Printing OM log records

To print the OM log records from the z/OS® system log, use the IMS File Select and Formatting Print utility (DFSERA10) with exit routine CSLOERA3.

The example in the following figure shows the JCL that is required to print the log records from a z/OS system log.

JCL to print OM log records from a z/OS system log

//CSLERA1   JOB   MSGLEVEL=1,MSGCLASS=A,CLASS=K
//STEP1     EXEC  PGM=DFSERA10
//STEPLIB   DD    DISP=SHR,DSN=IMS.SDFSRESL
//SYSPRINT  DD    SYSOUT=A
//SYSUT1    DD    DSN=SYSLOG.OM.AUDIT.TRAIL.LOG,
//                SUBSYS=(LOGR,IXGSEXIT),
//                DCB=(BLKSIZE=32760)
//SYSIN     DD
CONTROL    CNTL   H=EOF
OPTION     PRINT  EXITR=CSLULALE
END
//

Command input and command response log records longer than 32 760 bytes are divided into two or more segments. Unsolicited output has a maximum length of 320 bytes. Each segment is sent to the MVS logger on a separate IXGWRITE call from OM. Therefore, long log records appear as multiple records on the log stream. Additional control data is added to the command response and command input log records to enable the CSLOERA3 and CSLULALE formatting utilities to reassemble log records that have been separated into multiple segments. A bit is added to the log record prefix to indicate single segment log records, including log records other than command input or command response. Log records are printed in the same order that they were sent to the log stream, based on the timestamp provided in the log record. If MAXBUFSIZE is set lower than 32 760 bytes, log records will not be broken into multiple segments. Instead, any log record that exceeds the length in MAXBUFSIZE will be truncated.

Recommendation: Set the MAXBUFSIZE to 32760 bytes. Log records requiring more than 65,535 segments will continue to be truncated. Currently, this limitation affects only a log record longer than 2GB.

The DD statements for printing OM log records are:

STEPLIB: DSN= points to IMS.SDFSRESL, which contains the IMS File Select and Formatting Print utility, DFSERA10.
SYSUT1: DSN= points to the OM log stream name that is specified on the AUDITLOG= parameter in the CSLOIxxx PROCLIB member.

The control statements for printing the OM log records are:

H=: Specifies the number of log records to print. To print all of the log records, specify H=EOF.
EXITR=CSLULALE: Identifies the OM log record exit routine that is called to format each log record. Exit routine CSLULALE formats the OM audit trail in a format similar to a syslog. Exit routine CSLOERA3 can also be used. Exit routine CSLOERA3 prints the records in a dump format, including the record type and time-stamp information for each record, and provides the contents of the record up to a maximum of 32 760 bytes.

To limit the log data to a specific time range, use the FROM and TO parameters on the SUBSYS statement, as shown in the figure below. This DD card prints log records from 11:00 to 12:00 on day 42 of the year 2007.

JCL to limit log data to a specific time range

//SYSUT1    DD    DSN=SYSLOG.OM.AUDIT.TRAIL.LOG,
//                SUBSYS=(LOGR,IXGSEXIT,
//                'FROM=(2007/042,11:00:00),TO=(2007/042,12:00:00)'), 
//                DCB=(BLKSIZE=32760)

Dates and times are specified in Greenwich Mean Time (GMT). The seconds field in the time value is optional. To use local dates and times, add the LOCAL keyword, as shown in the following table.

JCL to limit log data to a specific time range, using local dates and times

//SYSUT1    DD    DSN=SYSLOG.OM.AUDIT.TRAIL.LOG,
//                SUBSYS=(LOGR,IXGSEXIT,
//                'FROM=(2007/042,11:00:00),TO=(2007/042,12:00:00),LOCAL'),
//                DCB=(BLKSIZE=32760)