AMQ9209 and AMQ9228 messages flooding the WMQ error log
Your WebSphere MQ (WMQ) queue manager records many AMQ9209 and AMQ9228 messages despite the fact all of the channels and clients were running normally.
The system error log messages were:
AMQ9209: Connection to host 'jtf (9.xx.yy.zz)' closed.
AMQ9228: The TCP/IP responder program could not be started.
The error messages were caused by a port scanning tool, that runs on the user's network. Each time the scanner connected to the MQ port, the listener would assume a new MQ connection was being established.
When the scanner disconnected without sending any data, then MQ wrote the AMQ9209 message to record the error. Because the listener did not know what channel the connection was for, it followed up with a generic AMQ9228 message rather than the more usual AMQ9999 message ("Channel ended abnormally").
Resolving the problem
Prevent the port scanner from accessing the WebSphere MQ ports.
WebSphere MQ WMQ MQSeries
More support for:
Channels LU62 / TCP
Software version: 5.3, 6.0, 7.0, 7.0.1, 7.1, 7.5
Operating system(s): AIX, HP-UX, Linux, OpenVMS, Solaris, Tandem NSK, Windows
Reference #: 1110505
Modified date: 2012-11-21