This LFA User's Guide is aimed at those network administrators responsible for monitoring resource usage, planning the load, etc.

Transcription

1

2

3 October 1997

4 1, 1997

5 Preface THE LOG FILE ANALYZER (LFA) LFA is an analytical tool that provides the means to administer communication lines. It offers a complete range of facilities to monitor resource usage in an OSI/DSA network. This is achieved through analysis of the AEP-format administrative records (see section 3). LFA operates on a passive logfile and provides three main functions: statistical analysis; accounting reporting; and formatting functions. The formatting functions provide conversion of AEP records into "human" readable format (non-encoded format with field separators). This format could be used by user-developed applications (in COBOL) and/or transferred to a PC for processing. WHO SHOULD READ THIS MANUAL This LFA User's Guide is aimed at those network administrators responsible for monitoring resource usage, planning the load, etc. 47 A3 50UC Rev02 iii

6 Log File Analyzer User's Guide RELATED DOCUMENTS A complete list and descriptions of all OSI/DSA manuals are provided in the DSA Documentation Directory, Order Number 39 A The following publications provide supplementary information on the topics discussed in this manual. FGP7 Simple Generation Guide A2 46DM AUPI7 User's Guide A2 76UC CNS7 A2 NOI Operator Guide A2 34DM DNS V4 NOI Operator's Guide A2 25DN DNS-E V2 NOI Operator's Manual...39 A2 12EB Guided NOI User's Guide A2 59DM VIDSA7 User's Guide A3 52UC VIDSA7 Software Release Bulletin A3 53UC CPDS7 User's Guide A2 36UC For a general understanding of Bull networking, and a detailed description of the functions and control of network components: DSA Concepts...39 A DSA Network Administration Guide...39 A For the CRNETGEN utility that generates the DPS7/7000 network: GCOS 7-V7 Network Overview and Concepts A4 92UC GCOS 7-V7 Network Generation A2 93UC For network directives on the Datanet to generate the DNS/DNS-E network: DNS System Generation A2 22DN DNS NGL Reference Manual A2 23DN DNS-E V2 System Generation...39 A2 09EB DNS-E NGL Reference Manual...39 A2 10EB For network directives on the CNP7 to generate the CNS7 network: CNS7 A2 NGL Reference Manual A2 32DN For FECM functions to manage the SYSGEN, LOAD, and DUMP functions on the Datanet and CNP7: GCOS 7-V7 Network User Guide A2 94UC For the format and analysis of logfile messages: DSA Log File Messages...39 A For a complete list of object classes: AUPI Programmer's Reference Manual A2 16DM For administration and control of correspondents connected to the DPS 7/7000 host: GCOS 7-V6 DSAC User's Guide A2 75UC iv 47 A3 50UC Rev02

7 Preface For GCOS 7 interactive operations, terminal connection, menus, and GCL commands: IOF Terminal User's Reference Manual, PART A2 38UJ For referencing network control messages and the actions required in network operations: GCOS 7 Network System Messages and Reason Codes...47 A2 29EB DNS-E Network System Messages and Reason Codes...39 A2 08EB DNS Network System Messages and Reason Codes...39 A2 19EB CNS Network System Messages and Reason Codes...39 A2 20EB CNS Documentation Directory A2 30DN For the list of manuals available for the respective product lines: GCOS 7 Bibliography A2 02UG DSA Documentation Directory...39 A DNS Documentation Directory...39 A The following abbreviations may be proprietary to Bull S.A.: CNP7 DNS OSF CNS GCOS 7 CNS7 GCOS 8 The following abbreviations may be proprietary to International Business Machines Corporation: CICS IMS PU_T2 SNA TSO GTF NCP PUT_5 SSCP VTAM IBM NetView SNA TAP 47 A3 50UC Rev02 v

8 Log File Analyzer User's Guide ORDERING INFORMATION All the aforementioned documentation can be ordered from: Bull Electronics Angers S.A. CEDOC Atelier de reprographie 331, Avenue Patton ANGERS Cedex 01 FRANCE or Bull HN Information Systems Inc. Publication Order Entry FAX: (508) MA02/423S Technology Park Billerica, MA USA Bull software reference manuals are periodically updated to support improvements to the software. Before ordering any of the aforementioned manuals, it is recommended that you refer to the appropriate documentation directory to obtain information concerning the specific edition of the manual supporting the installations current release. USER REMARKS FORM A user remarks form is provided at the back of this manual for your comments. BULL welcomes your comments as they may assist in improving this manual. Thank you. vi 47 A3 50UC Rev02

9 Table of Contents 1. Introduction and LFA Preparation OVERVIEW OF THE LOG FILE ANALYZER Log Files Data Records LFA Functions Operating Modes Formatting Statistical and Accounting Analyses LOG FILE ANALYZER FUNCTIONS LFA Formatter LFA Statistics Analyzer LFA Accounting Analyzer NOTATION CONVENTIONS LFA PREPARATION Preparation Restrictions and Limitations A3 50UC Rev02 vii

10 Log File Analyzer User's Guide 2. LFA Operation OVERVIEW OF THE LOG FILE ANALYZER Report Routing Alternative Files and COBOL (Reformatted) Files Operating Modes Menu Driven Mode Command line Mode Profiles Selection Criteria Applied to AEP Records Input to the LFA: The AEP Records The AEP Administrative Control Information Field Output from the LFA: Displays, Reports, and Reformatted Files PERFORMANCE AND USAGE ISSUES Phase 1: Command Entry Phase 2: Reading Log Files Formatter Statistics and Accounting Analyzers Accounting Analyzer Phase 3: Report Output Formatter Statistics and Accounting Analyzers Formatter and Accounting Analyzer Factors Affecting Performance and Resource Utilization Complexity of Commands Utilization of the Language File Volume of Output Number of Entities Reported Guidelines for Using LFA Record Count Summary Network Performance Measures PROFILES Node Utilization Profile Session Performance Analysis Profile Physical Connection Reports Profile Executing Profiles Batch Execution Making Selections From a Form The LFA Menu Making Selections From the Menu STARTING THE LFA The LFA Command viii 47 A3 50UC Rev02

11 Table of Contents Using the LFA Menu Selecting the Required LFA Function Saving Commands in a Profile Using Commands Stored in a Profile OPERATING THE LFA IN COMMAND LINE MODE Suspending the Menu System COMMENT command DISPLAY Command HELP Command QUIT Command WAIT Command LOAD Command SAVE Command BREAK Key External Control Command Error Messages Running the LFA in Batch Mode LFA Formatter OVERVIEW Formatter Output Reports USING THE FORMATTER IN MENU MODE Selecting the Required Formatter Function Selecting Report Characteristics Selecting AEP Records Selecting Nodes Selecting Version Number Selecting Types (AEP1 Records Only) Selecting Domains (AEP2 Records Only) Selecting Powers (AEP2 Records Only) Selecting Classes Selecting Codes Selecting Origins Selecting Levels Selecting Objects Selecting States Selecting Groups Selecting Start Date and Time Selecting Stop Date and Time Selecting Number of Records Selecting AEP Error Types Selecting Responder System Types Selecting RCLEFT/RCRIGHT A3 50UC Rev02 ix

12 Log File Analyzer User's Guide Reformatting Records to COBOL Format The Reformatted Record Structure Selecting Log Files Resetting the Formatting Requirements Selecting Display Format Requirements USING THE FORMATTER IN COMMAND-LINE MODE RESET Command SELECT Command REPORT Command READ Command REFORMAT Command LFA Statistics Analyzer OVERVIEW THE STATISTICS ANALYZER MAIN MENU Selecting an Option Selecting the Type of Analysis Record Count Summary Node Utilization Statistics DSAC Utilization Statistics Path Analysis Statistics Network Error Event Statistics Network Error Summary Statistics Connection Events Statistics Performance Analysis Statistics Status Analysis Statistics SELECTING TRAFFIC VOLUME, EXCEPTION OR UFTSUMMARY ANALYSIS Traffic Volume Analysis Statistics Exception Analysis Statistics Summary File Transfer Statistics DEFINING STATISTICAL REPORT REQUIREMENTS Detailed File Transfer Statistics Selecting Nodes Selecting System Type Selecting Log Files x 47 A3 50UC Rev02

13 Table of Contents 4.5 SELECTING START/END TIME AND INTERVAL Selecting Start and End Time Selecting the Interval Selecting Files STARTING THE STATISTICS ANALYZER USING THE STATISTICS ANALYZER IN COMMAND LINE MODE STAT Command STATISTICS ANALYZER GENERATED REPORTS Unsolicited Events Record Count Report The Node Utilization Analysis Report The Node Utilization Analysis Report - with Line Suppression DSAC Utilization Analysis Report Path Analysis Report Network Error Event Analysis Report Error Event Summary Analysis Report Connection Event Analysis Report Performance Analysis Report Status Analysis Reports Traffic Volume Analysis Reports Exception Analysis Reports Summary File Transfer Analysis Report Detailed File transfer Analysis Report A3 50UC Rev02 xi

14 Log File Analyzer User's Guide 5. LFA Accounting Analyzer OVERVIEW USING THE ACCOUNTING ANALYZER IN MENU MODE Selecting Report Type, Alternative Output File, Node, System Type, and Account Number Selecting Users, Billing Party, Charges, Input Logfile, and Duration Log File Accounting Summary Report Log File Accounting Detail Report Reformatting Records to COBOL Format The Reformatted Record Structure Executing Accounting Analysis USING THE ACCOUNTING ANALYZER IN COMMAND-LINE MODE ACCOUNT Command xii 47 A3 50UC Rev02

15 Table of Contents Appendices A. Statistical and AccountingAnalysis Reports... A-1 A.1 OVERVIEW... A-1 A.1.1 Report Format... A-1 A.2 REPORT #1 UNSOLICITED EVENTS RECORD COUNT ANALYSIS... A-3 A.3 REPORT #2 NODE UTILIZATION ANALYSIS... A-5 A.4 REPORT #3 DSAC UTILIZATION ANALYSIS... A-7 A.5 REPORT #4 PATH ANALYSIS... A-9 A.6 REPORT #5 NETWORK ERROR EVENT ANALYSIS... A-10 A.7 REPORT #6 CONNECTION EVENT ANALYSIS... A-12 A.8 REPORT #7 DSA SESSION PERFORMANCE ANALYSIS... A-14 A.9 REPORT #8 DSA SESSION/LOGICAL CONNECTION STATUS ANALYSIS... A-16 A.10 REPORT #9 DSA SESSION/LOGICAL CONNECTION TRAFFIC VOLUME ANALYSIS... A-19 A.11 REPORT #10 DSA SESSION/LOGICAL CONNECTION EXCEPTION ANALYSIS. A-21 A.12 REPORT #11 TRANSPORT CONNECTION PERFORMANCE ANALYSIS... A A3 50UC Rev02 xiii

16 Log File Analyzer User's Guide A.13 REPORT #12 TRANSPORT CONNECTION STATUS ANALYSIS... A-24 A.14 REPORT #13 TRANSPORT CONNECTION TRAFFIC VOLUME ANALYSIS... A-26 A.15 REPORT #14 TRANSPORT CONNECTION EXCEPTION ANALYSIS... A-28 A.16 REPORT #15 VIRTUAL CIRCUIT PERFORMANCE ANALYSIS... A-29 A.17 REPORT #16 VIRTUAL CIRCUIT STATUS ANALYSIS... A-31 A.18 REPORT #17 VIRTUAL CIRCUIT TRAFFIC VOLUME ANALYSIS... A-33 A.19 REPORT #18 VIRTUAL CIRCUIT EXCEPTION ANALYSIS... A-35 A.20 REPORT #19 LINK CONNECTION PERFORMANCE ANALYSIS... A-36 A.21 REPORT #20 LINK STATUS ANALYSIS... A-38 A.22 REPORT #21 LINK CONNECTION TRAFFIC VOLUME ANALYSIS... A-41 A.23 REPORT #22 LINK CONNECTION EXCEPTION ANALYSIS... A-43 A.24 REPORT #23 PHYSICAL CONNECTION PERFORMANCE ANALYSIS... A-44 A.25 REPORT #24 PHYSICAL CONNECTION STATUS ANALYSIS... A-46 A.26 REPORT #25 PHYSICAL CONNECTION TRAFFIC VOLUME ANALYSIS... A-49 A.27 REPORT #26 PHYSICAL CONNECTION EXCEPTIONS ANALYSIS... A-50 A.28 REPORT #27 SUMMARY FILE TRANSFER ANALYSIS... A-51 A.29 REPORT #28 DETAILED FILE TRANSFER ANALYSIS... A-53 A.30 REPORT #29 LOG FILE ACCOUNTING SUMMARY REPORT... A-55 xiv 47 A3 50UC Rev02

17 Table of Contents A.31 REPORT #30 LOG FILE ACCOUNTING DETAIL REPORT... A-57 A.32 REPORT #31 ISO SESSION PERFORMANCE ANALYSIS... A-59 A.33 REPORT #32 ISO SESSION STATUS ANALYSIS... A-61 A.34 REPORT #33 ISO SESSION EXCEPTION ANALYSIS... A-63 A.35 REPORT #34 ERROR EVENT SUMMARY ANALYSIS... A-64 B. Exportable Statistical andaccounting Analysis Reports... B-1 B.1 OVERVIEW... B-1 B.2 REPORT #1 UNSOLICITED EVENTS RECORD COUNT ANALYSIS... B-1 B.3 REPORT #2 NODE UTILIZATION ANALYSIS... B-2 B.4 REPORT #3 DSAC UTILIZATION ANALYSIS... B-2 B.5 REPORT #4 PATH ANALYSIS... B-2 B.6 REPORT #5 NETWORK ERROR EVENT ANALYSIS... B-3 B.7 REPORT #6 CONNECTION EVENT ANALYSIS... B-3 B.8 REPORT #7 DSA SESSION PERFORMANCE ANALYSIS... B-4 B.9 REPORT #8 DSA SESSION/LOGICAL CONNECTION STATUS ANALYSIS... B-4 B.10 REPORT #9 DSA SESSION/LOGICAL CONNECTION TRAFFIC VOLUME ANALYSIS... B-4 B.11 REPORT #10 DSA SESSION/LOGICAL CONNECTION EXCEPTION ANALYSIS. B-5 B.12 REPORT #11 TRANSPORT CONNECTION PERFORMANCE ANALYSIS... B-5 47 A3 50UC Rev02 xv

18 Log File Analyzer User's Guide B.13 REPORT #12 TRANSPORT CONNECTION STATUS ANALYSIS... B-5 B.14 REPORT #13 TRANSPORT CONNECTION TRAFFIC VOLUME ANALYSIS... B-6 B.15 REPORT #14 TRANSPORT CONNECTION EXCEPTION ANALYSIS... B-6 B.16 REPORT #15 VIRTUAL CIRCUIT PERFORMANCE ANALYSIS... B-6 B.17 REPORT #16 VIRTUAL CIRCUIT STATUS ANALYSIS... B-7 B.18 REPORT #17 VIRTUAL CIRCUIT TRAFFIC VOLUME ANALYSIS... B-7 B.19 REPORT #18 VIRTUAL CIRCUIT EXCEPTION ANALYSIS... B-7 B.20 REPORT #19 LINK CONNECTION PERFORMANCE ANALYSIS... B-8 B.21 REPORT #20 LINK STATUS ANALYSIS... B-8 B.22 REPORT #21 LINK CONNECTION TRAFFIC VOLUME ANALYSIS... B-8 B.23 REPORT #22 LINK CONNECTION EXCEPTION ANALYSIS... B-9 B.24 REPORT #23 PHYSICAL CONNECTION PERFORMANCE ANALYSIS... B-9 B.25 REPORT #24 PHYSICAL CONNECTION STATUS ANALYSIS... B-9 B.26 REPORT #25 PHYSICAL CONNECTION TRAFFIC VOLUME ANALYSIS... B-10 B.27 REPORT #26 PHYSICAL CONNECTION EXCEPTIONS ANALYSIS... B-10 B.28 REPORT #34 ERROR EVENT SUMMARY ANALYSIS... B-10 xvi 47 A3 50UC Rev02

19 Table of Contents C. LFA Error Messages... C-1 C.1 ERROR MESSAGES CONCERNING CONTROL COMMANDS... C-1 C.2 ERROR MESSAGES CONCERNING PROGRAM LOGIC... C-5 C.3 ERROR MESSAGES CONCERNING LOG FILE RECORD STRUCTURE... C-6 47 A3 50UC Rev02 xvii

20 Log File Analyzer User's Guide xviii 47 A3 50UC Rev02

21 Table of Contents Illustrations Figures 1-1 Overview of NMF in relation to LFA Preparing the LFA Selection Criteria and Log Files AEP Record Formats AEP Administrative Control Information Field LFA Form LFA Menu Starting the LFA AEP Record Display-LFA Formatter Sample Formatter Output - Full Mode Sample Formatter Output - Brief Mode LFA Form Report Form First Select Form Second Select Form Reformat Form Read Form Reset Form Display Form First Statistics Form Second Statistics Form Third Statistics Form Fourth Statistics Form Unsolicited Events Summary Report Node Utilization Analysis Report Node Utilization Analysis Report - with Line Suppression DSAC Utilization Analysis Report Path Analysis Report Network Error Event Analysis Report Error Event Summary Analysis Report Connection Event Analysis Report Performance Analysis - Session Report Transport Connection Status Analysis Traffic Volume Analysis Report - Virtual Circuits Exception Analysis Report - Link Connection Summary File Transfer Analysis Report Detailed File transfer Analysis Report First Accounting Form Second Accounting Form Log File Accounting - Summary Report Log File Accounting - Detail Report Third Account Form A3 50UC Rev02 xix

22 Log File Analyzer User's Guide Tables 2-1 LFA Output AEP Record Summary AEP Types AEP Domains AEP Powers AEP Class Types (1/5) AEP Codes AEP Origins Network Message Priority Levels System States AEP Record Groups AEP Error Types System Type of Responder Control Information Description Response Information Description Names of OSI/DSA Layers used in Statistics Analysi Names of End Points for Traffic Volume Analysis Statistics Names of End Points for Exception Analysis Statistics System Types Control Information Description xx 47 A3 50UC Rev02

23 1. Introduction and LFA Preparation This section provides an introduction to using the Log File Analyzer (LFA). 1.1 OVERVIEW OF THE LOG FILE ANALYZER The LFA analyzes the AEP-format administrative records (stored in a log file), which report on the commands, responses, and unsolicited messages exchanged among the nodes. The LFA (see Figure 1-1) is a tool used to determine network problem areas, the usage patterns of various nodes and links, detailed information about aspects of network operation, and accounting information Log Files The Administrative Storage Facility (ASF) creates and manages log files, and is controlled through the Network Control Language (NCL) and special ASF operator commands. The log files contain Administrative Exchange Protocol (AEP) records originating from the different Node Administrators (NADs) in a network. The log files can be created on any OSI/DSA system in the network that has sufficient storage capacity. Generally, log files will be located at a Network Control Point (NCP) designated by the network administrator. For further information on AEPs refer to Section 2. For further information on ASF, NCL, NADs, and NCP refer to the appropriate manual. NOTE: LFA should not be run on the currently active log file as unpredictable results may occur Data Records The data records written to a log file consist of operational and error statistics regarding the network, and serve as input to the LFA. The LFA processes the data in log files according to user specified criteria. 47 A3 50UC Rev02 1-1

24 Log File Analyzer User's Guide LFA Functions The Log File Analyzer performs three functions: selects and reformats AEP records from system log files performs statistical analyses on these records performs accounting analyses on these records. The results of these functions can be displayed a terminal and/or stored in user specified files Operating Modes The LFA can operate in interactive or batch mode. In interactive mode, the LFA offers a full menu interface complemented by a command line mode equivalent. In batch mode, control commands are taken from an input file, and reports are redirected to an output file Formatting The LFA formatting function provides a software tool to translate and/or display the data contained in the OSI/DSA log files. Detailed selection of AEP records can limit displays to the most desirable subset of data. The LFA can thus produce an alternative log file (in the original AEP format), or a reformatted file containing all records selected from the log file(s), and suitable as input to a COBOL program Statistical and Accounting Analyses The LFA statistical and accounting analyses are performed on source AEP data from the log files, or captured AEP data processed by the formatting functions and stored in an alternative file. The results of the analyses can be displayed as detailed tabular data or summary reports. Data from the statistical analyses can be used to monitor the efficient operation of network elements in order to prevent bottlenecks or exceeded capacity. Statistical analysis of reported errors may also help to determine the most likely location(s) of failing network components. The accounting analyses can create alternative accounting files containing billing information suitable as input to a COBOL program A3 50UC Rev02

25 Introduction and LFA Preparation Network Messages Log Files LFA LFA Form atter Reports Alternate Log Files Reformatted Log Files Statistical Analyzer Accounting Analyzer Reports Reports Alternate Accounting files Figure 1-1. Overview of NMF in relation to LFA 47 A3 50UC Rev02 1-3

26 Log File Analyzer User's Guide 1.2 LOG FILE ANALYZER FUNCTIONS The LFA provides an operator interface, through which the three major functions are available. Execution of Log File Analysis is controlled by a set of commands entered directly by the user through a menu- or a command-driven interface. The menu interface performs basic syntax verification, and automatically formats selection statements. The command line interface is provided for experienced users to enter commands in a concise manner, and for use in batch mode execution of LFA commands. Refer to Section 2 for more detailed information LFA Formatter LFA Formatter functions are presented through a series of menus or through a command line interface. LFA Formatter allows the user to specify log files to be scanned, selection criteria, level of detail (comprehensive or summary), and whether the selected records are to be written to a reformatted log file, or to an alternative log file. Command mode offers the same functions as menu mode using the commands SELECT, REPORT, RESET, and READ. However, syntax verification is performed at execution time. Refer to Section 3 for more detailed information LFA Statistics Analyzer LFA Statistics Analyzer is a tool for generating a comprehensive set of reports on the usage of network resources. This is achieved through statistical analyses of the AEP records contained in a log file. The statistics analyzer offers four broad categories of reports: summaries of log file contents OSI/DSA line performance general system performance file transfer statistics. LFA Statistics Analyzer functions are presented through a series of menus or through a command line interface. LFA Statistics Analyzer allows the user to specify the topic of the report, and selection criteria for extraction of AEP records from the log files. Command line mode offers the same functions as the menu system using the STAT command. Refer to Section 4 for more detailed information A3 50UC Rev02

27 Introduction and LFA Preparation LFA Accounting Analyzer The Accounting Analyzer is a tool for generating billing reports based on analyses of time usage data from the log files. The LFA Accounting Analyzer functions are presented through a series of menus or through a command line interface. LFA Accounting Analyzer allows the user to specify the level of detail, and the selection criteria for extraction of billing information from the log files. The command line mode offers the same functions as the menu system using the ACCOUNT command. The Reformatted Accounting file is created by the LFA using data from an accounting analysis of the input Log File(s). It contains user specified accounting data extracted from the input log files, stored in standard COBOL format. Refer to Section 5 for more detailed information. 47 A3 50UC Rev02 1-5

28 Log File Analyzer User's Guide 1.3 NOTATION CONVENTIONS The following conventions are used to describe commands in this User's Guide: UPPER CASE words denote command names and parameter keywords. They must be specified as shown, but they can be coded as lower case words or as a ComBination of upper case and lower case letters. lower case words represent variable information to be supplied. Brackets [ ] enclose optional parameters, values, or groups that may be omitted or chosen, according to your needs. When enclosing vertically stacked options, brackets indicate that only one of the enclosed options may be chosen. For example: [ = { A } ] [ W = { B } ] [ = { C } ] indicates that parameter W can be treated in one of the following four ways: W can be omitted W = A W = B W = C Braces { } enclose a list of parameters, values, or groups, one of which must be chosen. Choices may be presented vertically (only one option may be chosen): = { A } W = { B } = { C } or horizontally, where a vertical bar separates the different options that must be selected. For example: A { B C D } denotes one of the three choices, AB, AC, or AD. Ellipsis... means the previous item can be repeated any number of times. If the item is bracketted { A...} the entire contents of the brackets may be repeated. Default Value (the value assumed when a construct is omitted) is underlined. For example: [ = { A }] [ W = { }] [ = { C }] means that parameter W may take values A or C, and when the parameter is omitted, the value A is taken A3 50UC Rev02

29 Introduction and LFA Preparation 1.4 LFA PREPARATION Preparation Before running the LFA for the first time, some actions must be performed by the system administrator: Creation of project and user authorized to run the LFA. Creation of master directory and catalog for the LFA. Creation of the LFA language file. The GCL command PREPARE_LFA (see Figure 1-2), available in IOF domain and reserved to system administrator, will be used for all these actions. Two members of SYS.HSLLIB are used by this GCL command: LFA_COMMAND for project and user creation. LFA_SQFILE for language file creation. The GCL command PREPARE_LFA can also be used only to override old language file by a new one (refer to FN parameter). PREPARE_LFA -->: prepare LFA FN PROJECT USER + 1 if installing first tim e + project to be created LFA user to be created authorized to run LFA LFA PASSW ORD VOLUME password of newly created user volume name for language file LFA Figure 1-2. Preparing the LFA 47 A3 50UC Rev02 1-7

30 Log File Analyzer User's Guide Syntax: {PREPARE_LFA} { } {PREPLFA } FN = {bool} {PROJECT PROJ} = {name-12 LFA} [{USER US} = {char-12 LFA}] [{PASSWORD PWD} = {char-12 LFA}] [{VOLUME VOL} = {volume-32}] Parameters: FN PROJECT USER PASSWORD VOLUME First - or not first - installation of the LFA. When 1: Project, user authorized to run the LFA, master directory and catalog are created. Space is allocated for the language file built from LFA_SQFILE member of SYS.HSLLIB. When 0: Only update of language file from LFA_SQFILE member of SYS.HSLLIB. Project name for the LFA user and also prefix name for catalog and language file Default value: LFA. User name authorized to run the LFA. Default value: LFA. Password of newly created user. Default value: LFA. Volume name (in the format: media:ms/xxx) where catalog and language file must be created. Constraints: Command only authorized to user under SYSADMIN project. When FN=1, USER and VOLUME must be specified A3 50UC Rev02

31 Introduction and LFA Preparation Examples: PREPLFA FN=1 PROJ=LFA USR=LFA PWD=LFA VOL=BFU023:MS/B10; {Creation of project, user, master directory LFA, catalog LFA.CATALOG, and language file LFA.LANGFL0 on specified volume} PREPLFA FN=0 PROJ=LFA; {Only update, from LFA_SQFILE member of SYS.HSLLIB, of language file LFA.LANGFL0 that overrides old one} Restrictions and Limitations Restrictions are: 1. The LFA can be run only by system administrator or user under project created by PREPARE_LFA command, otherwise following messages appear (with default project LFA): ***DS06. LFA.CATALOG FILE ACCESS RIGHTS VIOLATION ***DS06. LFA.LANGFL0 FILE ACCESS RIGHTS VIOLATION Cannot open language file, (impossible d'avoir accès au fichier de langue) LFA.LANGFL0 2. The PRTFILE keyword is implemented only for the invocation command LFA. 3. When executing the READ, ACCOUNT and STATISTICS commands, you must specify the absolute pathnames for the log files to be read. 4. Alternate files must be pre-created as follows: a) Alternate log files must be FILES, not members. b) Alternate log files must be FIXED BLOCK, with record length 200. c) An increment size should be specified. Limitations are: 1. When executing LFA in absentee (batch) mode, you must specify an existing file for the PRTFILE parameter. 2. The SAVE command does not save the REPORT and READ command options. 47 A3 50UC Rev02 1-9

32 Log File Analyzer User's Guide A3 50UC Rev02

33 2. LFA Operation This section presents an overview of the operation of the Log File Analyzer, and provides a general description of the LFA Menu and Command interfaces. 2.1 OVERVIEW OF THE LOG FILE ANALYZER The Log File Analyzer has three main functions: formatting statistical analysis accounting analysis. These functions are controlled via commands ened in forms or via a command line. Once a log file has been defined it remains as default until cancelled Report Routing The LFA can route reports to a terminal or to a file. This redirection can only be specified when LFA is invoked, and will be in effect throughout the session. To return output from a file to the screen, the user must quit LFA Alternative Files and COBOL (Reformatted) Files The Formatter can produce alternative log files based upon AEP records in the source log files, or convert AEP record formats to a sequential file format that is suitable for COBOL input. The Accounting Analyzer can also produce an alternative accounting file suitable for input to a COBOL program. 47 A3 50UC Rev02 2-1

34 Log File Analyzer User's Guide Operating Modes The LFA offers both menu driven and command line modes of operation. Both modes provide an interface to the LFA command set, and an on line information facility Menu Driven Mode Menu driven mode allows users to build commands via a sequence of forms and options which reflect the syntax inherent in those commands. In addition, extensive verification functions in the forms processing software ensure that conflicting selections do not occur. Menu mode simplifies processing for the new and inexperienced user Command line Mode Command line mode offers direct access to the LFA command set. Though this method may be more rapid for experienced users, it is primarily intended to be used in batch processing, where files of commands are processed without user intervention. Batch processing provides a high degree of flexibility in operating the LFA, since it eliminates the need for operator intervention in repetitive and periodic applications. Commands are issued directly to the LFA and must be correct and in the proper sequence. Formatter Commands, Statistical Analysis Commands, and Accounting Commands are mutually exclusive. Command syntax and command interpretation will be described in the command line mode section of the manual. After control commands (entered through menu or batch mode) have been validated, the LFA reads and selects appropriate data from the log file(s) specified in the command(s). The LFA then generates the requested output Profiles Command line mode and menu driven mode provide a facility to save a defined command and its selection criteria in an external file called a profile, which may be reused at a later time. It provides a method for a network administrator to predefine various commands A3 50UC Rev02

35 LFA Operation Selection Criteria Applied to AEP Records When using the functions of the LFA it is possible to specify records to be extracted from the log file(s). This is achieved using selection criteria (search requirements). The LFA will read each AEP record and extract those records which satisfy the selection criteria. Selection criteria allow the user to carry out a general or specific search of the log file(s). In the case of the LFA Formatter, it is possible to carry the selection process further by specifying several selection statements. The multiple selection statements are processed using logical OR. The various criteria within each selection statement are processed using logical AND. Where multiple parameter values are specified within selection criteria, these values are processed using logical OR. Examples are provided below. The relationship between selection criteria and the log files is illustrated in Figure 2-1. LFA Selection Mechanism Log Files Select Statement 1 Criteria Criteria n Selected AEP Records Select Statement m Criteria Criteria n Figure 2-1. Selection Criteria and Log Files 47 A3 50UC Rev02 2-3

36 Log File Analyzer User's Guide Examples SELECT NODE=N001 CLASS=SS CODE=OP/CL/ER AEP records will be selected if they meet the following criteria: (NODE=N001) and (CLASS=SS) and (CODE=OP) or (CODE=CL) or (CODE=ER) SELECT NODE=N002 CLASS=VC SELECT NODE=N003 CLASS=TC CODE=OP/ER/CL AEP records will be selected if they meet the following criteria: ((NODE=N002) and (CLASS=VC)) or ((NODE=N003) and (CLASS=TC) and ((CODE=OP) or (CODE=ER) or (CODE=CL)) Multiple selection statements are entered directly in command line mode. In menu mode, multiple selection statements are entered through the formatter SELECT form. Current selection criteria can be displayed using the DISPLAY command, or by entering the Display Current Requirements command from the Main menu Input to the LFA: The AEP Records The log files generated by the Administrative Storage Facility (ASF) contain Administrative Exchange Protocol (AEP) records processed by the various Node Administrators (NADs) throughout a network. The LFA can handle input from several log files. It does not alter the contents of these files. Multiple input log files are read sequentially, in the order specified by the user. The sequence can be important, especially when statistical analysis is carried out. There are two basic types of control and administrative information recorded in the log files. These are responses to networking commands, and unsolicited messages announcing events and errors in the network. AEP records are divided into four fields (see Figure 2-2): The Administrative Control Information Field is present in all AEP records generated by a DSAC component. It is 26 bytes long and contains much of the information used by the LFA record extraction functions. The Command Parameters Field is present in records that contain NCL command and response information, and in unsolicited event reports. The length of this field is determined by the number of parameters the NCL command requires. Each element of the record specifies which values, if any, were assigned to the command parameters A3 50UC Rev02

37 LFA Operation The Response Parameters Field is present in records that contain NCL command and response information. The length of this field is determined by the number of parameters the NCL command requires. Each element of the record specifies the value, if any, generated in response to the parameter. If a response generated by an NCL command is too lengthy for one AEP record, special records can be generated containing a Response Parameter Field, but omitting the Command Parameter field. In this way, any number of AEP records can be generated to accommodate the full response to a command. The Command Errors Field is present in all records of an error condition. The field contains either a general error code, or a specific error code, depending on the nature of the DSAC component that originated the record. Administrative Control Inform ation Command Parameters Response Parameters Command Errors AEP Version Responder Postmark Origin Information Command Descriptor Response Descriptor Version Node Origin System Type From } Duration To Domain Power Class Code Level System Type Figure 2-2. AEP Record Formats The AEP Administrative Control Information Field The Administrative Control Information field of an AEP record contains much of the information processed by the LFA selection mechanism, and consists of the following components: The AEP Version component is used by the Formatter Version parameter. The Responder Postmark component provides the node name and system type of the responder (NAD that recorded the information), and the time at which the AEP record was originated. This information is used by the LFA to obtain Node Name, System Type and Duration parameters. The Origin Information component provides the node name and system type of originator of a networking event (this component identifies the NAD in the case of unsolicited messages). This information is used by the Formatter Origin parameter. 47 A3 50UC Rev02 2-5

38 Log File Analyzer User's Guide The Command Descriptor component identifies the type of networking command described by the AEP record. This component is used by the Formatter Domain, Power, Class, and Code parameters, or the Type parameter. The Command Parameters field of the AEP record provides details on each parameter setting for the command. The Response Descriptor component identifies the response generated to a networking command, or an unsolicited event. This component is used by the Formatter Level and System Type parameters. The Response Parameters field of the AEP record provides a detailed description of the response generated to each command parameter. L:RED FROM=SYS.DSALOG1 TO=SDC.LAF7.DSALOG1 RANGE=(1,1); Reading : sys.dsalog1 Range: 1,1 Alternate output file:sdc.lfa7.dsalog1 AEP RSP SYS RSP ND DATE TIME ORG ND ORIGIN DOM POW CLASS CODE LVL 2 DNS BC UMP SYS REP EX CD150 6 message:er-ex EXECUTIVE ERROR OR EVENT Response Completion Status:Normal completion TIME-INTERVAL-IN-SECONDS : (INTERV) CPU-IDENTIFICATION : CPU #0 : (CPUID ) PERCENT-CPU-USED : 1 (%CPU ) TIME-INTERVAL-IN-SECONDS : (INTERV) CPU-IDENTIFICATION : CPU #1 : (CPUID ) PERCENT-CPU-USED : 2 (%CPU ) +++ EADY 10:47 TEXT ROLL 24 0 Figure 2-3. AEP Administrative Control Information Field A3 50UC Rev02

39 LFA Operation Output from the LFA: Displays, Reports, and Reformatted Files The three functions of the LFA are each designed to produce displays of information. These displays (on screen and/or in files) contain processed reports, AEP records, or information derived from AEP records. Table 2-1 summarizes the output of each LFA component. Table 2-1. LFA Output Components Reports/Displays Files Formatter Extracted AEP Records Alternate Log File Reformatted Log File Redirected Output Statistics Analyser Accounting Analyser Summary Node Utilization DSAC Utilization Path Analysis Error Analysis OSI/DSA Layer Analysis (Traffic Volume, Performance, Status, Exceptions) Connection Events File Transfer information User Summary User Detail Redirected Output Alternate Accounting File Redirected Output 47 A3 50UC Rev02 2-7

40 Log File Analyzer User's Guide 2.2 PERFORMANCE AND USAGE ISSUES This section provides guidelines on how to use the LFA effectively. LFA operation proceeds in three phases: Command entry Reading log files Report output Phase 1: Command Entry All commands, keywords, and file names are validated as they are entered, and if valid, are stored in a command tree. The size of the command tree is directly related to the complexity of the commands Phase 2: Reading Log Files After the command entry phase has been completed, the LFA processes the commands. Each AEP record is read from and compared to the selection criteria (if any). If the record meets the selection criteria, it is passed to the function processor (Formatter, Statistics Analyzer, Accounting Analyzer) Formatter In either brief or full reporting mode, the AEP Record Summary (two lines of output) is generated to provide header information for each AEP record selected. In full reporting mode, each response field in the AEP record is reported on a separate line. It contains a description of the field, the value of the data in the field, and the abbreviation of the field. The description and abbreviation are read from the LFA language file, which contains record and field descriptions for all possible AEP records. In Brief reporting mode, the AEP record Summary is displayed, followed by the response field numbers, and values for the particular AEP record. If either reformatting, or an alternative log file has been selected, the selected record will also be written to the specified file. For an alternative log file, the selected record is copied unaltered. For a reformatted file, the individual fields of the record are converted to text, and delimited by special characters. If FULL COBOL reformatting is required, the abbreviation for the field is also written to the output record A3 50UC Rev02

41 LFA Operation Statistics and Accounting Analyzers Each selected record is processed to determine if it contains information applicable to the selected report. If so, the data is extracted and accumulated in a tree structure that contains branches for each report type and nodes to be reported on, and leaves that contain information from the various data fields. A new branch and/or leaf is created as required for each processed record Accounting Analyzer If the reformatted accounting file option has been selected, the selected record is written to the specified file Phase 3: Report Output This phase is entered after all log files have been read and their records processed Formatter After the Formatter has completed processing records selected from the log file, it produces a report that displays the number of records read, selected, and reported Statistics and Accounting Analyzers For each requested output report, the data collection tree is scanned, and relevant data is stored in the format applicable to the report. After all the reports have been produced, the number of records read, selected, and used in the reports is displayed Formatter and Accounting Analyzer If an alternative output or reformatted file has been created, it is closed in this phase of operation. 47 A3 50UC Rev02 2-9

42 Log File Analyzer User's Guide Factors Affecting Performance and Resource Utilization Complexity of Commands As the complexity and length of the input command set increases, the size of the internal command tree also increases. This results in a slight increase in the memory requirement and an increase in CPU utilization as each record is processed Utilization of the Language File If a full report and/or a FULL COBOL output file are requested from the Formatter, the language file is accessed for every AEP record descriptor, and for every response field in that AEP record. This results in a large increase in input and output to disk. The language file is also accessed during record selection if the OBJECT, AEPERR, or STATE keywords are used Volume of Output The Statistical Analyzer and Accounting Analyzer produce only a small to moderate amount of report output. However, the Formatter can produce an extremely large amount of output if the selection criteria are too broad, even in a small log file. In addition, the reformatted output file generally contains larger records than the input AEP records. A large amount of output also results in a very large increase in input and output to disk Number of Entities Reported For each entity reported on by the Statistics or Accountig analyzers, a leaf must be added to the data collection tree. This results in an increase in both memory utilization and CPU utilization when handling reports of great complexity and containing many entities A3 50UC Rev02

43 LFA Operation Guidelines for Using LFA In large and busy networks, input log files can contain several thousand records. Performing detailed analyses can be very time consuming, and may result in much more output than can be viewed or printed. To avoid this, the scope of the information to be analyzed should be narrowed before using the desired LFA function. One method of reducing analysis effort is to use effective filtering at the NAD. This filtering will limit the types and numbers of AEP records stored in the log file to those actually required for analysis Record Count Summary As a first step, the Statistics Analyzer should be used to obtain a record count summary without applying selection criteria. This will provide a general picture of what is available in the log files. The picture will include the time range in which data was collected, the nodes and system types from which the data originated, and the major classes (session, transport connection, virtual circuit, etc.) that produced the records. In a mature network, this information is not likely to change dramatically from day to day, and may be of less interest to network management staff who are familiar with the network Network Performance Measures The Statistics Analyzer can be used to monitor network performance. The monitoring can include network resource usage, detection of anomalies within a reporting period, and trend observation over a series of reporting periods. The following reports are considered the most important measures of network performance. The Node Utilization Analysis report provides CPU and memory utilization, per node, as a function of time. Reports can also be provided at specified intervals (e.g., every 30 minutes), so that resource usage during the reporting period can be monitored. A summary is also provided for comparison with other reporting periods. Node Utilization is most relevant to CNS7 and DNS systems. Usage examples are provided in the Profiles section. The Session Performance Analysis report provides a measure of application traffic, per node, as a function of time. Reports can be obtained at specified intervals, and a summary of activity over the full reporting period is also provided. Session performance data can be obtained for ISO Session, and DSA Session activity. DSA Session activity is calculated using SS AEP records from GCOS6, GCOS7, or GCOS8 nodes, and LC AEP records from CNS7, DNS, and NAS400 (Questar 400) nodes. The Physical Line Traffic Volume Analysis report provides line usage, per node, as a function of time. Reports can be obtained at specified intervals, and a summary of activity over the full reporting period is also provided. This report is particularly useful for primary network lines. 47 A3 50UC Rev

44 Log File Analyzer User's Guide The Physical Line Status Analysis report provides total counts of information sent and received from each specified connection from the local node to the remote end point. The report indicates start time and duration for each connection, the amount of information sent and received, and the reason code, if any, for an error that occurred during the connection. Interval reporting is not applicable to this report. The Physical Line Exception Analysis report provides exception (communications error) statistics between a local and a remote end point. Interval reporting is not applicable to this report A3 50UC Rev02

45 LFA Operation 2.3 PROFILES The LFA offers the user a facility for the specification of common record selection criteria and reporting requirements through the use of profiles. A profile is a standard system text file that contains LFA command lines. It may be created from within the LFA when operating in menu mode. Alternatively, a profile may be created by any text file editor prior to executing the LFA. In this way, a complex set of selection and reporting requirements can be used at any time without having to manually re-enter requirements. In addition, as profiles are stored in standard system text, they may be shared among a group of network administrators and operators. The LFA main menu provides a profile creation option known as SAVE (SV). Menus also provide a LOAD (LD) option, which will read a previously defined profile after resetting current requirements. NOTE: The LOAD option is available only in command mode. Profiles provide an effective means of specifying frequently used selection criteria. For example, the profiles required to invoke the Statistics Analysis reports previously described under "Network Performance Measures" have the following syntactic form: STat-<reporting requirements> -DUration / INterval Duration need not be specified. However, the duration specified above will select all AEP records created on or after January 1, The first reporting interval will be the end of the first half hour period in which a relevant AEP record was processed (from the first relevant AEP record detected). The user can produce and save any number of site specific profiles by using menu mode to create and SAVE a profile. Profiles can be executed in menu mode or command line mode. In either case, when a profile is first invoked, the user must specify the FRom log file(s). Thereafter, for the same log file(s), it is not necessary to specify the input file name. If output to a file is required, the user must specify the file name when invoking LFA (FRom and PRtfile information cannot be stored in a profile). The following examples show the text of the system supplied profiles and the resulting output. 47 A3 50UC Rev