Solve:Operations Automation Create message event for CICS DFHSN1105 message and take action

Products

• SOLVE:Operations Automation
• SOLVE:Access Session Management
• SOLVE:FTS
• SOLVE
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME

Issue/Introduction

There is a CICS message 
"DFHSN1105 05/15/2020 18:02:20 CICS SIGNON AT NETNAME aaaaaa BY USER uuuuuu REQUIRES A PASSWORD."

Would like to make a message rule whenever the same message ID(DFHSN1105) happens together with the same user ID(uuuuuu) more than 3 times within 1 minute, then would like to take some action on the message.

Environment

Release : 11.9

Component : SOLVE:Operations Automation for z/OS

Resolution

Regarding creation of a new message event.

You can use the Eventview which specifically caters for this exact functionality.



NM --------------- EventView : TEST Message Delivery ---XXXXX

Command ==> Function=UPDATE



Deliver............+





E Threshold sssssssssssssssssssssssssssssssssssssssssssssssssssN

e

e Maximum Number...



e Time Interval…..



e Do Action ........+



e Correlation Key ….

e

DsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM





From the online HELP:



Threshold Fields

Maximum Number specifies the maximum number of times the message can arrive within the specified time interval.



Time Interval specifies the time interval for threshold processing.
Valid values are 00.00.01 through 24.00.00.





Do Action specifies how actions associated with the message rule are executed.

Valid values are:



AFTER - The action is performed after the threshold is reached.



BEFORE - The action is performed before the threshold is reached.





ALWAYS - The action is performed regardless of whether the threshold has been reached.





----------------



If you want to do something specific to the resource that can be achieved by running a process as the Message Action.



NM --------------- EventView : TEST Message Actions ----CSNM 

Command ==> Function=UPDATE



Reply Text …



System Command ...



OCS Command ...... FSTOP XYZZY





E Automation Actions ssssssssssssssssssssssssssssssssssssssssssN

e S/B=Browse U=Update L=List

e Process Parameters

e

e

e Command Parameters

e

e

e

DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM


------------------------------------------------------------------------------

You can use the Extended Filter to say what USER you want on this panel:



U11NCE71---- EventView : <test> Extended Message Filter ----PWD

Command == Function=UPDATE



Message Text ......... <test>

Wildcard Character ...

Descriptor Code .....+

Route Code ..........+

Message ID ........... (of major line)

System Name ..........



E Message Text Analysis ssssssssssssssssssssssssssssssssssN

e

e Strt Word Scan
e Pos Num Opr Text

e 1

e 2

e 3

e 4

e 5

e

e Expression ..... e.g. 1 and (2 or 3)



DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM

----------------------------------------------------------------------------------------

See following sample NCL for the requirement about the message happens 3 times for the same user within 1 minute.


-*--------------------------------------------------------------------*
-* SET UP A RULE FOR MESSAGE ID DFHSN1105 AND SET THE MESSAGE ACTION *
-* TO RUTO RUN THIS NCL. *
-* *
-* THIS NCL WILL KEEP TRACK OF WHETHER THE SAME USERID APPEARS *
-* THREE TIMES () IN A MINUTE (#INTERVAL). *
-* *
-* THE DEFAULT ACTION IS TO ISSUE A WTO IN THE FORMAT: *
-* *
-* PASSWORDX CICS_REGION_NAME USERID COUNT *
-* *
-* E.G. PASSWORDX CICS uuuuuuu 3 *
-* *
-* SET UP ANOTHER RULE TO TRAP THE PASSWORDX MESSAGE AND TAKE WHATEVER*
-* ACTION IS DESIRED OR MODIFY THIS NCL TO PERFORM THE ACTION DIRECTLY*
-*--------------------------------------------------------------------*

-*--------------------------------------------------------------------*
-* IF INVOKED WITH ARG 1 IT WILL BE THE KEY OF THE RECORD TO DELETE *
-*--------------------------------------------------------------------*
&IF .&1 NE . &THEN +
&DO
= &1
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY

&EXIT
&DOEND

-*--------------------------------------------------------------------*
-* SET UP THE TIME INTERVAL WITHIN WHICH THE THRESHOLD NUMBER OF *
-* MESSAGES MUST ARRIVE TO TRIGGER SOME ACTION. FORMAT IS HH.MM.SS *
-*--------------------------------------------------------------------*
= 00.01.00

-*--------------------------------------------------------------------*
-* SET UP THE THRESHOLD VALUE FOR THE NUMBER OF TIMES THE SAME USERID *
-* APPEARS WITH THE TIME INTERVAL BEFORE ACTION IS TAKEN *
-*--------------------------------------------------------------------*
= 3

-*--------------------------------------------------------------------*
-* BUILD TABLE KEY OF MESSAGE ID AND USERID FROM THE MESSAGE *
-* CHECK TO SEE IF WE ALREADY HAVE A RECORD FOR THIS COMBINATION *
-*--------------------------------------------------------------------*
= &CONCAT &ZMSGMSGID # &ZMSGWORD11
&VARTABLE GET ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT

-*--------------------------------------------------------------------*
-* IF THE TABLE DOES NOT EXIST ALLOCATE IT NOW *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 16 &THEN +
&VARTABLE ALLOC ID=PASSWORD SCOPE=SYSTEM DATA=1 KEYLEN=32
&ELSE +
-*--------------------------------------------------------------------*
-* IF THE ENTRY DOES NOT EXIST ADD IT TO THE TABLE AND *
-* SET UP A TIMER TO DELETE IT AFTER THE TIME INTERVAL EXPIRES *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 4 &THEN +
&DO
= 1
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT

-AT *+ LIMIT=1 ROUTE=SYS PMSG=NO TZ=UTC CMD=CVMSG

&EXIT
&DOEND

-*--------------------------------------------------------------------*
-* WE FOUND AN EXISTING ENTRY FOR THE USERID SO WE INCREMENT THE COUNT*
-*--------------------------------------------------------------------*
= + 1

-*--------------------------------------------------------------------*
-* IF THE COUNT IS BELOW THE THRESHOLD UPDATE THE TABLE ENTRY *
-*--------------------------------------------------------------------*
&IF LT &THEN +
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
&ELSE +
&DO
-*-----------------------------------------------------------------*
-* DELETE THE TABLE ENTRY *
-*-----------------------------------------------------------------*
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
-*-----------------------------------------------------------------*
-* THE DEFAULT ACTION IS TO WRITE A WTO WHICH CAN BE PICKED UP BY *
-* ANOTHER RULE TO TAKE FURTHER ACTION. *
-* SUBSTITUTE YOUR OWN ACTION HERE IF DESIRED *
-*-----------------------------------------------------------------*
&WTO DATA=PASSWORDX &ZMSGWORD4 &ZMSGWORD11
&DOEND


You can set up a rule for message id DFHSN1105 and set the Message Action to run this NCL.
The NCL will keep track of whether the same userid appears three times in a minute and will then take action if it does.

The action is to issue a WTO that looks like this:

PASSWORDX CICS_REGION_NAME USERID COUNT

e.g. PASSWORDX CICS uuuuuu 3

You can then set up another rule to trap the PASSWORDX message and take whatever action you need OR you can change the NCL to take the action directly.