Installation Instructions

Receive the XMIT file as described in the installation instructions as received with your order (free or payed) of your ZSS license key.

Make sure the load-library is APF-authorized. We require this to make ourselves non-swappable. Also, we like to be able to open an Extended Master Console Session (EMCS). Should you have any worries regarding the code we run, being APF-authorized and all, you can apply for a code-review at support@zdevops.com. This, obviously, is an NDA-compliant review and thus cannot be discussed outside the scope it

Make sure you have the IP and PORT for your Splunk indexer (we support TCP connetions only)

Submit the following JCL to test your setup (substituting ip and port with valid values):

//ZSS     EXEC PGM=ZSSMAIN, 
//             REGION=64M, 
//             PARM='POSIX(ON)/<ip>,<port>,EMCSID' 
//STEPLIB   DD DSN=ZSS.LOAD, 
//             DISP=SHR 
//SYSPRINT  DD SYSOUT=* 
//ZSS#CNTL  DD * 
lic = xxxxxxxxxx
validto = xxxxxxxx
msgid = bpxf024i

That will result in all BPXF024I messages being forwarded to your Splunk indexer at the specified ip and port using an EMCS session ID as specified.

Trigger such a message by executing the following command either via an SSH session into your Mainframe or via your trusted “TSO OMVS” environment:

echo "Testing ZSS Setup" > /dev/console

You should then be able to find the following data in you Splunk environment.

You can now start specifying all the messages you want to send to your Splunk environment. You can specify multiple msgid’s (fully or partially qualified) on a single line seperated by a comma. You can also repeat the msgid line in the control statements. If you omit the msgid keyword from the control statements ZSS will forward all messages to Splunk.

Control Statements

Below is an example set of control statements that cover the statements you can provide.

msgid = iea , ief
msgid = ich408i
msgid = $HASP
lic = 3FA5820E18F34B94B6D9341297F8C79439C3B832819838AB542F75F128DA9CED
validto = 20200804

The lic statement specifies your license key. The validto statement specifies the last date at which your license key is valid. If either of these do not match the license information the product will not run.

The msgid statement can be repeated multiple times. You can specify one or more message filters per line.

Messages and Codes

ZSSE000I ERROR ACTIVATING CONSOLE

EMCS could not be activated. Check syslog for messages.

ZSSE001I ERROR TRYING TO GET A MESSAGE

EMCS could not read the message from the SYSLOG, processing continutes

ZSSE002I CONSOLE IS ALREADY ACTIVE

An EMCS with the specified name is already active. Either stop the console with the duplicate name or start ZSS with a different EMCS name.

ZSSE003I EMCS has been activated..

The EMCS is active and running in it’s separate thread.

ZSSE005I EMCS has been deactivated..

EMCS is deactivated. This message is shown when stopping ZSS.

ZSSE006I ERROR DEACTIVATING CONSOLE

EMCS cannot be deactivated. If ZSS stops normally this is not an issue.

ZSSE007I ALERT DETECTED - DEACTIVATING CONSOLE

Jikes! @Loet, wat zetten we hier neer 🙂

ZSSE008I Modify Handler active...

Idem deze///

ZSSE009I CONSOLE QUEUEING STOPPED DUE TO MEMORY LIMIT

The specified region is not large enough to queue all messages from the syslog. Either you’ve some severe message flooding, or the region is just too small.

ZSSE010I CONSOLE QUEUEING STOPPED DUE TO DEPTH LIMIT

Too many messages in the queue to be processed.

ZSSE011I INTERNAL SYSTEM ERROR ON CONSOLE

Jikes! Major issues. @loet ik denk dit moet een E worden?

ZSSE012I RECEIVED QUEUE DEPTH ALERT

Message queue is increasing……

ZSSE013I ZSSOUT Open Error..

Error opening ZSSOUT DD for debugging purposes.

ZSSE013I PUT to ZSSOUT......

@LOET? wat moet hier?

ZSSC001E On Error Active

Severe error during ZSS#CNTL processing. Make sure all keywords are specified correctly. Otherwise contact support.

ZSSC002I Capture all syslogrecords..

You did not specify any message filtering. All messages will be forwarded to Splunk.

ZSSL021I License expires within <days> days

Your license will expire in <days> days. Renew your license by sending an e-mail to support@zdevops.com requesting a new license for your ZSS product.

ZSSL021E Grace Period exceeded, license downgraded

Your license has expired, including a seven day grace period. Get a new license key via support@zdevops.com

ZSSL022W Grace Period started, for a maximum of 7 days

Your license has expired, in case you forgot to renew your license, a 7 day grace period is now in effect. Get a new license key via support@zdevops.com

ZSSL020E CSNBOWH RC:rc RSN:rsn

Severe error during CSNBOWH processing. Contact support@zdevops.com unless you also have a ZSSL022E error message following this error.

ZSSL022E ICSF may not be active.

ICSF may not be active. It’s required to perform essential crypto functions.
Make sure ICSF is active

ZSSM099I ZSS ended..

ZSS has ended.

ZSSM098E On Error Active in mainline..

Severe error in ZSS. Contact support@zdevops.com

ZSSM097E Execution parameters fault

You have specified an incorrect PARM. Refer to the documentation or contact support.

ZSSM005I Execution Parameters Accepted..

All execution parameters accepted.

ZSSM096E Invalid Control Statement(s)

There’s not much more to say. Check your ZSS#CNTL

ZSSM006I Control Statements Accepted..

A job well done. All control statements in ZSS#CNTL are accepted.

ZSSM125E No valid license key

Your license key is invalid. Get a valid license key via support@zdevops.com

ZSSM002I Enjoy your FREE license

You are running the free version of ZSS. Enjoy!

ZSSM001I ZSSSUB thread finished

Thread finished.

ZSSM002I ZSSROUT thread finished

Thread finished

ZSSP099E On Error Active..

Severe error during PARM processing.

ZSSR098E On Error Active..

Severe error during routing.

ZSSR001I ZSSSEND thread finsihed in router

Thread in router has finished

ZSSR097E ZSSsend RC > 0

Errors in sending

ZSSR096I Probably Splunk server is not active

Follow up message to ZSSR097E, most likely Splunk cannot be reached or is not active.

ZSSU098E On Error Active..

Severe error in SUB thread.

ZSSU002I Thread ended..

SUB thread ended