Significantly improve your Mainframe availability by connecting logs with traces

Speed up resolution of mainframe application issues and switch to a proactive and preventive mode of operations, through z/OS logs and traces in context with both your Dynatrace SaaS and Managed deployments.

Logs are essential observability telemetry

Organizations are increasingly challenged to deliver seamless digital services, an essential component for achieving business-critical objectives. These challenges are amplified by complex hybrid cloud environments, where managing diverse technologies across cloud providers and platforms like IBM Z Mainframe becomes particularly demanding.

To address this complexity, it's vital to unify observability telemetry and its signals across all layers of the application delivery chain, including the mainframe platform, within a single AI-powered observability solution.

Dynatrace enrichment capabilities enhance ingested log records by adding contextual metadata such as trace IDs, span IDs, and process group instance IDs automatically and without any manual tagging efforts. This allows seamless correlation between logs, application performance metrics, and traces. This is essential for accelerating AI-driven root cause analysis and significantly reducing time spent on shortening RCA and MTTx, as many of our customers can confirm.

Simplify and automate z/OS log collection

Dynatrace Log Management & Analytics extends beyond distributed technology stacks to include support for the IBM Z Mainframe platform. It automatically captures and ingests logs from monitored IBM CICS and IBM IMS regions and offers you advanced ingest rules. All collected logs are enriched automatically with topological metadata, allowing seamless mapping to Dynatrace's topology and entity model for z/OS Hosts (LPARs) and z/OS Processes (regions).

Figure 1. Dynatrace automatically maps log lines to z/OS entities, in this case, to the process name and job ID of a CICS region

Additionally, logs can be enriched with Trace IDs and Span IDs to precisely correlate each log line with the corresponding CICS or IMS trace or span that generated it.

Figure 2. Dynatrace can map log lines to a specific z/OS trace, which allows you to directly navigate to the trace that created the specific log line (via "View trace").

This dramatically simplifies navigation for any user in your organization. By selecting the log line containing the Trace ID and Span ID, you can directly navigate to the related trace while understanding the load times and delay.

Figure 3. This example shows an end-to-end trace and the log line that was written by a CICS COBOL program

Let's summarize what we've seen so far. Log enrichment significantly enhances and accelerates:

• Correlation with distributed traces, enabling end-to-end visibility across systems.
• Troubleshooting, by linking logs to specific spans or transactions-accelerating troubleshooting.
• Observability for both structured and unstructured log data, ensuring comprehensive insights regardless of log format.

Beyond the agent: Stream mainframe logs to Dynatrace with OpenTelemetry

Dynatrace OneAgent® already supports ingestion of logs out of the box. However, when it comes to mainframe environments, the story is more nuanced.

Why all logs are not created equal

Some logs-especially those on mainframes-are proprietary, customer-specific, and deeply embedded in legacy workflows. And while Dynatrace is constantly adding additional and automated coverage for additional log types, some might never be supported natively by OneAgent, simply because their structure and relevance are unique to each customer.

But that doesn't mean they're out of reach.

OpenTelemetry to the rescue

For logs that fall outside OneAgent's native scope, OpenTelemetry offers a powerful alternative. By deploying an OpenTelemetry Collector, customers can stream log data from their LPARs to a distributed host-preferably to Linux, Windows, or zLinux to save MSU consumption. But even z/OS itself is an option for hosting an OpenTelemetry Collector.

The Collector supports:

• Filelog receiver for arbitrary text files
• Syslog receiver for structured system logs
• Filter processor for preprocessing and enrichment
• Concurrent export to multiple backends, including Dynatrace via OTLP

Getting logs off the mainframe

There are several ways to move logs from LPARs to distributed systems:

• SFTP: A blunt but reliable method
• z/OSMF: Offers REST API access to SMF records
• z/OS Data Gatherer: SMF REST Services
• Custom scripts or processes: Tailored to specific datasets
• Streaming frameworks: Kafka, MQ, or even FTP-to-Collector bridges

The bottom line: Just transfer log data from the mainframe to the host where the OpenTelemetry Collector is located, and it will handle everything for you from there.

There's no strict requirement to provision a dedicated host to run your OpenTelemetry Collector. If Dynatrace OneAgent is already monitoring one of your LPARs, the ActiveGate hosting the Dynatrace zRemote component is a perfectly suitable environment for the Collector.

Figure 4. The ActiveGate hosting the zRemote mediates the ingestion of both out-of-the-box logs and OpenTelemetry logs.

Preprocessing and enrichment

Both the Dynatrace Distro and the Contrib Distro of the OpenTelemetry Collector support advanced preprocessing:

• Timestamp normalization (for example, converting z/OS timestamps to Unix time)
• Resource attribute extraction (for example, job name, LPAR ID, subsystem)
• Sensitive data masking and filtering

This ensures that even complex logs are transformed into structured telemetry before reaching the backend.

The cherry on top: Dynatrace OpenPipeline

While OpenTelemetry handles ingestion and transformation, Dynatrace OpenPipeline® adds another layer of intelligence during ingestion and processing:

• Further enrich logs with business context
• Extract metrics, events, and business observability events
• Apply AI-driven baselining and anomaly detection
• Transform, mask, or drop data
• Some of these capabilities overlap with the Collector, giving users flexibility to choose where to apply logic based on performance, cost, and control.

Operlog: A prime candidate

Let's take Operlog as an example-a system log that many customers are keen to stream. While it's not a simple text dataset, creative solutions can bridge the gap. If you can extract Operlog records and store them as text on a Linux host, the Collector can ingest them immediately. From there, Dynatrace visualizations and alerting kick in.

Here's a snapshot of how Operlog looks once streamed and processed in Dynatrace:

Figure 5. Log entries captured from Operlog visualized in Dynatrace

Not satisfied with only logs?

You're not limited to ingesting only proprietary log files via OpenTelemetry.

Do you have access to metrics that are relevant for tracking the health of the subsystems on your mainframe? Would you rather feed in certain data as events instead of logs?

Just as the OpenTelemetry Collector is highly customizable, Dynatrace offers multiple ways of ingesting all these signals.

Figure 6. Possible sources for OpenTelemetry signals and how Dynatrace ingests them

Conclusion

Mainframe logs may be complex, but they're not unreachable. With OpenTelemetry and Dynatrace working in tandem, even the most proprietary datasets can be brought into the fold. Whether you're using OneAgent, OpenTelemetry, or a hybrid approach, the key is creativity-and the right tooling.

What's next

Dynatrace currently supports CICS MSGUSR and IMS Master Terminal Logs via its z/OS Agents, and remains committed to enhancing these capabilities. This includes exploring support for additional z/OS log types and expanding the scope of information captured through the z/OS Agents.

Log monitoring is also available for Linux on IBM Z and LinuxONE. For more details, see the blog post, Enable full observability for Linux on IBM Z mainframe now with logs.

Get started with Dynatrace log observability

If you're looking to elevate your end-to-end observability and explore tailored possibilities within your specific z/OS environment, we'd be happy to connect. Reach out to us to request a demo and dive deeper into what Dynatrace can offer.