| Author |
Message
|
| tlaner |
 Posted: Wed Oct 26, 2011 3:09 pm Post subject: Mysterious Queue properties change |
 |
|
Newbie
Joined: 20 Jun 2003
Posts: 8
Location: USA
|
Today on one of our production Unix Queue Managers, one of our local queues properties were changed. After we did an audit of our usr logs we could not see that any user(su mqm) altered the properties.
I was wondering if there could be some issue in 7.0.1.3 certain queue properties may get zero'ed out unde some condition. The properties that were altered were:
MAXDEPTH(50000) MAXMSGL(4194304) were changed to MAXDEPTH(0) MAXMSGL
(0)
There are no FDC's that alert us to an issue.
This caused a major outage in our systems today and my team is under the gun to find out how this could occur. Currently the queue managers are running on a solaris zone on a Oracle T5120. MQ Series version 7.0.1.3.
Any help would be appreciated. This has occured twice before since we have gone to MQSeries version 7. |
|
| Back to top |
|
 |
| bruce2359 |
| Posted: Wed Oct 26, 2011 3:49 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
Does the alteration date/time of the queue indicate that the change was made recently?
Who (or what) has mqm privilege? Get them in a room and smack them with a fish until someone confesses?
You might want to configure configuration events (qmgr attribute).
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| tlaner |
| Posted: Wed Oct 26, 2011 4:22 pm Post subject: |
|
|
Newbie
Joined: 20 Jun 2003
Posts: 8
Location: USA
|
Yes the alteration time was today at 16:14...I already beat up my team and they all claim that they didn't do any change. The su.logs only showed 4 people logged in to this server at that time. I personally interviewed all of them and they all claim no action was taken.
I believe them and they are, I hope, smart enough to never set these properties at 0 even by mistake. |
|
| Back to top |
|
|
| bruce2359 |
| Posted: Wed Oct 26, 2011 6:07 pm Post subject: |
|
|
Poobah
Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.
|
Inbound channels on the affected qmgr? If so, it's possible that the admin command could have come from another of your qmgrs, or from WMQ software on installed on elsewhere.
Are your channels secured (SSL)?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live. |
|
| Back to top |
|
|
| Mr Butcher |
| Posted: Wed Oct 26, 2011 10:45 pm Post subject: |
|
|
Padawan
Joined: 23 May 2005
Posts: 1716
|
maybe that information can be digged out of the mq transaction log files. i did a change on a local queue and found that in the log (using the strings command). however, i did not find my userid, maybe thats coded by uuid or groupid somewhere (i am more familiar with the z/OS log records).
so maybe its worth taking a hex editor or a log analysis tool (is there any free one?!?) and have a look at the logs.
_________________
Regards, Butcher |
|
| Back to top |
|
|
| zpat |
| Posted: Wed Oct 26, 2011 11:04 pm Post subject: |
|
|
Jedi Council
Joined: 19 May 2001
Posts: 5866
Location: UK
|
You can turn on command events - may help in the future to prove that no-one issued such a command or PCF message.
Do you have any add-on MQ tools or system management tools? |
|
| Back to top |
|
|
| PeterPotkay |
| Posted: Thu Oct 27, 2011 9:14 am Post subject: Re: Mysterious Queue properties change |
|
|
Poobah
Joined: 15 May 2001
Posts: 7722
|
| tlaner wrote: |
| After we did an audit of our usr logs we could not see that any user(su mqm) altered the properties. |
Also check what other IDs are members of the mqm group. Those IDs could have run runmqsc without issuing su - mqm.
_________________
Peter Potkay
Keep Calm and MQ On |
|
| Back to top |
|
|
| tlaner |
| Posted: Thu Oct 27, 2011 7:04 pm Post subject: |
|
|
Newbie
Joined: 20 Jun 2003
Posts: 8
Location: USA
|
| We found the culprit. We had an app using PCFs doing some "supposedly" minor admin functions. It was using a version 6 jar file to connect to our MQ Version 7 QM. It seems some of the get properties in this case came back with null values and we used the same values to set properties which turned those properties to zero. I know, not a good design. I need to open a pmr on this as to why this occurs. It never occurred when we were pure MQ Version 6. |
|
| Back to top |
|
|
|
|
