All Apps and Add-ons

JMS Messaging Modular Input: Unable to read IBM Websphere MQ with error "call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE')"

Contributor

After following http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/, I am unable to read from the queue. I have the following error.

02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/DEVSplunkQueue : Error browsing queue : com.ibm.msg.client.jms.DetailedResourceAllocationException: JMSWMQ2008: Failed to open MQ queue 'TEST.DVL.EIL.EEH.SPLUNK.TEST'. JMS attempted to perform an MQOPEN, but WebSphere MQ reported an error. Use the linked exception to determine the cause of this error. Check that the specified queue and queue manager are defined correctly.
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(Reason.java:588)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:236)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQMessageConsumer.checkJmqiCallSuccess(WMQMessageConsumer.java:128)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQConsumerShadow.initialize(WMQConsumerShadow.java:856)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQSyncConsumerShadow.initialize(WMQSyncConsumerShadow.java:133)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueEnumeration.(WMQQueueEnumeration.java:207)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.internal.WMQQueueBrowser.getEnumeration(WMQQueueBrowser.java:166)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.jms.internal.JmsQueueBrowserImpl.getEnumeration(JmsQueueBrowserImpl.java:200)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.mq.jms.MQQueueBrowser.getEnumeration(MQQueueBrowser.java:110)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.browseQueue(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2017' ('MQRC_HANDLE_NOT_AVAILABLE').
02-09-2016 08:41:42.197 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.java:223)
0 Karma
1 Solution

Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browsemode = all
browse
queueonly = 1
durable = 0
index = jms
index
messageheader = 1
index
messageproperties = 1
init
mode = jndi
jmsconnectionfactoryname = DEVSplunkCF
jndi
initialcontextfactory = com.sun.jndi.fscontext.RefFSContextFactory
jndi
providerurl = file:/opt/splunk/etc/apps/jmsta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

Contributor

Edited the inputs.conf configuration:
[jms://queue/DEVSplunkQueue]
browsemode = all
browse
queueonly = 1
durable = 0
index = jms
index
messageheader = 1
index
messageproperties = 1
init
mode = jndi
jmsconnectionfactoryname = DEVSplunkCF
jndi
initialcontextfactory = com.sun.jndi.fscontext.RefFSContextFactory
jndi
providerurl = file:/opt/splunk/etc/apps/jmsta/local/
sourcetype = mq
strip_newlines = 1

commented out the below and added a different value (two lines down)

browse_frequency = -1

browse_frequency = 60
disabled = 0

View solution in original post

0 Karma

New Member

I had a similar situation before, and thanks for this post, I modified the browse_frequency from -1 to 60, then it works and I start seeing event coming in from MQ to Splunk. 🙂

0 Karma

Motivator

From the error it looks like you've run out of available handles.

http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.tro.doc/q040900_.htm

http://stackoverflow.com/questions/1539826/wsmq-queue-limit

Are you seeing any errors on the mq sever?

0 Karma