Data stream configuration for data gathered by Log Forwarder

This reference lists the configuration values that you can update in the Configure Log Forwarder data stream window. The fields that are shown in this window are based on the source from which the Log Forwarder collects data for the data stream.

The Log Forwarder gathers z/OS® log data from the following sources:
  • Job log, which is output that is written to a data definition (DD) by a running job
  • z/OS UNIX log file, including the UNIX System Services system log (syslogd)
  • Entry-sequenced Virtual Storage Access Method (VSAM) cluster
  • z/OS system log
  • IBM® Tivoli® NetView for z/OS messages
  • IBM WebSphere® Application Server for z/OS High Performance Extensible Logging (HPEL) log
  • z/OS Resource Measurement Facility (RMF) Monitor III reports
  • z/OS sequential data set

Table 1 summarizes which data streams come from which sources.

Important: Mixing different formats of data in one data stream is not supported. You need to examine the data source and ensure all data uses the same format when you collect it from the same output dataset.

For example, if you define the WebSphere Liberty Console log data stream and collect the Console logs from STDOUT, and if you are also sending WebSphere log4j logs to STDOUT, issues arise due to the distinct formats of these log types. The Z Common Data Provider will cache the log4j logs as partial logs because the data stream type is defined for WebSphere Liberty Console logs only. To avoid this problem, the WebSphere log4j logs need to go to a separate data set instead of STDOUT, so the Z Common Data Provider can differentiate between them and process them correctly.

Table 1. Correlation between the sources from which the Log Forwarder gathers data and the data streams that can be defined for those sources
Source Data streams
Job log
z/OS UNIX log file
Entry-sequenced VSAM cluster
z/OS SYSLOG
IBM Tivoli NetView® for z/OS messages
IBM WebSphere Application Server for z/OS HPEL log
Resource Measurement Facility Monitor III reports
z/OS sequential data set