All Apps and Add-ons

JMS Messaging Modular Input: Unable to read IBM Websphere MQ with error "call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE')"

jgbricker
Contributor

After following http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/, I am unable to read from the queue. I have the following error.

02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/DEVSplunkQueue : Error browsing queue : com.ibm.msg.client.jms.DetailedResourceAllocationException: JMSWMQ2008: Failed to open MQ queue 'TEST.DVL.EIL.EEH.SPLUNK.TEST'. JMS attempted to perform an MQOPEN, but WebSphere MQ reported an error. Use the linked exception to determine the cause of this error. Check that the specified queue and queue manager are defined correctly.
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:588)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:128)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:856)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQSyncConsumerShadow.initialize(WMQSyncConsumerShadow.java:133)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueEnumeration.(WMQQueueEnumeration.java:207)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueBrowser.getEnumeration(WMQQueueBrowser.java:166)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.jms.internal.JmsQueueBrowserImpl.getEnumeration(JmsQueueBrowserImpl.java:200)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.mq.jms.MQQueueBrowser.getEnumeration(MQQueueBrowser.java:110)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.browseQueue(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE').
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
0 Karma
1 Solution

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

jgbricker
Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

0 Karma

wcflam
New Member

I had a similar situation before, and thanks for this post, I modified the browse_frequency from -1 to 60, then it works and I start seeing event coming in from MQ to Splunk. 🙂

0 Karma

Jeremiah
Motivator

From the error it looks like you've run out of available handles.

http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.tro.doc/q040900_.htm

http://stackoverflow.com/questions/1539826/wsmq-queue-limit

Are you seeing any errors on the mq sever?

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...