All Apps and Add-ons

JMS Messaging Modular Input: Unable to read IBM Websphere MQ with error "call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE')"

jgbricker
Contributor

After following http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/, I am unable to read from the queue. I have the following error.

02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/DEVSplunkQueue : Error browsing queue : com.ibm.msg.client.jms.DetailedResourceAllocationException: JMSWMQ2008: Failed to open MQ queue 'TEST.DVL.EIL.EEH.SPLUNK.TEST'. JMS attempted to perform an MQOPEN, but WebSphere MQ reported an error. Use the linked exception to determine the cause of this error. Check that the specified queue and queue manager are defined correctly.
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:588)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:128)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:856)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQSyncConsumerShadow.initialize(WMQSyncConsumerShadow.java:133)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueEnumeration.(WMQQueueEnumeration.java:207)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueBrowser.getEnumeration(WMQQueueBrowser.java:166)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.jms.internal.JmsQueueBrowserImpl.getEnumeration(JmsQueueBrowserImpl.java:200)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.mq.jms.MQQueueBrowser.getEnumeration(MQQueueBrowser.java:110)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.browseQueue(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE').
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
0 Karma
1 Solution

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

0 Karma

wcflam
New Member

I had a similar situation before, and thanks for this post, I modified the browse_frequency from -1 to 60, then it works and I start seeing event coming in from MQ to Splunk. 🙂

0 Karma

Jeremiah
Motivator

From the error it looks like you've run out of available handles.

http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.tro.doc/q040900_.htm

http://stackoverflow.com/questions/1539826/wsmq-queue-limit

Are you seeing any errors on the mq sever?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...