mainframe.ibm
Introduction
The tags beginning with mainframe.ibm
identify events generated by an IBM mainframe.
Valid tags and data tables
The full tag must have 4 levels. The first two are fixed as mainframe.ibm
. The third level identifies the type of events sent, and the fourth level indicates the event subtype.Â
These are the valid tags and corresponding data tables that will receive the parsers' data:
Tag | Data table |
---|---|
|
|
For more information, read more About Devo tags.
How is the data sent to Devo?
A couple of relay rules are needed to define the fourth level of the tag and send the data to the target table. Create the rules using the following values:
Relay rule 1
Source Tag →
devo.collectors.out
Select the Stop processing checkbox
Relay rule 2
Source message →
([^ ]+).*
Target tag →
mainframe.ibm.type80.\M1
Select the Stop processing and Sent without syslog tag checkboxes
Table structure
These are the fields displayed in this table:
mainframe.ibm.type80
Field | Type | Extra fields |
---|---|---|
eventdate |
| Â |
hostname |
| Â |
EVENT_TYPE |
| Â |
EVENT_QUAL |
| Â |
TIME_WRITTEN |
| Â |
DATE_WRITTEN |
| Â |
SYSTEM_SMFID |
| Â |
VIOLATION |
| Â |
USER_NDFND |
| Â |
USER_WARNING |
| Â |
EVT_USER_ID |
| Â |
EVT_GRP_ID |
| Â |
AUTH_NORMAL |
| Â |
AUTH_SPECIAL |
| Â |
AUTH_OPER |
| Â |
AUTH_AUDIT |
| Â |
AUTH_EXIT |
| Â |
AUTH_FAILSFT |
| Â |
AUTH_BYPASS |
| Â |
AUTH_TRUSTED |
| Â |
LOG_CLASS |
| Â |
LOG_USER |
| Â |
LOG_SPECIAL |
| Â |
LOG_ACCESS |
| Â |
LOG_RACINIT |
| Â |
LOG_ALWAYS |
| Â |
LOG_CMDVIOL |
| Â |
LOG_GLOBAL |
| Â |
TERM_LEVEL |
| Â |
BACKOUT_FAIL |
| Â |
PROF_SAME |
| Â |
TERM |
| Â |
JOB_NAME |
| Â |
READ_TIME |
| Â |
READ_DATE |
| Â |
SMF_USER_ID |
| Â |
LOG_LEVEL |
| Â |
LOG_VMEVENT |
| Â |
LOG_LOGOPT |
| Â |
LOG_SECL |
| Â |
LOG_COMPATM |
| Â |
LOG_APPLAUD |
| Â |
LOG_NONOMVS |
| Â |
LOG_OMVSNPRV |
| Â |
AUTH_OMVSSU |
| Â |
AUTH_OMVSSYS |
| Â |
USR_SECL |
| Â |
RACF_VERSION |
| Â |
RECORD_EXTENSION |
| Â |
hostchain |
| ✓ |
tag |
| ✓ |
rawMessage |
| v |
Â