Many components of TCPIP write information to syslogd. This is a process that captures the data sent to it over a UDP socket, and writes it to files in the Unix file system. If the syslogd is not active then messages may be written to the job log. When I was trying to set up AT-TLS, I had 10s of messages on the job log, each time a client tried to use AT-TLS.
The IBM documentation is not very clear, it tells you how to turn on debug, trace etc but does not clearly explain the difference, and when they are used.
It look like the PAGENT’s job is to take a configuration file, parse it, and pass the configuration data to TCPIP.
If you are using AT-TLS to set up TLS channels, the trace data comes from the TCPIP address space into syslogd.
Configure syslogd
See if SYSLOGD is running, if not, try to start it. If it does not exist…
- Copy /usr/lpp/tcpip/samples/syslog.conf to its default configuration file /etc/syslog.conf, or another file.
- Copy TCPIP.SEZAINST(SYSLOGD) to your proclib concatenation.
- The program uses environment variables defined in STDENV to control operations. The default configuration file location is /etc/syslog.conf .
You can configure syslog.conf for example
*.TCPIP.*.* /var/log/%Y/%m/%d/TCPIP
*.SYSLOGD.*.* /var/log/%Y/%m/%d/syslogd
*.err /var/log/%Y/%m/%d/errors
This says all messages for SYSLOGD go to a file like /var/log/2022/05/14/syslogd, and error messages go to /var/log/2022/05/14/errors
This means you get a file of messages for each day. For me, I just used /var/log/syslogd.log and /var/log/errors.log, and deleted them periodically. My syslog.conf is
*.INETD*.*.* /var/log/inetd auth.* /var/log/auth mail.* /var/log//mail -F 640 -D 770 local1.err /var/log/local1 *.err /var/log/errors *.CPAGENT.*.* /var/log/CPAGENT *.TTLS*.*.* /var/log/TTLS *.Pagent.*.* /var/log/Pagent *.TCPIP.*.debug /var/log/TCPIPdebug *.TCPIP.*.warning /var/log/TCPIP *.TCPIP.*.err /var/log/TCPIPerr *.TCPIP.*.info /var/log/TCPIPinfo *.SYSLOGD*.*.* /var/log/syslogd *.TN3270*.*.* /var/log/tn3270 *.SSHD*.*.* /var/log/SSHD
Priority
Data logged to syslogd has a “priority”. For example AT-TLS trace level 32 (Data) have a priority of “debug”. You can use this for example
*.TCPIP.*.debug /var/log/TCPIPdebug *.TCPIP.*.* /var/log/TCPIP
This says
- for messages from TCPIP with priority debug or higher( debug, info, notice, warning, error, crit, alert, emerg) then write the data to /var/log/TCPIPdebug .
- Write all messages to /var/log/TCPIP
As debug is the lowest level of priority, these statements are effectively the same.
It may be better to have
*.TCPIP.*.debug /var/log/TCPIPdebug *.TCPIP.*.warning /var/log/TCPIP
The priority can be “none” which means do not log any messages.
How do I capture messages not handled else where?
This is a bit clumsy.
When a message arrives each of the rules are check. If the check is true the message is logged.
You can have compound checks separated by a semicolon for a rule.
For example
*.*.*.* ; *.TCPIP.*.none ; *.PAGENT.*.none /var/log/all.log
This says log all messages – but not from TCPIP or PAGENT. If you have have one file for 20 jobs, you need to have 20 statements with the semicolon.
You can spread the definition over several lines. The semicolon at the end of the line says read next line. The code is not smart enough to put the /var/log/all on its own line, so using a ‘dummy’ may make it easier to maintain.
*.*.*.*;
*.TCPIP.*.none;
*.PAGENT.*.none;
*.DUMMY.*.none /var/log/all
Capturing the right data
If the config file you can specify options like
*.TCPIP.*.* /var/log/TCPIP *.*.*. /var/log/all
The entries are Userid.Jobname.facility.priority.
PAGENT AT-TLS request are reported via TCPIP.
I could not find how to filter the TCPIP data so the AT-TLS data went to one file, and other TCPIP data went to another file. For TCPIP it looks like the “facility” is either “daemon” or “auth”, which
ISPF interface
There is an ISPF syslog browser tool which displays information about the logs, and helps you browse the logs of interest. The documentation for this is not very good.
I got this to work by experimentation. I created an exec like MYSYSLOG
/* Rexx */
address ispexec
"LIBDEF ISPMLIB DATASET ID('TCPIP.SEZAMENU') STACK"
"LIBDEF ISPPLIB DATASET ID('TCPIP.SEZAPENU') STACK"
address tso "ALTLIB ACTIVATE APPLICATION(CLIST)
DATASET('TCPIP.SEZAEXEC') "
"SELECT CMD(EZASYRGO) NEWPOOL PASSLIB NEWAPPL(EZAS)"
address tso "ALTLIB DEACTIVATE APPLICATION(CLIST)"
"LIBDEF ISPPLIB"
"LIBDEF ISPMLIB"
You can execute this from ISPF option 6 or have this built into the ISPF panels.
Originally this exec was called syslogd; when I used it, I got
SYSTEM COMPLETION CODE=4C5 REASON CODE=77A53217
Where 4C5 is TCPIP’s abend code and 3217 – the program has the wrong Authrorization Code (APF related). This is because there is a command syslogd which was executed in preference to my exec. When I renamed the exec to MYSYSLOG it used the exec and it worked fine!
The first panel is
EZASYP01 ----------------- z/OS CS Syslogd Browser ---------------- Row 1 of 1
Command ===> Scroll ===> PAGE
Enter syslogd browser options
Recall migrated data sets ==> NO (Yes/No) Recall data sets or not
Maximum hits to display ==> 200 (1-99999) Search results to display
Maximum file archives ==> 30 (0-400) Days to look for file archives
Display start date/time ==> YES (Yes/No) Retrieve start date/time
Display active files only ==> NO (Yes/No) Active files only, no archives
DSN Prefix override value ==>
Enter file or data set name of syslogd configuration, or select one from below:
File/DS Name ==> /etc/syslog.conf
Press ENTER to continue, or press END PF key to exit without a selection
Line commands: S Select, R Remove from list, B Browse content, E Edit content
Cmd Recently used syslogd configuration file or data set name
--- --------------------------------------------------------------------------
/etc/syslog.conf
******************************* Bottom of data ********************************
Pressing enter, gave me another panel with
EZASYP00 ----------------- z/OS CS Syslogd Browser ---------------- Row 1 of 6
OPTION ===> Scroll ===> PAGE
Select one of the following, or press END PF key to exit the syslogd browser
1 Change current syslogd configuration file and/or options
2 Guide me to a possible syslogd destination
3 Clear guide-me hits (indicated by ==> in the Cmd column)
4 Search across all active syslogd files
Current config file ==> /etc/syslog.conf
Line commands: B Browse, A List archives, S Search active file and archives,
SF Search active file, SA Search archives, I File/DSN info
Archive
Cmd Rule/Active UNIX file name Start Time Type Avail.
--- --------------------------------------------- ----------------- ---- ------
*.SYSLOGD*.*.* 28 May 2022 13:31 None 0
/var/log/syslogd
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
*.INETD*.*.* Empty N/A None 0
/var/log/inetd
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
auth.* Empty N/A None 0
/var/log/auth
I could then browse the error log for SYSLOGD.
You can search for userid, strings etc, and give date ranges.
However for my small, one person usage, I found it was easier to use Unix services and use the command
oedit /var/syslogd.log
to edit the file.
ColinPaice 
One thought on “Setting up syslogd on z/OS”