Hello David,
Thanks for reply. I have set below parameter in my SYSLOG parm file. But
# The following are example statements that illustrate how to
# configure automatic archival. See the section on syslogd rules for
# details about specifying rules.
#
ArchiveTimeOfDay 11:10
ArchiveThreshold 50
ArchiveCheckInterval 600
#
BeginArchiveParms
DSNPrefix TST1.ARCHIVE
Volume TST011
RetPd 30
EndArchiveParms
#
*.SYSLOGD.daemon.* /var/logs/syslogd/daemon.notice -N daemon.notice
#####################################################################
#
# Write all messages with priority err and higher to log file errors.
#
# THIS EXAMPLE STATEMENT IS UNCOMMENTED.
#
*.* /tmp/ivp.syslog.log
In TST1.ARCHIVE.DAEMON.** dataset, I see only such message as below. But
actual syslog message, I see only in ivp.syslog.log file.
Is there any way to get all logs in the dataset in place of
ivp.syslog.log.
Dec 1 14:59:40 TSTLPAR syslogd: FSUM1230 Log file
/var/logs/syslogd/daemon.notice was created
Dec 1 14:59:40 TSTLPAR syslogd: FSUM1262 File system /SYSTEM/var archive
complete, file /var/logs/syslogd/daemon.notice - destination
TST1.ARCHIVE.DAEMON.N.D181201.T145940
Dec 1 14:59:40 TSTLPAR syslogd: FSUM1261 File system /SYSTEM/var archive
results: old utilization 34% - new utilization 34%
Dec 1 14:59:40 TSTLPAR syslogd: FSUM1261 File system /SYSTEM/tmp archive
results: old utilization 0% - new utilization 0%
Dec 2 07:59:37 TSTLPAR syslogd: FSUM1219 syslogd: exiting on signal 15
Dec 2 07:59:45 TSTLPAR syslogd: FSUM1220 syslogd: restart
Dec 2 07:59:45 TSTLPAR syslogd: FSUM1237 Job SYSLOGD running in
local-only mode
Dec 2 07:59:45 TSTLPAR syslogd: FSUM1232 syslogd: running non-swappable
On Wed, Dec 5, 2018 at 3:12 PM Jousma, David <
[email protected]> wrote:
> Sure. I'm not sure which part you are confused about.
>
> daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N DAEMON(+1)
>
> The part that I added was -N DAEMON(+1) which means to create a new
> archive dataset using DSNPrefix and DAEMON(+1) to create external archive
> dataset. The -N parameter specifies that the file should be automatically
> archived and then re-initialized when an archive event occurs.
>
> This rule is actually in the sample SYSLOGD config file straight from IBM
> that we have used.
>
> Write all messages with priority err or higher from applications
> # which specify facility "daemon" to the log file daemon.
> # Because we chose to log messages from syslogd and inetd separately,
> # we'll filter out those messages from this rule using special
> # priority none.
> #
> # Notes:
> #
> # a) In this example, SYSLOGD followed by some other character is the
> # job name of syslogd. If it is different on your system, change
> # the rule.
> # b) In this example, INETD followed by some other character is the
> # job name of inetd. If it is different on your system, change the
> # rule.
> #
> # daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/%Y/%m/%d/daemon
>
> _________________________________________________________________
> Dave Jousma
> Mainframe Engineering, Assistant Vice President
> [email protected]
> 1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H
> p 616.653.8429
> f 616.653.2717
>
> -----Original Message-----
> From: IBM Mainframe Discussion List <[email protected]> On Behalf
> Of saurabh khandelwal
> Sent: Tuesday, December 4, 2018 11:39 PM
> To: [email protected]
> Subject: Re: SYSLOGD Automation
>
> **CAUTION EXTERNAL EMAIL**
>
> **DO NOT open attachments or click on links from unknown senders or
> unexpected emails**
>
> Hello David,
>
> I am unable to understand this config. Can you please help me to mke sense
> out of below line code.
>
> daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N
> DAEMON(+1)
>
> On Tue, Dec 4, 2018 at 3:08 PM Jousma, David <
> [email protected]> wrote:
>
> > Here is what we code. You have to add offload info for every SYSLOGD
> > stream you are writing or it wont offload it.
> >
> > ArchiveTimeOfDay 00:01
> > BeginArchiveParms
> > DSNPrefix TEMPG.PDP.SYSLOGD.&SYSNAME
> > Unit SYSDA
> > EndArchiveParms
> >
> > daemon.err;*.SYSLOGD*.*.none;*.INETD*.*.none /var/log/daemon -N
> > DAEMON(+1)
> > auth.* /var/log/auth -N AUTH(+1)
> > mail.* /var/log/mail -N MAIL(+1)
> > *.err /var/log/errors -N ERRORS(+1)
> > *.debug /var/log/trace -N TRACE(+1)
> > *.INETD*.*.* /var/log/inetd -N INETD(+1)
> > *.trmd*.*.* /shared/PROD/trmd/trmdTEC1 -N TRMD(+1)
> >
> > _________________________________________________________________
> > Dave Jousma
> > Mainframe Engineering, Assistant Vice President [email protected]
> > 1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H p 616.653.8429 f
> > 616.653.2717
> >
> > -----Original Message-----
> > From: IBM Mainframe Discussion List [mailto:[email protected]]
> > On Behalf Of saurabh khandelwal
> > Sent: Monday, December 3, 2018 11:08 PM
> > To: [email protected]
> > Subject: SYSLOGD Automation
> >
> > **CAUTION EXTERNAL EMAIL**
> >
> > **DO NOT open attachments or click on links from unknown senders or
> > unexpected emails**
> >
> > Hello Group,
> >
> > We have requirement to automate the archival process of syslogd logs
> > from omvs and placing them in dataset on regular process.
> >
> > I looked at SYSLOGD address space and find that parm file is used for
> > this is from TCPIP.TCPPARMS(SYSLOG) and I made below modification to
> > start archival process.
> >
> >
> > details about specifying rules.
> >
> > #
> >
> > ArchiveTimeOfDay 07:00
> >
> > ArchiveThreshold 50
> >
> > ArchiveCheckInterval 600
> >
> > #
> >
> > BeginArchiveParms
> >
> > DSNPrefix TESB.ARCHIVE
> >
> > Volume TSO020
> >
> > RetPd 30
> >
> > EndArchiveParms
> >
> > #
> >
> > *.SYSLOGD.daemon.* /var/logs/syslogd/daemon.notice -N daemon.n
> >
> >
> >
> > # Write all messages with priority err and higher to log file errors.
> >
> > #
> >
> > # THIS EXAMPLE STATEMENT IS UNCOMMENTED.
> >
> > #
> >
> > *.* /tmp/ivp.syslog.log
> > #
> >
> > Now, I can see archival dataset generated on regular interval from the
> > above parameter I mentioned in SYSLOG parm file but its not full
> > syslogd log, which we should be seeing it.
> >
> > Can you please help, if anything more should be modified to make this
> > process work .
> >
> > ----------------------------------------------------------------------
> > For IBM-MAIN subscribe / signoff / archive access instructions, send
> > email to [email protected] with the message: INFO IBM-MAIN
> > **CAUTION EXTERNAL EMAIL**
> >
> > **DO NOT open attachments or click on links from unknown senders or
> > unexpected emails**
> >
> > This e-mail transmission contains information that is confidential and
> may
> > be privileged. It is intended only for the addressee(s) named above. If
> > you receive this e-mail in error, please do not read, copy or
> > disseminate it in any manner. If you are not the intended recipient,
> > any disclosure, copying, distribution or use of the contents of this
> > information is prohibited. Please reply to the message immediately by
> > informing the sender that the message was misdirected. After replying,
> > please erase it from your computer system. Your assistance in correcting
> this error is appreciated.
> >
> >
> > ----------------------------------------------------------------------
> > For IBM-MAIN subscribe / signoff / archive access instructions, send
> > email to [email protected] with the message: INFO IBM-MAIN
> >
>
>
> --
> Thanks & Regards
> Saurabh Khandelwal
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions, send email
> to [email protected] with the message: INFO IBM-MAIN **CAUTION
> EXTERNAL EMAIL**
>
> **DO NOT open attachments or click on links from unknown senders or
> unexpected emails**
>
> This e-mail transmission contains information that is confidential and may
> be privileged. It is intended only for the addressee(s) named above. If
> you receive this e-mail in error, please do not read, copy or disseminate
> it in any manner. If you are not the intended recipient, any disclosure,
> copying, distribution or use of the contents of this information is
> prohibited. Please reply to the message immediately by informing the sender
> that the message was misdirected. After replying, please erase it from your
> computer system. Your assistance in correcting this error is appreciated.
>
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to [email protected] with the message: INFO IBM-MAIN
>
--
Thanks & Regards
Saurabh Khandelwal
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
