处理syslog

1、首先启动SDSF命令空间

IsfRC = isfcalls( "ON" ) if IsfRC <> 0 then do say "RC" IsfRC "returned from isfcalls( ON )" exit IsfRC end

2、执行st命令和查询作业

isfprefix = 'syslog*' isfowner = '**' isfcols = "jname jobid ownerid queue jclass prtdest retcode" address SDSF "isfexec st" if RC <> 0 then do say "RC" RC "returned from ISFEXEC ST" end

isfprefix, isfowner, isfcols是系统变量，可以发现isf开头的变量都是系统变量。这段代码的作用相当于，（1）SDSF里执行st命令，（2）在SDSF的命令行输入“prefix syslog*”,”owner **”,这样就会在st里列出前缀是syslog的作业。

3、获得要打印的数据集的DDName

address SDSF "isfact st token('"token.1"') parm(np ?) (prefix j_" address SDSF "isfact st token('"j_token.1"') parm(np sa)" sysut1dd = isfddname.1

这时sysut1dd变量的值就是syslog的DDName，下面对文件的操作将直接用这个DDName进行读写。我们一般要读写文件，是不是也先为数据集名赋值个DDName，比如"alloc da(‘ibmuser.contest.jcl’) f(line) shr reuse"，为ibmuser.contest.jcl赋值line的DDName。这里的原理一样一样的~

4、获得上次处理的行号

linedsn = 'ibmuser.contest.temp(line)' "alloc da('"linedsn"') f(line) shr reuse" "execio * diskr line (stem linenum. finis" "free f(line)"

因为操作syslog，相当于操作数据集内容，但是每次有新的syslog增加时，数据集里行数就会多出来。虽然syslog有日期和时间，但是如果我们每次都重新遍历这个数据集，是不是很浪费性能？所以我们在外部文件存一个数值，这个数值代表了上次我们遍历到的行号。如果syslog增加了，我们可以从这个行号继续访问就可以了。

5、关键的部分介绍完了，接下来就是怎么去解析sysut1dd指定的数据集了。对syslog的解析就是每次读一行，拆分字符串，然后把想保存的关键字段赋值给相应的变量。

LEAVE_LOOP = "N" line_num = linenum.1 /***process syslog record ***/ i=0 do forever "execio 1 diskr "sysut1dd" "line_num" (stem indata. " line_num = line_num + indata.0 IF RC = 2 THEN, LEAVE_LOOP = "Y" do k=1 to indata.0 if strip(substr(indata.k,11,4)) <> '' then do parse var indata.k, 1 classtemp, 2 ., 11 sysnametemp, 15 ., 20 ldatetemp, 25 ., 26 ltimetemp, 34 ., 35 lltimetemp, 37 ., 38 jobnametemp, 46 ., 57 keytexttemp, 65 ., 66 txtmsgtemp if strip(keytexttemp) = "$HASP100" then do if substr(txtmsgtemp,1,6) = "GETLOG" then do line_num = line_num + 10 iterate end end if strip(keytexttemp) <> "" then do i = i + 1 class.i = classtemp sysname.i = sysnametemp ldate.i = ldatetemp ltime.i = ltimetemp lltime.i = lltimetemp jobname.i = jobnametemp keytext.i = keytexttemp txtmsg.i = txtmsgtemp end else do txtmsg.i = txtmsg.i 吵 " "吵 txtmsgtemp end end else do parse var indata.k 1 . 57 msg txtmsg.i = txtmsg.i 吵 msg end end if leave_loop = 'Y' then leave end /*****generate JCL job *************/

6、通过第5步，我们已经把syslog的相应字段都保存到数组变量里。接下来我们就动态构造JCL作业，把这些syslog插入到相应的DB2表中。

/*****generate JCL job *************/ queue "//GETLOG JOB CLASS=A,MSGLEVEL=(1,1),MSGCLASS=A" queue "//PH01S01 EXEC PGM=IKJEFT01,DYNAMNBR=20" queue "//STEPLIB DD DSN=DSN910.SDSNLOAD,DISP=SHR" queue "//SYSTSPRT DD SYSOUT=*" queue "//SYSTSIN DD *" queue " DSN SYSTEM(DB9G) " queue " RUN PROGRAM(DSNTIAD) PLAN(DSNTIA91) - " queue " LIB('DSN910.DB9G.RUNLIB.LOAD') " queue "//SYSPRINT DD SYSOUT=* " queue "//SYSUDUMP DD SYSOUT=* " queue "//SYSIN DD * " do j=1 to i if strip(sysname.j) <> "" & strip(ldate.j) <> "" , & strip(ltime.j) <> "" & strip(keytext.j) <> "" , & strip(class.j) <> "" then do if strip(jobname.j) = "" then jobname.j = 'xxxxxxxx' if strip(txtmsg.j) = "" then txtmsg.j = 'xxxxxxxx' ldate.j = '2012-10-23' queue " insert into ibmuser.syslog values(" queue " '" 吵 class.j 吵 "'," queue " '" 吵 sysname.j 吵 "'," queue " '" 吵 ldate.j 吵 "'," queue " '" 吵 ltime.j 吵 "'," queue " '" 吵 lltime.j 吵 "'," queue " '" 吵 jobname.j 吵 "'," queue " '" 吵 keytext.j 吵 "'," /*queue " '" 吵 txtmsg.j 吵 "');"*/ parse var txtmsg.j 1 txt1 61 txt2 121 txt3 181 txt4, 241 txt5 301 txt6 361 txt7 queue " '" 吵 txt1 queue " " 吵 txt2 queue " " 吵 txt3 queue " " 吵 txt4 queue " " 吵 txt5 queue " " 吵 txt6 queue " " 吵 txt7 吵 "');" /* say "*********************************" say "class:" 吵 class.j say "sysname:" 吵 sysname.j say "ldate:" 吵 ldate.j say "ltime:" 吵 ltime.j say "jobname:" 吵 jobname.j say "keytext:" 吵 keytext.j say "txtmsg:" 吵 txtmsg.j say "*********************************" */ end end outddn = 'ibmuser.contest.jcl(syslog)' "ALLOC DA('"OUTDDN"') FI(OUTDD) OLD REUSE" "EXECIO " QUEUED() " DISKW OUTDD (FINIS" "FREE FI(OUTDD)"

7、我们提交动态生成的JCL作业，真正把增加的syslog插入到DB2表中。

/*** submit jcl job **/ call msg("off") "submit ('"outddn"')" call msg("on")

8、最后一步，我们将行号变量再写回数据集中，比如这次我们操作syslog到3800行，就把3800保存起来，下次就从syslog的3800开始遍历。

/*** write line_num **/ linenum.1 = line_num "alloc da('"linedsn"') fi(line) old reuse " "execio * diskw line (stem linenum. finis " "free fi(line)" call isfcalls "OFF"

At last but not least，处理syslog，关键是你对syslog字段的了解，比如（1）有时一条完整的syslog由多行组成；（2）有的syslog缺少某个字段等等。当面对各种不同问题时，你的代码应该都有一定的解决方法。

转载于:https://www.cnblogs.com/Gatsby/archive/2013/04/10/3011652.html