> Q1 How to use DFSORT to select the first duplicate of multi-line messages
in Syslog
Jason,
You are showing me the dcb attributes of the files after you have done the
match. I was hoping to do on the RAW syslog , I am not even sure as to how
you created the files with FB (as syslog/operlog has the machine character
FBM/VBM) .but oh well.
It is quite amazing that you just show the sample input and output, but
with zero explanation of on "how is a duplicate identified? " I assumed
that the duplicate is idenfitied by the message DSI556I where the DDNAME=
'key' . The 'key' is the value to identify the duplicates. Based on that
assumption here is the job that will remove the duplicate messages for the
message DSI556I where the DDNAME= . I also assumed that your input is
already sorted on the message DSI556I i.e the duplicate records are next to
each other.
//STEP0100 EXEC PGM=SORT
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=Your input 149 fb file
//SORTOUT DD SYSOUT=*
//SYSIN DD *
OPTION COPY
INREC IFTHEN=(WHEN=GROUP,
BEGIN=(20,5,CH,GT,C' '),
PUSH=(140:57,08)),
IFTHEN=(WHEN=(020,5,CH,GT,C' ',AND,
140,8,CH,GT,C' '),
PARSE=(%01=(STARTAFT=C'DDNAME = ''',
ENDBEFR=C'''',
FIXLEN=8)),
OVERLAY=(148:%01))
OUTREC IFTHEN=(WHEN=GROUP,
BEGIN=(148,1,CH,GT,C' '),
PUSH=(148:148,08),RECORDS=2),
IFTHEN=(WHEN=GROUP,
KEYBEGIN=(140,17),
PUSH=(157:SEQ=4))
OUTFIL OMIT=(157,4,ZD,GT,2),
BUILD=(1,133)
/*
> Q2. How to use DFSORT to compare two the Syslog depending on multi-line
messages.
Here is sample JCL which will give you the desired results.
//STEP0200 EXEC PGM=SORT
//SYSOUT DD SYSOUT=*
//INA DD DISP=SHR,DSN=your.Input.first.file
//INB DD DISP=SHR,DSN=your.Input.second.file
//SORTOUT DD SYSOUT=*
//SYSIN DD *
JOINKEYS F1=INA,FIELDS=(150,16,A)
JOINKEYS F2=INB,FIELDS=(140,16,A)
JOIN UNPAIRED
REFORMAT FIELDS=(F1:1,147,?)
SORT FIELDS=(140,8,CH,A)
OUTREC IFTHEN=(WHEN=GROUP,
BEGIN=(148,1,CH,EQ,C'B'),
PUSH=(148:148,1),RECORDS=2)
OUTFIL OMIT=(148,1,CH,EQ,C'B'),
BUILD=(1,133)
/*
//JNF1CNTL DD *
INREC IFTHEN=(WHEN=INIT,
OVERLAY=(140:SEQNUM,8,ZD)),
IFTHEN=(WHEN=GROUP,
BEGIN=(20,5,CH,GT,C' '),
PUSH=(150:57,08)),
IFTHEN=(WHEN=(020,5,CH,GT,C' ',AND,
150,8,CH,GT,C' '),
PARSE=(%01=(STARTAFT=C'DDNAME = ''',
ENDBEFR=C'''',
FIXLEN=8)),
OVERLAY=(158:%01))
/*
//JNF2CNTL DD *
OMIT COND=(20,5,CH,EQ,C' ')
INREC IFTHEN=(WHEN=INIT,
PARSE=(%01=(STARTAFT=C'DDNAME = ''',
ENDBEFR=C'''',
FIXLEN=8)),
OVERLAY=(140:57,08,
148:%01))
/*
> Q3 . Do we need to transfer multi-line messages to single-line messages?
How to transfer it?
You can use DFSORT's ICETOOL operator RESIZE to merge multiple lines into
a single line. Check this link which shows example of RESIZE
https://www.ibm.com/docs/en/zos/2.1.0?topic=re-example-1
Thanks,
Kolusu
DFSORT Development
IBM Corporation
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
