APAR status
Closed as program error.
Error description
A JMS application has a ConnectionFactory configured to use an MQ Security Exit, which fails to run successfully. When the application issues the JMS method: javax.jms.ConnectionFactory.createConnection(); it is presented with a JMS Exception of the form: com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed to connect to queue manager 'myQMGR' with connection mode 'Client' and host name 'localhost(1414)'. Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information. at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException at com.ibm.msg.client.wmq.common.internal.Reason.createException at com.ibm.msg.client.wmq.internal.WMQConnection.<init> at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7Pr oviderConnection at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProv iderConnection at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConn ection at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection at com.ibm.mq.jms.MQConnectionFactory.createConnection at SecurityExitTest.startTest at SecurityExitTest.main Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2537' ('MQRC_CHANNEL_NOT_AVAILABLE'). at com.ibm.msg.client.wmq.common.internal.Reason.createException ... 8 more Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9204: Connection to host 'localhost(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2537;AMQ9536: Channel ended by an exit. [1=SEC.EXIT.CHANNEL,2=/var/mqm/exits/mySecurityExit.so(ChlExit)] ],3=localhost(1414),5=RemoteExitChain.callScyExitSecParms] at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect at com.ibm.msg.client.wmq.internal.WMQConnection.<init> ... 7 more Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9536: Channel ended by an exit. [1=SEC.EXIT.CHANNEL,2=/var/mqm/exits/mySecurityExit.so(ChlExit)] at com.ibm.mq.jmqi.remote.exit.RemoteExitChain.callScyExitSecParms at com.ibm.mq.jmqi.remote.impl.RemoteConnection.initOAMUserAuth at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSes sion at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect ... 9 more However after several iterations of the application connection attempt is made, it is observed that the queue manager reports that the maximum number of channels has been reached, and further attempts to connect fail due to the queue manager rejecting the connection attempts.
Local fix
Problem summary
**************************************************************** USERS AFFECTED: This issue affects users of the MQ classes for Java and classes for JMS, who have applications that are using security exits. Platforms affected: MultiPlatform **************************************************************** PROBLEM DESCRIPTION: When an MQ classes for Java or MQ classes for JMS application attempts to connect to a queue manager where a security exit has been configured to be called on the client side, the security exit may request that the channel is closed as part of its failure processing. If this happens the connection attempt is rejected, and the application will receive an exception. For example when using the MQ classes for JMS API, the following exception might be thrown from the call to: javax.jms.ConnectionFactory.createConnection(String username, String password); com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed to connect to queue manager 'myQMGR' with connection mode 'Client' and host name 'localhost(1414)'. Check the queue manager is started and if running in client mode, check there is a listener running. Please see the linked exception for more information. at com.ibm.msg.client.wmq.common.internal.Reason.reasonToException( Reason.java:595) at com.ibm.msg.client.wmq.common.internal.Reason.createException(Re ason.java:215) at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnecti on.java:424) at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7Pr oviderConnection(WMQConnectionFactory.java:8470) at com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProv iderConnection(WMQConnectionFactory.java:7810) at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createCon nection(JmsConnectionFactoryImpl.java:325) at com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConn ection(JmsConnectionFactoryImpl.java:243) at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection(MQConn ectionFactory.java:6038) at com.ibm.mq.jms.MQConnectionFactory.createConnection(MQConnection Factory.java:6068) at myApplication.myMethod Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2537' ('MQRC_CHANNEL_NOT_AVAILABLE'). at com.ibm.msg.client.wmq.common.internal.Reason.createException(Re ason.java:203) ... 9 more Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9204: Connection to host 'localhost(1414)' rejected. [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2537;AMQ9536: Channel ended by an exit. [1=SEC.EXIT.CHANNEL ,2=/var/mqm/exits/myExit.so(ChlExit)]],3=localhost(1414),5=Remot eExitChain.callScyExitSecParms] at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java: 2301) at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java: 1273) at com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJ mqiImpl.java:377) at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:562) at com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnecti on.java:357) ... 8 more Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9536: Channel ended by an exit. [1=SEC.EXIT.CHANNEL ,2=/var/mqm/exits/myExit.so(ChlExit)] at com.ibm.mq.jmqi.remote.exit.RemoteExitChain.callScyExitSecParms( RemoteExitChain.java:597) at com.ibm.mq.jmqi.remote.impl.RemoteConnection.initOAMUserAuth(Rem oteConnection.java:2386) at com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSes sion(RemoteConnectionSpecification.java:351) at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(Remo teConnectionPool.java:161) at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java: 1749) ... 12 more This exception is expected in this scenario - the security exit has rejected the connection attempt. However the underlying connection handle to the queue manager (the 'hconn') is left open when this happens, resulting in the hconn being orphaned with no mechanism to close it from the JMS API (a JMS Connection object was not returned to the application by the createConnection method call when it threw the exception). The same problem can occur when creating a JMS Session, if the Connection was successfully created, but then subsequent Session creation requests on new TCP/IP sockets (especially in the channel configuration case of SHARECNV(1) ) fail in the security exit. The net result is that the additional channel instances are created but not used by the application. If this issue is repeatedly encountered during the lifetime of the JVM/queue manager, the queue manager's maximum channel instance count could be reached, which will then result in all further connection requested being rejected.
Problem conclusion
The MQ classes for Java and classes for JMS have been updated such that, if a security exit returns a return code which would result in a failure to complete the establishing of the connection to the queue manager, the 'hconn' associated with this new connection attempt is closed before the exception is thrown back to the calling application. --------------------------------------------------------------- The fix is targeted for delivery in the following PTFs: Version Maintenance Level v9.1 LTS 9.1.0.11 v9.2 LTS 9.2.0.5 v9.x CD 9.2.5 The latest available maintenance can be obtained from 'WebSphere MQ Recommended Fixes' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037 If the maintenance level is not yet available information on its planned availability can be found in 'WebSphere MQ Planned Maintenance Release Dates' http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309 ---------------------------------------------------------------
Temporary fix
Comments
APAR Information
APAR number
IT38158
Reported component name
MQ WINDOWS V7
Reported component ID
5724H7220
Reported release
710
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2021-08-26
Closed date
2021-11-01
Last modified date
2022-06-14
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
MQ WINDOWS V7
Fixed component ID
5724H7220
Applicable component levels
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFKSJ","label":"WebSphere MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.1"}]
Document Information
Modified date:
15 June 2022