Separation of UserLogs (Generic Data Streams) from Z System Data

After working with User Log files with the ZCDP/ZLDA product, we've come to the opinion that these Application USER LOGS (Generic streams) would be better managed if hosted separately from the standard Z-based infrastructure data stream feeds process flow.

We've only uncovered a couple scenarios so far that can impact the perceived health of the HBO STCs, and are nervous that other conditions may surface to show other impacts.

From a design aspect, we roll out the policy configurations across many LPARs globally with a standard set of infra-structure feeds, including SMF records to support the provided IBM dashboards, along with the major logs supporting key system infrastructure components such as z/OS SYSLOG, NETVIEW, CICS MSGUSR, and WLP STDOUT / STDERR.

Conceptually we don’t see this infrastructure space as a proper home for application files, and would expect to see this data handled via separate STCs, owned and cost charged to the application file owners. Our application community is planning to roll this out with many files, containing very large volumes of data.

Condition examples experienced (so far):

Any kind of exceptional file condition will produce incessant messages in the log forwarder task, generated every few seconds.

1 –

Security violations for missing entitlement (for STC owning FID) for read access to user logs, will produce incessant errors (every few seconds for each affected file) on the log forwarder task. This entitlement access is controlled by application file owners.

2 –

Operational processes managed by the application file owners, whereby application files remain in an empty state, will generate incessant messages noting READ functionality against an empty file.

3 –

Operational processes managed by the application file owners, whereby re-allocated files are opened by CICS for transactional loads to write data, but doing this in “initial load mode” with un-primed files, will generate incessant messages noting READ functionality in conflict with current exclusive-control ownership by CICS.

Application file management should be handled by application teams, not z/OS engineering teams.

The collection of “Generic” data streams representing application-specific files should reside in a separate policy file, and processed by separate log forwarder / data streamer tasks from those handling the Z system data.