Sure. I'm not sure which part you are confused about. daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N DAEMON(+1)
The part that I added was -N DAEMON(+1) which means to create a new archive dataset using DSNPrefix and DAEMON(+1) to create external archive dataset. The -N parameter specifies that the file should be automatically archived and then re-initialized when an archive event occurs. This rule is actually in the sample SYSLOGD config file straight from IBM that we have used. Write all messages with priority err or higher from applications # which specify facility "daemon" to the log file daemon. # Because we chose to log messages from syslogd and inetd separately, # we'll filter out those messages from this rule using special # priority none. # # Notes: # # a) In this example, SYSLOGD followed by some other character is the # job name of syslogd. If it is different on your system, change # the rule. # b) In this example, INETD followed by some other character is the # job name of inetd. If it is different on your system, change the # rule. # # daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/%Y/%m/%d/daemon _________________________________________________________________ Dave Jousma Mainframe Engineering, Assistant Vice President [email protected] 1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H p 616.653.8429 f 616.653.2717 -----Original Message----- From: IBM Mainframe Discussion List <[email protected]> On Behalf Of saurabh khandelwal Sent: Tuesday, December 4, 2018 11:39 PM To: [email protected] Subject: Re: SYSLOGD Automation **CAUTION EXTERNAL EMAIL** **DO NOT open attachments or click on links from unknown senders or unexpected emails** Hello David, I am unable to understand this config. Can you please help me to mke sense out of below line code. daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N DAEMON(+1) On Tue, Dec 4, 2018 at 3:08 PM Jousma, David < [email protected]> wrote: > Here is what we code. You have to add offload info for every SYSLOGD > stream you are writing or it wont offload it. > > ArchiveTimeOfDay 00:01 > BeginArchiveParms > DSNPrefix TEMPG.PDP.SYSLOGD.&SYSNAME > Unit SYSDA > EndArchiveParms > > daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N > DAEMON(+1) > auth.* /var/log/auth -N AUTH(+1) > mail.* /var/log/mail -N MAIL(+1) > *.err /var/log/errors -N ERRORS(+1) > *.debug /var/log/trace -N TRACE(+1) > *.INETD*.*.* /var/log/inetd -N INETD(+1) > *.trmd*.*.* /shared/PROD/trmd/trmdTEC1 -N TRMD(+1) > > _________________________________________________________________ > Dave Jousma > Mainframe Engineering, Assistant Vice President [email protected] > 1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H p 616.653.8429 f > 616.653.2717 > > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:[email protected]] > On Behalf Of saurabh khandelwal > Sent: Monday, December 3, 2018 11:08 PM > To: [email protected] > Subject: SYSLOGD Automation > > **CAUTION EXTERNAL EMAIL** > > **DO NOT open attachments or click on links from unknown senders or > unexpected emails** > > Hello Group, > > We have requirement to automate the archival process of syslogd logs > from omvs and placing them in dataset on regular process. > > I looked at SYSLOGD address space and find that parm file is used for > this is from TCPIP.TCPPARMS(SYSLOG) and I made below modification to > start archival process. > > > details about specifying rules. > > # > > ArchiveTimeOfDay 07:00 > > ArchiveThreshold 50 > > ArchiveCheckInterval 600 > > # > > BeginArchiveParms > > DSNPrefix TESB.ARCHIVE > > Volume TSO020 > > RetPd 30 > > EndArchiveParms > > # > > *.SYSLOGD.daemon.* /var/logs/syslogd/daemon.notice -N daemon.n > > > > # Write all messages with priority err and higher to log file errors. > > # > > # THIS EXAMPLE STATEMENT IS UNCOMMENTED. > > # > > *.* /tmp/ivp.syslog.log > # > > Now, I can see archival dataset generated on regular interval from the > above parameter I mentioned in SYSLOG parm file but its not full > syslogd log, which we should be seeing it. > > Can you please help, if anything more should be modified to make this > process work . > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, send > email to [email protected] with the message: INFO IBM-MAIN > **CAUTION EXTERNAL EMAIL** > > **DO NOT open attachments or click on links from unknown senders or > unexpected emails** > > This e-mail transmission contains information that is confidential and may > be privileged. It is intended only for the addressee(s) named above. If > you receive this e-mail in error, please do not read, copy or > disseminate it in any manner. If you are not the intended recipient, > any disclosure, copying, distribution or use of the contents of this > information is prohibited. Please reply to the message immediately by > informing the sender that the message was misdirected. After replying, > please erase it from your computer system. Your assistance in correcting this > error is appreciated. > > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, send > email to [email protected] with the message: INFO IBM-MAIN > -- Thanks & Regards Saurabh Khandelwal ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN **CAUTION EXTERNAL EMAIL** **DO NOT open attachments or click on links from unknown senders or unexpected emails** This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
