee, you are notified that no part of the e-mail or any attachment may be
disclosed, copied or distributed, and that any other action related to this
e-mail or attachment is strictly prohibited, and may be unlawful. If you have
received this e-mail by error, please notify the sender immediately by return
e-mail, and delete this message.
Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its
employees shall not be liable for the incorrect or incomplete transmission of
this e-mail or any attachments, nor responsible for any delay in receipt.
Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch
Airlines) is registered in Amstelveen, The Netherlands, with registered number
33014286
********************************************************
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
