All Apps and Add-ons

JMS Messaging Modular Input: Unable to read IBM Websphere MQ with error "call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE')"

jgbricker
Contributor

After following http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/, I am unable to read from the queue. I have the following error.

02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/DEVSplunkQueue : Error browsing queue : com.ibm.msg.client.jms.DetailedResourceAllocationException: JMSWMQ2008: Failed to open MQ queue 'TEST.DVL.EIL.EEH.SPLUNK.TEST'. JMS attempted to perform an MQOPEN, but WebSphere MQ reported an error. Use the linked exception to determine the cause of this error. Check that the specified queue and queue manager are defined correctly.
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:588)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:128)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:856)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQSyncConsumerShadow.initialize(WMQSyncConsumerShadow.java:133)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueEnumeration.(WMQQueueEnumeration.java:207)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueBrowser.getEnumeration(WMQQueueBrowser.java:166)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.jms.internal.JmsQueueBrowserImpl.getEnumeration(JmsQueueBrowserImpl.java:200)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.mq.jms.MQQueueBrowser.getEnumeration(MQQueueBrowser.java:110)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.browseQueue(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE').
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
0 Karma
1 Solution

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

0 Karma

wcflam
New Member

I had a similar situation before, and thanks for this post, I modified the browse_frequency from -1 to 60, then it works and I start seeing event coming in from MQ to Splunk. 🙂

0 Karma

Jeremiah
Motivator

From the error it looks like you've run out of available handles.

http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.tro.doc/q040900_.htm

http://stackoverflow.com/questions/1539826/wsmq-queue-limit

Are you seeing any errors on the mq sever?

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...

Enterprise Security Content Update (ESCU) | New Releases

In March, the Splunk Threat Research Team had 2 releases of security content via the Enterprise Security ...