Solve:Operations Automation Create message event for CICS DFHSN1105 message and take action
Article ID: 192221
Updated On:
Products
SOLVE:Operations Automation
SOLVE:Access Session Management
SOLVE:FTS
SOLVE
MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
Issue/Introduction
There is a CICS message
"DFHSN1105 05/15/2020 18:02:20 AC3CIC2 SIGNON AT NETNAME RLURA14 BY USER SPSLYW REQUIRES A PASSWORD."
I want to make a message rule whenever the same message ID(DFHSN1105) happens together with the same user ID(SPSLYW) more than 3 times within 1 minute, I want to take some action.
"DFHSN1105 05/15/2020 18:02:20 AC3CIC2 SIGNON AT NETNAME RLURA14 BY USER SPSLYW REQUIRES A PASSWORD."
I want to make a message rule whenever the same message ID(DFHSN1105) happens together with the same user ID(SPSLYW) more than 3 times within 1 minute, I want to take some action.
Environment
Release : 11.9
Component : CA SOLVE:Operations Automation for z/OS
Resolution
Regarding your creation of a new message event.
You can use the Eventview which specifically caters for this exact functionality.
NMDE9--------------- EventView : TEST Message Delivery ---CSNM15
Command ==> Function=UPDATE
Deliver............+
E Threshold sssssssssssssssssssssssssssssssssssssssssssssssssssN
e
e Maximum Number...
e Time Interval…..
e Do Action ........+
e Correlation Key ….
e
DsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
From the online HELP:
Threshold Fields
Maximum Number specifies the maximum number of times the message can arrive within the specified time interval.
Time Interval specifies the time interval for threshold processing.
Valid values are 00.00.01 through 24.00.00.
Do Action specifies how actions associated with the message rule are executed.
Valid values are:
AFTER - The action is performed after the threshold is reached.
BEFORE - The action is performed before the threshold is reached.
ALWAYS - The action is performed regardless of whether the threshold has been reached.
----------------
If you want to do something specific to the resource that can be achieved by running a process as the Message Action.
NMDE9--------------- EventView : TEST Message Actions ----CSNM15
Command ==> Function=UPDATE
Reply Text …
System Command ...
OCS Command ...... FSTOP XYZZY
E Automation Actions ssssssssssssssssssssssssssssssssssssssssssN
e S/B=Browse U=Update L=List
e Process Parameters
e
e
e Command Parameters
e
e
e
DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
------------------------------------------------------------------------------
You can use the Extended Filter to say what USER you want on this panel:
U11NCE71---- EventView : PWDTEST1 Extended Message Filter ----PWD
Command == Function=UPDATE
Message Text ......... PWDTEST1
Wildcard Character ...
Descriptor Code .....+
Route Code ..........+
Message ID ........... (of major line)
System Name ..........
E Message Text Analysis ssssssssssssssssssssssssssssssssssN
e
e Strt Word Scan
e Pos Num Opr Text
e 1
e 2
e 3
e 4
e 5
e
e Expression ..... e.g. 1 and (2 or 3)
DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
----------------------------------------------------------------------------------------
See following sample NCL for the requirement about the message happens 3 times for the same user within 1 minute.
-*--------------------------------------------------------------------*
-* SET UP A RULE FOR MESSAGE ID DFHSN1105 AND SET THE MESSAGE ACTION *
-* TO RUTO RUN THIS NCL. *
-* *
-* THIS NCL WILL KEEP TRACK OF WHETHER THE SAME USERID APPEARS *
-* THREE TIMES () IN A MINUTE (#INTERVAL). *
-* *
-* THE DEFAULT ACTION IS TO ISSUE A WTO IN THE FORMAT: *
-* *
-* PASSWORDX CICS_REGION_NAME USERID COUNT *
-* *
-* E.G. PASSWORDX AC3CIC2 SPSLYW 3 *
-* *
-* SET UP ANOTHER RULE TO TRAP THE PASSWORDX MESSAGE AND TAKE WHATEVER*
-* ACTION IS DESIRED OR MODIFY THIS NCL TO PERFORM THE ACTION DIRECTLY*
-*--------------------------------------------------------------------*
-*--------------------------------------------------------------------*
-* IF INVOKED WITH ARG 1 IT WILL BE THE KEY OF THE RECORD TO DELETE *
-*--------------------------------------------------------------------*
&IF .&1 NE . &THEN +
&DO
= &1
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
&EXIT
&DOEND
-*--------------------------------------------------------------------*
-* SET UP THE TIME INTERVAL WITHIN WHICH THE THRESHOLD NUMBER OF *
-* MESSAGES MUST ARRIVE TO TRIGGER SOME ACTION. FORMAT IS HH.MM.SS *
-*--------------------------------------------------------------------*
= 00.01.00
-*--------------------------------------------------------------------*
-* SET UP THE THRESHOLD VALUE FOR THE NUMBER OF TIMES THE SAME USERID *
-* APPEARS WITH THE TIME INTERVAL BEFORE ACTION IS TAKEN *
-*--------------------------------------------------------------------*
= 3
-*--------------------------------------------------------------------*
-* BUILD TABLE KEY OF MESSAGE ID AND USERID FROM THE MESSAGE *
-* CHECK TO SEE IF WE ALREADY HAVE A RECORD FOR THIS COMBINATION *
-*--------------------------------------------------------------------*
= &CONCAT &ZMSGMSGID # &ZMSGWORD11
&VARTABLE GET ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-*--------------------------------------------------------------------*
-* IF THE TABLE DOES NOT EXIST ALLOCATE IT NOW *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 16 &THEN +
&VARTABLE ALLOC ID=PASSWORD SCOPE=SYSTEM DATA=1 KEYLEN=32
&ELSE +
-*--------------------------------------------------------------------*
-* IF THE ENTRY DOES NOT EXIST ADD IT TO THE TABLE AND *
-* SET UP A TIMER TO DELETE IT AFTER THE TIME INTERVAL EXPIRES *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 4 &THEN +
&DO
= 1
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-AT *+ LIMIT=1 ROUTE=SYS PMSG=NO TZ=UTC CMD=CVMSG
&EXIT
&DOEND
-*--------------------------------------------------------------------*
-* WE FOUND AN EXISTING ENTRY FOR THE USERID SO WE INCREMENT THE COUNT*
-*--------------------------------------------------------------------*
= + 1
-*--------------------------------------------------------------------*
-* IF THE COUNT IS BELOW THE THRESHOLD UPDATE THE TABLE ENTRY *
-*--------------------------------------------------------------------*
&IF LT &THEN +
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
&ELSE +
&DO
-*-----------------------------------------------------------------*
-* DELETE THE TABLE ENTRY *
-*-----------------------------------------------------------------*
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
-*-----------------------------------------------------------------*
-* THE DEFAULT ACTION IS TO WRITE A WTO WHICH CAN BE PICKED UP BY *
-* ANOTHER RULE TO TAKE FURTHER ACTION. *
-* SUBSTITUTE YOUR OWN ACTION HERE IF DESIRED *
-*-----------------------------------------------------------------*
&WTO DATA=PASSWORDX &ZMSGWORD4 &ZMSGWORD11
&DOEND
You can set up a rule for message id DFHSN1105 and set the Message Action to run this NCL.
The NCL will keep track of whether the same userid appears three times in a minute and will then take action if it does.
The action is to issue a WTO that looks like this:
PASSWORDX CICS_REGION_NAME USERID COUNT
e.g. PASSWORDX AC3CIC2 SPSLYW 3
You can then set up another rule to trap the PASSWORDX message and take whatever action you need OR you can change the NCL to take the action directly.
You can use the Eventview which specifically caters for this exact functionality.
NMDE9--------------- EventView : TEST Message Delivery ---CSNM15
Command ==> Function=UPDATE
Deliver............+
E Threshold sssssssssssssssssssssssssssssssssssssssssssssssssssN
e
e Maximum Number...
e Time Interval…..
e Do Action ........+
e Correlation Key ….
e
DsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
From the online HELP:
Threshold Fields
Maximum Number specifies the maximum number of times the message can arrive within the specified time interval.
Time Interval specifies the time interval for threshold processing.
Valid values are 00.00.01 through 24.00.00.
Do Action specifies how actions associated with the message rule are executed.
Valid values are:
AFTER - The action is performed after the threshold is reached.
BEFORE - The action is performed before the threshold is reached.
ALWAYS - The action is performed regardless of whether the threshold has been reached.
----------------
If you want to do something specific to the resource that can be achieved by running a process as the Message Action.
NMDE9--------------- EventView : TEST Message Actions ----CSNM15
Command ==> Function=UPDATE
Reply Text …
System Command ...
OCS Command ...... FSTOP XYZZY
E Automation Actions ssssssssssssssssssssssssssssssssssssssssssN
e S/B=Browse U=Update L=List
e Process Parameters
e
e
e Command Parameters
e
e
e
DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
------------------------------------------------------------------------------
You can use the Extended Filter to say what USER you want on this panel:
U11NCE71---- EventView : PWDTEST1 Extended Message Filter ----PWD
Command == Function=UPDATE
Message Text ......... PWDTEST1
Wildcard Character ...
Descriptor Code .....+
Route Code ..........+
Message ID ........... (of major line)
System Name ..........
E Message Text Analysis ssssssssssssssssssssssssssssssssssN
e
e Strt Word Scan
e Pos Num Opr Text
e 1
e 2
e 3
e 4
e 5
e
e Expression ..... e.g. 1 and (2 or 3)
DssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssM
----------------------------------------------------------------------------------------
See following sample NCL for the requirement about the message happens 3 times for the same user within 1 minute.
-*--------------------------------------------------------------------*
-* SET UP A RULE FOR MESSAGE ID DFHSN1105 AND SET THE MESSAGE ACTION *
-* TO RUTO RUN THIS NCL. *
-* *
-* THIS NCL WILL KEEP TRACK OF WHETHER THE SAME USERID APPEARS *
-* THREE TIMES () IN A MINUTE (#INTERVAL). *
-* *
-* THE DEFAULT ACTION IS TO ISSUE A WTO IN THE FORMAT: *
-* *
-* PASSWORDX CICS_REGION_NAME USERID COUNT *
-* *
-* E.G. PASSWORDX AC3CIC2 SPSLYW 3 *
-* *
-* SET UP ANOTHER RULE TO TRAP THE PASSWORDX MESSAGE AND TAKE WHATEVER*
-* ACTION IS DESIRED OR MODIFY THIS NCL TO PERFORM THE ACTION DIRECTLY*
-*--------------------------------------------------------------------*
-*--------------------------------------------------------------------*
-* IF INVOKED WITH ARG 1 IT WILL BE THE KEY OF THE RECORD TO DELETE *
-*--------------------------------------------------------------------*
&IF .&1 NE . &THEN +
&DO
= &1
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
&EXIT
&DOEND
-*--------------------------------------------------------------------*
-* SET UP THE TIME INTERVAL WITHIN WHICH THE THRESHOLD NUMBER OF *
-* MESSAGES MUST ARRIVE TO TRIGGER SOME ACTION. FORMAT IS HH.MM.SS *
-*--------------------------------------------------------------------*
= 00.01.00
-*--------------------------------------------------------------------*
-* SET UP THE THRESHOLD VALUE FOR THE NUMBER OF TIMES THE SAME USERID *
-* APPEARS WITH THE TIME INTERVAL BEFORE ACTION IS TAKEN *
-*--------------------------------------------------------------------*
= 3
-*--------------------------------------------------------------------*
-* BUILD TABLE KEY OF MESSAGE ID AND USERID FROM THE MESSAGE *
-* CHECK TO SEE IF WE ALREADY HAVE A RECORD FOR THIS COMBINATION *
-*--------------------------------------------------------------------*
= &CONCAT &ZMSGMSGID # &ZMSGWORD11
&VARTABLE GET ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-*--------------------------------------------------------------------*
-* IF THE TABLE DOES NOT EXIST ALLOCATE IT NOW *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 16 &THEN +
&VARTABLE ALLOC ID=PASSWORD SCOPE=SYSTEM DATA=1 KEYLEN=32
&ELSE +
-*--------------------------------------------------------------------*
-* IF THE ENTRY DOES NOT EXIST ADD IT TO THE TABLE AND *
-* SET UP A TIMER TO DELETE IT AFTER THE TIME INTERVAL EXPIRES *
-*--------------------------------------------------------------------*
&IF &ZFDBK = 4 &THEN +
&DO
= 1
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
-AT *+ LIMIT=1 ROUTE=SYS PMSG=NO TZ=UTC CMD=CVMSG
&EXIT
&DOEND
-*--------------------------------------------------------------------*
-* WE FOUND AN EXISTING ENTRY FOR THE USERID SO WE INCREMENT THE COUNT*
-*--------------------------------------------------------------------*
= + 1
-*--------------------------------------------------------------------*
-* IF THE COUNT IS BELOW THE THRESHOLD UPDATE THE TABLE ENTRY *
-*--------------------------------------------------------------------*
&IF LT &THEN +
&VARTABLE PUT ID=PASSWORD SCOPE=SYSTEM KEY=#KEY FIELDS=D1 VARS=#CNT
&ELSE +
&DO
-*-----------------------------------------------------------------*
-* DELETE THE TABLE ENTRY *
-*-----------------------------------------------------------------*
&VARTABLE DELETE ID=PASSWORD SCOPE=SYSTEM KEY=#KEY
-*-----------------------------------------------------------------*
-* THE DEFAULT ACTION IS TO WRITE A WTO WHICH CAN BE PICKED UP BY *
-* ANOTHER RULE TO TAKE FURTHER ACTION. *
-* SUBSTITUTE YOUR OWN ACTION HERE IF DESIRED *
-*-----------------------------------------------------------------*
&WTO DATA=PASSWORDX &ZMSGWORD4 &ZMSGWORD11
&DOEND
You can set up a rule for message id DFHSN1105 and set the Message Action to run this NCL.
The NCL will keep track of whether the same userid appears three times in a minute and will then take action if it does.
The action is to issue a WTO that looks like this:
PASSWORDX CICS_REGION_NAME USERID COUNT
e.g. PASSWORDX AC3CIC2 SPSLYW 3
You can then set up another rule to trap the PASSWORDX message and take whatever action you need OR you can change the NCL to take the action directly.
Feedback
Yes
No
Powered by
