Solve:Operations Automation Create message event for CICS DFHSN1105 message and take action
book
Article ID: 192221
calendar_today
Updated On:
Products
SOLVE:Operations AutomationSOLVE:Access Session ManagementSOLVE:FTSSOLVEMAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
Issue/Introduction
There is a CICS message "DFHSN1105 05/15/2020 18:02:20 AC3CIC2 SIGNON AT NETNAME RLURA14 BY USER SPSLYW REQUIRES A PASSWORD."
I want to make a message rule whenever the same message ID(DFHSN1105) happens together with the same user ID(SPSLYW) more than 3 times within 1 minute, I want to take some action.
Environment
Release : 11.9
Component : CA SOLVE:Operations Automation for z/OS
Resolution
Regarding your creation of a new message event.
You can use the Eventview which specifically caters for this exact functionality.
NMDE9--------------- EventView : TEST Message Delivery ---CSNM15
Command ==> Function=UPDATE
Deliver............+
E Threshold sssssssssssssssssssssssssssssssssssssssssssssssssssN
See following sample NCL for the requirement about the message happens 3 times for the same user within 1 minute.
-*--------------------------------------------------------------------* -* SET UP A RULE FOR MESSAGE ID DFHSN1105 AND SET THE MESSAGE ACTION * -* TO RUTO RUN THIS NCL. * -* * -* THIS NCL WILL KEEP TRACK OF WHETHER THE SAME USERID APPEARS * -* THREE TIMES () IN A MINUTE (#INTERVAL). * -* * -* THE DEFAULT ACTION IS TO ISSUE A WTO IN THE FORMAT: * -* * -* PASSWORDX CICS_REGION_NAME USERID COUNT * -* * -* E.G. PASSWORDX AC3CIC2 SPSLYW 3 * -* * -* SET UP ANOTHER RULE TO TRAP THE PASSWORDX MESSAGE AND TAKE WHATEVER* -* ACTION IS DESIRED OR MODIFY THIS NCL TO PERFORM THE ACTION DIRECTLY* -*--------------------------------------------------------------------*
-*--------------------------------------------------------------------* -* IF INVOKED WITH ARG 1 IT WILL BE THE KEY OF THE RECORD TO DELETE * -*--------------------------------------------------------------------* &IF .&1 NE . &THEN + &DO = &1 &VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
&EXIT &DOEND
-*--------------------------------------------------------------------* -* SET UP THE TIME INTERVAL WITHIN WHICH THE THRESHOLD NUMBER OF * -* MESSAGES MUST ARRIVE TO TRIGGER SOME ACTION. FORMAT IS HH.MM.SS * -*--------------------------------------------------------------------* = 00.01.00
-*--------------------------------------------------------------------* -* SET UP THE THRESHOLD VALUE FOR THE NUMBER OF TIMES THE SAME USERID * -* APPEARS WITH THE TIME INTERVAL BEFORE ACTION IS TAKEN * -*--------------------------------------------------------------------* = 3
-*--------------------------------------------------------------------* -* BUILD TABLE KEY OF MESSAGE ID AND USERID FROM THE MESSAGE * -* CHECK TO SEE IF WE ALREADY HAVE A RECORD FOR THIS COMBINATION * -*--------------------------------------------------------------------* = &CONCAT &ZMSGMSGID # &ZMSGWORD11 &VARTABLE GET ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-*--------------------------------------------------------------------* -* IF THE TABLE DOES NOT EXIST ALLOCATE IT NOW * -*--------------------------------------------------------------------* &IF &ZFDBK = 16 &THEN + &VARTABLE ALLOC ID=PASSWORD SCOPE=SYSTEM DATA=1 KEYLEN=32 &ELSE + -*--------------------------------------------------------------------* -* IF THE ENTRY DOES NOT EXIST ADD IT TO THE TABLE AND * -* SET UP A TIMER TO DELETE IT AFTER THE TIME INTERVAL EXPIRES * -*--------------------------------------------------------------------* &IF &ZFDBK = 4 &THEN + &DO = 1 &VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-AT *+ LIMIT=1 ROUTE=SYS PMSG=NO TZ=UTC CMD=CVMSG
&EXIT &DOEND
-*--------------------------------------------------------------------* -* WE FOUND AN EXISTING ENTRY FOR THE USERID SO WE INCREMENT THE COUNT* -*--------------------------------------------------------------------* = + 1
-*--------------------------------------------------------------------* -* IF THE COUNT IS BELOW THE THRESHOLD UPDATE THE TABLE ENTRY * -*--------------------------------------------------------------------* &IF LT &THEN + &VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT &ELSE + &DO -*-----------------------------------------------------------------* -* DELETE THE TABLE ENTRY * -*-----------------------------------------------------------------* &VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY -*-----------------------------------------------------------------* -* THE DEFAULT ACTION IS TO WRITE A WTO WHICH CAN BE PICKED UP BY * -* ANOTHER RULE TO TAKE FURTHER ACTION. * -* SUBSTITUTE YOUR OWN ACTION HERE IF DESIRED * -*-----------------------------------------------------------------* &WTO DATA=PASSWORDX &ZMSGWORD4 &ZMSGWORD11 &DOEND
You can set up a rule for message id DFHSN1105 and set the Message Action to run this NCL. The NCL will keep track of whether the same userid appears three times in a minute and will then take action if it does.
The action is to issue a WTO that looks like this:
PASSWORDX CICS_REGION_NAME USERID COUNT
e.g. PASSWORDX AC3CIC2 SPSLYW 3
You can then set up another rule to trap the PASSWORDX message and take whatever action you need OR you can change the NCL to take the action directly.