I think there is a difference in multi-line messages (where each line is
identified by an id, '808' in the example below) and long messages that are
spread in syslog over more than 1 line. I think your example belongs to the
latter.
MR0000000 MVSC 19339 09:30:47.49 ACTWRK02 00000000 .HASP003 RC=(52),D 808
DR 808 00000000 .HASP003 RC=(52),D JOBQ
- NO SELECTABLE ENTRIES FOUND MATCHING
ER 808 00000000 .HASP003
SPECIFICATION
Kees.
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf
Of Matt Hogstrom
Sent: 05 December 2019 02:28
To: [email protected]
Subject: Syslog Message Normalization
I’m processing syslog messages and I’d like to combine multi-line messages into
a single entry before processing the entries. For instance, these messages
N 0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND PROGRAM
FOR 02 SECONDS. ===
N 0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER
00 4 0 0.000020 0.000000 0.0
S 31 JES2 0
0 0 0
Would become
0020000 PROD 19111 16:00:40.08 JOB08657 00000090 +=== SUSPEND PROGRAM FOR
02 SECONDS. ===
0004000 PROD 19111 16:00:40.08 JOB08657 00000290 -STIMER 00
4 0 0.000020 0.000000 0.0 31 JES2 0 0 0
0
Given there are a number of subtle rules I was wondering if anyone had written
or was aware of a general purpose normalizer.
Matt Hogstrom
[email protected]
+1-919-656-0564
PGP Key: 0x90ECB270
Facebook <https://facebook.com/matt.hogstrom> LinkedIn
<https://linkedin/in/mhogstrom> Twitter <https://twitter.com/hogstrom>
“It may be cognitive, but, it ain’t intuitive."
— Hogstrom
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to
[email protected] with the message: INFO IBM-MAIN
********************************************************
For information, services and offers, please visit our web site:
http://www.klm.com. This e-mail and any attachment may contain confidential and
privileged material intended for the addressee only. If you are not the
addressee, you are notified that no part of the e-mail or any attachment may be
disclosed, copied or distributed, and that any other action related to this
e-mail or attachment is strictly prohibited, and may be unlawful. If you have
received this e-mail by error, please notify the sender immediately by return
e-mail, and delete this message.
Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its
employees shall not be liable for the incorrect or incomplete transmission of
this e-mail or any attachments, nor responsible for any delay in receipt.
Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch
Airlines) is registered in Amstelveen, The Netherlands, with registered number
33014286
********************************************************
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
