> If we put them together, the output isn't what we need.

Jason,

It is quite easy to get the multi-line messages.  Looks like you are
interested in extracting messages which begins with HSAM...

Basically a multi-line message will NOT have the date and time for the
continuation lines. And the message id are at fixed position on the first
line (position 58)

Assuming your syslog is FBM and LRECL=133 here is a job that would extract
the HSAM.. messages (single and multi-line)

//STEP0100 EXEC PGM=SORT
//SYSOUT   DD SYSOUT=*
//SORTIN   DD DISP=SHR,DSN=Your Input Syslog/Operlog
//SORTOUT  DD SYSOUT=*
//SYSIN    DD *
  OPTION COPY
  INREC IFTHEN=(WHEN=GROUP,
               BEGIN=(21,5,CH,GT,C' '),   $ IF DATE IS > ' '
                PUSH=(134:58,08))         $ MESSAGE ID

  OUTFIL BUILD=(01,133),                  $ ORIGINAL LRECL
  INCLUDE=(134,4,CH,EQ,C'HSAM')           $ ONLY HSAM MESSAGES
/*

Thanks,
Kolusu
DFSORT Development
IBM Corporation



----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN

Reply via email to