SDSF

Introduction

SDSF - System Display and Search Facility is a utility on the z/OS systems that can allow you to go through the various types of logs on the z/OS system, including logs from different systems within a Sysplex.
It's a window into the z/OS system (or sysplex) that provides the data centre personnel the information they need to perform all of their day-to-day duties.

There are many things that can be monitored from within SDSF

While at first SDSF was only available for systems operating with JES2, z/OS 1.10 has introduced the ability for JES3 systems to also make use of SDSF.

The notes here will provide information for JES2 systems only

Some of the things you can do with SDSF include

Contents

The SDSF menu has many entries and it shouldn't be hard to see how some of them correlate to the JES2 process

Some other entries in the menu allow you to manage more things:

The menu also includes various system and resource management entries

Accessing and using SDSF

Apart from the interactive version, you can also access SDSF in the following ways

As mentioned, batch jobs can be used to invoke SDSF, for example to avoid losing time by retyping the same SDSF commands for commonly performed tasks.
JCL can be defined to use either the SDSF or ISFAFD utilities, with the main difference between the two being that ISFAFD accepts overtyping the commands and the us of the PF keys.

The ability to use REXX programs to interact with SDSF was introduced in z/OS 1.9 while the ability to use Java was introduced in z/OS 1.12

The interactive version of SDSF can be accessed directly from TSO using the SDSF command, however it is recommended to use ISPF and select the appropriate item there.

SDSF menu

How the SDSF menu will look for you after you start it will depend on the authority that was assigned to the user ID you are using and not all options might be available for you.

As the SDSF menu is hierarchical, not all options will be available from the first, topmost menu, and some options might be available from multiple entries in that top menu.

When in the menu, you can use TAB to move your cursor to the option you want to enter and press ENTER.
Alternatively, you can type the name of the option into the command line, and enter that way.

Most of the data in SDSF will be presented in the form of a table with each row being one entry, consisting of many columns.

Pressing ENTER will refresh the data on the screen.

Columns

The columns that are displayed by default when you first enter SDSF are called the primary field list.

You can use the ? command in order to see the alternate fields that were configured for this SDSF panel. After entering the command, some columns will remain in place, while the new, alternative columns will be displayed on the right and highlighted. Entering the command again will revert to the primary columns

in a Sysplex environment, activity from multiple systems will be shown together, with the SYSNAME column showing which system the entry belongs to.

Colours within the columns

Pop-Up boxes

If SDSF is ran under ISPF, many commands can be entered that will display a pop-up box that will contain more information and sometimes allow for things to be changed or defined in an interactive way.

For example ARRANGE ? will display a the popup.
Most of the commands that will display a popup are with the ? sign.

if incorrect values are entered in the popup box, it should display an error message and give you a chance to remedy the incorrect values.

Action bar and SET SCREEN

Apart from the command line, the action bar at the top of the screen can also be used to interact with the SDSF.

To interact with it, you can place the cursor over the items on it and press ENTER. Depending on the setup, you might be able to use the mouse to achieve this as well.

Doing so should open a popup for the selected action bar item. Within that popup you can place the cursor on one of the options, or type the number next to it and press ENTER in order to select it.
Note: If the number next to an option is replaced with an * this usually indicates that this option cannot be selected right now. If an option ends with ... then selecting it will display another popup prompting you for more information.

Most of what can be achieved with the action bar can be achieved with typed-in commands, and you might want to disable the action bar in order to give more space for the actual entries to be displayed.

To open a popup that will allow you to disable the action bar, you can enter the SET SCREEN command.

This pop up also allows you to customise the default point-and-shoot settings

To edit the colours, highlight and the intensity of the entries being displayed, the same SET SCREEN command can be issued.
The lower part of the popup will contain separate settings for the Colour of the text, the type of highlight to be used and the intensity. Separate settings can be applied to

If you need to restore a value to the default, simply erase the current value.
The F5 key can be used to refresh the window content and ENTER can be used to confirm any changes

For example the top line with the paging, I/O and CPU stats is the Title Lane

PF Key shortcuts

Many actions can be done with the PF keys
If running under ISPF, in order to display what can you do with them you can use the PFSHOW command.
In order to hide the help you can use the PFSHOW OFF command and to modify the function key values you can use the KEYS command.

The PF3 key or the END command can be used to go 'up' a level, while the PF4 key or RETURN will immediately put you back at ISPF or TSO.

PF11 will scroll the columns, letting you see more information

HELP

Help specific to the panel you're at can be displayed by pressing the PF1 key.
If accessed through ISPF, you can also issue TUTOR in order to get an interactive tutorial on using SDSF.

The SET CURSOR command

The SET CURSOR command can be used in order to determine what happens to the cursors position after you press ENTER.

The SET CONFIRM command

The SET CONFIRM command can be used in order to prevent commands that can purge jobs and output being issued accidentally.

After issuing SET CONFIRM ON, a confirmation popup will appear every time you issue a command such as CANCEL or PURGE.

Purging a job can be achieved by typing in P in the NP field on the line of a job.

SET CONFIRM OFF will disable the confirmation popup from appearing each time a dangerous command is entered while SET CONFIRM ? will allow you to check the status of the confirmation popup setting.

The SET BROWSE command

After tabbing over to an entry on the list and pressing ENTER, the default browsing action will happen.
This could be S (SDSF browse) ,SB (ISPF browse) or SE (ISPF edit)

The SET BROWSE ? command will display a popup menu that will allow you to define the default option for this situation
SET BROWSE NONE can be used to make it so no action is taken by deafult

The SET FFPS command

This command allows you to set the Point-and-shoot behaviour of the SDSF session (note that set screen is still used for the defaults)
For example SET FFPS ON will enable the point-and-shoot feature

The SET PAS command

This command is an alias for the SET FFPS command above, they act the same

The SET ACTION command

When displaying most of the SDSF screens you can type in a short command into the NP field (or as mentioned in previous section, just press enter)

In order to see what short commands can be entered in the NP field, you can use the SET ACTION ON command in the command line
There are a few variations of this command:

Invoking REXX on a SDSF row

By using the % character in the NP row, you can also invoke a REXX program on it.
You can specify the program to be ran (and any parameters to be supplied to it) directly in the NP field, or you can provide just the % character alone. This will display a popup that will let you populate the rest of the information.

Auto-refresh of the data

As you might know, pressing the ENTER key, will refresh the data visible on the screen.

The use of & character in the command line followed by a number of seconds will automatically refresh the values shown.
For example &10 will refresh the shown panel every 10 seconds.
The updates can happen between every 2 and 999 seconds.

This can be stopped by pressing the RESET key and PA1, (or if at a SNA terminal, the Attn key)

Entering JES / MVS commands from SDSF

Sometimes you might want to run a quick JES or MVS command while in SDSF.
This can be achieved, by prefixing the command with the / character typing it into the SDSF command line.

For example:
/D R,L
After executing the command, there should a confirmation of it in the top-right corner of the screen.
If you need to enter a command that is longer than the COMMAND line in SDSF, then you can put the + sign at the end of the command. This will display a panel that will allow you to extend the entered command.

Checking if you're authorized

If you enter a command, you might not receive the response you expect, or have an error message in the top-right corner.
If this happens, it might be because you're not authorized to use that command.
In order to display the commands you're authorized to use you can use the ```

QUERY AUTH

Another command that can be useful in checking your authorization, is the

WHO

command. This command will display the current version of several products associated with the data that is associated with what SDSF displays, as well as the group name linked to the security privileges that you have.

Printing data from SDSF

There are many commands that you can use to print things from within SDSF

There are 3 main steps in printing

  1. Define where to print to
    • print request can be sent to SYSOUT, a data set of your choosing or to a pre-allocated ddname
  2. Print the data
    • There are many commands that can achieve this
  3. Stop the print process
    • This will free up whatever was opened for the printing process

PRINT or PRINT OPEN can be entered on any SDSF panel and will use the default SYSOUT data set. If successful you'll have a message in the top right.
Some other examples include

PRINT OPEN T 3 STD2 - print open can have extra parameters that describe the data set to be printed to. T indicates the class of the sysout, 3 specifies the number of copies required and STD2 defines the special forms required. If they are not entered, the defaults for your system will be used.

PRT SYSOUT - print can be shortened to PRT, or even PT, the SYSOUT added at the end will open a panel that will allow you to configure the attributes, instead of you having to type them in alongside the command, or using the defaults for the system.

PRINT ODSN datasetName - If you already have a dataset that you'd want to print to, you can specify it like so. The existing data in the dataset will be overwritten Extra parameters can be added, but it might be easier to just use the next command

PRINT DATASET - This will display a panel that will let you specify the data set, new or existing and some additional attributes for it.

PRINT FILE - This command display a panel that will let you specify what ddname the screen should be printed to.

So for example to open a sysout data set by default and define an output class (in this case S) you can use
PRINT OPEN S
or
PRT SYSOUT

Apart from entering the commands, you can also enter a short command into the NP field to print output of a job

There are a few ways of printing the screen image

if under TSO, you can enter the PRINT SCREEN command, which will send a copy of the current screen into the sysout or dataset that was defined as the print location

Under ISPF, there are a few options you can use:

When viewing the output, you can choose to print only parts of it, for example
PRINT 11 25 will print the contents of the currently viewed output, starting at line 11 and finishing at line 25.
The first number can be replaced with an * which would indicate the current top of the screen. In this case, the second number will not be an absolute line number, but the number of lines to print.

Additional commands can be used when viewing the log to pint only parts of it, for example the timeframe from which the log should be printed
PT 21:00:00 04/15/2024 22:00:00 04/15/2024 this command will print the log entries from the specified time frame (1 hour) The date part can be omitted and will default to the current day.

To be able to finish printing you need to close the print operation. This will usually be done on logout, but if you want to do it sooner, you can do so manually with
PRINT CLOSE

Filtering

SET DISPLAY command

If you have entered a new panel, and you see only a few entries, there is a good chance there is a filter applied.
You can type SET DISPLAY ON to display the current viewing filters. They will be shown just below the command line.

There will be a few values there

Similarly SET DISPLAY OFF will hide this information (without disabling the filters)

PREFIX command

PREFIX or PRE command will allow you to specify the jobs displayed to use the prefix filter

DEST command

You can set the DEST filter in a similar way

OWNER command

The same scheme as the PREFIX applies here

SYSNAME command

This one is useful in Sysplex situations, where SDSF might be able to pull logs from multiple systems at once and the same scheme applies

SELECT command Temporary filter override

In some cases, you might have multiple filters set but want to quickly check the unfiltered log, without completely disabling the filters you currently have
The SELECT or S command can be used to perform that.

FILTER command

While the filters shown before are nice and good, you can use the FILTER command to create more complex and advanced filters

FILTER <Column name> <filter type> <value> is the general structure of the filter command

for example
FILTER MAX-RC EQ ABEND* will apply a filter where the value in MAX-RC column is EQual to the pattern ABEND* (begins with ABEND)

When running SDSF under ISPF, the FILTER ? command will display a pop-up window that will let you show the current filters and add new ones.

This will allow you to define many filters and a AND/OR relation between the filters

If not under ISPF, you will not be able to add new filters with this command.

FILTER OFF can be used to temporarily disable the filtering, FILTER ON will re-enable it.

All filtering options can also be accessed from the action bar on the top of the screen

Searching for data

Displaying Alternate fields

On SDSF panels with tabular data, there will be columns displayed, additional attributes can be accessed by typing in ? in the command line, or by simply scrolling right with the RIGHT command (or the PF) keys.

Note that the primary and alternative fields can be configured by the admin

Column numbers

In order to look for text in a specific column number range you can use a "ruler" that displays the number of the column above it
You can enable it with COLS and disable with RESET

FIND command

the FIND or F command can be used to search (from top to bottom) through the data
For example when you are viewing the SYSLOG and need to search that this specific job has run you can issue

FIND A#CLNRES

This will find the first instance of the text and place the cursor on the first letter of the text (and show a message in the top right corner of the screen)

To look for the next instance you can issue the IFIND command, or press the F5 key.

If you want to find the last reference to something, you can scroll to the bottom of the log.
You can do that quickly by using the M command and pressing F8 (the scroll down key).
Afterwards you can issue the FIND command with the PREV parameter to look for the previous instance of the thing you're looking for. For example:

FIND A#CLNRES PREV

And again, the F5 key or IFIND command can be used to repeat that

There are more things you can specify in the FIND command to make more complex searches, for example

Unsuccessful FIND requests

Sometimes you might not FIND what you asked for, there are two scenarios like that

Changing the FIND limit

If you want to change the limit that was mentioned in the second situation above, you can use the
FINDLIM command, either by using it together with a number to determine the limit or interactively as FINDLIM ?

LOCATE command

Sometimes you might not be able to FIND what you want. The LOCATE command may be useful. It is also able to scroll to the correct column or line

Arranging data

ARRANGE Command

The ARRANGE or ARR command can be used to modify in which order columns are displayed on the display, as well as to change the width of columns

You can use ARRANGE ? to configure this interactively

Within this menu, you can select which column you want to move by typing / next to it and A (after) or B (before) next to the column you want to move it next to.
You can also move blocks of columns, by using // instead at the start and end of the block.

Next to that, you can also change the width of the columns by typing in numbers.

The menu allows you to perform some additional actions, which are explained within.

The pop up window can also be accessed from the top menu bar in VIEW - Arrange option.

You can also make changes to the arrangement from the command line

Sorting data

Sorting by column value

The easiest way to sort data is to select a column by placing the cursor over it and pressing enter. Doing it again will change the order in which the things are sorted.

SORT command

Another way to sort things is with the SORT command.
You can use SORT ? to interactively configure it.
SORT allows you to set up to 10 sorts in order (for example first sort by the job name and then sort the jobs with the same name by the CPU% they use)

The pop-up menu can also be accessed from the top menu bar in VIEW - SORT option.

You can also use the SORT command directly, for example

Log types on the system

SYSLOG

SYSLOG will usually be configured to be the default log on the system that can be accessed with the LOG command (the other most common option being OPERLOG)

If SYSLOG is not set to be the default, you can access it with LOG S command (if you have the sufficient authority)

The top of the SYSLOG contains fields that describe the characteristics of the log, including the name of it, the JES job number and the dataset number associated with the log, system ID, date, number of lines in the log, number of outstanding WTOR messagesetc.

When entering the log, you will be placed at the bottom, where the most recent data is placed. While the log will keep being updated while open, it will not update the display automatically, it will do so when you press the ENTER key.

Each line of data in the log is a maximum of 130 characters long and consist of multiple columns

The characters at the start of the line describe the record and request type
Common record types include

  • N - normal, single line message
  • M - Multi-line message
    And the common request types include
  • C - Command
  • R - Response to a command

What follows those is the routing code information for the first 28 routing codes (shown in hex)

The next column will display from which system name did the message originate, as well as a timestamp for it.

It also shows the TOS user / job DI / started task ID / or a multi-line ID associated with the message in the log.

The next column contains the user exit flag

And the final column, finally has the actual message .

The maximum length that the SYSLOG will display is 130 characters

WTOR messages

If you have the sufficient authority you can notice that when you access the log some messages at the bottom of the screen are displayed in a different colour.
Those messages are the WTOR (Write To Operator with Reply) messages. You can reply to those messages with the command line on the top of the screen

/02,U will reply with “U” to the WTOR message with the ID of 02

If those messages are not being displayed on your screen, you might not have the appropriate privileges granted by the administrator, or the ACTION command has been used to suppress them

ACTION command

You can enter te ACTION ? Command to check which WTOR messages are currently being displayed and which ones are currently being suppressed.

You can issue the command with different parameters to determine which WTORs to show or hide.

  • ACTION 1 2 USER
    • Up to 4 routing codes can be specified in the command to be displayed. This command will display WTORs for routing codes 1, 2 and any of the organization’s own custom routing codes
  • ACTION MVS
    • This will display WTORs for the action codes 1-12, which are reserved for MVS use
  • ACTION ALL
    • This will display all WTOR messages incoming
  • ACTION OFF
    • This will hide all WTOR messages

RSYS command

The RSYS command can also be used to limit the WTOR messages displayed in the SYSLOG and OPERLOG based on the system that produced the WTOR message.

RSYS ? Will display a pop up menu which will display what filter is currently enabled.

RSYS SYSTEMNAME can also be used to specify it without the use of the pop up menu.

SYSID command

You can issue SYSID ? Command to display the current SYSID setting, as well as a list of members within the MAS.

SYSID system can be used to display te SYSLOG for the specified system.

OPERLOG

OPERLOG or Operator LOG consists of messages that are merged from Sysplex systems.

It can be set to be the default log accessed with the LOG command, or if not can be accessed with the LOG O command.

The OPERLOG displays a similar list of attributes to the SYSLOG panel at the top of the screen, including the number of outstanding WTORs.

Filtering the OPERLOG

The OPERLOG panel is different in that it can perform several filters on the data SDSF#FILTER command within it, however there are no column names displayed within it.

This log can be filtered with those fields

  • SYSNAME
    • Records for the specific system in the Sysplex
  • DATE
    • Self explanatory
  • TIME
    • also self-explanatory
  • DATETIME
    • A combination of the tow previous ones
  • JOBNAME
    • Display log records belonging to specific jobs by their name
  • JOBID
    • Display log records belonging to specific jobs by their ID
  • CONSOLE
    • Specifying this filter might be useful when needing to identify logs from a particular user ID
  • MSGID
    • If you need to figure out how many times a specific error message has occurred you can use this field to specify the message ID
  • MSGTEXT
    • This will let you filter by the content of the message in the log

When ran under ISPF, you can use the FILTER ? Command in this log as well To configure the filters used. When SDSF is not ran under ISPF and this command is used, it will simply display the currently active filters

NEXT and PREVIOUS commands

When browsing the OPERLOG, you can use next and previous commands to scroll a certain length of time within the log, specifying the period with Days, Hours Minutes and Seconds.

For example, in order to scroll the log for 3 minutes forward you can issue
NEXT 3 M

Line numbering

Note that the OPERLOG does not support absolute line numbering, meaning that it is not possible to use the LOCATE and PRINT commands, as they need line numbers.

SET SCREEN command

The SET SCREEN command will open a pop-up box that will let you configure some of the screen characteristics, within it you can enable the setting that will display the original colouring of the messages in the log, which might make it easier to see which ones are more important

You can also define your own message display characters ro highlighting.

Log data for both SYSLOG and OPERLOG can be accessed programmatically as well, with the use of REXX, Java and Batch SDSF.

ULOG

Another type of log that is available to most users is the User Log ULOG.

What is ULOG

User Log (ULOG) can be accessed by entering ULOG or U from any SDSF panel.

This log collects information on the MVS and JES commands that were issued by the suer. This is useful for monitoring what actions have been performed by a user throughout the session.

What's inside?

You might notice that on the top of the screen you see the console name. This EMCS console is activated automatically when you select ULOG. The name will be taken from the username that was associated with the session.

The EMCS console allows commands to be issued and the responses to be received and displayed directly in the ULOG for this specific user.

Shared ULOG sessions

If you see any information regarding your ULOG session being shared then it might mean that splitting the screen has created multiple sessions. The console will be shared between those sessions but the sessions without the word SHARED in the header will receive command responses for both.

You can disable sharing between consoles with the SET CONMOD ON command, followed by staring a new ULOG session.

ULOG will also display the result of commands that were issued as action characters in other SDSF panels, which might be helpful when we'd be unable to locate a job and need to see if we've cancelled or purged it via another SDSF panel by accident.

Both FIND and PRINT commands can be used in the ULOG panel.

NOTE: It is really useful to use the PRINT command if we want to keep a more permanent record of what's in the ULOG, as the content of it is automatically deleted when the SDSF session is closed.

Searching and filtering

Both the FIND and PRINT commands can be used in this log as well.

Troubleshooting

If the command responses are not being save d in the ULOG, then the Message Processing Facility (MPF) might be suppressing the response or the console ID might not have the authority

If you have the authority, you can enter the command to display the suppressed messages
/D U.DASD

If you use the same TSO USERID across different systems in the Sysplex the EMCS console name for each session will be the same because it will use the same USERID name! This will result in command responses for the first system that activated the EMCS console being the only ones appearing in the ULOG.

A method of avoiding those issues is to assign a different EMCS console name to the session with the SET CONSOLE name command

You will need to exit and re-access ULOG to activate a new EMCS console name.

Operating the SDSF server

SDSF is automatically invoked during system initialization and as part of this process a SDSF server is started. This server is used for:

It is recommended that the ISFPARMS statements (usually stored in the ISFPRM00 member of the PARMLIB ) are used in preference to assembler macros.
The benefit of storing them in this format is that they are easier to define and are more dynamic as they can be invoked without link-editing or reassembling.

The SDSF servers that reside in a Sysplex communicate via the XCF facility. The ISFPARMS contains the CONENCT statement necessary to define the server connection.

From z/OS 1.10 SDSF can also be configure to be used with JES3.
Most of the SDSF panels available under JES2 are also accessible from JSE3.
There are a few JES3 specific panels that are also availabel in SDSF:

Entering SDSF commands

Invoking any MVS commands within SDSF requires the / prefix, the same commands discussed below can be entered in the System console without the prefix

Starting and stopping SDSF

the commands in the section below probably also apply to other servers and services, however the learning module covered SDSF, so SDSF is used as the example here

Stopping SDSF

SDSF can be started and stopped with the following syntax

STOP SDSF
or
P SDSF
Will perform a manual shutdown of SDSF
This should output some messages

ISF726I SDSF shutdown in progress for serevr SDSF.
ISF434I Server SDSF connection with XCF stopping.
ISF435I Server SDSF connection with XCF stopped.
IEF352I ADDRESS SPACE UNAVAILABLE
$hasp395 SDSF     ENDED
  • Indication what server is being shut down (SDSF)
  • First message indicating that XCF communications are being stopped by the SDSF
  • Second message, confirming that the XCF connections have been stopped
  • Message indicating that the address space used for the SDSF server has ended nad is now temporarily unavailable
  • Final message indicating that the shutdown is complete

Starting SDSF

There are several options you can invoke if you need to start SDSF.
Usually the system will user the ISFPRM00 member of the PARMLIB to get the defaults
You can start SDSF using

START SDSF
or
S SDSF

In cases when you are performing some testing or you want to load a different PARMLIB member you can use the command as such
START SDSF,M=xx where the xx is the two digits at the end of the PARMLIB member name.

Additionally, there are many parameters you can specify as such
START SDSF,P=foobar where foobar is the parameter you want to supply.

Some example parameters are:

  • DEBUG or DB
    • This will start SDSF in diagnostic, or debug mode, which will be useful when there are issues.
  • TRACE or TR
    • This will be used when you're instructed to run a trace on SDSF when there are issues
  • ARM
    • If Automatic Restart Manager is operational, providing this argument will register SDSF to use it. NOARM will do the oposite

Querying and modifying information about SDSF

After SDSF has started, you can issue the
MODIFY
command to display the status of attributes associated with it, for example
MODIFY SDSF,D

If you need to get information about the communication status between SDSF servers you can issue
MODIFY servername,DISPLAY,COMM

All of the SDSF server option (apart from ARM) that can be defined at START command, can also be invoked dynamically with the MODIFY command, for example:
MODIFY SDSF,P=DEBUG
will dynamically enable debug mode for SDSF

In order to refresh the ISFPARMS statements that have been updated you can enter
MODIFY SDSF,REFRESH

Starting and stopping communications between SDSF servers

If there are problems preventing SDSF data from other systems in the sysplax from being displayed, then it might be an issue with the communication between SDSF servers.

You can stop the communications using
MODIFY SDSF,STOP,COMM,TERMINATE - TERMINATE can be added at the end to force the connections to stop

You can then start the communications again with
MODIFY SDSF,START,COMM

Handling problems

Authorization in SDSF

A common problem reported by SDSF users is that they are not able to display the information they require.
The first step in tackling those issues is to determine the authorization level the user is on.
This can be done with the use of the WHO command.

The information returned after running this command will include the authorization group that you (their user issuing the command) is assigned to.

When looking at ISFPARMS and the group that the user belongs to you will find many areas that relate to authorization.
If a user cannot access a specific SDSF option, your should check the AUTH field and see if the option has been specified

If the problem is associated with the user not being able to enter any MVS or JES commands, then you should check the CMDAUTH field parameter for the group they are assigned to and see if it is set to ALL

SDSF Abends

If SDSF Abends (abnormally ends) then clearly there was something that went really wrong.
The following data should be gathered

If a user has issues with their session and they have high enough authority, they can issue
ABEND themselves. This will result in their SDSF session ending with a user code of 222 and a dump being taken. Note that this will not bring down the entire SDSF product, justend the session for that particular user.

A trace can also be run on SDSF, it can be done with the MODIFY command as shown in the section above.