ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum Index » General IBM MQ Support » Mysterious Queue properties change

Post new topic  Reply to topic
 Mysterious Queue properties change « View previous topic :: View next topic » 
Author Message
tlaner
PostPosted: Wed Oct 26, 2011 3:09 pm    Post subject: Mysterious Queue properties change Reply with quote

Newbie

Joined: 20 Jun 2003
Posts: 8
Location: USA

Today on one of our production Unix Queue Managers, one of our local queues properties were changed. After we did an audit of our usr logs we could not see that any user(su mqm) altered the properties.

I was wondering if there could be some issue in 7.0.1.3 certain queue properties may get zero'ed out unde some condition. The properties that were altered were:
MAXDEPTH(50000) MAXMSGL(4194304) were changed to MAXDEPTH(0) MAXMSGL
(0)
There are no FDC's that alert us to an issue.

This caused a major outage in our systems today and my team is under the gun to find out how this could occur. Currently the queue managers are running on a solaris zone on a Oracle T5120. MQ Series version 7.0.1.3.

Any help would be appreciated. This has occured twice before since we have gone to MQSeries version 7.
Back to top
View user's profile Send private message Yahoo Messenger
bruce2359
PostPosted: Wed Oct 26, 2011 3:49 pm    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.

Does the alteration date/time of the queue indicate that the change was made recently?

Who (or what) has mqm privilege? Get them in a room and smack them with a fish until someone confesses?

You might want to configure configuration events (qmgr attribute).
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
tlaner
PostPosted: Wed Oct 26, 2011 4:22 pm    Post subject: Reply with quote

Newbie

Joined: 20 Jun 2003
Posts: 8
Location: USA

Yes the alteration time was today at 16:14...I already beat up my team and they all claim that they didn't do any change. The su.logs only showed 4 people logged in to this server at that time. I personally interviewed all of them and they all claim no action was taken.

I believe them and they are, I hope, smart enough to never set these properties at 0 even by mistake.
Back to top
View user's profile Send private message Yahoo Messenger
bruce2359
PostPosted: Wed Oct 26, 2011 6:07 pm    Post subject: Reply with quote

Poobah

Joined: 05 Jan 2008
Posts: 9469
Location: US: west coast, almost. Otherwise, enroute.

Inbound channels on the affected qmgr? If so, it's possible that the admin command could have come from another of your qmgrs, or from WMQ software on installed on elsewhere.

Are your channels secured (SSL)?
_________________
I like deadlines. I like to wave as they pass by.
ב''ה
Lex Orandi, Lex Credendi, Lex Vivendi. As we Worship, So we Believe, So we Live.
Back to top
View user's profile Send private message
Mr Butcher
PostPosted: Wed Oct 26, 2011 10:45 pm    Post subject: Reply with quote

Padawan

Joined: 23 May 2005
Posts: 1716

maybe that information can be digged out of the mq transaction log files. i did a change on a local queue and found that in the log (using the strings command). however, i did not find my userid, maybe thats coded by uuid or groupid somewhere (i am more familiar with the z/OS log records).
so maybe its worth taking a hex editor or a log analysis tool (is there any free one?!?) and have a look at the logs.
_________________
Regards, Butcher
Back to top
View user's profile Send private message
zpat
PostPosted: Wed Oct 26, 2011 11:04 pm    Post subject: Reply with quote

Jedi Council

Joined: 19 May 2001
Posts: 5866
Location: UK

You can turn on command events - may help in the future to prove that no-one issued such a command or PCF message.

Do you have any add-on MQ tools or system management tools?
Back to top
View user's profile Send private message
PeterPotkay
PostPosted: Thu Oct 27, 2011 9:14 am    Post subject: Re: Mysterious Queue properties change Reply with quote

Poobah

Joined: 15 May 2001
Posts: 7722

tlaner wrote:
After we did an audit of our usr logs we could not see that any user(su mqm) altered the properties.


Also check what other IDs are members of the mqm group. Those IDs could have run runmqsc without issuing su - mqm.
_________________
Peter Potkay
Keep Calm and MQ On
Back to top
View user's profile Send private message
tlaner
PostPosted: Thu Oct 27, 2011 7:04 pm    Post subject: Reply with quote

Newbie

Joined: 20 Jun 2003
Posts: 8
Location: USA

We found the culprit. We had an app using PCFs doing some "supposedly" minor admin functions. It was using a version 6 jar file to connect to our MQ Version 7 QM. It seems some of the get properties in this case came back with null values and we used the same values to set properties which turned those properties to zero. I know, not a good design. I need to open a pmr on this as to why this occurs. It never occurred when we were pure MQ Version 6.
Back to top
View user's profile Send private message Yahoo Messenger
Display posts from previous:   
Post new topic  Reply to topic Page 1 of 1

MQSeries.net Forum Index » General IBM MQ Support » Mysterious Queue properties change
Jump to:  



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP
 
 


Theme by Dustin Baccetti
Powered by phpBB © 2001, 2002 phpBB Group

Copyright © MQSeries.net. All rights reserved.