处理syslog

1、首先启动SDSF命令空间

IsfRC = isfcalls( "ON" )
if IsfRC <> 0 then do
  say "RC" IsfRC "returned from isfcalls( ON )"
  exit IsfRC
end

2、执行st命令和查询作业

isfprefix = 'syslog*'
isfowner = '**'
isfcols = "jname jobid ownerid queue jclass prtdest retcode"
address SDSF "isfexec st"
if RC <> 0 then do
  say "RC" RC "returned from ISFEXEC ST"
end

isfprefix, isfowner, isfcols是系统变量，可以发现isf开头的变量都是系统变量。这段代码的作用相当于，（1）SDSF里执行st命令，（2）在SDSF的命令行输入“prefix syslog*”,”owner **”,这样就会在st里列出前缀是syslog的作业。

3、获得要打印的数据集的DDName

address SDSF "isfact st token('"token.1"') parm(np ?) (prefix j_"
address SDSF "isfact st token('"j_token.1"') parm(np sa)"
sysut1dd = isfddname.1

这时sysut1dd变量的值就是syslog的DDName，下面对文件的操作将直接用这个DDName进行读写。我们一般要读写文件，是不是也先为数据集名赋值个DDName，比如"alloc da(‘ibmuser.contest.jcl’) f(line) shr reuse"，为ibmuser.contest.jcl赋值line的DDName。这里的原理一样一样的~

4、获得上次处理的行号

linedsn = 'ibmuser.contest.temp(line)'
"alloc da('"linedsn"') f(line) shr reuse"
"execio * diskr line (stem linenum. finis"
"free f(line)"

因为操作syslog，相当于操作数据集内容，但是每次有新的syslog增加时，数据集里行数就会多出来。虽然syslog有日期和时间，但是如果我们每次都重新遍历这个数据集，是不是很浪费性能？所以我们在外部文件存一个数值，这个数值代表了上次我们遍历到的行号。如果syslog增加了，我们可以从这个行号继续访问就可以了。

5、关键的部分介绍完了，接下来就是怎么去解析sysut1dd指定的数据集了。对syslog的解析就是每次读一行，拆分字符串，然后把想保存的关键字段赋值给相应的变量。

LEAVE_LOOP = "N"
line_num = linenum.1
/***process syslog record ***/
i=0
do forever
  "execio 1 diskr "sysut1dd" "line_num" (stem indata. "
  line_num = line_num + indata.0
  IF RC = 2 THEN,
      LEAVE_LOOP = "Y"
  do k=1 to indata.0

   if strip(substr(indata.k,11,4)) <> '' then do
     parse var indata.k,
     1  classtemp,
     2  .,
     11 sysnametemp,
     15 .,
     20 ldatetemp,
     25 .,
     26 ltimetemp,
     34 .,
     35 lltimetemp,
     37 .,
     38 jobnametemp,
     46 .,
     57 keytexttemp,
     65 .,
     66 txtmsgtemp
     if strip(keytexttemp) = "$HASP100" then do
       if substr(txtmsgtemp,1,6) = "GETLOG" then do
         line_num = line_num + 10
         iterate
       end
     end
     if strip(keytexttemp) <> "" then do
       i = i + 1
       class.i = classtemp
       sysname.i = sysnametemp
       ldate.i = ldatetemp
       ltime.i = ltimetemp
       lltime.i = lltimetemp
       jobname.i = jobnametemp
       keytext.i = keytexttemp
       txtmsg.i = txtmsgtemp
     end
     else do
       txtmsg.i = txtmsg.i 吵 "  "吵 txtmsgtemp
     end
   end
   else do
     parse var indata.k 1 . 57 msg
     txtmsg.i = txtmsg.i 吵 msg
   end
  end
  if leave_loop = 'Y' then leave
end
/*****generate JCL job  *************/

6、通过第5步，我们已经把syslog的相应字段都保存到数组变量里。接下来我们就动态构造JCL作业，把这些syslog插入到相应的DB2表中。

/*****generate JCL job  *************/
queue "//GETLOG  JOB CLASS=A,MSGLEVEL=(1,1),MSGCLASS=A"
queue "//PH01S01 EXEC PGM=IKJEFT01,DYNAMNBR=20"
queue "//STEPLIB DD DSN=DSN910.SDSNLOAD,DISP=SHR"
queue "//SYSTSPRT DD SYSOUT=*"
queue "//SYSTSIN  DD *"
queue "  DSN SYSTEM(DB9G)  "
queue "  RUN  PROGRAM(DSNTIAD) PLAN(DSNTIA91) -   "
queue "       LIB('DSN910.DB9G.RUNLIB.LOAD')      "
queue "//SYSPRINT DD SYSOUT=* "
queue "//SYSUDUMP DD SYSOUT=* "
queue "//SYSIN    DD *       "
do j=1 to i
  if strip(sysname.j) <> "" & strip(ldate.j) <> "" ,
    &  strip(ltime.j) <> ""  & strip(keytext.j) <> "" ,
    & strip(class.j) <> "" then do
    if strip(jobname.j) = "" then jobname.j = 'xxxxxxxx'
    if strip(txtmsg.j) = "" then txtmsg.j = 'xxxxxxxx'
    ldate.j = '2012-10-23'
    queue "  insert into ibmuser.syslog  values("
    queue "   '" 吵 class.j 吵 "',"
    queue "   '" 吵 sysname.j 吵 "',"
    queue "   '" 吵 ldate.j 吵 "',"
    queue "   '" 吵 ltime.j 吵 "',"
    queue "   '" 吵 lltime.j 吵 "',"
    queue "   '" 吵 jobname.j 吵 "',"
    queue "   '" 吵 keytext.j 吵 "',"
  /*queue "   '" 吵 txtmsg.j 吵 "');"*/
    parse var txtmsg.j 1 txt1 61 txt2 121 txt3 181 txt4,
                      241 txt5  301 txt6 361 txt7
    queue "   '" 吵 txt1
    queue "    " 吵 txt2
    queue "    " 吵 txt3
    queue "    " 吵 txt4
    queue "    " 吵 txt5
    queue "    " 吵 txt6
    queue "    " 吵 txt7 吵 "');"
 /* say "*********************************"
    say "class:" 吵 class.j
    say "sysname:" 吵 sysname.j
    say "ldate:" 吵 ldate.j
    say "ltime:" 吵 ltime.j
    say "jobname:" 吵 jobname.j
    say "keytext:" 吵 keytext.j
    say "txtmsg:" 吵 txtmsg.j
    say "*********************************" */
  end
end
outddn = 'ibmuser.contest.jcl(syslog)'
"ALLOC DA('"OUTDDN"') FI(OUTDD) OLD REUSE"
"EXECIO " QUEUED() " DISKW OUTDD (FINIS"
"FREE FI(OUTDD)"

7、我们提交动态生成的JCL作业，真正把增加的syslog插入到DB2表中。

/*** submit jcl job **/
call msg("off")
"submit ('"outddn"')"
call msg("on")

8、最后一步，我们将行号变量再写回数据集中，比如这次我们操作syslog到3800行，就把3800保存起来，下次就从syslog的3800开始遍历。

/*** write line_num **/
linenum.1 = line_num
"alloc da('"linedsn"') fi(line) old reuse "
"execio * diskw line (stem linenum. finis "
"free fi(line)"
call isfcalls "OFF"

At last but not least，处理syslog，关键是你对syslog字段的了解，比如（1）有时一条完整的syslog由多行组成；（2）有的syslog缺少某个字段等等。当面对各种不同问题时，你的代码应该都有一定的解决方法。