Collect WebSphere MQ MustGather data to solve TLS channel problems on HP NonStop Server

Resolving The Problem

Please answer these questions about the problem and then follow the steps below:

• What TLS channel problem did you observe on the system?
• What time did the TLS channel problem start and when did it stop?
• Which specific channels and certificates are involved in the problem?

Step 1: Generate Data

If the TLS channel problem is reproducible or is happening right now, generate data to provide more information about the problem:

1. If the problem occurs when starting a sending channel, generate a trace of the queue manager showing the channel start attempt.



2. Generate MQ trace simultaneously at the other end of the channel:
   
   
   • Linux and UNIX
   • Windows
   • IBM i

   • z/OS CHIN trace
   • z/VSE
   • HP OpenVMS

Step 2: Collect Data

1. Record the MQ version and maintenance level.



2. Record the operating system version and maintenance level.



3. From a Guardian prompt, display the VPROC output from the MQ amqcctca and amqcctca_r files:



Displaying the WebSphere MQ communications library VPROC output


TACL> VPROC AMQCCTCA
TACL> VPROC AMQCCTCA_R



4. List the contents of the queue manager ssl directory. Guardian users should run the osh TACL command to switch to the OSS environment first and then source the var/mqm/wmqprofile script in order to use WebSphere MQ commands. For example:



Displaying the key store directory for queue manager QMA


osh> . /path/to/var/mqm/wmqprofile
osh>  cd /path/to/var/mqm/qmgrs/QMA/ssl
osh>  ls -al




5. Display the WebSphere MQ CA certificates, securely passing your actual trust store password as suggested in the following example:



Displaying the WebSphere MQ CA certificates


osh> openssl x509 -noout -in /path/to/var/mqm/qmgrs/QMA/ssl/trust.pem -passin file:<(echo -n "passw0rd") -issuer -subject -dates




6. Display the WebSphere MQ personal certificates, securely passing your actual certificate store password as suggested in the following example:



Displaying the WebSphere MQ personal certificates


osh> openssl x509 -noout -in /path/to/var/mqm/qmgrs/QMA/ssl/cert.pem -passin file:<(echo -n "passw0rd") -issuer -subject -dates




7. Use runmqsc to record your queue manager, queues, channels and channel status information. If any command gives an error, carry on with the others:

DISPLAY QMGR ALL
DISPLAY QLOCAL(*) ALL
DISPLAY QALIAS(*) ALL
DISPLAY QREMOTE(*) ALL
DISPLAY CHANNEL(*) ALL
DISPLAY CHSTATUS(*) ALL




8. Use the sdcp script to package your files for IBM, including files containing the output from the commands listed in Step 1 and 2.

Step 3: Send Data to IBM

1. Send your data to the IBM ECuRep repository by email to websphere_support@ecurep.ibm.com, or by standard or secure HTTP or FTP.



2. While the data is transferring, send an email or use the IBM Service Request tool to update your PMR with your description of the problem and of the data you are sending.




A good description of the problem and the data is the most important information you can provide to IBM. Please do not send data without providing a description!



3. Contact your country representative if you need to speak to an IBM technical support representative, or in the US call 1-800-IBM-SERV. Refer to the IBM Software Support Handbook for more information on working with IBM.

Back to top