MQ Appliance Error Log Enhancements in 9.1.2
Jamie Squibb
Published on 22/03/2019
The MQ Appliance 9.1.2 firmware release introduces support for MQ diagnostic message services, as per those introduced on Windows, Linux and UNIX in versions 9.0.5 and 9.1.
Diagnostic message services
Diagnostic message services provide support for:
- Generation of custom queue manager and system error logs in text or JSON format
- Customization of error log sizes
- Suppression and/or exclusion of specific messages from error logs
- Filtering content written to error logs by message severity, for example to only include warnings or errors
Diagnostic message services for a queue manager are configured in its qm.ini file. This file can be viewed or modified on an appliance using the dspmqini and setmqini commands from within the mqcli shell. A service for messages not associated with a queue manager can be similarly configured in mqs.ini.
Integration with log targets
A diagnostic message service is also introduced in 9.1.2 that integrates MQ error logs with system log targets. This capability provides a single logging framework for both MQ and system activity on an appliance. It is enabled by default for new queue managers. The logging framework can be used to:
- View MQ activity for all queue managers in a single integrated log
- View MQ activity alongside system events for problem diagnosis
- Exploit existing log target output formats, including files, SMTP, SNMP and remote syslog servers for MQ error log events
The default appliance log target only subscribes to specific event categories and event severities. This means that it only includes MQ diagnostic messages with a severity of error or higher unless its subscriptions are modified. MQ error log messages are associated with the qmgr log event category. It is therefore possible to create an MQ-specific log target by subscribing to only this category. A log target can be refined to consume log messages for a single queue manager using an object filter that specifies the queue manager object type and name.
The MQ Appliance web UI displaying MQ error log messages that have been consumed by an XML file log target.
Integration with a remote syslog server
Using a syslog log target it is now possible to stream MQ diagnostic messages from an appliance to a remote syslog server, including tools such as Splunk or Elastic Stack. These tools are increasingly used for real-time monitoring and operational insight. Streaming error log messages using this method avoids the need to periodically download error log files from an appliance for offline analysis.
Elastic Stack can be used to collate events from multiple appliances and view them as an integrated log using Kibana. In the example below, an administrator investigating delayed responses to the shop in Oxford might use this capability to identify a problem connecting to the depot in Watford.
Using Kibana to display MQ error log messages that have been routed from multiple MQ Appliances to Elasticsearch.
A sample Logstash pipeline and Elasticsearch index mapping template are available at https://github.com/ibm-messaging/mq-appliance/tree/master/elastic
For more information about this enhancement and other updates in the 9.1.2 firmware release see the IBM MQ Appliance Knowledge Center at https://www.ibm.com/support/knowledgecenter/en/SS5K6E_9.1.0/com.ibm.mqa.doc/overview/ov00100_.htm