This blog post is my annotations to MQ messages, containing descriptions of what I did to get an MQ message, and what I did to fix the problem. It is meant for web search programs, rather than humans.
I will extend it as I experience problems.
AMQ7026E: A principal or group name was invalid.
I could display an auth entry
dspmqaut -m qml -t qmgr -g “cn=dynamic, o=Your Company”
Entity cn=dynamic, o=Your Company has the following authorizations for object qml:
connect
but not delete it
setmqaut -m qml -t qmgr -g “cn=dynamic,o=Your Company” -connect
AMQ7026E: A principal or group name was invalid.
I had set this up using LDAP, but MQ was not able to find the record in LDAP. This is because I had changed the configuration. There was an LDAP search
(&(objectClass=groupOfNames)(OU=cn=dynamic, o=Your Company))
It could not be found because there was no LDAP entry with objectClass=groupOfNames with an entry (OU=cn=dynamic, o=Your Company)
I had changed
DEFINE AUTHINFO(MYLDAP) +
AUTHTYPE(IDPWLDAP) +
GRPFIELD(sn)
to
GRPFIELD(ou)
So when MQ came to delete it, it looked for
(&(objectClass=groupOfNames)(OU=cn=dynamic, o=Your Company))
instead of
(&(objectClass=groupOfNames)(SN=cn=dynamic, o=Your Company))
and could not delete it.
I changed the LDAP group to add the OU, and the SETMQAUT command worked.
AMQ5532E: Error authorizing entity in LDAP
EXPLANATION:
The LDAP authorization service has failed in the ldap_first_entry call while
trying to find user or group ‘NULL’. Returned count is 0. Additional context is
‘cn=mqadmin,ou=groups,o=your Company’.
Colin’s comments
I had defined a dynamic group, by specifying the group name as part of the LDAP user entry.
When I changed the authinfo object yo have nestgrp(yes), I got the above message because there was no record for cn=mqadmin,ou=groups,o=your Company’.
Define the record with the appropriate object class as defined by the MQ AUTHINFO attribute CLASSGRP. (CLASSGRP(‘groupOfNames’) in my case).
AMQ5530E: Error from LDAP authentication and authorization service
EXPLANATION:
The LDAP authentication and authorization service has failed. The
‘ldap_ssl_environment_init’ call returned error 113 : ‘SSL initialization call
failed’. The context string is ‘keyfile=”/var/mqm/qmgrs/qml/ssl/key.kdb”
SSL/TLS rc=408 (ERROR BAD KEYFILE PASSWORD)’. Additional code is 0.
Colin’s comments.
I had changed the keyring using alter qmgr CERTLABL(ECRSA1024) SSLKEYR(‘/home/colinpaice/mq/zzserver’)
AMQ5530E: Error from LDAP authentication and authorization service
EXPLANATION:
The LDAP authentication and authorization service has failed. The
‘ldap_simple_bind’ call returned error 49 : ‘Invalid credentials’. The context
string is ‘10.1.1.2:389 ‘. Additional code is 0.
Colin’s comments
An anonymous logon to LDAP was attempted (LDAPUSER and LDAPPWD omitted) and the LDAP server had allowAnonymousBinds off.
Specify userid and password.
API: 2460 (099C) (RC2460): MQRC_HMSG_ERROR during get
I had this during an MQGET when the GMO was not using Version:4.
This would apply to PMO not using Version:3.
Reason 2464: FAILED: MQRC_IMPO_ERROR
MQIMPO impo = {MQIMPO_DEFAULT};
I got this return code because I had a C program on z/OS and compiled it using the ASCII option. This meant the IMPO eye catcher was ASCII 0x494D504F) instead of EBCDIC 0xC9D4D7D6.
MQIMPO impo = {MQIMPO_DEFAULT};
// if we are in ascii mode we need to convert eyecatcher from ASCII to
// EBCDIC
__a2e_l(impo.StrucId,sizeof(impo.StrucId));
This also applies to
2482: FAILED: MQRC_PD_ERROR
2440 (0988) (RC2440): MQRC_SUB_NAME_ERROR
I got this because my data was in EBCDIC, but I had specified the code page as 437 ( ASCII).
AMQ9669E The PKCS #11 token could not be found
AMQ9669E The PKCS #11 token could not be found. Severity 30 : Error Explanation The PKCS #11 driver failed to find the token specified to MQ in the PKCS #11 token label field of the GSK_PKCS11 SSL CryptoHardware parameter. The channel is <insert_3>; in some cases its name cannot be determined and so is shown as ‘????’. The channel did not start. Response Ensure that the PKCS #11 token exists with the label specified. Restart the channel.
I got this when I had the following in my mqclient.ini
SSL:
…
SSLCryptoHardware=GSK_PKCS11=/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so\;UserPIN (mytoken)\;12345678\;SYMMETRIC_CIPHER_ON\;
I commented out the SSLCryptoHardware… (I used #SSLCryptoHardware…) and it worked.
Z/OS messages
CSQY010E %CSQ9 CSQYASCP LOAD MODULE CSQYARIB IS NOT AT THE CORRECT
RELEASE LEVEL
If you get CSQYARIB then this can be caused by running Beta code past its validity date.
CSQX630E %CSQ9 CSQXRESP Channel ???? requires SSL
The chinit needs some SSL tasks and a keyring
%csq9 ALTER QMGR SSLTASKS(5) SSLKEYR(MQRING)
Restart the CHINIT.
Return codes
3015 (0BC7) (RC3015): MQRCCF_CFST_PARM_ID_ERR
IBM Documentation: Explanation. Parameter identifier is not valid. The MQCFST Parameter field value was not valid.
Colin’s comment. I passed a value which was valid, but the context was not valid. For example I issued a PCF command to start SMDSCONN. On the console the command gave
CSQM174E M801 CSQMSSMD ‘SMDSCONN’ KEYWORD IS NOT ALLOWED WITH CFLEVEL(4) – THIS KEYWORD REQUIRES CFLEVEL(5)
3229 (0C9D) (RC3220) MQRCCF_PARM_VALUE_ERROR
I got this trying to use MQCMD_INQUIRE_Q.
I had used qtype=MQOT_LOCAL_Q = 1004 when I should have used MQQT_LOCAL = 1
The PCF return message told me the incorrect parameter and value
2019 (07E3) (RC2019): MQRC_HOBJ_ERROR
I got the MQRC_HOBJ_ERROR when using MQSUB to subscribe to a topic. This is described here.
Colin’s comment
I got this because the queue I was using was not consistent with the subscription definition. For example
- The subscription was using a managed subscription and I was using a queue
- The queue name I specified in the queue handle did not match the queue name in the subscription
You can use the DISPLAY SUB(..) DEST DESTCLAS
A managed subscription will have a DEST(SYSTEM.MANAGED.DURABLE…) and DESTCLAS(MANAGED).
When using a queue you will have DEST(COLINSUBQ) DISTYPE(RESOLVED)
ColinPaice 