ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » IBM MQ Security » MQ queue depth checking without mqm authority granted

Post new topic  Reply to topic Goto page 1, 2  Next
 MQ queue depth checking without mqm authority granted « View previous topic :: View next topic » 
Author Message
yupoet
PostPosted: Wed Nov 03, 2010 10:22 pm    Post subject: MQ queue depth checking without mqm authority granted Reply with quote

Apprentice

Joined: 26 Nov 2008
Posts: 36

How can an ID do some checking against queue depth on mainframe, without any privileged access to COMMAND INPUT queue and no access to privileged mqm group (TPMQM) ?
Back to top
View user's profile Send private message
Mr Butcher
PostPosted: Thu Nov 04, 2010 12:52 am    Post subject: Reply with quote

Padawan

Joined: 23 May 2005
Posts: 1716

you can either put a "display qlocal(youqueuename) curdepth" to the SYSSTEM.COMMAND.INPUT queue (or use PCF command) and read the proper reply from the ReplyToQueue, or use the MQ API (MQINQ).

For both solutions you need proper security, depending which security classes are active in your environment (MQQUEUE, MQCMDS, MQCONN, MQADMIN.......)

There are tables in the z/OS MQ System Setup Guide that exactly show you which security is requred for which action / command / API call.
_________________
Regards, Butcher
Back to top
View user's profile Send private message
Vitor
PostPosted: Thu Nov 04, 2010 3:56 am    Post subject: Re: MQ queue depth checking without mqm authority granted Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

yupoet wrote:
How can an ID do some checking against queue depth on mainframe, without any privileged access to COMMAND INPUT queue and no access to privileged mqm group (TPMQM) ?


Why would any id that didn't have that access have any interest in queue depth?
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
yupoet
PostPosted: Sun Apr 17, 2011 11:02 pm    Post subject: Reply with quote

Apprentice

Joined: 26 Nov 2008
Posts: 36

some application team people requested this...

finally I just rejected their request and will do it each time for them
Back to top
View user's profile Send private message
zpat
PostPosted: Sun Apr 17, 2011 11:10 pm    Post subject: Reply with quote

Jedi Council

Joined: 19 May 2001
Posts: 5849
Location: UK

An application with inquiry authority (on that queue) can use the MQI call MQINQ.

A REXX program would be easy to code (with the REXX MQ support pac).
Back to top
View user's profile Send private message
Mr Butcher
PostPosted: Mon Apr 18, 2011 2:23 am    Post subject: Reply with quote

Padawan

Joined: 23 May 2005
Posts: 1716

Quote:
and will do it each time for them


hopefully you will not need 5 months for the answer as you needed here to answer Vitor's question.
_________________
Regards, Butcher
Back to top
View user's profile Send private message
bruce2359
PostPosted: Mon Apr 18, 2011 5:14 am    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9392
Location: US: west coast, almost. Otherwise, enroute.

Do the developers want to know IF there are any messages in the queue? Or do they want to know exactly HOW MANY messages are in the queue?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
gbaddeley
PostPosted: Mon Apr 18, 2011 7:34 pm    Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2491
Location: Melbourne, Australia

zpat wrote:
An application with inquiry authority (on that queue) can use the MQI call MQINQ.


Yes, they can write a litte app program that opens the queues (which they will already have access to) and do an MQINQ to obtain the current depth. No need to muck around with MQ commands and securing them.

The amqsinqa sample program contains an example of coding a MQINQ call to do this.
_________________
Glenn
Back to top
View user's profile Send private message
MQMB&WAS
PostPosted: Mon Apr 16, 2018 10:31 am    Post subject: Reply with quote

Centurion

Joined: 12 Jun 2016
Posts: 130

gbaddeley wrote:
zpat wrote:
An application with inquiry authority (on that queue) can use the MQI call MQINQ.


Yes, they can write a litte app program that opens the queues (which they will already have access to) and do an MQINQ to obtain the current depth. No need to muck around with MQ commands and securing them.

The amqsinqa sample program contains an example of coding a MQINQ call to do this.


can't amqsbcg be used to get the queue depth?
Back to top
View user's profile Send private message
Vitor
PostPosted: Mon Apr 16, 2018 11:02 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

MQMB&WAS wrote:
can't amqsbcg be used to get the queue depth?


a) Please don't reopen 7 year old threads.
b) Yes, if you want to read all the way to the bottom of the queue in a hideously inefficient manner and accept that by the time you've done that, the depth might have changed & you've not counted any uncommitted messages anyway.
c) I repeat my question from 7 years ago - why would any id without administrative access be interested in queue depth? No application should be concerned with the depth of the queue, simply the existence (or otherwise) of available messages to retrieve.
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
MQMB&WAS
PostPosted: Mon Apr 16, 2018 11:14 am    Post subject: Reply with quote

Centurion

Joined: 12 Jun 2016
Posts: 130

Vitor wrote:
why would any id without administrative access be interested in queue depth? No application should be concerned with the depth of the queue, simply the existence (or otherwise) of available messages to retrieve.


Thanks for your time, Vitor. The application queue owner wants a way to query the queue depth. They do have put/get/inq access. What would be the best way to do this?
Back to top
View user's profile Send private message
Vitor
PostPosted: Mon Apr 16, 2018 11:19 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

MQMB&WAS wrote:
Vitor wrote:
why would any id without administrative access be interested in queue depth? No application should be concerned with the depth of the queue, simply the existence (or otherwise) of available messages to retrieve.


Thanks for your time, Vitor. The application queue owner wants a way to query the queue depth. They do have put/get/inq access. What would be the best way to do this?


Which part of "no application should be concerned with the depth of the queue" was unclear?

There's no good reason why the application owner would want this. What's the bad reason that's been given?
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
gbaddeley
PostPosted: Mon Apr 16, 2018 5:14 pm    Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2491
Location: Melbourne, Australia

For normal application processing of MQ messages, app programs should not be concerned with the current depth. However, from an operational support perspective, it is useful to know what is happening with the current depth if an issue is being investigated.
_________________
Glenn
Back to top
View user's profile Send private message
Vitor
PostPosted: Tue Apr 17, 2018 5:08 am    Post subject: Reply with quote

Grand High Poobah

Joined: 11 Nov 2005
Posts: 26093
Location: Texas, USA

gbaddeley wrote:
For normal application processing of MQ messages, app programs should not be concerned with the current depth. However, from an operational support perspective, it is useful to know what is happening with the current depth if an issue is being investigated.




Exactly.

And why would operational support be trying to run administrative tools without administrative access?
_________________
Honesty is the best policy.
Insanity is the best defence.
Back to top
View user's profile Send private message
PeterPotkay
PostPosted: Tue Apr 17, 2018 3:49 pm    Post subject: Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7717

MQMB&WAS wrote:
Vitor wrote:
why would any id without administrative access be interested in queue depth? No application should be concerned with the depth of the queue, simply the existence (or otherwise) of available messages to retrieve.


Thanks for your time, Vitor. The application queue owner wants a way to query the queue depth. They do have put/get/inq access. What would be the best way to do this?

Have the App Owner work with your Enerprise Monitoring Team, whose tools probably capture details like queue depth, perhaps every minute or so, storing that information in a database, allowing people to look at the queue depth historically.

No, their program logic does not need to and should not want to query the queue depth to make any sort of processing decision.
_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic  Reply to topic Goto page 1, 2  Next Page 1 of 2

MQSeries.net Forum Index » IBM MQ Security » MQ queue depth checking without mqm authority granted
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.