Readme for IBM MQ 9.0 and its maintenance

The main sections of this document describe product limitations and known problems.

In addition to this document, you can find more information on the IBM MQ website: https://www.ibm.com/products/mq.

The SupportPac web page is here: https://ibm.biz/mqsupportpacs.

For current information about known problems and available fixes, see the IBM MQ Support page: https://www.ibm.com/mysupport/s/topic/0TO5000000024cJGAQ/mq?language=en_US&productId=01t0z000006zdYXAAY.

Product documentation for all supported versions of IBM MQ is available through IBM Documentation: https://www.ibm.com/docs/ibm-mq. Specifically, the IBM MQ 9.0 product information is available in IBM Documentation: https://www.ibm.com/docs/ibm-mq/9.0.

Announcement letters

Announcement letters for Continuous Delivery Releases

Announcement letters for IBM MQ V9.0.0

Update history

Installation instructions

Installation instructions are available as part of the IBM MQ 9.0 product information published in IBM Documentation: https://www.ibm.com/docs/en/ibm-mq/9.0?topic=mq-installing-uninstalling

Limitations and known problems for Long Term Support releases

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 13

There are no new limitations or known problems that require your attention.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 12

An error message in the IBM MQ Explorer log, after IBM MQ 9.0.0.12 is installed on Windows

After IBM MQ 9.0.0, Fix Pack 12 is installed on Windows, you might see an Unresolved requirement error message in the IBM MQ Explorer log file the first time the IBM MQ Explorer is started.

The log file is here:

<USER_Home>\IBM\WebSphereMQ\workspace-<installation_name>\.metadata\.log

This issue affects Fix Pack 11 and later. For an example of the error message, see the matching readme entry for Fix Pack 11.

This error message can be ignored.

IBM MQ Explorer installation details might not be updated after IBM MQ 9.0.0.12 is installed or uninstalled on Windows

When IBM MQ 9.0.0, Fix Pack 12 is installed or uninstalled on Windows, the plug-in level information displayed on the "Installed Software" tab of the "IBM MQ Explorer Installation Details" panel might not be updated. However, the changed plug-in levels have been applied. To confirm this, check the Apache Ant version that is displayed on the "Installed Software" tab. It should show Eclipse Orbit Apache Ant 1.10.11.v20210720-1445 org.apache.ant.

This issue affects Fix Pack 11 and later.

Cannot start IBM MQ Explorer after reverting to an earlier Fix Pack on Windows 64

After uninstalling IBM MQ 9.0.0, Fix Pack 12 on 64-bit Windows, and reverting to the previous Fix Pack, you might not be able to start IBM MQ Explorer by using strmqcfg in the earlier fix pack.

This issue was previously seen when reverting from IBM MQ 9.0.0, Fix Pack 2 to IBM MQ 9.0.0, Fix Pack 1.

To resolve this issue, see the following technote: https://www.ibm.com/support/pages/node/297519

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 11

An error message in the IBM MQ Explorer log, after IBM MQ 9.0.0.11 is installed on Windows

After IBM MQ 9.0.0, Fix Pack 11 is installed on Windows, you might see the following error message in the IBM MQ Explorer log file the first time the IBM MQ Explorer is started.

The log file is here:

<USER_Home>\IBM\WebSphereMQ\workspace-<installation_name>\.metadata\.log

!MESSAGE FrameworkEvent ERROR
!STACK 0
org.osgi.framework.BundleException: Could not resolve module: org.eclipse.equinox.http.jetty [298]
  Unresolved requirement: Import-Package: org.eclipse.jetty.servlet; version="[9.4.0,10.0.0)"
    -> Export-Package: org.eclipse.jetty.servlet; bundle-symbolic-name="org.eclipse.jetty.servlet"; bundle-version="9.4.33.v20201020"; version="9.4.33"; uses:="javax.servlet,javax.servlet.descriptor,javax.servlet.http,org.eclipse.jetty.http.pathmap,org.eclipse.jetty.security,org.eclipse.jetty.server,org.eclipse.jetty.server.handler,org.eclipse.jetty.server.handler.gzip,org.eclipse.jetty.server.session,org.eclipse.jetty.util,org.eclipse.jetty.util.annotation,org.eclipse.jetty.util.component,org.eclipse.jetty.util.resource"
       org.eclipse.jetty.servlet [615]
         Unresolved requirement: Import-Package: org.eclipse.jetty.jmx; version="[9.4.33,10.0.0)"; resolution:="optional"
         Unresolved requirement: Import-Package: org.eclipse.jetty.security; version="[9.4.33,10.0.0)"
	at org.eclipse.osgi.container.Module.start(Module.java:444)
	at org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel(ModuleContainer.java:1634)
	at org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.incStartLevel(ModuleContainer.java:1613)
	at org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.doContainerStartLevel(ModuleContainer.java:1585)
	at org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.dispatchEvent(ModuleContainer.java:1528)
	at org.eclipse.osgi.container.ModuleContainer$ContainerStartLevel.dispatchEvent(ModuleContainer.java:1)
	at org.eclipse.osgi.framework.eventmgr.EventManager.dispatchEvent(EventManager.java:230)
	at org.eclipse.osgi.framework.eventmgr.EventManager$EventThread.run(EventManager.java:340)

This error message can be ignored.

IBM MQ Explorer installation details are not updated after IBM MQ 9.0.0.11 is installed or uninstalled on Windows

When IBM MQ 9.0.0, Fix Pack 11 is installed or uninstalled on Windows, the plug-in level information displayed on the "Installed Software" tab of the "IBM MQ Explorer Installation Details" panel is not updated. However, the changed plug-in levels have been applied.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 9/10

There are no new limitations or known problems that require your attention.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 8

Incompatibility between GSKit 8.0.55.3 and later, and the version 8 IBM JRE on AIX

This issue affects only AIX systems that are running an IBM MQ Java or JMS application that meets all of the following criteria:

• Not using the JRE supplied with IBM MQ
• Using a Version 8 IBM JRE earlier than Version 8.0 Service Refresh 5 Fix Pack 40
• Using a bindings mode connection to the queue manager
• Using AMS

The incompatibility is caused by an IBMJCEPlus name space change for GSKit, as described in JRE APAR IJ17282 (https://www.ibm.com/support/pages/apar/IJ17282).

If your system meets all these criteria, update your JRE to Version 8.0 Service Refresh 5 Fix Pack 40 or later, or use the JRE supplied with the IBM MQ fix pack.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 5/6/7

There are no new limitations or known problems that require your attention.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 4

Erroneous entries are created in the Object Authority Manager (OAM) data store

This issue affects users of the default Object Authority Manager.

A programming error resulted in the creation of erroneous entries in the Object Authority Manager (OAM) data store. These entries contain entities with the name <<invalid>>.

This issue is fixed in IBM MQ 9.0.0, Fix Pack 4, by APAR IT24223. The erroneous entries are removed from the OAM when the queue manager is restarted.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 3

Java client hangs when queue manager is quiescing as new connection attempt is made

This issue affects applications that use the following IBM MQ features:

• Classes for JMS
• Classes for Java
• JCA resource adapter
• OSGi bundles
• Managed File Transfer

An IBM MQ queue manager can send, to connected clients, notifications requesting a controlled closure of conversations (connection handles). A queue manager sends these notifications, for example, when the queue manager is being quiesced. If a thread within a Java client receives one of these notifications at the same time as another thread within the client requests a new conversation, a deadlock can occur. This is because both threads need access to the internal connectionsLock on the RemoteConnectionSpecification object.

This issue is fixed in IBM MQ 9.0.0, Fix Pack 3, by APAR IT22127. The fix launches a new thread to reassociate the connection with its RemoteConnectionSpecification, if necessary, so that the connection can be reused.

For the fix to work for your applications, you need to add the following new policy to the policy file used by the Java Security Manager:

permission java.lang.RuntimePermission "modifyThread";

Changes to default values for some ciphers

The JRE is updated to 8.0.5.10 in this release. By default, this level of the JRE disables ciphers whose algorithms match DES40_CBC or RC4_40. For example:

SSL_KRB5_EXPORT_WITH_DES_CBC_40_SHA

To re-enable these ciphers, update your java/lib/security/java.security file to remove the algorithm that your cipher uses from the jdk.tls.disabledAlgorithms name:value pair.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 2

Cannot start IBM MQ Explorer after reverting to an earlier Fix Pack on Windows 64

After uninstalling IBM MQ 9.0.0, Fix Pack 2 on 64-bit Windows, and reverting to the previous Fix Pack, you might not be able to start IBM MQ Explorer by using strmqcfg in the earlier fix pack.

To resolve this issue, see the following technote: https://www.ibm.com/support/pages/node/297519

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.0, FIX PACK 1

Platform availability for this Fix Pack

Fix packs are delivered for distributed platforms only. They are not delivered for the z/OS platform, or for the IBM MQ Appliance. IBM MQ 9.0.0, Fix Pack 1 is released only on AIX, IBM i, Linux, and Windows. It is not released on HP-UX or Solaris.

FDC can incorrectly show missing subscriptions for a clustered queue manager

The cluster repository process includes maintenance checks. One check is that internal subscriptions exist for queue and queue manager objects in the local queue manager view of the cluster configuration. If a queue manager record is found not to have subscriptions in the clusters it is a member of, an FDC with probe RM702021 (Missing Subscription) is generated.

However, during the process of creating a new full repository there is a point in time when the queue manager record can include a cluster name that the local queue manager is not yet aware of (because it is not yet a full repository for the named cluster, nor is it a partial repository). In this case, the generated FDC is misleading as there should not be any subscriptions.

APAR IT14931, delivered in IBM MQ 9.0.2 and IBM MQ 9.0.0, Fix Pack 1, checks whether the queue manager could be a deferred full repository, and if so does not generate the FDC. But the system cannot be sure that the queue manager is about to become a full repository, so it is important that you also make the following manual checks:

• Check that cluster receiver channels in the cluster configuration are shared in the appropriate clusters.
• Check that name lists used by cluster receiver channels on remote queue managers, contain the expected list of cluster names.
• Check that manually defined sender channels are correctly defined, and that the destination is expected to be a full repository. Manually defined channels (CLUSSDR) are always expected to point to full repositories. CLUSSDR channels that point to partial repositories are a configuration error.

IBM MQ JMS ExceptionListener is not invoked for all cases of connection broken exceptions

The following issues affect a JMS application that uses the IBM MQ 9.0 classes for JMS:

• When you set the JMS ConnectionFactory property JmsConstants.ASYNC_EXCEPTIONS to the value JmsConstants.ASYNC_EXCEPTIONS_ALL, your application's JMS ExceptionListener should be called not only for broken connection exceptions, but also for any exception raised during asynchronous message delivery to a JMS MessageListener. However, non-connection broken exceptions (for example MQRC_GET_INHIBITED) were not being delivered to the ExceptionListener.

• When a JMS Session uses a different TCP/IP socket to the JMS Connection, the application's ExceptionListener was not invoked if only the socket used by the JMS Session is broken.

• Your application's JMS ExceptionListener is only invoked for a connection broken exception when the application is using asynchronous message consumers, and not when using synchronous message consumers.

APAR IT14820, delivered in this fix pack, implements the following fixes:

• An ExceptionListener registered by an application is invoked for any connection broken exceptions, regardless of whether the application is using synchronous or asynchronous message consumers.

• An ExceptionListener registered by an application is invoked if a TCP/IP socket used by a JMS Session is broken.

• Non-connection broken exceptions (for example MQRC_GET_INHIBITED) that arise during message delivery are delivered to an application's ExceptionListener when the application is using asynchronous message consumers and the JMS ConnectionFactory used by the application has the ASYNC_EXCEPTIONS property set to the value ASYNC_EXCEPTIONS_ALL.

GSKit 8.0.50.69 or later alters the stash file format

APAR IT16295, delivered in this fix pack, updates the GSKit component level to 8.0.50.69 or later. This update alters the stash file format used when generating a .sth file to stash the key database password. Stash files generated by this level of the GSKit are not readable by earlier GSKit levels.

To ensure compatibility, any applications or other installations that use a stash file generated with this level of the GSKit should be updated to a version of IBM MQ that contains GSKit 8.0.50.69 or later.

If you cannot update applications or other installations, you can request a stash file format that is compatible with earlier versions. You do this by supplying the -v1stash parameter to the runmqakm or runmqckm commands when you use the -stash or -stashpw options to generate a stash file.

When using the iKeyman GUI, you cannot generate a stash file that is compatible with earlier IBM MQ versions.

Log-on issues when using Managed File Transfer agents on z/OS

When the IBM WebSphere MQ File Transfer Edition product became a component of IBM MQ, a number of security enhancements were made. These included restricting the following commands so that they can be issued only by the user that the agent or logger processes were running as:

• fteStartAgent
• fteStopAgent
• fteSetAgentTraceLevel
• fteShowAgentDetails
• fteStartLogger
• fteStopLogger
• fteSetLoggerTraceLevel

When you use IBM MQ Managed File Transfer on z/OS, you can run agents as a started task. Such tasks typically run as an administrative user that might not have log-on privileges. In this situation, you cannot log on to the z/OS system as the same user that the agent is running under, which in turn means that the following commands cannot be issued for that agent:

• fteStartAgent
• fteStopAgent
• fteSetAgentTraceLevel
• fteShowAgentDetails

APAR PI52942, delivered in this fix pack, adds a new agent property adminGroup for use with IBM MQ Managed File Transfer agents on z/OS. When this property is set to the name of an existing group, members of that group can perform the previous commands for that agent.

Limitations and known problems for the initial IBM MQ 9.0.0 release

For traditional Chinese, the IBM MQ Explorer MFT plug-in displays an "assertion failed" error message

For the traditional Chinese locale zh_TW, when using the Managed File Transfer (MFT) plug-in to monitor file transfers using the Transfer Progress view, the IBM MQ Explorer continually displays an error message with the following text:

assertion failed: Column 7 has no label provider.

This error was introduced when an update to the traditional Chinese translation for the title of Column 7 ("Started", in English) was not also applied to a control file used by the MFT plug-in.

This issue is fixed in IBM MQ Version 9.0.0, Fix Pack 8, by APAR IT28289.

This issue can also be resolved by applying either of the following local fixes.

Local Fix Method One:

1. Temporarily open the IBM MQ Explorer in a different language and locale.
   One way to do this is to configure the Java system properties user.language and user.region. You do this for the IBM MQ Explorer by opening the MQExplorer.ini file located in the /bin directory of the IBM MQ installation, and adding these entries to the end of the file after the following line:

   -vmargs

   For example, to open the IBM MQ Explorer in US English, add the following lines to the MQExplorer.ini file:

   -Duser.language=en
   -Duser.region=US

   The end of the file now looks similar to the following example:

   -vmargs
   -Xmx512M
   -Duser.language=en
   -Duser.region=US

   Save and close the file.

2. In the new locale:
   1. Open IBM MQ Explorer.
   2. Connect to the MFT configuration.
   3. Open the Transfer Log page listed under the MFT configuration.
   4. Ensure the "Current Transfer Progress" view is also displayed. It is, by default, located directly beneath the Transfer Log content view.
3. Close IBM MQ Explorer then reopen it in the zh_TW locale. If zh_TW is your system locale, remove the specific user.language and user.region system properties from the MQExplorer.ini file.

Local Fix Method Two:

1. Close IBM MQ Explorer.
2. Open the dialog_settings.xml file from the IBM MQ Explorer workspace. This is located in a directory similar to the following:
   [on Linux]
   /home/user1/IBM/WebSphereMQ/workspace-Installation1/.metadata/.plugins/com.ibm.wmqfte.explorer
   [on Windows]
   C:\Users\Administrator\IBM\WebSphereMQ\workspace-Installation1\.metadata\.plugins\com.ibm.wmqfte.explorer\
3. Delete any one of the items listed under the following XML entry for "COLUMNS", so that the list contains seven items, rather than the original eight.

   <section name="TRANSFER_PROGRESS_VIEW_SETTINGS">
       <item value="zh" key="LOCALE"/>
           <list key="COLUMNS">
               <!-- Delete any one of the items here -->
           </list>

   For example, delete the first item in the list for "COLUMNS":

           <item value=""/>

4. Save and close the file.
5. Restart IBM MQ Explorer.

The IBM MQ Explorer Managed File Transfer plug-in does not handle passwords longer than 12 characters if MQCSP Authentication Mode is enabled

If you use the IBM MQ Explorer Managed File Transfer plug-in, or have Managed File Transfer agents that connect to a queue manager using the CLIENT transport and specify a password, then the agent does not authenticate with the queue manager if the password specified is greater than 12 characters in length. This is because the code does not use MQCSP authentication, and authenticates using "compatibility mode", which limits the password to 12 characters in length.

Under APAR IT17772, delivered in IBM MQ 9.0.0, Fix Pack 2, the code is updated so that you can disable the default compatibility mode and enable MQCSP Authentication mode. You can do this in the following ways:

• In the IBM MQ Explorer:

  • Select the queue manager you want to connect to.
  • Right click, and select Connection Details > Properties.
  • Click the Userid tab.
  • Ensure Enable user identification is selected, and clear the User identification compatibility mode checkbox.
• For MFT agents:

  • Add a new parameter useMQCSPAuthentication to the MFTCredentials.xml file for the relevant user. Set the parameter to true. If the parameter is not there, it is by default set to false and uses compatibility mode to authenticate the user with the queue manager.

Here is an example entry to show how to set the useMQCSPAuthentication parameter in the MFTCredentials.xml file:

&#09; <tns:qmgr name="CoordQueueMgr" user="ernest"
mqUserId="ernest" mqPassword="AveryL0ngPassw0rd2135"
useMQCSPAuthentication="true"/>

This fix is implemented in IBM MQ 9.0.3, and in IBM MQ 9.0.0, Fix Pack 2.

The File Transfer fteCleanAgent command, run with no parameters, does the equivalent of -all

When running the fteCleanAgent command with only the agent name and no arguments specified, the behavior is equivalent to fteCleanAgent agent_name -all. As a result, all the following definitions are cleared on the agent the command was run against:

• In-progress and pending transfers
• Resource monitor definitions
• Scheduled transfers definitions

For example, the following two commands result in the same behavior:

fteCleanAgent agent100
fteCleanAgent -all agent100

Under APAR IT15522, delivered in IBM MQ 9.0.0, Fix Pack 2, the fteCleanAgent command is updated so that a user must specify which Managed File Transfer state to clear by passing the appropriate parameters to the command, as well as providing an agent name. This APAR also adds a new property to revert fteCleanAgent to its original behavior if required. The property is called failCleanAgentWithNoArguments and is set in the command.properties file. By default the value of failCleanAgentWithNoArguments is true, and the fteCleanAgent command does not run if only the agent name parameter is specified.

This fix is implemented in IBM MQ 9.0.3, and in IBM MQ 9.0.0, Fix Pack 2.

.NET client policy files are not shipped with early IBM MQ 9.0 releases

Policy files for the .NET client of IBM MQ are not shipped with IBM MQ 9.0.3 and earlier, or IBM MQ 9.0.0 Fix Pack 1 and earlier. If an application is compiled using an IBM MQ version earlier than 9.0, and you have to run it against one of the affected 9.0 releases, either copy the contents of the NonPrimaryRedirect.config file (at &MQ_INSTALL_PATH&\Tools\dotnet\samples\cs\base) to the application's app.config file, or recompile the application with the affected 9.0 release.

This issue is fixed by APAR IV98407. This fix is implemented in IBM MQ 9.0.4, and in IBM MQ 9.0.0, Fix Pack 2.

Correlation ID selector defined on a JMS message listener is not passed to the queue manager

The correlation identifier message selector defined on the MessageConsumer or JMSConsumer object on which a JMS MessageListener is registered is not being passed to the queue manager. This results in all messages on the destination being sent to the listener, instead of only those that match the selector.

This issue is fixed by APAR IT16106. This fix is implemented in IBM MQ 9.0.3, and in IBM MQ 9.0.0, Fix Pack 2.

JMS application returns null, and triggers "Receive interrupted by async Session start" message

If an application does the following:

1. Creates an asynchronous consumer on a JMS session,
2. Associates a MessageListener with that consumer,
3. Creates a synchronous consumer in the onMessage method of that MessageListener using the same session the original asynchronous consumer was created with,

then any subsequent receive on that synchronous consumer returns null instead of a message, and outputs a message to the console: Receive interrupted by async Session start.

The JMS specification does not permit the use of a session for synchronous methods when asynchronous message delivery is running. Your JMS application must create a separate session if you want to use both synchronous methods and asynchronous delivery simultaneously.

Under APAR IT13758, the message output by the console is changed to give this explanation and solution. This change is implemented in IBM MQ 9.0.1, and in IBM MQ 9.0.0, Fix Pack 1.

JRE Null pointer when using SUITEB SSL FIPS with the AMQP listener

When using the IBM MQ AMQP listener to authenticate an AMQP client using SUITEB-compliant certificates and a cipher suite with SSLFIPS(YES) set on the queue manager, the listener might unexpectedly abend with a null pointer exception coming from within the Java Runtime Environment com.ibm.crypto.fips.provider.GCTR class.

This issue is fixed in the Java Runtime Environment by APAR IV83436.

The -mt flag in the java/lib64/Makefile must be removed on Linux systems

When you compile the XA switch load libraries for the 64-bit IBM MQ Classes for Java, you might get the following error:

gcc: error: unrecognized command line option '-mt'

If you get this error, remove the '-mt' flag from the following file:

ibm_mq_root/java/lib64/jdbc/Makefile

The flag is set in the following line:

LINK_OPTIONS = -eMQStart -m64 -mt -mcmodel=medium ${MQLIBPATH} ${MQLIBS}

The IBM MQ Managed File Transfer Java EE database logger generates warning messages in WebSphere Application Server Community Edition 2.1 when used with an Oracle database

This issue affects all users of the database logger to persist, to an Oracle database, information published as XML log messages to the SYSTEM.FTE topic on the coordination queue manager.

If any of the columns defined for a table created in the Oracle database are of type CLOB (for example NCLOB), the Java class defined using Java Persistence Architecture (JPA) to represent that table should annotate the class member-variables representing the column of type CLOB with @Lob. If not, the column type is assumed to be of type VARCHAR.

In previous versions of the product, this annotation was not included in the Java classes provided with the IBM MQ Managed File Transfer component. Therefore, when the JPA implementation tried to match the member field representing a column in a database table with the actual column in the database table, the difference was detected and reported as a warning.

This issue is fixed in IBM MQ 9.0.0, subject to the following ongoing limitations:

• Columns with the names SOURCE_BRIDGE_URL and DESTINATION_BRIDGE_URL in the table FTELOG.TRANSFER_EVENT should be defined with the column length 2083.
• Users of the IBM MQ Managed File Transfer component that have a database logger that connects to a Db2 database might have to update these column lengths manually after applying this fix pack, if the length of these columns is defined as 1024. If data longer than 1024 bytes is written, then the data is truncated and no warning is given by Db2.

Users might not be able to use GB18030 characters for Installation Description on Windows

During the installation of the server for Windows, you can specify an Installation Description. If you try to use some GB18030 characters, they might not appear on the input fields and might not be shown correctly on the Summary page.

IBM MQ license: failure to determine system distribution for Linux on System z

On Linux systems that do not have the lsb_release command installed the following message might be seen when running the mqlicense.sh command:

WARNING: Unable to determine distribution and release for this system.
Check that it is supported before continuing with installation.

If you receive this message, check that the system meets the requirements at https://www.ibm.com/support/pages/node/597469, then proceed with the installation.

Limitations and known problems for Continuous Delivery releases

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.5

Changes to Product Insights support

In IBM MQ 9.0.5, the name of the Product Insights configuration stanza in qm.ini changes from BluemixRegistration to ReportingService. Queue managers configured with the old stanza name do not start until the stanza name is changed or the stanza is removed from qm.ini.

Java client hangs when queue manager is quiescing as new connection attempt is made

This issue affects applications that use the following IBM MQ features:

• Classes for JMS
• Classes for Java
• JCA resource adapter
• OSGi bundles
• Managed File Transfer

An IBM MQ queue manager can send, to connected clients, notifications requesting a controlled closure of conversations (connection handles). A queue manager sends these notifications, for example, when the queue manager is being quiesced. If a thread within a Java client receives one of these notifications at the same time as another thread within the client requests a new conversation, a deadlock can occur. This is because both threads need access to the internal connectionsLock on the RemoteConnectionSpecification object.

This issue is fixed in IBM MQ 9.0.5 and IBM MQ 9.0.0, Fix Pack 3 by APAR IT22127. The fix launches a new thread to re-associate the connection with its RemoteConnectionSpecification, if necessary, so that the connection can be reused.

For the fix to work for your applications, you need to add the following new policy to the policy file used by the Java Security Manager:

permission java.lang.RuntimePermission "modifyThread";

Changes to default values for some ciphers

The JRE is updated to 8.0.5.10 in this release. By default, this level of the JRE disables ciphers whose algorithms match DES40_CBC or RC4_40.

For example:

SSL_KRB5_EXPORT_WITH_DES_CBC_40_SHA

To re-enable these ciphers, update your java/lib/security/java.security file to remove the algorithm that your cipher uses from the jdk.tls.disabledAlgorithms name:value pair.

Spurious warning message and FDCs generated during RDQM uninstall process

If a replicated data queue manager exists when the MQSeries rpms are uninstalled (for example, during an upgrade) FDCs with Probe ID XC721050 are generated, during the uninstall, from program name amqiclen.

These can safely be ignored.

When the drbd-utils rpm is uninstalled, the following warning is displayed:

warning: /etc/drbd.d/global_common.conf saved as /etc/drbd.d/global_common.conf.rpmsave 

This can safely be ignored.

Error message when updating RHEL system that has RDQM installed

If you do a "yum update" on an RHEL system that has RDQM installed, you get an error about a libqb package. To avoid this, edit the /etc/yum.conf file and add the following line:

exclude=libqb*

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.4

There are no new limitations or known problems that require your attention.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.3

PTF needed for IBM MQ Advanced for z/OS VUE to connect to the IBM Blockchain service on IBM Cloud

IBM MQ 9.0.3 introduces a new Connector Pack component for IBM MQ Advanced for z/OS Value Unit Edition. This pack provides the following connectivity:

• IBM MQ for z/OS connectivity to the IBM Product Insights service on IBM Cloud
• IBM MQ for z/OS connectivity to the IBM Blockchain service on IBM Cloud
• MFT Agent running on z/OS connectivity to IBM MQ that runs on a remote z/OS system

To enable the connectivity to the IBM Blockchain service on IBM Cloud, you need to install the PTF for APAR PI81206. If you do not do this, an attempt to run the IBM MQ Blockchain Bridge displays the following error text:

The MQ to BlockChain bridge requires an enablement APAR to run. 
Consult IBM Documentation for further details.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.2

JRE security vulnerabilities

There are multiple vulnerabilities in IBM Runtime Environment Java 8, used by IBM MQ 9.0.2. Further details, including CVSS scoring and interim fix details, can be found here: https://www.ibm.com/support/pages/node/294233

This issue is fixed in the JRE that is included in IBM MQ 9.0.3.

FDC can incorrectly show missing subscriptions for a clustered queue manager

The cluster repository process includes maintenance checks. One check is that internal subscriptions exist for queue and queue manager objects in the local queue manager view of the cluster configuration. If a queue manager record is found not to have subscriptions in the clusters it is a member of, an FDC with probe RM702021 (Missing Subscription) is generated.

However, during the process of creating a new full repository there is a point in time when the queue manager record can include a cluster name that the local queue manager is not yet aware of (because it is not yet a full repository for the named cluster, nor is it a partial repository). In this case, the generated FDC is misleading as there should not be any subscriptions.

APAR IT14931, delivered in IBM MQ 9.0.2 and IBM MQ 9.0.0, Fix Pack 1, checks whether the queue manager could be a deferred full repository, and if so does not generate the FDC. But the system cannot be sure that the queue manager is about to become a full repository, so it is important that you also make the following manual checks:

• Check that cluster receiver channels in the cluster configuration are shared in the appropriate clusters.
• Check that name lists used by cluster receiver channels on remote queue managers, contain the expected list of cluster names.
• Check that manually defined sender channels are correctly defined, and that the destination is expected to be a full repository. Manually defined channels (CLUSSDR) are always expected to point to full repositories. CLUSSDR channels that point at partial repositories are a configuration error.

Certificate keystores might not open if they contain certificates with serial numbers that have a leading zero

If you are using a JRE other than the one supplied in IBM MQ 9.0.2, note that recently released JRE maintenance levels that are supported by IBM MQ, including those provided by Oracle and by other IBM products, are known to fail to open certificate keystores if they contain certificates with serial numbers that have a leading zero in their encoding. This might impact product and application function.

Further details can be found here: https://www.ibm.com/support/pages/node/294121

IBM MQ 9.0 Managed File Transfer agents publish XML status messages in bytes message format (MQFMT_NONE) by default

APAR IT15971, delivered in IBM MQ 9.0.2 and IBM MQ 9.0.0, Fix Pack 2, adds a property messagePublicationFormat. This property controls the format of messages that are published to the SYSTEM.FTE topic. The default behavior of the MFT agent was not intended to change, so by default the messages should be published in the mixed format - that is, the MQFMT_NONE and MQFMT_STRING format, depending on the Topic. However, under APAR IT15971, when you specify messagePublicationFormat=mixed the effect is the same as specifying messagePublicationFormat=MQFMT_NONE.

The issue is fixed in IBM MQ 9.0.3, by APAR IT19721.

LIMITATIONS AND KNOWN PROBLEMS FOR IBM MQ 9.0.1

JRE security vulnerabilities

There are multiple vulnerabilities in IBM Runtime Environment Java Version 8 used by IBM MQ 9.0.1. Further details, including CVSS scoring and interim fix details, can be found here: https://www.ibm.com/support/pages/node/294233

This issue is fixed in the JRE that is included in IBM MQ 9.0.3.

IBM MQ JMS ExceptionListener is not invoked for all cases of connection broken exceptions

The following issues affect a JMS application that uses the IBM MQ 9.0 classes for JMS:

• When you set the JMS ConnectionFactory property JmsConstants.ASYNC_EXCEPTIONS to the value JmsConstants.ASYNC_EXCEPTIONS_ALL, your application's JMS ExceptionListener should be called not only for broken connection exceptions, but also for any exception raised during asynchronous message delivery to a JMS MessageListener. However, non-connection broken exceptions (for example MQRC_GET_INHIBITED) were not being delivered to the ExceptionListener.
• When a JMS Session uses a different TCP/IP socket to the JMS Connection, the application's ExceptionListener was not invoked if only the socket used by the JMS Session is broken.
• Your application's JMS ExceptionListener is only invoked for a connection broken exception when the application is using asynchronous message consumers, and not when using synchronous message consumers.

APAR IT14820, delivered in IBM MQ 9.0.0, Fix Pack 1, implements the following fixes:

• An ExceptionListener registered by an application is invoked for any connection broken exceptions, regardless of whether the application is using synchronous or asynchronous message consumers.
• An ExceptionListener registered by an application is invoked if a TCP/IP socket used by a JMS Session is broken.
• Non-connection broken exceptions (for example MQRC_GET_INHIBITED) that arise during message delivery are delivered to an application's ExceptionListener when the application is using asynchronous message consumers and the JMS ConnectionFactory used by the application has the ASYNC_EXCEPTIONS property set to the value ASYNC_EXCEPTIONS_ALL.

GSKit 8.0.50.69 or later alters the stash file format

APAR IT16295, delivered in IBM MQ 9.0.0, Fix Pack 1, updates the GSKit component level to 8.0.50.69 or later. This update alters the stash file format used when generating a .sth file to stash the key database password. Stash files generated by this level of the GSKit are not readable by earlier GSKit levels.

To ensure compatibility, any applications or other installations that use a stash file generated with this level of the GSKit should be updated to a version of IBM MQ that contains GSKit 8.0.50.69 or later.

If you cannot update applications or other installations, you can request a stash file format that is compatible with earlier IBM MQ versions. You do this by supplying the -v1stash parameter to the runmqakm or runmqckm commands when you use the -stash or -stashpw options to generate a stash file.

When using the iKeyman GUI, you cannot generate a stash file that is compatible with earlier versions.

Log-on issues when using Managed File Transfer agents on z/OS

When the IBM WebSphere MQ File Transfer Edition product became a component of IBM MQ, a number of security enhancements were made. These included restricting the following commands so that they can be issued only by the user that the agent or logger processes were running as:

• fteStartAgent
• fteStopAgent
• fteSetAgentTraceLevel
• fteShowAgentDetails
• fteStartLogger
• fteStopLogger
• fteSetLoggerTraceLevel

When you use IBM MQ Managed File Transfer on z/OS, you can run agents as a started task. Such tasks typically run as an administrative user that might not have log-on privileges. In this situation, you cannot log on to the z/OS system as the same user that the agent is running under, which in turn means that the following commands cannot be issued for that agent:

• fteStartAgent
• fteStopAgent
• fteSetAgentTraceLevel
• fteShowAgentDetails

APAR PI52942, delivered in IBM MQ 9.0.0, Fix Pack 1, adds a new agent property adminGroup for use with IBM MQ Managed File Transfer agents on z/OS. When this property is set to the name of an existing group, members of that group can execute the previous commands for that agent.

strmqweb (web console) does not work on some Ubuntu systems

On Ubuntu, after you run the strmqweb command to launch the web console, you might find that you can log on and see a running queue manager, but when you try to interact with the queue manager you get an error.

This issue seems to affect only Ubuntu systems where the default shell is Dash.

A workaround is to stop the web server by running the command endmqweb, then restart it by running the command bash strmqweb. This ensures the script is run under Bash.

Copyright, notices and trademarks

Copyright and trademark information

This information was developed for products and services offered in the U.S.A.

IBM may not offer the products, services, or features discussed in this information in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this information. The furnishing of this information does not give you any license to these patents. You can send license inquiries, in writing, to:

For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the information. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this information at any time without notice.

Any references in this information to non-IBM web sites are provided for convenience only and do not in any manner serve as an endorsement of those web sites. The materials at those web sites are not part of the materials for this IBM product and use of those web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Programming License Agreement, or any equivalent agreement between us.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. This information includes examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

Copyright license

This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM's application programming interfaces.

Windows is a trademark of Microsoft Corporation in the United States, other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Linux is a trademark of Linus Torvalds in the United States, other countries, or both.

Other company, product, or service names may be trademarks or service marks of others.

For more information, see https://www.ibm.com/legal/copytrade.