Using the MQ Event Archive feature in OMEGAMON XE for Messaging for Audit Purposes
KayMaggi 11000091ER Visits (7167)
The WebSphere MQ monitoring agent, a component of both OMEGAMON XE for Messaging for z/OS and ITCAM Agents for WebSphere Messaging for distributed platforms, has long fully supported MQ Events produced by queue managers as a convenient way to monitor. However, did you know that the Event Archive feature, which was first introduced in v7.1.0 of the MQ monitoring agent, allows you to record the MQ Events historically with all associated details? Therefore, this feature allows you to keep MQ Events for audit purposes.
Typically, the "configuration" and non-display "command" events are interesting to preserve for audit, since they indicate changes made to your queue managers. If you enable these events in your queue manager, the MQ monitoring agent will pick them up automatically by default. For historical collection and warehousing, you need to enable Event Archive historical recording in TEP historical configuration, and with the filter tab for the historical collection, you can limit the event types for recording to just those important for audit purposes.
You can view historically logged events in TEP in the Event Archive workspace, which is an alternate workspace in the MQSeries Events navigator item. The workspace allows you to view events over a historical time span, and it includes the MQ Event Search feature.
Note that the Event Archive attribute group also can be used in real-time situation monitoring for cases in which you need the complete set of details with the event at the time the situation is triggered. In v7.3.0, we added Event User ID as a distinct attribute separate from details in order to help facilitate monitoring in cases when the user ID is required as a filter or notification attribute.
If using the MQ Event Archive feature for audit purposes is interesting to you, please be sure to view this presentation for complete information.