IC85940: CRTMQM COMMAND FAILS WHEN ISSUED WITH -MD OR -LD OPTION TO CREATE QUEUE MANAGER DATA AND LOG DIRECTORIES ON SHARED NAS

WebSphere MQ V7.5 Fix Pack 7.5.0.1
Fix Pack 7.1.0.3 for WebSphere MQ V7.1

APAR status

• Closed as program error.

Error description

• WHEN CREATING DIRECTORY STRUCTURE, ERROR AMQ6245 IS RETURNED FOR
  EACH CreateFile OR CreateDirectory CALL AND CULMINATES WITH
  ERROR AMQ7019: AN ERROR OCCURRED WHILE CREATING OR CHECKING THE
  DIRECTORY STRUCTURE FOR THE QUEUE MANAGER.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  WebSphere MQ v7.1 users who create queue manager by specifying
  -md or -ld option to create the data and/or the log directories
  on some NAS devices implementing CIFS.
  
  Platforms affected:
  Windows
  
  ****************************************************************
  PROBLEM SUMMARY:
  During queue manager creation MQ assigns the user/group
  permissions to the newly created data and log directories. The
  access control list (ACL) prepared will contain the SIDs of
  the privileged groups such as MQM, Administrators and SYSTEM
  along with the SID of the creator. The SID of the group
  Administrators and that of the SYSTEM are same on all the
  machines. However the SID of the local MQM group can not be
  resolved on any other machine other than the server where it
  is created, unless it is created on a domain controller.
  
  When the queue manager directories are created it can fail on
  some NAS devices if the ACL contains the SID of the MQM group,
  as the SID of an unresolved group can not be accepted by the
  device.
  

Problem conclusion

• WebSphere MQ v7.1 adds '-a' option to the crtmqm command to
  provide access to a additional security group on the queue
  manager data and log directories. Through this APAR we have
  introduced a sub option '-ar' to remove the local MQM group SID
  from the default ACLs.
  
  In the WebSphere MQ v7.1 infocenter
  
  Topic URL:
  http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/topic/
  com.ibm.mq.doc/fa15650_.htm
  
  Below text needs to be added under the description of -a
  option just before the Restriction section.
  
  -ar  LocalGroup|Domain\GlobalGroup|GlobalGroup@Domain
  In addition to the -a option, the 'r' removes the permissions
  of the MQM group from  the folders containing queue manager
  data and logs. use this option if the queue manager folders
  are to be created on a shared device that will not accept
  unresolved SIDs in ACLs.
  
  A new  parameter RemoveMQMAccess is added to the qm.ini file
  under AccessMode. If queue manager is created with -ar option
  then the value of RemoveMQMAccess is set TRUE. When the queue
  manager initializes we prepare the list of security attributes.
  If the value to this attribute is TRUE then we remove the SID
  of the MQM group from the security attributes.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
                     v7.1
  Platform           Fix Pack 7.1.0.3
  --------           --------------------
  Windows            7.1.0.3
  
  Platform           v7.5
  --------           --------------------
  Multiplatforms     7.5.0.1
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PM74233

Fix information

• Fixed component name

  WMQ WINDOWS V7

• Fixed component ID

  5724H7220

Applicable component levels

• R701 PSY

     UP