Search Management

The Search Management page allows you to create, modify, save, and access search rules, as well as submit search requests. You can specify complex search conditions for locating VTAM 3270 sessions based on the content of output window data within the selected archive. You can make this search request private (for yourself only), or with the proper authorization, you can make a public search request that can be used by any authorized user.

 

To create a search rule

  1. From the rules tab of the Search Management page, click Add. The Search Rule page appears.

  2. Type a name for your search rule in the Name text box. Names must follow valid ISPF naming conventions. The name can be alphanumeric, up to eight characters in length, and must start with a letter.

  3. Choose to make the search request either Private or Public by clicking the Public button. Private search requests can be viewed by the originator only. Public search requests can be viewed by all authorized users.

    Only users with Global Recording Administrator authority on the mainframe are authorized to create global search requests. If you do not have Global Recording Administrator authority, this field does not appear on your window.

  4. Select a Search Type: VTAM, TCP, or MQ.

  5. Select an Archive from the archive list. The information on which you can search is located in an archive that has previously been created.

  6. Specify a Search Scope (for VTAM) or a Source Data Format (for TCP):

If the search type specified above is VTAM, you must specify a Search scope:

    • Inputs searches user-entered inputs.
    • Outputs searches target text on user output screens (transmitted from the application to a user's terminal).
    • Both searches both inputs and outputs.

If the search type specified above is TCP, you must specify a Source Data Format:

    • ASCII identifies whether data being sent is ASCII.
    • EBCDIC identifies whether data being sent is EBCDIC.
  1. Specify Filters to use when searching.

If the search type specified is VTAM, the archive search is limited to the following IDs:

    • User ID is the user ID mask used to search. It could be ccc* or simply *.

    • Application ID is the appl ID used to search.

    • Terminal ID is the terminal ID used to search.

With those specific IDs, the wildcards * and ? may be used.

 

If the search type specified is TCP, the archive search is limited to the following specific IP addresses or ports:

    • Client IP is the IP address of the client.
    • Client port is the port number of the client.  
    • Server IP is the IP address of the server.
    • Server port is the port number of the server.

If the search type specified is MQ, the archive search is limited to the following specific MQ filter criteria:

    • Queue Manager is the name of the queue manager.
    • Queue/Object is the name of the queue or other object defined by the queue manager.
    • Job Name is the name of the IBM workload scheduler job.
    • Put Application Name is the name of the application sending the MQ message to a queue.
    • User Identifier is the user ID for Websphere MQ.
  1. Specify search Criteria by typing the information that you want to search for in the Search String text box and click Save. The search string will now appear in the search table.

    You can create more advanced search strings by clicking the Advanced button. The search strings are executed in the order they appear in the list. The combined search strings create a search rule.

    • Select an Operation from the list. The list contains standard relational operators.
      If you add more than one search string, select AND or OR from the list by clicking .
      The right and left parentheses ( ) can be used to build conditional searches.

VTAM specific

    • Row specifies to search only this row. Zero (0) is the valid wildcard character.
    • Column specifies to search only this column through the number of columns specified in Length. Zero (0) is the valid wildcard character.
    • Length is the length of the search string padded with blanks. Zero (0) is the valid wildcard character.

TCP or MQ specific

    • Data type is the data type of the string being searched.
    • Start is the starting position in the data stream.
    • Length is the length from the starting point.
  1. Specify a Time Range on which to search by completing the Start date, Start time, End date, and End time. This limits the archive search to a specific time period rather than the entire archive repository set. Be sure the toggle switch is in the On position in order to enable this field.

  2. Click Submit, Queue, or Save for your new search rule:

    • Click Submit to save your search rule, start your search immediately and create your report. A message will appear giving a date and time when the report was submitted. When execution is complete, the report will appear in the tree view. You may need to click the refresh button in the tree view to refresh the Reports list with your report when it has finished executing.
    • Click Queue to save your search rule and queue your report for later submission.
    • Click Save to save your search rule for future use. It will be saved with the name you entered in the Request Name field. After it is saved, it will appear in the tree view with either a local rule icon or a global rule icon depending on the choice you made when you created the rule.

Click (Clear) to clear all fields and start over without saving the search rule.

 

Related Topics

Welcome to Application Audit

Log on to Application Audit

Archive Management

Create Archive Request