| Author |
Message
|
| sachinramesh |
 Posted: Wed Aug 16, 2023 6:29 am Post subject: GET authorizations missing on the queue |
 |
|
Disciple
Joined: 20 Feb 2007
Posts: 170
|
HI,
Application has complained that they are not able to access the mq queue.
the error log has entry saying no authorization for the user to get.
It was supposed to be there as application is using it from some time.
when we checked we could see the get authorization is missing .app started working after providing the authorization.
We have checked our qmgr backup also to see if the authorization is missing .we can see in the backup file the GET authorization is present.
Is there a possibility for the authorizations to change without manual intervention.There is nothing in the logs too which says the authorization is removed.
This is on MQ9.2 |
|
| Back to top |
|
 |
| gbaddeley |
| Posted: Wed Aug 16, 2023 3:48 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
| Quote: |
| Is there a possibility for the authorizations to change without manual intervention. |
No.
Maybe the app has changed its credentials, and MQ is using a different authorization profile compared to the previous state.
Check the first authorization error in the MQ error logs and relate the timing to any possible changes in the application.
If the are using MQ Client, check if any settings have changed on their SVRCONN channel, eg. MCAUSER.
_________________
Glenn |
|
| Back to top |
|
|
| sachinramesh |
| Posted: Thu Aug 17, 2023 12:24 am Post subject: |
|
|
Disciple
Joined: 20 Feb 2007
Posts: 170
|
Thanks Gbaddeley,
Actually application has changed their password on their end.
will that be a reason for the missing Get authorizations and if so why only get is missing .
i am also trying to compare the logs first updated with the error and the application password change timings |
|
| Back to top |
|
|
| hughson |
| Posted: Thu Aug 17, 2023 1:48 am Post subject: Re: GET authorizations missing on the queue |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| sachinramesh wrote: |
| We have checked our qmgr backup also to see if the authorization is missing .we can see in the backup file the GET authorization is present. |
I am curious, what this means. What form does your backup file take, and how can you see authorizations in it?
Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| sachinramesh |
| Posted: Thu Aug 17, 2023 2:28 am Post subject: |
|
|
Disciple
Joined: 20 Feb 2007
Posts: 170
|
HI Hughson,
Its the Qmgr object backup using dmpmqcfg |
|
| Back to top |
|
|
| hughson |
| Posted: Thu Aug 17, 2023 2:40 am Post subject: |
|
|
Padawan
Joined: 09 May 2013
Posts: 1959
Location: Bay of Plenty, New Zealand
|
| sachinramesh wrote: |
HI Hughson,
Its the Qmgr object backup using dmpmqcfg |
Ah gotcha. So you know the last date it was there - the date of the dmpmqfg. However, unless you have command or config events turned on, any reporting of who removed it is not available.
Cheers,
Morag
_________________
Morag Hughson @MoragHughson
IBM MQ Technical Education Specialist
Get your IBM MQ training here!
MQGem Software |
|
| Back to top |
|
|
| sachinramesh |
| Posted: Thu Aug 17, 2023 4:19 am Post subject: |
|
|
Disciple
Joined: 20 Feb 2007
Posts: 170
|
Yes, it was present till the application changed the credentials on their app.
The timings of the first error in the our logs and the App credentails change time is also matching.
As gbaddeley said change in the application credentials could be the reason .
not sure why only Get has changed and all other authroizations are not changed on the queue[/list][/quote][/code] |
|
| Back to top |
|
|
| gbaddeley |
| Posted: Thu Aug 17, 2023 2:15 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
| sachinramesh wrote: |
As gbaddeley said change in the application credentials could be the reason .
|
Password change will not affect authorisations. Userid change could do it.
| Quote: |
| not sure why only Get has changed and all other authroizations are not changed on the queue |
GET could only change if there was a deliberate operation by someone/something to modify a MQ authorization profile.
Can you do a diff on the backup and current state? Maybe other things have changed as well.
_________________
Glenn |
|
| Back to top |
|
|
|
|
