| Author |
Message
|
| exerk |
 Posted: Thu Nov 17, 2011 8:51 am Post subject: Dead-letter Handler as a Service |
 |
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
Scenario: WMQ V7.0.1.6 running under domain user control, and the requirement is to run the DLQH as a service.
Everything works fine with the queue manager except the Service fails with the following in the queue manager log (some content redacted/changed):
| Code: |
17/11/2011 14:12:09 - Process(9856.1) User(<domain user name>) Program(amqzmgr0.exe)
Host(HOSTNAME)
AMQ5020: Permission denied attempting to execute program
'<path>\mqdlqh.bat'.
EXPLANATION:
A request was made to execute the program <path>\mqdlqh.bat, however the operation was unsuccessful because the WebSphere MQ operating environment has insufficient permissions to access the program file.
ACTION:
Check the access permissions of the of the program to be executed and if necessary alter them to include execute permission for the WebSphere MQ userId. Also check that the WebSphere MQ userId has search access on all directories which compose the path to the program file.
----- amqzmgr0.c : 2883 ------------------------------------------------------- |
The domain user is that which WMQ runs under on each server, and it most definitely has the necessary rights to the location of the batch file, and the batch file itself. Further, we can see the stdout and stderr files being created so we know for certain that the user has write authority for the target directory (which contains the batch file, rules file, and stdout/stderr files).
So, we ran a command window as the user (using contact admin) and tried to run the service from the command console but got a 'permission denied' message. Executing runmqdlq from the command line, either as the logged on user (part of mqm group, but only temporarily, and also a domain user) or as the domain user and everything works as advertised.
Service definition as follows:
| Code: |
DEFINE SERVICE(DEAD.LETTER.HANDLER) +
DESCR('Dead-letter queue message handler') +
CONTROL(STARTONLY) +
SERVTYPE(SERVER) +
STARTCMD([path]\mqdlqh.bat) +
STARTARG(DEAD.QUEUE +QMNAME+ <[path]\[rules file name]) +
STOPCMD( ) +
STOPARG( ) +
STDOUT([path]\+QMNAME+_DLQ_stdout.txt) +
STDERR([path]\+QMNAME+_DLQ_stderr.txt) +
REPLACE |
The Windows admins are scratching their heads, I'm convinced it's environmental but can't identify what's missing. To be sure it wasn't a configuration issue, I used the same service definition in a 'local' mode WMQ installation, which worked perfectly - the service ran as MUSR_MQADMIN - which reinforces my belief that the problem on the domain box is environmental.
An FDC file was also cut but it related to javaw.exe (first attempt to start the service from the GUI) and I'll post the header from that if anyone thinks it's relevant.
I'd much appreciate feedback from anyone whom may have encountered the same issue, and fixed it, or point out the blindingly obvious detail I have missed!
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
 |
| Michael Dag |
| Posted: Thu Nov 17, 2011 9:41 am Post subject: |
|
|
Jedi Knight
Joined: 13 Jun 2002
Posts: 2607
Location: The Netherlands (Amsterdam)
|
why do you SERVTYPE(SERVER) instead of SERVTYPE(COMMAND)? clearly it's a command that runs once... or is there something in mqdlqh.bat that runs over and over and over on a timer?
did you put a SET command in the bat file to see what the environment settings are etc?
_________________
Michael
MQSystems Facebook page |
|
| Back to top |
|
|
| exerk |
| Posted: Thu Nov 17, 2011 9:50 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| Michael Dag wrote: |
| why do you SERVTYPE(SERVER) instead of SERVTYPE(COMMAND)? clearly it's a command that runs once... or is there something in mqdlqh.bat that runs over and over and over on a timer? |
Tried it as both, same problem. The reason it's set to SERVER is so it shows a status in MQExplorer (I know, but it's not my train set!) or a command console.
| Michael Dag wrote: |
| ...did you put a SET command in the bat file to see what the environment settings are etc? |
No, but I'll give it a go. I don't think it will make a difference as I'm pretty sure the batch file is not being executed.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Nov 17, 2011 8:56 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
your *.bat or *.cmd file does not get executed.
Verify the properties (fine grained) and make sure you have following set for the user/group that runs MQ...: read + execute
Could it be that the admins left the read property out of the permissions?
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| mqjeff |
| Posted: Fri Nov 18, 2011 2:58 am Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
| the error seems reasonably clear to me that the batch file itself is never started because the <domain user name> does not have access to the batch file - either because it doesn't have permissions on the batch file itself or doesn't have permissions on the path to the batch file. |
|
| Back to top |
|
|
| exerk |
| Posted: Fri Nov 18, 2011 3:30 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| fjb_saper wrote: |
your *.bat or *.cmd file does not get executed.
Verify the properties (fine grained) and make sure you have following set for the user/group that runs MQ...: read + execute
Could it be that the admins left the read property out of the permissions?
|
Both the admins and myself have checked the properties and the user has full control of the directory and its contents.
UPDATE: Last night we explicitly set authorities to the mqm group on the server and restarted the server (it is Windows) and this morning we moved the service groups back to the server - magically it all works! So we did the same with the other server, restarted it, and moved back the service groups - and it doesn't work on that node.
I have thrown the whole lot back at the box builders to sort out, and I'm now off to the dungeon to have a dummy spit and a sulk! 
BACK STORY: I had a nightmare getting the amqmsrvn service to run under domain-user control, and it required PMR intervention to get it to do so, so I strongly suspect there is something funny about the way the environment is set up.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| exerk |
| Posted: Fri Nov 18, 2011 3:32 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| mqjeff wrote: |
| the error seems reasonably clear to me that the batch file itself is never started because the <domain user name> does not have access to the batch file - either because it doesn't have permissions on the batch file itself or doesn't have permissions on the path to the batch file. |
Jeff, that's why we explicitly set the permissions, just in case they weren't being inherited.
EDIT: Apologies to all for not making it explicitly clear in the OP that the platform is Windows, and for the patchy nature of replies - once I'm on the system I can't connect to the outside world.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| shashivarungupta |
| Posted: Tue Nov 22, 2011 5:54 am Post subject: |
|
|
Grand Master
Joined: 24 Feb 2009
Posts: 1343
Location: Floating in space on a round rock.
|
what's inside "mqdlqh.bat" ? Does it have runmqdlq, if yes then why can not we keep it as it is (with or without absolute path of mq to bin folder where runmqdlq reside.) (just curious). 
I've been facing similar kind of issue, but not getting permission denied error in the qmgr error logs., but my issue says its unable to connect to qmgr and dlq handler ends as soon as it gets started. here 
_________________
*Life will beat you down, you need to decide to fight back or leave it. |
|
| Back to top |
|
|
| exerk |
| Posted: Tue Nov 22, 2011 6:03 am Post subject: |
|
|
Jedi Council
Joined: 02 Nov 2006
Posts: 6339
|
| shashivarungupta wrote: |
| what's inside "mqdlqh.bat" ? |
All the batch file contains is the line runmqdlq %1 %2 %3
| shashivarungupta wrote: |
| I've been facing similar kind of issue, but not getting permission denied error in the qmgr error logs., but my issue says its unable to connect to qmgr and dlq handler ends as soon as it gets started. here |
There was some confusion in your post quoted above to say the least - I wasn't the only one getting confused half-way through as to whether you were triggering it, or starting it as a service. As regards that post, see my answer to it.
_________________
It's puzzling, I don't think I've ever seen anything quite like this before...and it's hard to soar like an eagle when you're surrounded by turkeys. |
|
| Back to top |
|
|
| shashivarungupta |
| Posted: Tue Nov 22, 2011 7:42 am Post subject: |
|
|
Grand Master
Joined: 24 Feb 2009
Posts: 1343
Location: Floating in space on a round rock.
|
| exerk wrote: |
| shashivarungupta wrote: |
| what's inside "mqdlqh.bat" ? |
All the batch file contains is the line runmqdlq %1 %2 %3
| shashivarungupta wrote: |
| I've been facing similar kind of issue, but not getting permission denied error in the qmgr error logs., but my issue says its unable to connect to qmgr and dlq handler ends as soon as it gets started. here |
There was some confusion in your post quoted above to say the least - I wasn't the only one getting confused half-way through as to whether you were triggering it, or starting it as a service. As regards that post, see my answer to it. |
Thanks for your inputs.
I followed the way you have, but I used runmqdlq %1 %2 %3 %4 in the batch file and passed that bat file as start command. Which took parameters (as start arguments) Qname QmgrName < RuleFile.txt
(where %3 is for < ) . after setting the read+execute permissions on the bat file PLUS on the Server Service Object for user 'MUSR_MQADMIN' (on windows), it get started successfully !!!
Qmgr error log would have a notification about it, like :
| Quote: |
-------------------------------------------------------------------------------
11/22/2011 20:54:28 - Process(3672.1) User(MUSR_MQADMIN) Program(runmqdlq.exe) Host(vagupta7)
AMQ8708: Dead-letter queue handler started to process INPUTQ(DEADQ).
EXPLANATION:
The dead-letter queue handler (runmqdlq) has been started and has parsed the input file without detecting any errors and is about to start processing the queue identified in the message.
ACTION:
None.
------------------------------------------------------------------------------- |
Thanks
_________________
*Life will beat you down, you need to decide to fight back or leave it. |
|
| Back to top |
|
|
|
|
