MQ Monitoring: How to have an audit trail of which MQ Administrator actually made configuration changes?

IBM Support

Search support or find a product: Search

Our apologies

No results were found for your search query.

Tips

To return expected results, you can:

Reduce the number of search terms. Each term you use focuses the search further.
Check your spelling. A single misspelled or incorrectly typed term can change your result.
Try substituting synonyms for your original terms. For example, instead of searching for "java classes", try "java training"
Did you search for an IBM acquired or sold product ? If so, follow the appropriate link below to find the content you need.

Our apologies

Search results are not available at this time. Please try again later or use one of the other support options on this page.

No results were found for your search query.

Tips

To return expected results, you can:

Reduce the number of search terms. Each term you use focuses the search further.
Check your spelling. A single misspelled or incorrectly typed term can change your result.
Try substituting synonyms for your original terms. For example, instead of searching for "java classes", try "java training"
Did you search for an IBM acquired or sold product ? If so, follow the appropriate link below to find the content you need.

Yes you can. You will have to:

a) Enable the monitoring feature for Configuration Events and
b) Use the following Plugin for MQ Explorer to view the events: MS0P: WebSphere MQ Events and Statistics Plug-in

++ Command and Configuration Events
- Command events do not record the security commands like setmqaut, nor other commands such as strmqm.
- Successful commands from runmqsc or PCF are recorded as event messages.
- The corresponding system event queue is:
SYSTEM.ADMIN.COMMAND.EVENT
- Configuration changes report "before" and "after" definitions of objects
- Provides a record of who changed, what and when
- The default value for these new attributes CMDEV and CONFIGEV is DISABLED
- The corresponding system event queue is:
SYSTEM.ADMIN.CONFIG.EVENT
- Need to explicitly enable these features:
display qmgr event
AMQ8408: Display Queue Manager details.
QMNAME(V7) CMDEV(ENABLED) CONFIGEV(ENABLED)

- Note: You will need to consume the event records from the system queues, otherwise the queues will fill up!
For more details visit the MQ Knowledge Center:

https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.mon.doc/q036290_.htm
IBM MQ 9.1.x > IBM MQ > Monitoring and performance > Monitoring your IBM MQ network > Event monitoring >
Instrumentation events > Controlling events >
Controlling configuration, command, and logger events
.
https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.mon.doc/q036480_.htm
IBM MQ 9.1.x > IBM MQ > Monitoring and performance > Monitoring your IBM MQ network > Event monitoring >
Configuration events

https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.mon.doc/q036520_.htm
IBM MQ 9.1.x > IBM MQ > Monitoring and performance > Monitoring your IBM MQ network > Event monitoring >
Command events

It is recommended to use the MQ Explorer and to install the following plugin:
MS0P: WebSphere MQ Events and Statistics Plug-in
https://www.ibm.com/support/pages/ms0p-websphere-mq-explorer-%E2%80%93-extended-management-plug-ins-and-tools
Abstract
WebSphere MQ Explorer plug-in for Events and Statistics reports.
Download Description
This SupportPac provides a mechanism to format Event messages and to aggregate the Statistics and Accounting reports generated by WebSphere MQ. The SupportPac can be used either as a plug-in in the WebSphere MQ Explorer or as a standalone command line program.

Scenario:
The CMDEV and CONFIGEV were enabled.
Created new queue “QEVENT”.
From MQ Explorer, select SYSTEM.ADMIN.CONFIG.EVENT then right click on “Format Event Messages …”
Figure 1 shows a screen capture from the plugin MS0P.
The top section is: Events for Queue Manager
Next section is: SYSTEM.ADMIN.CONFIG.EVENT
Next subsection is: Config Create Object
There is information such as the user id who created/modified the object.
In this example the created object is a queue named: QEVENT
The user who created it was:
Event User ID : rivera

The following figures (2 and 3) show an example of an ALTER of a queue by users "mqm" and "rivera" (who are MQ Administrators), in order to show that the Event shows the actual MQ administrator userid (mqm or rivera, in this case) who did the configuration change.

Figure 2: Configuration change made by user "mqm"

Figure 3: Configuration change made by user "rivera"

Select SYSTEM.ADMIN.COMMAND.EVENT then right click on “Format Event Messages …”
This queue grows VERY FAST when using MQ Explorer due to the constant activity from the MQ Explorer: inquiry, etc.
Figure 4 shows a snapshot:
Next section is: SYSTEM.ADMIN.COMMAND.EVENT
The example command is for inquiry.