New IBM WebSphere MQ 7.1, 7.5 and 8.0 attributes in DISPLAY QMGR for new or migrated queue managers - Middleware News
WebSphere MQ 7.1, 7.5 and 8.0 introduce new
features and some of them are represented as new attributes to the QMGR
object in runmqsc, which can be shown via the command DISPLAY QMGR.
a) These attributes are common to new queue
managers created in MQ 7.1, 7.5 and 8.0, or to migrated queue managers
created in previous versions and then upgraded to MQ 7.1, 7.5 and 8.0:
ACTVCONO(DISABLED) < - New in 7.1
ACTVTRC(OFF) < - New in 7.1
CERTLABL('ibmwebspheremqqm_X') < - - - New in 8.0
CERTVPOL(ANY) < - New in 7.1
CHLAUTH() < - New in 7.1 feature is DISABLED for migrated Queue Mgr
But it is ENABLED for new Queue Managers
CONNAUTH('SYSTEM.DEFAULT.AUTHINFO.IDPWOS') < - - - New in 8.0
CUSTOM( ) < - New in 7.1
DEFCLXQ(SCTQ) < - - New in 7.5
PSCLUS(ENABLED) < - New in 7.1
SPLCAP(DISABLED) < - - New in 7.5
SUITEB(NONE) < - New in 7.1
VERSION() < - New in 7.1
XRCAP(NO) < - New in 7.1
b) This is a new attribute added to upgraded queue managers:
CHLAUTH(DISABLED) => Channel Authority Records feature is DISABLED.
c) By default, when creating a new queue manager in MQ 7.1, the following attribute is ENABLED:
CHLAUTH(ENABLED) => Channel Authority Records feature is ENABLED.
See the following technote related to MQ RC 2035 when trying to use an MQ administrator id to remotely access a new queue manager created in MQ 7.1:
WMQ 7.1 / 7.5 / 8.0 queue manager RC 2035 MQRC_NOT_AUTHORIZED or AMQ4036 when using client connection as an MQ Administrator
+ References
Command DISPLAY QMGR:
WebSphere MQ > Reference > Administration reference > MQSC reference > The MQSC commands
DISPLAY QMGR
Attribute ACTVCONO (New in 7.1):
WebSphere MQ > Monitoring and performance > Application activity trace > Application activity trace messages > Application activity trace information collection
MQCONNX options
Use the ConnectOpts parameter on the MQCONNX call to enable or disable application activity reports on a per connection basis.
If an application attempts to modify the accounting behavior of an application using these flags but the QMGR attribute ACTVCONO is set to DISABLED then no error is returned to the application and activity trace collection is defined by the Qmgr attributes and the activity trace ini file.
MQCONNX values might be ignored based on the ACTVCONO value.
Attribute ACTVTRC (New in 7.1):
WebSphere MQ > Monitoring and performance > Application activity trace > Application activity trace messages > Application activity trace information collection
MQI application activity trace information
Use the queue manager attribute ACTVTRC to control the collection of MQI application activity trace information
Attribute CERTLABL (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Reference > Configuration reference > Channel attributes > Channel attributes in alphabetical order >
Certificate label (CERTLABL)
This attribute specifies the certificate label of the channel definition.
The label identifies which personal certificate in the key repository is sent to the remote peer. The certificate is defined as described in Digital certificate labels.
Example for queue manager called QMGR1:
CERTLABL('ibmwebspheremqqm_qmgr1')
Attribute CERTVPOL (New in 7.1):
WebSphere MQ Explorer > Reference > Properties
Queue manager properties
Certificate validation policy
The certificate validation policy attribute controls which SSL/TLS certificate validation policy is used to validate digital certificates received from remote partners. There are two possible values for the attribute:
ANY
RFC5280
Changes to this attribute take effect only after a refresh security command has been issued.
Attribute CHLAUTH (New in 7.1):
Whether channel authentication records are checked.
WebSphere MQ > Security > Security overview > WebSphere MQ security mechanisms
Channel authentication records
Attribute CONNAUTH('SYSTEM.DEFAULT.AUTHINFO.IDPWOS') (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Security > Connection authentication > Configuration
A queue manager can be configured to use a supplied user ID and password to check whether a user has authority to access resources.
Turning on connection authentication on a queue manager
On a queue manager object, the CONNAUTH attribute can be set to the name of an authentication information object. This object can be one of two types:
IDPWOS Indicates that the queue manager uses the local operating system to authenticate the user ID and password.
IDPWLDAP Indicates that the queue manager uses an LDAP server to authenticate the user ID and password.
Attribute CUSTOM (New in 7.1):
This attribute is reserved for the configuration of new features before separate attributes have been introduced. It can contain the values of zero or more attributes as pairs of attribute name and value in the form NAME(VALUE).
Attribute DEFCLXQ (New in 7.5):
WebSphere MQ > Configuring > Configuring a queue manager cluster > Clustering: Best practices > Clustering: Planning how to configure cluster transmission queues
How to choose what type of cluster transmission queue to use
From version 7.5 onwards, you can choose which cluster transmission queue is associated with a cluster-sender channel.
b) All cluster-sender channels are automatically associated with a separate cluster transmission queue. The queues are created by the queue manager from the model queue SYSTEM.CLUSTER.TRANSMIT.MODEL.QUEUE and named SYSTEM.CLUSTER.TRANSMIT.ChannelName. Select this alternative default option by setting the queue manager attribute DEFCLXQ to CHANNEL.
Attribute PSCLUS (New in 7.1):
Controls whether this queue manager participates in publish subscribe activity across any clusters in which it is a member. No clustered topic objects can exist in any cluster when modifying from ENABLED to DISABLED.
WebSphere MQ > Reference > Administration reference > MQSC reference > The MQSC commands
DISPLAY QMGR
PSCLUS
Controls whether this queue manager participates in publish subscribe activity across any clusters in which it is a member. No clustered topic objects can exist in any cluster when modifying from ENABLED to DISABLED.
Attribute REVDNS (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Product overview > What's new in WebSphere MQ Version 8.0 > New family features
Security: Reverse lookup host names in CHLAUTH rules
The WebSphere MQ CHLAUTH rules have been enhanced so that CHLAUTH definitions can use Domain Name Server (DNS) host names instead of IP addresses. The queue manager REVDNS attribute controls whether reverse lookup of the hostname from a Domain Name Server is done for the IP address from which a channel has connected. If this attribute is enabled, DNS host names are reverse looked-up for the IP addresses of inbound channels when this information is required.
If the REVDNS attribute is not enabled, DNS host names are not reverse looked-up for the IP addresses of inbound channels.
Attribute SPLCAP (New in 7.5):
WebSphere MQ > Reference > Developing applications > MQI applications reference > Attributes of objects
Attributes for the queue manager
SPLCAP
Indicates whether security capabilities of WebSphere MQ Advanced Message Security are available for a queue manager.
MQCAP_SUPPORTED: This is the default value if the WebSphere MQ AMS component is installed for the installation that the queue manager is running under.
MQCAP_NOT_SUPPORTED
Attribute SUITEB (New in 7.1):
Whether Suite B compliant cryptography is used.
WebSphere MQ > Security > Security overview > WebSphere MQ security mechanisms > Security protocols in WebSphere MQ > WebSphere MQ support for SSL and TLS
Configuring WebSphere MQ for Suite B
Attribute VERSION (New in 7.1):
The version of the WebSphere MQ installation, the queue manager is associated with. The version has the format VVRRMMFF:
VV: Version
RR: Release
MM: Maintenance level
FF: Fix level
For example, the value shown in this technote of VERSION(07010000) means: 7.1.0.0
07: Version
01: Release
00: Modification level
00: Fix level
Examples:
VERSION(07050000)
VERSION(08000000)
Attribute XRCAP (New in 7.1):
XRCAP means "Telemetry capable". For example, AIX, Linux and Windows are supported, but HP-UX and Solaris are not.
There is no further documentation at the moment. This technote will be updated when further information on XRCAP is available.
ACTVCONO(DISABLED) < - New in 7.1
ACTVTRC(OFF) < - New in 7.1
CERTLABL('ibmwebspheremqqm_X') < - - - New in 8.0
CERTVPOL(ANY) < - New in 7.1
CHLAUTH() < - New in 7.1 feature is DISABLED for migrated Queue Mgr
But it is ENABLED for new Queue Managers
CONNAUTH('SYSTEM.DEFAULT.AUTHINFO.IDPWOS') < - - - New in 8.0
CUSTOM( ) < - New in 7.1
DEFCLXQ(SCTQ) < - - New in 7.5
PSCLUS(ENABLED) < - New in 7.1
SPLCAP(DISABLED) < - - New in 7.5
SUITEB(NONE) < - New in 7.1
VERSION() < - New in 7.1
XRCAP(NO) < - New in 7.1
b) This is a new attribute added to upgraded queue managers:
CHLAUTH(DISABLED) => Channel Authority Records feature is DISABLED.
c) By default, when creating a new queue manager in MQ 7.1, the following attribute is ENABLED:
CHLAUTH(ENABLED) => Channel Authority Records feature is ENABLED.
See the following technote related to MQ RC 2035 when trying to use an MQ administrator id to remotely access a new queue manager created in MQ 7.1:
WMQ 7.1 / 7.5 / 8.0 queue manager RC 2035 MQRC_NOT_AUTHORIZED or AMQ4036 when using client connection as an MQ Administrator
+ References
Command DISPLAY QMGR:
WebSphere MQ > Reference > Administration reference > MQSC reference > The MQSC commands
DISPLAY QMGR
Attribute ACTVCONO (New in 7.1):
WebSphere MQ > Monitoring and performance > Application activity trace > Application activity trace messages > Application activity trace information collection
MQCONNX options
Use the ConnectOpts parameter on the MQCONNX call to enable or disable application activity reports on a per connection basis.
If an application attempts to modify the accounting behavior of an application using these flags but the QMGR attribute ACTVCONO is set to DISABLED then no error is returned to the application and activity trace collection is defined by the Qmgr attributes and the activity trace ini file.
MQCONNX values might be ignored based on the ACTVCONO value.
Attribute ACTVTRC (New in 7.1):
WebSphere MQ > Monitoring and performance > Application activity trace > Application activity trace messages > Application activity trace information collection
MQI application activity trace information
Use the queue manager attribute ACTVTRC to control the collection of MQI application activity trace information
Attribute CERTLABL (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Reference > Configuration reference > Channel attributes > Channel attributes in alphabetical order >
Certificate label (CERTLABL)
This attribute specifies the certificate label of the channel definition.
The label identifies which personal certificate in the key repository is sent to the remote peer. The certificate is defined as described in Digital certificate labels.
Example for queue manager called QMGR1:
CERTLABL('ibmwebspheremqqm_qmgr1')
Attribute CERTVPOL (New in 7.1):
WebSphere MQ Explorer > Reference > Properties
Queue manager properties
Certificate validation policy
The certificate validation policy attribute controls which SSL/TLS certificate validation policy is used to validate digital certificates received from remote partners. There are two possible values for the attribute:
ANY
RFC5280
Changes to this attribute take effect only after a refresh security command has been issued.
Attribute CHLAUTH (New in 7.1):
Whether channel authentication records are checked.
WebSphere MQ > Security > Security overview > WebSphere MQ security mechanisms
Channel authentication records
Attribute CONNAUTH('SYSTEM.DEFAULT.AUTHINFO.IDPWOS') (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Security > Connection authentication > Configuration
A queue manager can be configured to use a supplied user ID and password to check whether a user has authority to access resources.
Turning on connection authentication on a queue manager
On a queue manager object, the CONNAUTH attribute can be set to the name of an authentication information object. This object can be one of two types:
IDPWOS Indicates that the queue manager uses the local operating system to authenticate the user ID and password.
IDPWLDAP Indicates that the queue manager uses an LDAP server to authenticate the user ID and password.
Attribute CUSTOM (New in 7.1):
This attribute is reserved for the configuration of new features before separate attributes have been introduced. It can contain the values of zero or more attributes as pairs of attribute name and value in the form NAME(VALUE).
Attribute DEFCLXQ (New in 7.5):
WebSphere MQ > Configuring > Configuring a queue manager cluster > Clustering: Best practices > Clustering: Planning how to configure cluster transmission queues
How to choose what type of cluster transmission queue to use
From version 7.5 onwards, you can choose which cluster transmission queue is associated with a cluster-sender channel.
b) All cluster-sender channels are automatically associated with a separate cluster transmission queue. The queues are created by the queue manager from the model queue SYSTEM.CLUSTER.TRANSMIT.MODEL.QUEUE and named SYSTEM.CLUSTER.TRANSMIT.ChannelName. Select this alternative default option by setting the queue manager attribute DEFCLXQ to CHANNEL.
Attribute PSCLUS (New in 7.1):
Controls whether this queue manager participates in publish subscribe activity across any clusters in which it is a member. No clustered topic objects can exist in any cluster when modifying from ENABLED to DISABLED.
WebSphere MQ > Reference > Administration reference > MQSC reference > The MQSC commands
DISPLAY QMGR
PSCLUS
Controls whether this queue manager participates in publish subscribe activity across any clusters in which it is a member. No clustered topic objects can exist in any cluster when modifying from ENABLED to DISABLED.
Attribute REVDNS (New in 8.0):
WebSphere MQ 8.0.0 > WebSphere MQ > Product overview > What's new in WebSphere MQ Version 8.0 > New family features
Security: Reverse lookup host names in CHLAUTH rules
The WebSphere MQ CHLAUTH rules have been enhanced so that CHLAUTH definitions can use Domain Name Server (DNS) host names instead of IP addresses. The queue manager REVDNS attribute controls whether reverse lookup of the hostname from a Domain Name Server is done for the IP address from which a channel has connected. If this attribute is enabled, DNS host names are reverse looked-up for the IP addresses of inbound channels when this information is required.
If the REVDNS attribute is not enabled, DNS host names are not reverse looked-up for the IP addresses of inbound channels.
Attribute SPLCAP (New in 7.5):
WebSphere MQ > Reference > Developing applications > MQI applications reference > Attributes of objects
Attributes for the queue manager
SPLCAP
Indicates whether security capabilities of WebSphere MQ Advanced Message Security are available for a queue manager.
MQCAP_SUPPORTED: This is the default value if the WebSphere MQ AMS component is installed for the installation that the queue manager is running under.
MQCAP_NOT_SUPPORTED
Attribute SUITEB (New in 7.1):
Whether Suite B compliant cryptography is used.
WebSphere MQ > Security > Security overview > WebSphere MQ security mechanisms > Security protocols in WebSphere MQ > WebSphere MQ support for SSL and TLS
Configuring WebSphere MQ for Suite B
Attribute VERSION (New in 7.1):
The version of the WebSphere MQ installation, the queue manager is associated with. The version has the format VVRRMMFF:
VV: Version
RR: Release
MM: Maintenance level
FF: Fix level
For example, the value shown in this technote of VERSION(07010000) means: 7.1.0.0
07: Version
01: Release
00: Modification level
00: Fix level
Examples:
VERSION(07050000)
VERSION(08000000)
Attribute XRCAP (New in 7.1):
XRCAP means "Telemetry capable". For example, AIX, Linux and Windows are supported, but HP-UX and Solaris are not.
There is no further documentation at the moment. This technote will be updated when further information on XRCAP is available.
Comments
Post a Comment