Configuring IBM MQ authority

Edit online

You need to provide all the necessary access rights for IBM MQ sensors to query and gather monitoring data if the Instana agent is run by a nonprivileged user.

Depending on the user (privileged or nonprivileged) installing the Instana agent, the agent's ability to access and display monitoring data in the Instana UI varies.

  • Privileged user: If the Instana agent is installed by using a privileged user, it has all the necessary authorities. Therefore, you can view all the monitoring data in the Instana UI.

  • Nonprivileged user: If the Instana agent is installed by using a nonprivileged user to connect to the queue manager, you must grant appropriate Object Authority Manager (OAM) authorities to the user to query all the monitoring data.

Granting IBM MQ OAM authorities

Edit online

To provide the IBM MQ OAM authorities to a nonprivileged user, use the setmqaut control command or MQSC commands. The setmqaut command is in the $MQ_INSTALLED_DIR/bin directory.

Note: The user that you use to issue the setmqaut command or MQSC commands must be a privileged user.

  1. To grant the user the appropriate authorities to access queue manager that you want to monitor, run one of the following commands:

    • setmqaut command:

      setmqaut -m QMGR -t qmgr -p UserID +connect +dsp +inq

    • MQSC command:

      SET AUTHREC PRINCIPAL('UserID') OBJTYPE(QMGR) AUTHADD(CONNECT,DSP,INQ)

    Where:

    • QMGR: Name of Queue Manager
    • UserID: User ID of the user.

    You must specify the fully qualified user for the -p option. For example, -p user@domain or -p user@host.

    Note: To specify a user group name, replace the -p option with the -g option in the setmqaut command.

  2. For the Instana UI to display data, the user specified by UserID needs access to various objects. To grant the appropriate authorities, run one of the following set of commands:

    • setmqaut commands:

      setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.COMMAND.QUEUE -p UserID +dsp +inq +put +chg
setmqaut -m QMGR -t queue -n SYSTEM.DEFAULT.MODEL.QUEUE -p UserID +dsp +get
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.STATISTICS.QUEUE -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.QMGR.EVENT -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.PERFM.EVENT -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.CHANNEL.EVENT -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.LOGGER.EVENT -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.CONFIG.EVENT -p UserID +dsp +inq +get +chg
setmqaut -m QMGR -t queue -n SYSTEM.ADMIN.COMMAND.EVENT -p UserID +dsp +inq +get +chg

setmqaut -m QMGR -t queue -n "**" -p UserID +dsp +inq +chg
setmqaut -m QMGR -t channel -n "**" -p UserID +dsp
setmqaut -m QMGR -t clntconn -n "**" -p UserID +dsp
setmqaut -m QMGR -t listener -n "**" -p UserID +dsp
setmqaut -m QMGR -t topic -n "**" -p UserID +dsp

    • MQSC commands:

      SET AUTHREC PROFILE('SYSTEM.ADMIN.COMMAND.QUEUE') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,PUT,CHG)
SET AUTHREC PROFILE('SYSTEM.DEFAULT.MODEL.QUEUE') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,GET)
SET AUTHREC PROFILE('SYSTEM.ADMIN.STATISTICS.QUEUE') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.QMGR.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.PERFM.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.CHANNEL.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.LOGGER.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.CONFIG.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)
SET AUTHREC PROFILE('SYSTEM.ADMIN.COMMAND.EVENT') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,GET,CHG)

SET AUTHREC PROFILE('**') OBJTYPE(QUEUE) PRINCIPAL('UserID') AUTHADD(DSP,INQ,CHG)
SET AUTHREC PROFILE('**') OBJTYPE(CHANNEL) PRINCIPAL('UserID') AUTHADD(DSP)
SET AUTHREC PROFILE('**') OBJTYPE(CLNTCONN) PRINCIPAL('UserID') AUTHADD(DSP)
SET AUTHREC PROFILE('**') OBJTYPE(LISTENER) PRINCIPAL('UserID') AUTHADD(DSP)
SET AUTHREC PROFILE('**') OBJTYPE(TOPIC) PRINCIPAL('UserID') AUTHADD(DSP)
    Note: The change permission (+chg in setmqaut and CHG in MQSC) on queue object is needed to retrieve queue reset statistics data. You can choose not to grant change permission if required, but the queue reset statistics data will not be displayed in queue dashboard.

  3. To ensure all the commands work, restart queue manager or refresh security:

    echo "REFRESH SECURITY" | runmqsc QMGR

These permissions cover all the necessary access rights for IBM MQ sensors to query and gather monitoring data.

Additional permissions

Edit online

Typically, read-only access is adequate for most monitoring data needs. However, for some of the following metrics, additional permissions are required. The permissions must be adjusted to accommodate these requirements based on your required monitoring metrics.

  • Queue reset statistics data:

    To retrieve queue reset statistics data, queue objects require the change authority (+chg).

  • Statistics data from SYSTEM.ADMIN.STATISTICS.QUEUE queue:

    Access to statistics data from SYSTEM.ADMIN.STATISTICS.QUEUE queue requires the get authority (+get) because the statistics data is collected from this queue.

  • IBM MQ events:

    To obtain IBM MQ events, such as queue manager events, performance events, and channel events, grant get authority (+get) to the SYSTEM.ADMIN.PERFM.EVENT, SYSTEM.ADMIN.CHANNEL.EVENT, and SYSTEM.ADMIN.QMGR.EVENT system queues.

  • IBM MQ monitoring data from the PCF interface:

    The IBM MQ sensor calls the PCF interface to inquire data. The IBM MQ management mechanism uses the put authority (+put) for SYSTEM.ADMIN.COMMAND.QUEUE queue to put the PCF command. To create a temporary queue based on the queue template and to save the PCF command, queue manager needs get authority to retrieve the queue template from SYSTEM.DEFAULT.MODEL.QUEUE queue.