| Author |
Message
|
| CriticalDeadline |
 Posted: Mon Sep 15, 2014 12:50 pm Post subject: IIB v9 startup showing ownership as mqm id... ? |
 |
|
Novice
Joined: 15 Sep 2014
Posts: 10
|
Hi, we have a new install of iib and mq. MQ is running with mqm as expected. Go to start iib with the svciib and it appears to start correctly but when you issue a ps -ef it's running under user mqm. This is unexpected, not sure where we went wrong on the install or permissions setting? We have another broker installation in another environment that's not doing this and as far as I can tell everything is the same between the two boxes. Thanks for any pointers.
| Code: |
MQSI 9.0.0.1
/opt/IBM/mqsi/9.0.0.1
$ whoami
svciib
$ id svciib
uid=16430(svciib) gid=1521(mqbrokers) groups=1(staff),1523(mqm),1509(ftpgrp)
$ id mqm
uid=16426(mqm) gid=1523(mqm) groups=1(staff),1521(mqbrokers),1509(ftpgrp)
$
$ ps -ef | grep IIB
$ mqsistart IIB01U
BIP8071I: Successful command completion.
$ ps -ef | grep IIB
svciib 6750262 19988506 0 16:42:36 pts/1 0:00 grep IIB
mqm 12386482 20447320 0 16:42:20 - 0:00 biphttplistener IIB01U
mqm 12779686 1 0 16:42:19 - 0:00 bipservice IIB01U
mqm 20447320 12779686 121 16:42:19 - 0:04 bipbroker IIB01U
$ mqsistop IIB01U
BIP8016E: Unable to stop component.
A request to stop this component was refused.
Investigate the reason for this failure and reissue the command. The problem may be that the component was in the process of being stopped or started, in this case just reissue the command. It may be that the command could not be issued because of insufficient userid permissions. If you are unable to resolve the problem, contact your IBM support center.
$
$ sudo su mqm
$
$ whoami
mqm
$ mqsistop IIB01U
exec(): 0509-036 Cannot load program mqsistop.bin because of the following errors:
0509-150 Dependent module libPersonality.a(libPersonality.a.so) could not be loaded.
0509-022 Cannot load module libPersonality.a(libPersonality.a.so).
0509-026 System error: A file or directory in the path name does not exist.
$ . ../svciib/.profile
MQSI 9.0.0.1
/opt/IBM/mqsi/9.0.0.1
$ mqsistop IIB01U
BIP8071I: Successful command completion.
$ ps -ef | grep IIB
$
|
|
|
| Back to top |
|
 |
| mqjeff |
| Posted: Mon Sep 15, 2014 12:53 pm Post subject: |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 17447
|
On unix, the integration service always runs as the user that executes mqsistart.
Windows is able to use the Windows service userid config when someone runs mqsistart, but there isn't a good way to do that on Unix, not really.
If you want IIB to run as user XYZ, then you need to make sure that it is always user XYZ that issues mqsistart. |
|
| Back to top |
|
|
| CriticalDeadline |
| Posted: Mon Sep 15, 2014 12:57 pm Post subject: |
|
|
Novice
Joined: 15 Sep 2014
Posts: 10
|
| Hi - I don't follow. svciib is the one that issued mqsistart, yet svciib isn't the owner of the process. Somehow, it's running as mqm. See my putty-log output. |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Mon Sep 15, 2014 6:50 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20696
Location: LI,NY
|
| CriticalDeadline wrote: |
| Hi - I don't follow. svciib is the one that issued mqsistart, yet svciib isn't the owner of the process. Somehow, it's running as mqm. See my putty-log output. |
What are the file persmissions for mqsistart in your system?
r.s-r.s-r.x ?
What is the primary group of svciib? 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| stoney |
| Posted: Mon Sep 15, 2014 11:59 pm Post subject: |
|
|
Centurion
Joined: 03 Apr 2013
Posts: 140
|
Did you configure this integration node to run as an MQ service, using the -d defined flag of mqsicreatebroker or mqsichangebroker?
Integration nodes that are configured to run as MQ services are started by the queue manager, so will run under the mqm user ID instead of the user ID that ran mqsistart. |
|
| Back to top |
|
|
| CriticalDeadline |
| Posted: Tue Sep 16, 2014 4:30 am Post subject: |
|
|
Novice
Joined: 15 Sep 2014
Posts: 10
|
| fjb_saper wrote: |
| CriticalDeadline wrote: |
| Hi - I don't follow. svciib is the one that issued mqsistart, yet svciib isn't the owner of the process. Somehow, it's running as mqm. See my putty-log output. |
What are the file persmissions for mqsistart in your system?
r.s-r.s-r.x ?
What is the primary group of svciib? |
Hi, they are:
| Code: |
$ ls -al | grep mqsistar
-rwxr-xr-x 1 root system 2290 Nov 24 2013 mqsistart
$ id svciib
uid=16430(svciib) gid=1521(mqbrokers) groups=1(staff),1523(mqm),1509(ftpgrp)
$ id mqm
uid=16426(mqm) gid=1523(mqm) groups=1(staff),1521(mqbrokers),1509(ftpgrp)
|
| stoney wrote: |
Did you configure this integration node to run as an MQ service, using the -d defined flag of mqsicreatebroker or mqsichangebroker?
Integration nodes that are configured to run as MQ services are started by the queue manager, so will run under the mqm user ID instead of the user ID that ran mqsistart.
|
It looks like that's what happened. Looking through our install putty logs, we ran:
| Code: |
mqsicreatebroker IIB01U -q BAMQ01U -l /var/mqsi/IIB01U/lib -t -s active -d defined
|
Thanks for what looks like the diagnosis! Can this be only be fixed by deleting the broker and recreating it appropriately? We've since deployed several flows, is there a 'less drastic' way to undo this? |
|
| Back to top |
|
|
| stoney |
| Posted: Tue Sep 16, 2014 4:37 am Post subject: |
|
|
Centurion
Joined: 03 Apr 2013
Posts: 140
|
You can use mqsichangebroker to remove the MQ service definition without having to recreate the broker:
| Code: |
| mqsichangebroker IIB01U -d undefined |
|
|
| Back to top |
|
|
| CriticalDeadline |
| Posted: Tue Sep 16, 2014 4:48 am Post subject: |
|
|
Novice
Joined: 15 Sep 2014
Posts: 10
|
| stoney wrote: |
You can use mqsichangebroker to remove the MQ service definition without having to recreate the broker:
| Code: |
| mqsichangebroker IIB01U -d undefined |
|
Thank you for this. I did so and now can't start broker with the service account. Why would removing the '-d defined' flag cause this behavior? As shown in the OP I was able to start the broker with the service account previously (just not stop it, that had to be done by mqm). Any idea offhand for a fix?
| Code: |
$ mqsichangebroker IIB01U -d undefined
BIP8071I: Successful command completion.
$
$ ps -ef | grep IIB
svciib 11927800 10682462 0 08:39:29 pts/3 0:00 grep IIB
$
$
$ mqsistart IIB01U
BIP8138E: Userid 'svciib' cannot be used by this component.
The userId selected cannot be used by the component. This may be because the userId does not have the required authorization or that the userId is invalid for operations that the component requires, for example, if a component is to use fastbind (-t) on UNIX platforms it must use the ServiceUserId 'mqm'.
Check that the user has the required authority to create files and retry.
$
|
|
|
| Back to top |
|
|
| rekarm01 |
| Posted: Tue Sep 16, 2014 4:52 am Post subject: Re: IIB v9 startup showing ownership as mqm id... ? |
|
|
Grand Master
Joined: 25 Jun 2008
Posts: 1415
|
| CriticalDeadline wrote: |
| Code: |
$ id svciib
uid=16430(svciib) gid=1521(mqbrokers) groups=1(staff),1523(mqm),1509(ftpgrp)
$ id mqm
uid=16426(mqm) gid=1523(mqm) groups=1(staff),1521(mqbrokers),1509(ftpgrp) |
|
Is that group meant to be "mqbrokers", or "mqbrkrs"? |
|
| Back to top |
|
|
| stoney |
| Posted: Tue Sep 16, 2014 4:57 am Post subject: |
|
|
Centurion
Joined: 03 Apr 2013
Posts: 140
|
The mqsicreatebroker command you specified earlier specified the -t flag. The -t flag specifies that the integration node should use WebSphere MQ fastpath bindings. Only the mqm user ID can use WebSphere MQ fastpath bindings.
You either need to stop the integration node from using WebSphere MQ fastpath bindings:
| Code: |
| mqsichangebroker IIB01U -n |
Or you need to always start and stop the integration node using the mqm user ID. |
|
| Back to top |
|
|
| CriticalDeadline |
| Posted: Tue Sep 16, 2014 5:13 am Post subject: |
|
|
Novice
Joined: 15 Sep 2014
Posts: 10
|
| stoney wrote: |
The mqsicreatebroker command you specified earlier specified the -t flag. The -t flag specifies that the integration node should use WebSphere MQ fastpath bindings. Only the mqm user ID can use WebSphere MQ fastpath bindings.
You either need to stop the integration node from using WebSphere MQ fastpath bindings:
| Code: |
| mqsichangebroker IIB01U -n |
Or you need to always start and stop the integration node using the mqm user ID. |
Awesome, everything is working as expected now. Thanks very much for your help!! |
|
| Back to top |
|
|
|
|
