Find first-failure data capture data

This topic describes tips on how to locate first-failure data capture (FFDC) data on an iSeries™ server. The information is most useful if the failure causing the FFDC data output occurred on the application server (AS). The FFDC data for an application requester (AR) can usually be found in one of the spooled files associated with the job running the application program.

Note: No FFDC data is produced unless the QSFWERRLOG system value is set to *LOG.

Execute a Display Messages (DSPMSG) QSYSOPR command and look for a Software problem detected in Qccxyyyy message in the QSYSOPR message log. (cc in the program name is usually RW, but could be CN or SQ.) The presence of this message indicates that FFDC data was produced. You can use the help key to get details on the message. The message help gives you the problem ID, which you can use to identify the problem in the list presented by the Work with Problems (WRKPRB) command. You might be able to skip this step because the problem record, if it exists, might be at or near the top of the list.
Enter the Work with Problems (WRKPRB) command and specify the program name (Qccxyyyy) from the Software problem detected in Qccxyyyy message. Use the program name to filter out unwanted list items. When a list of problems is presented, specify option 5 on the line containing the problem ID to get more problem details, such as symptom string and error log ID.
When you have the error log ID, enter the Start System Service Tools (STRSST) command. On the first screen, select Start a service tool. On the next screen, enter 1 to select Error log utility. On the next screen, enter 2 to select Display or print by error log ID. In the next screen, you can:
- Enter the error log ID.
- Enter Y to get the hexadecimal display.
- Select the Print or Display option.

The Display option gives 16 bytes per line instead of 32. This can be useful for online viewing and printing screens on an 80-character workstation printer. If you choose the Display option, use F6 to see the hexadecimal data after you press Enter.

The hexadecimal data contains the first one KB of the FFDC dump data, preceded by some other data. The start of the FFDC data is identified by the FFDC data index. The name of the target job (if this is on the application server) is before the data index. If the FFDC dump spool file has not been deleted, use this fully qualified job name to find the spool file. If the spool file is missing, either:

Use the first one KB of the dump stored in the error log.
Re-create the problem if the one KB of FFDC data is insufficient.

When interpreting FFDC data from the error log, the FFDC data in the error log is not formatted for reading as well as the data in the spooled files. Each section of the FFDC dump in the error log is prefixed by a four-byte header. The first two bytes of the header are the length of the following section (not counting the prefix). The second two bytes, which are the section number, correspond to the section number in the index.