Readme for WebSphere MQ V7.1.0, Fix Pack 8

Content

DESCRIPTION
------------
This readme file describes the following:

1. What is new in each fix pack.
2. Limitations, known problems and other changes.
3. How to obtain and install IBM WebSphere MQ Version 7.1.0, Fix Pack 8.
4. Notices and trademarks.

A minor update has been made to the product license, removing an incorrect reference
to z/OS. Please see here for details:
http://www.ibm.com/software/sla/sladb.nsf/lilookup/C7B6AE18DBB9EA2F85257945003596E8?opendocument&li_select=005F6A9250D3F20A85257945003596E1

In addition to this file, you can find more information on the IBM MQ website:
http://www.ibm.com/software/products/ibm-mq

The latest version of this readme file is here:
https://ibm.biz/mqreadmes

The SupportPac web page is here:
https://ibm.biz/mqsupportpacs

For current information about known problems and available fixes, see the Support
page of the IBM MQ website:
http://www.ibm.com/support/entry/myportal/product/websphere/websphere_mq

Web documentation updates:
The latest updates to the web-based IBM WebSphere MQ documentation are available from
the IBM MQ website: http://www.ibm.com/software/integration/wmq/library/

Announcement letter:
The announcement letters for IBM WebSphere MQ Version 7.1 (US English) are available here:

IBM WebSphere MQ Distributed
http://www.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&supplier=897&letternum=ENUS211-395
IBM WebSphere MQ for z/OS
http://www.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&supplier=897&letternum=ENUS211-394

See the announcement letter for the following types of information:
- Detailed product description, including description of new function
- Product-positioning statement
- Ordering details
- Hardware and software requirements

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++

UPDATE HISTORY

12 Jan 2017 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 8
12 Feb 2016 - Updates for deprecated SSLv3 CipherSpecs in Fix Pack 7
19 Nov 2015 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 7
03 Nov 2015 - Warnings when uninstalling IBM MQ Explorer 7.1.0, Fix Pack 6
(fixed in IBM MQ Explorer 7.1.0, Fix Pack 7)
21 Nov 2014 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 6
16 May 2014 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 5
11 Nov 2013 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 4
15 May 2013 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 3
15 Aug 2012 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 2
31 May 2012 - Updates for IBM WebSphere MQ Version 7.1.0, Fix Pack 1
11 Nov 2011 - Updates for IBM WebSphere MQ Version 7.1.0


++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Section 1 : Release notes - What's new in this release
++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Version 7.1.0, Fix Pack 8
-------------------------
No new function.

Version 7.1.0, Fix Pack 7
-------------------------
IBM WebSphere MQ adds support for using the IBM WebSphere MQ classes for JMS in
certain versions of the CICS Open Services Gateway initiative (OSGi)
Java Virtual Machine (JVM) server.

Version 7.1.0, Fix Pack 6
-------------------------
No new function.

Version 7.1.0, Fix Pack 5
-------------------------
No new function.

Version 7.1.0, Fix Pack 4
-------------------------
No new function.

Version 7.1.0, Fix Pack 3
-------------------------
From Fix Pack 7.1.0.3, Windows 2012 is now supported, although the installation image
needs to be the one updated to the 7.1.0.3 level in order to take advantage of this new
support.

Version 7.1.0, Fix Pack 2
-------------------------
From Fix Pack 7.1.0.2 onwards, WebSphere MQ queue managers and MQI clients enforce the
Triple DES (3DES) recommendations from FIPS SP800-67 when configured in FIPS mode. This
means that the FIPS 140-2 compliant 3DES CipherSpecs may only transfer a maximum of 32Gb
data using a single session key. This limit does not apply if WebSphere MQ is not operating
in FIPS mode. By default, FIPS mode is disabled.

If a channel transfers more than 32Gb data in FIPS mode, it terminates with error AMQ9288.
This restriction applies to all channel types. When client connection conversation sharing
is enabled, the 32Gb limit applies to the total amount of data sent by all connections which
are sharing the same secure socket.

The affected 3DES CipherSpecs are:

ECDHE_ECDSA_3DES_EDE_CBC_SHA256
ECDHE_RSA_3DES_EDE_CBC_SHA256
TLS_RSA_WITH_3DES_EDE_CBC_SHA

To avoid the AMQ9288 error when using FIPS mode, take one of the following actions:

1) Alter your channels to use a different CipherSpec which does not use 3DES.
2) Enable secret key reset to ensure that session keys are reset before 32Gb data is transferred.
3) As a last resort, you can disable FIPS mode (although this is not recommended).


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Section 2 : Limitations, known problems and other changes
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


GSKit 8.0.50.69 or later alters the stash file format
-----------------------------------------------------

For IBM WebSphere MQ Version 7.1.0, Fix Pack 8, APAR IT16295 updates the GSKit component
level to 8.0.50.69 or later. This update alters the stash file format used when
generating a .sth file to stash the key database password. Stash files generated by
this level of the GSKit are not readable by earlier GSKit levels.

To ensure compatibility, any applications or other installations that use a stash
file generated with this level of GSKit should be updated to a version of MQ that
contains GSKit 8.0.50.69 or later.

If you cannot update applications or other installations, you can request
a backwards-compatible stash file format. You do this by supplying the "-v1stash"
parameter to the runmqakm or runmqckm commands when you use the "-stash" or
"-stashpw" options to generate a stash file.

You cannot generate a backwards-compatible stash file when using the iKeyman GUI.


Deprecation of support for weaker CipherSpecs
---------------------------------------------
IBM WebSphere MQ Version 7.1.0, Fix Pack 7 deprecates the SSLv3 protocol and the use
of the following CipherSpecs on channel definitions associated with the queue manager:

AES_SHA_US (SSLV3 only)
RC4_SHA_US
RC4_MD5_US
TRIPLE_DES_SHA_US
DES_SHA_EXPORT1024
RC4_56_SHA_EXPORT1024
RC4_MD5_EXPORT
RC2_MD5_EXPORT
DES_SHA_EXPORT
TLS_RSA_WITH_DES_CBC_SHA (not SSLV3)
NULL_SHA
NULL_MD5
FIPS_WITH_DES_CBC_SHA
FIPS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_NULL_SHA256 (not SSLV3)

Attempting to use or configure one of these CipherSpecs results in one or more of the following
messages in the queue manager error log: AMQ8242, AMQ9616, AMQ9635.

To continue using any SSLv3 CipherSpecs in the previous list (that is, any CipherSpec except
the two that are flagged as "not SSLV3"), set the environment variable AMQ_SSL_V3_ENABLE to
the value "TRUE" in the environment used to start the queue manager.
Alternatively, add the following entry to the SSL stanza of the queue manager's qm.ini file:
AllowSSLV3=Y
Setting the environment variable overrides any value specified in the qm.ini file.

To continue using any CipherSpecs in the previous list except the one that is flagged as
"SSLV3 only", set or export to "Yes" the environment variable AMQ_SSL_WEAK_CIPHER_ENABLE in
the environment used to start the queue manager.
Alternatively, add the following entry to the SSL stanza of the queue manager's qm.ini file:
AllowWeakCipherSpec=Yes
Setting the environment variable overrides any value specified in the qm.ini file.


APAR IV31952
-------------
The fix for APAR IV31952 changed the authority checks that IBM WebSphere MQ makes on channel
objects when you run the RESET CHANNEL command. Applying this fix can give changed behavior
and you might need to alter some authorities.

Your systems are affected only if your channels run with an MCAUSER userID resolving to a
non-mqm user. The Reset Channel command can run internally within WebSphere MQ code, so,
even though you have not run the Reset Channel command manually, your system might still
be affected.

Ensure that, at a minimum, your channel's MCAUSER userID has both +DSP and +CTRLX authority
on the channel object, so that the userID can run Reset Channel commands. Before the fix
for IV31952, WebSphere MQ checked that the userID had +ALTUSR authority which you might
previously have granted to make your channel work.

After applying Fix Pack 3 or later, you can remove your MCAUSER's +ALTUSR authority on the
channel object because it is not required for the Reset Channel command. You should also
check that your MCAUSER userID has +DSP and +CTRLX authority on the channel object.


Uninstallation on AIX and HP-UX
--------------------------------
There is logic in the uninstallation process to prevent inadvertent removal of the
IBM WebSphere MQ installation in use for running queue managers. This logic has been seen
to be faulty on AIX and HP-UX, where it is possible to uninstall while queue managers are
still running, using that installation.

Please check carefully that all queue managers running on an installation that you intend
to uninstall are shut down prior to the uninstallation process. Please also check carefully
that you are uninstalling the intended installation, as we are unable on these platforms to
prevent you from accidentally uninstalling a different installation on which you still have
running queue managers.

This is a permanent restriction in IBM WebSphere MQ Version 7.1.0 and its fix packs.


Windows migration to IBM WebSphere MQ Version 7.1.0
---------------------------------------------------
If you migrate from an earlier version of IBM WebSphere MQ to Version 7.1.0 on the Windows
platform, you might experience one or both of the following issues:

The MQ service and MQ Alert Monitor (task bar icon) may fail to restart following migration,
unless they are terminated prior to migration. These will record errors that are visible in
the event viewer, with symptoms such as amqxcs2.dll not found, or Application SID does not
match the Connection SID. The migration process will succeed, and these errors can be ignored,
but the MQ service and Alert Monitor may need restarting manually following migration.

After migration, the 'Remove Fix pack' icon(s) may not be removed from the Start Menu. These
icons can be safely removed manually since they apply to the pre-migration installation at an
earlier version.

This is a permanent restriction in IBM WebSphere MQ Version 7.1.0 and its fix packs.


HP-UX Non-IBM licence text display
-----------------------------------
When viewing the Non-IBM licence text in text-only mode on HP-UX, no text is visible. There
are no Non-IBM licences applicable, but this is not made clear when viewing in this mode.

This is a permanent restriction in IBM WebSphere MQ Version 7.1.0 and its fix packs.


WebSphere MQ Telemetry Service log file permissions on UNIX/Linux
------------------------------------------------------------------
The permissions for log files created by the WebSphere MQ Telemetry Service (mqxr.log,
mqxr.stdout, mqxr.stderr) are not consistent with other WebSphere MQ log files and might need
an authorised user to modify the permissions to enable other users to read their contents,
for example when diagnosing problems.

This is a permanent restriction in IBM WebSphere MQ Version 7.1.0 and its fix packs.


MQ Explorer migration
----------------------
On a multi version system, if migrating from MQ V7.0.1.6 or higher to MQ V7.1 or higher, any
queue managers that are not auto start do not appear as running in MQ Explorer after they have
been manually started. To see the queue managers appear as running, restart MQ Explorer.

This is a permanent restriction in IBM WebSphere MQ Version 7.1.0 and its fix packs.


XMS .NET application hangs when closing a long waiting consumer
----------------------------------------------------------------
For Windows applications using IBM Message Service Client for .NET (also known as XMS .NET),
in unmanaged client mode, a hang delaying closure of the application can be observed if
consumer.close() is called subsequent to a client reconnection.

Unmanaged client mode is configured by setting the connection factory connection mode property
to XMSC.WMQ_CM_CLIENT_UNMANAGED. If this is used in combination with automatic client
reconnection, and a reconnection occurs, then calls to consumer.receive() or
consumer.receive(wait), where wait is an extended timeout period, will hang during closedown
due to a clash with the processing in consumer.close().


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Section 3 : How to obtain and install IBM WebSphere MQ Version 7.1.0, Fix Pack 8
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Product/Component Release: 7.1
Update Name: IBM WebSphere MQ Version 7.1.0, Fix Pack 8

Contents
---------
3.1 Download location and fix list

3.2 Prerequisites and corequisites

3.3 Installing
3.3.1 Prior to installation
3.3.2 Downloading the fix pack to an appropriate location
3.3.3 Uncompressing the fix pack installation images
3.3.4 Extracting the fix pack install files
3.3.6 Installation

3.4 Post installation
3.4.1 Performing the necessary tasks after installation
3.4.2 More information on installations of GSKit and JDK
3.4.3 Troubleshoot Installation from Support Site

3.5 Uninstalling


3.1 Download location and fix list
----------------------------------
For each IBM WebSphere MQ Version 7.1 fix pack, you can get download information
and a list of fixes here:
http://www.ibm.com/support/docview.wss?rs=171&uid=swg27024302

3.2 Prerequisites and corequisites
-----------------------------------
Before downloading Fix Pack 8, perform the following steps:

1. Ensure that your system meets all the system requirements:
http://www.ibm.com/software/integration/wmq/requirements/index.html
This action prevents technical problems that might occur after the installation and
configuration of the fix pack.

2. Review the Flashes and Authorized Problem Analysis Reports (APARs) on the IBM WebSphere MQ
support portal here:
http://www.ibm.com/support/entry/myportal/product/websphere/websphere_mq

APARs describe defects that have been addressed in a fix pack.

3. Ensure that you have sufficient file system free space to download and extract the fix
pack. You need to have a file system with one gigabyte of free space to contain the
compressed file and the uncompressed installation image.

4. Ensure that you have the free space required to install the fix pack. The free space must
be available in the location of the IBM WebSphere MQ installation that you are updating.

To determine the space used by the existing IBM WebSphere MQ products on UNIX platforms,
perform the following command:

du -k -s MQDIR

where MQDIR represents the location where the WebSphere MQ product is installed.

5. If you already have the IBM WebSphere MQ Version 7.1 product installed and have obtained
special fixes, contact IBM support to determine whether you need an updated version of
the fixes before you install Fix Pack 8. This helps to ensure that your system
is in a consistent state and that no special fixes are lost.


3.3 Installing
---------------

3.3.1 Prior to installation
----------------------------
Before installing Fix Pack 8, perform the following steps:

1. Read all of this readme.
2. Download the fix pack to an appropriate location.
3. Uncompress the fix pack.

3.3.2 Downloading the fix pack to an appropriate location
----------------------------------------------------------
There must not be any spaces in the directory path where you download and uncompress the
fix pack. If there are spaces in the directory path, the installation will fail.

3.3.3 Uncompressing the fix pack installation images
-----------------------------------------------------
All fix pack installation images on the download site are compressed in gz/Z/zip format.
Before you can apply the fix pack from this format, copy the downloaded file to a temporary
directory and use gunzip/uncompress and tar to extract the fix pack installation image.

3.3.4 Extracting the fix pack install files
--------------------------------------------
To extract the fix pack install files, perform the following steps:

1. Copy the gzipped/Z image to a temporary location.
2. Change to the directory where you copied the image.
3. The following are example commands to extract the fix pack
installation image:

gunzip -c filename.tar.gz | tar -xvf -
zcat filename.tar.Z | tar -xvf -
unzip filename.zip

where filename.tar.gz etc. is the name of the downloaded file.


3.3.5 Installing the fix pack
------------------------------
For information about how to install maintenance level upgrades, refer to the maintenance
tasks section of the IBM WebSphere MQ documentation:
http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.1.0/com.ibm.mq.doc/zi00090_.htm


3.4 Post installation
----------------------

3.4.1 Performing the necessary tasks after installation
--------------------------------------------------------
After installing Fix Pack 8, restart the queue managers.

After applying a fix pack, it is not mandatory to recompile applications.


3.4.2 More information about installations of GSKit and JRE
------------------------------------------------------------
For information regarding the levels of GSKit and JRE included with this product, go here:
http://www.ibm.com/support/docview.wss?rs=171&uid=swg27038676


3.5 Uninstalling
-----------------
For information about removing maintenance levels, refer to the maintenance tasks section of
the WebSphere MQ documentation:
http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.1.0/com.ibm.mq.doc/zi00090_.htm


+++++++++++++++++++++++++++++++++++++++++++++++
Section 4 : Copyright, Notices and trademarks
+++++++++++++++++++++++++++++++++++++++++++++++

4.1 Copyright and trademark information
-----------------------------------------
http://www.ibm.com/legal/copytrade.shtml

4.2 Notices
------------
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION
"AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Some jurisdictions do not allow disclaimer of express or implied
warranties in certain transactions, therefore, this statement may not
apply to you.

This information could include technical inaccuracies or typographical
errors. Changes are periodically made to the information herein; these
changes will be incorporated in new editions of the publication. IBM
may make improvements and/or changes in the product(s) and/or the
program(s) described in this publication at any time without notice.

THIRD-PARTY LICENSE TERMS AND CONDITIONS, NOTICES AND INFORMATION

The license agreement for this product refers you to this file for
details concerning terms and conditions applicable to third party
software code included in this product, and for certain notices and
other information IBM must provide to you under its license to certain
software code. The relevant terms and conditions, notices and other
information are provided or referenced below. Please note that any
non-English version of the licenses below is unofficial and is provided
to you for your convenience only. The English version of the licenses
below, provided as part of the English version of this file, is the
official version.

Notwithstanding the terms and conditions of any other agreement you may
have with IBM or any of its related or affiliated entities (collectively "IBM"),
the third party software code identified below are "Excluded Components" and
are subject to the following terms and conditions:

* the Excluded Components are provided on an "AS IS" basis
* IBM DISCLAIMS ANY AND ALL EXPRESS AND IMPLIED WARRANTIES AND
CONDITIONS WITH RESPECT TO THE EXCLUDED COMPONENTS, INCLUDING, BUT NOT
LIMITED TO, THE WARRANTY OF NON-INFRINGEMENT OR INTERFERENCE AND THE
IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE
* IBM will not be liable to you or indemnify you for any claims related
to the Excluded Components
* IBM will not be liable for any direct, indirect, incidental, special,
exemplary, punitive or consequential damages with respect to the
Excluded Components.


4.3 Trademarks
---------------
The following terms are trademarks of International Business Machines Corporation in the United States,
other countries, or both:
AIX, IBM, WebSphere MQ, SupportPac, z/OS, i5/OS, iSeries, OS/400
See also the IBM copyright and trademark information here: http://www.ibm.com/legal/copytrade.shtml
Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both.
Java and all Java-based trademarks are trademarks of Oracle in the United States, other countries, or both.
UNIX is a registered trademark of The Open Group in the United States and other countries
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.
Other company, product, or service names may be trademarks or service marks of others.