Alerting

Can I Monitor IBM MQ with Splunk ?

dmlee
Communicator

Hi, Can Splunk monitor IBM MQ (Message Queue) ? Customer wants to monitor MQ's performance on IBM2096 system, I don't know from where and how to get MQ's performance data (ex:transaction volume) from IBM2096.

Thanks~

Tags (1)
2 Solutions

gkanapathy
Splunk Employee
Splunk Employee

You might get lucky here, but this seems like it'd be more a problem that would be handled in an IBM MQ forum. My guess is that there will be APIs and you'd have to write a scripted input to poll and collect this data.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

There is a tool here that appears to allow extraction of MQ logs from an iSeries: http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg24006548

There is a Q posted here that describes some options for getting mainframe data to Splunk: http://answers.splunk.com/questions/2306/processing-of-mainframe-logs

I would add that you can also use a scripted input with s3270 to allow Splunk to perform operator commands and index the terminal displays.

HTH
ron

View solution in original post

bishtk
Communicator

Dear Splunkers, Please suggest the sourcetype to be used while setting up MQM crontab monitoring?

0 Karma

matt_batterham
New Member

It's possible monitor IBM MQ by feeding all the IBM MQ Status, Statistics, Events and usage data into SPLUNK using a tool called Lamaxu, http://www.queuemetrix.com/2015/12/21/how-to-integrate-lamaxu-with-splunk

Lamaxu supports queue managers deployed to all platforms, including AIX, Linux, iSeries, Windows and ZOS etc, as well as MQ message volume statistics and dataset usage from Mainframe ZOS managers.

0 Karma

Damien_Dallimor
Ultra Champion

You can monitor Websphere MQ (as it is now called) via exposed JMX MBeans using Splunk for JMX

You can also index the MQ messages from queues and topics using the JMS Messaging Modular Input

matt_batterham
New Member

Unfortunately IBM MQ does not expose monitoring metrics via JMX Mbeans. There used to be a version of IBM MQ called MQ Everyplace that had this feature however the product no longer exists.

0 Karma

mfrost8
Builder

In addition to the other comments, I would say it depends on what you mean by performance. Total messages through a given queue up to that point? That's a queue parameter that's reset to 0 at midnight and could picked off as a queue attribute. At least on what IBM calls the "distributed" platforms (nix and I think Windows), some events are logged to the SYSTEM.ADMIN..EVENT queues, but you would need to know the format to extract from there (or locate one of those IBM support pacs that might let you extract that to a log which you could log periodically).

We do pull in the queue manager logs and extract fields for use with Splunk, but that's really only part of the picture and not really about queue throughput. While I think you could get Splunk to get this data for you, you would need to roll your own way to extract it. MQ does not log individual messages as that would really hurt performance. Other tools exist (BMC's Middleware Management Performance and Availability is one example) to go in and look at all the specific MQ components out of the box.

ppang
Splunk Employee
Splunk Employee

Please check whether you have enabled the SYSLOG on the zOS.
If yes, you can send out those MQ messages to splunk by syslog.

http://ibmmainframes.com/about51050.html

Ron_Naken
Splunk Employee
Splunk Employee

There is a tool here that appears to allow extraction of MQ logs from an iSeries: http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg24006548

There is a Q posted here that describes some options for getting mainframe data to Splunk: http://answers.splunk.com/questions/2306/processing-of-mainframe-logs

I would add that you can also use a scripted input with s3270 to allow Splunk to perform operator commands and index the terminal displays.

HTH
ron

gkanapathy
Splunk Employee
Splunk Employee

You might get lucky here, but this seems like it'd be more a problem that would be handled in an IBM MQ forum. My guess is that there will be APIs and you'd have to write a scripted input to poll and collect this data.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...