Can I Monitor IBM MQ with Splunk ?

[dmlee]

Hi, Can Splunk monitor IBM MQ (Message Queue) ? Customer wants to monitor MQ's performance on IBM2096 system, I don't know from where and how to get MQ's performance data (ex:transaction volume) from IBM2096.

Thanks~

[gkanapathy · Accepted solution]

You might get lucky here, but this seems like it'd be more a problem that would be handled in an IBM MQ forum. My guess is that there will be APIs and you'd have to write a scripted input to poll and collect this data.

[bishtk]

Dear Splunkers, Please suggest the sourcetype to be used while setting up MQM crontab monitoring?

[matt_batterham]

It's possible monitor IBM MQ by feeding all the IBM MQ Status, Statistics, Events and usage data into SPLUNK using a tool called Lamaxu, http://www.queuemetrix.com/2015/12/21/how-to-integrate-lamaxu-with-splunk

Lamaxu supports queue managers deployed to all platforms, including AIX, Linux, iSeries, Windows and ZOS etc, as well as MQ message volume statistics and dataset usage from Mainframe ZOS managers.

[Damien_Dallimor]

You can monitor Websphere MQ (as it is now called) via exposed JMX MBeans using Splunk for JMX

You can also index the MQ messages from queues and topics using the JMS Messaging Modular Input

[matt_batterham]

Unfortunately IBM MQ does not expose monitoring metrics via JMX Mbeans. There used to be a version of IBM MQ called MQ Everyplace that had this feature however the product no longer exists.

[mfrost8]

In addition to the other comments, I would say it depends on what you mean by performance. Total messages through a given queue up to that point? That's a queue parameter that's reset to 0 at midnight and could picked off as a queue attribute. At least on what IBM calls the "distributed" platforms (nix and I think Windows), some events are logged to the SYSTEM.ADMIN..EVENT queues, but you would need to know the format to extract from there (or locate one of those IBM support pacs that might let you extract that to a log which you could log periodically).

We do pull in the queue manager logs and extract fields for use with Splunk, but that's really only part of the picture and not really about queue throughput. While I think you could get Splunk to get this data for you, you would need to roll your own way to extract it. MQ does not log individual messages as that would really hurt performance. Other tools exist (BMC's Middleware Management Performance and Availability is one example) to go in and look at all the specific MQ components out of the box.

[ppang]

Please check whether you have enabled the SYSLOG on the zOS.
If yes, you can send out those MQ messages to splunk by syslog.

http://ibmmainframes.com/about51050.html

[Ron_Naken · Accepted solution]

There is a tool here that appears to allow extraction of MQ logs from an iSeries: http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg24006548

There is a Q posted here that describes some options for getting mainframe data to Splunk: http://answers.splunk.com/questions/2306/processing-of-mainframe-logs

I would add that you can also use a scripted input with s3270 to allow Splunk to perform operator commands and index the terminal displays.

HTH
ron

[gkanapathy · Accepted solution]

You might get lucky here, but this seems like it'd be more a problem that would be handled in an IBM MQ forum. My guess is that there will be APIs and you'd have to write a scripted input to poll and collect this data.