All Apps and Add-ons

JMS Messaging Modular Input: Unable to read IBM Websphere MQ with error "call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE')"

jgbricker
Contributor

After following http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/, I am unable to read from the queue. I have the following error.

02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/DEVSplunkQueue : Error browsing queue : com.ibm.msg.client.jms.DetailedResourceAllocationException: JMSWMQ2008: Failed to open MQ queue 'TEST.DVL.EIL.EEH.SPLUNK.TEST'. JMS attempted to perform an MQOPEN, but WebSphere MQ reported an error. Use the linked exception to determine the cause of this error. Check that the specified queue and queue manager are defined correctly.
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:588)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:128)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:856)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQSyncConsumerShadow.initialize(WMQSyncConsumerShadow.java:133)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueEnumeration.(WMQQueueEnumeration.java:207)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueBrowser.getEnumeration(WMQQueueBrowser.java:166)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.jms.internal.JmsQueueBrowserImpl.getEnumeration(JmsQueueBrowserImpl.java:200)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.mq.jms.MQQueueBrowser.getEnumeration(MQQueueBrowser.java:110)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.browseQueue(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE').
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
0 Karma
1 Solution

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

0 Karma

wcflam
New Member

I had a similar situation before, and thanks for this post, I modified the browse_frequency from -1 to 60, then it works and I start seeing event coming in from MQ to Splunk. 🙂

0 Karma

Jeremiah
Motivator

From the error it looks like you've run out of available handles.

http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.tro.doc/q040900_.htm

http://stackoverflow.com/questions/1539826/wsmq-queue-limit

Are you seeing any errors on the mq sever?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...