Using the CZAJOBLG program

CZAJOBLG is a program that streams the JES-spooled output of one or more running z/OS jobs and started tasks to any SIEM in real-time. The streaming of JES SYSOUT is commonly referred to as Job Log support.

Using CZAJOBLG, you can:

• Select one or more running jobs or started task controls (STCs), or both, to monitor and forward to your SIEM their spooled SYSOUT data sets in real-time, as they are written.
• Monitor any number of jobs and started tasks, limited only by available memory.
• Monitor jobs and started tasks running on the same LPAR as CZAJOBLG, or on any other LPAR sharing a JES3 system or a JES2 multi-access spool (MAS) complex.
• Specify jobs by job or STC name, job ID (also called job number) and system name.
• Add and remove jobs from monitoring interactively without stopping and restarting CZAJOBLG or modifying any parameter files.
• Monitor application SYSOUT streams and system spooled data sets like JESMSGLG and JESYSMSG.
• Save network and SIEM resources by filtering SYSOUT records using regular expressions.
• Set up installation defaults once so that you do not have to specify installation preferences again and again for every monitored data set.
• Monitor multiple occurrences of repetitive jobs without manual intervention or reconfiguration.
• For jobs and started tasks with multiple spooled SYSOUT data sets, specify the data set to be forwarded by a combination of SYSOUT class, DD name, step name, and procedure step name.
• Label the forwarded records so that the output of different jobs and started tasks can be distinguished on the SIEM.

Subject only to available memory, CZAJOBLG supports any number of simultaneous SYSOUT streams. Each stream is called a JOBLOG definition.

Records might be formatted in some application-specific user-defined manner, or simply sent to the SIEM as-is.

CZAJOBLG is typically run as a z/OS started task but might be run as a job if that is preferred. CZAJOBLG requires one or more instances of BMC AMI Defender running on the same LPAR. BMC AMI Defender handles the actual formatting of records for and transmission of the records to the SIEM.

CZAJOBLG supports both JES2 and JES3. All options apply to both JES2 and JES3 except as otherwise indicated.

CZAJOBLG requires that a record layout be pre-defined in BMC AMI Defender. As CZAJOBLG is intended for use primarily with printable logs, the BMC Defender-supplied JOBLOG event type is usually completely satisfactory. The event type must be enabled in BMC AMI Defender with the appropriate SELECT and EVENT statements; see BMC AMI Defender documentation. You might want to define a custom event type to allow for filtering on specific fields, user formatting of specific fields, or for similar reasons.

CZAJOBLG writes a listing of status, diagnostic and error messages on DD CZAPRINT, that typically should be defined as a spooled data set. The messages, numbered from CZA0000 to CZA0199, and from CZA0700 to CZA0799, are documented in BMC AMI Defender for z/OS Messages and Codes.

CZAJOBLG must be APF-authorized.

CZAJOBLG accepts MODIFY and STOP commands from the z/OS system console. The MODIFY command can be used to specify an additional JOBLOG definition, or to cause CZAJOBLG to re-read a parameter file, either the same or a different member, and other options.

This section provides information about the following topics: