MQMonitor Agent - MCA user ID confifuration

[pivst01]

Hi All,

 

do you know please where and how can i configure a specific user for Monitor Agent to monitor MQ?

i couldnt find any property like userID or MCA user ID in the MQMonitor.properties.

 

thank you,

stefan

[Billy Cole]

Stefan,

 

Not sure if this helps, but we have a user on our host of the MQ agent that starts the agent.  This user then is granted group assignments on the MQ/Broker servers to allow for the groups mqm and mqbrkrs.  I haven't had need to change what the agent is logging into MQ with, and this has worked rather well over the last few years.

 

Hope this helps,

Billy

[pivst01]

Hi Billy,

 

yes, it is very helpful information.

is it hardcoded user id please? if so, what is the username/usergroup as i need it to set proper rights for this user/group on the MQ side, right?

(setmqaut -m <QMgrName> -t qmgr -g <GroupName> +dsp +inq +connect +crt

setmqaut -m <QMgrName> -t qmgr -p <PrincipalName> +dsp +get +inq +put +connect +sub +resume)

 

based on this information i supposed that i could configure the username/group.

"If the server connection channel used by the MQMonitor agent is CLIENT.WILY and the MCA user ID is set to Wily, then the user "Wily" must be made a member of mqm group, so the MQMonitor agent can connect to the Queue Manager without problems. - http://www.ca.com/us/support/ca-support-online/product-content/knowledgebase-articles/tec612772.aspx "

 

thank you,

stefan

[Billy Cole]

Morning Stefan,

 

In our instance, the user name is the unix account that starts the mq agent with the "./startMQMonitor.sh &".  In our case, we have an account on a Suse Linux server called "wilymq" which owns the wilyMQ directory.  We log into the server using our login account then sudo (su) into the wilymq user account.  Then when we issue the startMQMonitor, the wilymq user is used to call to the MQ instance on a different host.

On the MQ, you would need to assign the agent user to the groups "mqm" for MQ queue manager group and then the mqbrkrs in order to query the IIB (broker) queues.

 

You should be able to issue the "groups" command from the command line (linux) while logged into the wilymq account and get back "wilymq mqm mqbrkrs" on both the agent host and the MQ host.

 

There is a section in the APM for IBM MQ with the title "Set the MCA User ID" which has:

"If you do not specify the MCA User ID at connect time, the server uses the client user ID.

By defining the MCA User ID in the channel definition you can override the privileges of the client user ID"

 

Now, I'm not an MQ admin so I can't tell you if these accounts are default groups or what permissions from the OS to MQ are assigned to these groups.

 

For Broker, there is a MBMonitorJMSQueues.mqsc file that will create the reporting queues.  I found this down under the agent directory under properties.

 

Additional, you will need to copy the communication jars from your MQ instance to the agent and place them within the <agent home>/lib then align the start script.  The list of jars are listed within the startMQMonitor.sh script at the top.

 

Hope this helps,

Billy

[pivst01]

Hi Billy,

 

thank you for the clear explanation!

we have dedicated user for CA products as well (under who we run the MQAgent), so i will ask the MQ administrators to add this user to the MQM group.

 

thank you,

stefan