Mainframe Telemetry

Mainframe connectivity is the product.

Most automation tools treat the mainframe as a black box behind a screen scraper. Progull is built by engineers with deep, pre-existing expertise across z/OS, CICS, DB2 and JCL — with first-class instrumentation of SDSF, SYSLOG and the JES spool.

Telemetry sources

Six native signals, one reasoning context.

Each source is parsed natively into a typed event and fused into the agent's working memory for the incident.

z/OS SYSLOG & OPERLOG

IEF450I PAYRUN02 STEP0040 ABEND=S0C7 U0000

Continuous message stream ingestion with line-level parsing of IEF/IEC/IGZ message families. No polling, no screen scrape.

SDSF & JES2/JES3 spool

SYSOUT.PAYRUN02 · SYSUDUMP.PAYRUN02 · JESYSMSG

Structured extraction of step-level return codes, condition codes, sysout segments and dump datasets across JES2 and JES3.

JCL & PROC libraries

//STEP0040 EXEC PGM=PAYCALC,PARM='CLEAN'

Static analysis of JCL semantics — PROCs, overrides, DD allocations, step dependencies — required for any safe restart decision.

CICS region state

CICSPA01 · TRAN=PAYT · CSDF region warm-restart

Region state, transaction context and recycle orchestration with explicit safety checks and pre-flight resource validation.

DB2 diagnostics

SQLCODE=-911 SQLSTATE=40001 RESOURCE=PAY.OUT

SQLCODE, SQLSTATE, deadlocks, plan/package failures and resource contention mapped into the agent's reasoning context.

Change & CMDB context

CHG0044021 · COBOL deploy · 21:42 UTC

Correlates abends with recent change records, deploys and CI relationships from ServiceNow — the missing link for explainability.

Live trace

From JES spool to closed ticket.

A representative S0C7 abend, captured exactly as Progull sees it. Every line is a parsed, typed event — not OCR, not regex over a 3270 screen.

progull · live traceCONNECTED
[00:00.142] SYSLOG  IEF450I PAYRUN02 STEP0040 ABEND=S0C7
[00:00.310] SDSF    fetch SYSOUT.PAYRUN02 (38 KB)
[00:00.412] SDSF    fetch SYSUDUMP.PAYRUN02 (1.2 MB)
[00:00.580] JCL     parse STEP0040 EXEC PGM=PAYCALC PARM='CLEAN'
[00:00.722] DB2     SQLCODE=000 — no SQL fault path
[00:01.014] CHANGE  correlated CHG0044021 (COBOL deploy 21:42)
[00:01.380] AGENT   hypothesis: packed-decimal overflow in PAYCALC
[00:01.612] AGENT   confidence 0.94 — select playbook PB-MF-014
[00:01.701] SN      INC0098231 created · severity 2
[00:01.940] AGENT   HOLD GLFEED01
[00:02.013] AGENT   SUBMIT PAYRUN02.STEP0040 PARM='CLEAN'
[02:11.402] z/OS    RC=00 — STEP0040 complete
[02:13.118] DB2     PAY.OUT 142,408 rows verified
[02:13.901] AGENT   RELEASE GLFEED01
[02:14.000] SN      INC0098231 closed — auto-resolved
Restrictive environments

Designed for the way mainframes are actually run.

Least-privilege RACF/ACF2 profiles

Every Progull action runs under a named, auditable surrogate ID with the minimum SAF authority required.

No outbound dependencies by default

Deploy fully on-prem with private LLM endpoints, or run hybrid with brokered egress. You choose where reasoning happens.

Read-first, write-on-approval

Telemetry is read-only by default. Any state-changing action requires a policy match and is logged with signature and worknote.

Abend coverage

The abend families Progull resolves natively.

A non-exhaustive view of system, user and subsystem abends with first-class diagnosis paths shipped out of the box.

CodeFamilyTypical root causeDefault playbook
S0C4StorageAddress-space protection / bad pointer in COBOL/PL/ICapture dump · isolate module · open CR
S0C7Data exceptionInvalid packed-decimal in COBOL arithmeticResubmit with PARM=CLEAN · hold downstream
S322TimeCPU time exceeded for stepRe-time JCL · split step · escalate to capacity
S806LinkageLoad module not foundVerify STEPLIB · refresh LLA · resubmit
S913SecurityRACF access denied to datasetOpen access request · pause job class
SB37/SD37/SE37SpaceDataset out of space / extentsReallocate · compress · resubmit
U0016DB2Bind/plan failureRebind package · resubmit
SQLCODE-911DB2Deadlock / timeoutRetry with backoff · escalate on N retries
SQLCODE-904DB2Resource unavailableVerify image copy · check utility · resubmit
AICACICSRunaway transactionPurge TRAN · cycle region if pattern repeats
Deployment topology

Three patterns. Pick the one your security team signs.

  • On-prem, air-gapped

    Progull runtime and private LLM endpoint inside the mainframe data centre. Zero outbound egress. Operated under your existing change control.

  • Private cloud, brokered

    Runtime in your VPC; reasoning brokered to an approved hosted model via signed, audited egress. Telemetry never leaves your tenant unredacted.

  • Progull managed tenant

    Single-tenant managed deployment with customer-held keys, dedicated VPC peering and a transparent SOC 2 control plane.

Connectivity

How Progull actually reaches your z/OS estate.

transport
TLS 1.3 over private network · no public ingress
telemetry
SDSF API, JES2/JES3 spool API, SYSLOG batch reader
control
z/OSMF REST · System REXX · operator console under surrogate ID
db2
DB2 REST services or JDBC type-4 via private listener
cics
CMCI REST against managed CICSplex; no direct 3270
change
ServiceNow Table API · scoped app credentials
identity
RACF/ACF2/Top Secret surrogate IDs · per-env least privilege
audit
All control-plane calls signed and persisted to SIEM