{"id":401,"date":"2016-11-06T14:30:16","date_gmt":"2016-11-06T14:30:16","guid":{"rendered":"https:\/\/marketaylor.synology.me\/?p=401"},"modified":"2019-11-22T21:08:29","modified_gmt":"2019-11-22T21:08:29","slug":"formatting-mq-events-as-json","status":"publish","type":"post","link":"https:\/\/marketaylor.synology.me\/?p=401","title":{"rendered":"Formatting MQ Events as JSON"},"content":{"rendered":"

IBM MQ has always been able to generate event messages when something “interesting” has occurred in the queue manager. These events could be showing that a queue is full<\/a>, or that there has been an authorisation failure<\/a>; someone needing an audit trail might want to capture the command<\/a> and configuration<\/a> events. These events are written as MQ messages to well-known queues, using PCF structures which can be decoded to give the full description of the event.<\/p>\n

<\/p>\n

The amqsevt sample program<\/h2>\n

IBM MQ V8.0.0.4 included a new sample program, amqsevt<\/a>, designed to format these event messages. That fixpack contained both the executable program and source code for it. You can see more about the formatter in this video<\/a>. Here is an event as printed by the program:<\/p>\n

**** Message #7 (236 Bytes) on Queue SYSTEM.ADMIN.PERFM.EVENT ****\nEvent Type                     : Perfm Event [45]\nReason                         : Queue Full [2053]\nEvent created                  : 2016\/10\/21 07:11:28.58 GMT\n  Queue Mgr Name               : V9000_A\n  Base Object Name             : FULLEVT\n  Time Since Reset             : 0\n  High Queue Depth             : 4\n  Msg Enq Count                : 0\n  Msg Deq Count                : 0\n<\/pre>\n
Displaying events in this more readable, English-like, style can be very useful for administrators who want to see what is going on, without using a more formal monitoring product. However, there are times when a format more suitable for programmatic processing are needed.<\/p>\n
A modified version for JSON<\/h2>\n
The common MQ management and monitoring tools such as Omegamon are all able to decode the PCF messages, and take appropriate actions or generate alerts from these events. But many customers now want to integrate these events with other tools, that perhaps do not have an MQ-specific component or heritage. And so I’ve produced a modified version of the amqsevt program that can print the events in JSON, which is a simple format, but one which is capable of being parsed and searched with a variety of tools.<\/p>\n
This example shows the same event as above, but formatted as JSON:<\/p>\n
{\n  \"eventSource\" : {\n    \"objectName\" : \"SYSTEM.ADMIN.PERFM.EVENT\",\n    \"objectType\" : \"Queue\"\n  },\n  \"eventType\" : {\n    \"name\" : \"Perfm Event\",\n    \"value\" : 45\n  },\n  \"eventReason\" : {\n    \"name\" : \"Queue Full\",\n    \"value\" : 2053\n  },\n  \"eventCreation\" : \"2016\/10\/21 07:11:28.58 GMT\",\n  \"eventData\" : {\n    \"queueMgrName\" : \"V9000_A\",\n    \"baseObjectName\" : \"FULLEVT\",\n    \"timeSinceReset\" : 0,\n    \"highQueueDepth\" : 4,\n    \"msgEnqCount\" : 0,\n    \"msgDeqCount\" : 0\n  }\n}\n<\/pre>\n
Using the program<\/h2>\n
The modified amqsevt has an extra command line option, “-o json” to indicate that the output should be in JSON. When selected, some of the status (eg program starting or ending) messages from the program are disabled, so that the only information sent to stdout are the JSON events themselves. When needed, error messages are now sent to stderr. That means that the standard output from the program can be sent directly to any JSON-aware program without needing further filtering. There is a blank line between each event if you want to split output at a convenient point.<\/p>\n
This example uses the jq<\/a> command, which is designed to filter JSON, to find which queues have hit their full depth. It reads all the events from the queue manager and waits 2 seconds for any further input (the -w parameter):<\/p>\n
$ amqsevt -m QM1 -o json -w 2 |\\\n  jq 'select(.eventReason == 2053) | \n     .eventData.baseObjectName ' \"FULLEVT\"\n$\n<\/pre>\n
Note that the output includes the quotes around the queue name; any further processing may want to remove that. The “‘-r” option to jq will do that for you.<\/p>\n
In this next example, I redirected the output to a file, and then let the Splunk<\/a> monitoring product read it. Then I applied a filter to look for all events from the PERFM event queue:<\/p>\n
\"\"<\/p>\n
Where to get the program<\/h2>\n
The modified amqsevt program was originally available from github.com as a gist, but is now included as part of the MQ samples.<\/p>\n
This post was last updated on November 22nd, 2019 at 09:08 pm<\/p>","protected":false},"excerpt":{"rendered":"
IBM MQ has always been able to generate event messages when something “interesting” has occurred in the queue manager. These events could be showing that a queue is full, or that there has been an authorisation failure; someone needing an audit trail might want to capture the command and configuration events. These events are written … Continue reading “Formatting MQ Events as JSON”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5],"tags":[41,35,20,40,46],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-mq","tag-events","tag-ibmmq","tag-mqseries","tag-pcf","tag-splunk"],"yoast_head":"\nFormatting MQ Events as JSON - Mark Taylor's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/marketaylor.synology.me\/?p=401\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Formatting MQ Events as JSON - Mark Taylor's Blog\" \/>\n<meta property=\"og:description\" content=\"IBM MQ has always been able to generate event messages when something “interesting” has occurred in the queue manager. These events could be showing that a queue is full, or that there has been an authorisation failure; someone needing an audit trail might want to capture the command and configuration events. These events are written … Continue reading "Formatting MQ Events as JSON"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/marketaylor.synology.me\/?p=401\" \/>\n<meta property=\"og:site_name\" content=\"Mark Taylor's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-11-06T14:30:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-11-22T21:08:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png\" \/>\n<meta name=\"author\" content=\"Mark\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@marketaylor\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401\"},\"author\":{\"name\":\"Mark\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"headline\":\"Formatting MQ Events as JSON\",\"datePublished\":\"2016-11-06T14:30:16+00:00\",\"dateModified\":\"2019-11-22T21:08:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401\"},\"wordCount\":513,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/Pictures\\\/2019\\\/11\\\/splunk.png\",\"keywords\":[\"events\",\"ibmmq\",\"mqseries\",\"pcf\",\"splunk\"],\"articleSection\":[\"IBM MQ\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401\",\"name\":\"Formatting MQ Events as JSON - Mark Taylor's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/Pictures\\\/2019\\\/11\\\/splunk.png\",\"datePublished\":\"2016-11-06T14:30:16+00:00\",\"dateModified\":\"2019-11-22T21:08:29+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#primaryimage\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/Pictures\\\/2019\\\/11\\\/splunk.png\",\"contentUrl\":\"https:\\\/\\\/marketaylor.synology.me\\\/wp-content\\\/uploads\\\/Pictures\\\/2019\\\/11\\\/splunk.png\",\"width\":845,\"height\":900},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/?p=401#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/marketaylor.synology.me\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Formatting MQ Events as JSON\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#website\",\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/\",\"name\":\"Mark Taylor's Blog\",\"description\":\"Messaging, Music and Moving Around\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/marketaylor.synology.me\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/marketaylor.synology.me\\\/#\\\/schema\\\/person\\\/2d6f4113ff54187023e20c20186bbb3c\",\"name\":\"Mark\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g\",\"caption\":\"Mark\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/marketaylor\"],\"url\":\"https:\\\/\\\/marketaylor.synology.me\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Formatting MQ Events as JSON - Mark Taylor's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/marketaylor.synology.me\/?p=401","og_locale":"en_GB","og_type":"article","og_title":"Formatting MQ Events as JSON - Mark Taylor's Blog","og_description":"IBM MQ has always been able to generate event messages when something “interesting” has occurred in the queue manager. These events could be showing that a queue is full, or that there has been an authorisation failure; someone needing an audit trail might want to capture the command and configuration events. These events are written … Continue reading \"Formatting MQ Events as JSON\"","og_url":"https:\/\/marketaylor.synology.me\/?p=401","og_site_name":"Mark Taylor's Blog","article_published_time":"2016-11-06T14:30:16+00:00","article_modified_time":"2019-11-22T21:08:29+00:00","og_image":[{"url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png","type":"","width":"","height":""}],"author":"Mark","twitter_card":"summary_large_image","twitter_creator":"@marketaylor","twitter_misc":{"Written by":"Mark","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/marketaylor.synology.me\/?p=401#article","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/?p=401"},"author":{"name":"Mark","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"headline":"Formatting MQ Events as JSON","datePublished":"2016-11-06T14:30:16+00:00","dateModified":"2019-11-22T21:08:29+00:00","mainEntityOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=401"},"wordCount":513,"commentCount":0,"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=401#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png","keywords":["events","ibmmq","mqseries","pcf","splunk"],"articleSection":["IBM MQ"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/marketaylor.synology.me\/?p=401#respond"]}]},{"@type":"WebPage","@id":"https:\/\/marketaylor.synology.me\/?p=401","url":"https:\/\/marketaylor.synology.me\/?p=401","name":"Formatting MQ Events as JSON - Mark Taylor's Blog","isPartOf":{"@id":"https:\/\/marketaylor.synology.me\/#website"},"primaryImageOfPage":{"@id":"https:\/\/marketaylor.synology.me\/?p=401#primaryimage"},"image":{"@id":"https:\/\/marketaylor.synology.me\/?p=401#primaryimage"},"thumbnailUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png","datePublished":"2016-11-06T14:30:16+00:00","dateModified":"2019-11-22T21:08:29+00:00","author":{"@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c"},"breadcrumb":{"@id":"https:\/\/marketaylor.synology.me\/?p=401#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/marketaylor.synology.me\/?p=401"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/marketaylor.synology.me\/?p=401#primaryimage","url":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png","contentUrl":"https:\/\/marketaylor.synology.me\/wp-content\/uploads\/Pictures\/2019\/11\/splunk.png","width":845,"height":900},{"@type":"BreadcrumbList","@id":"https:\/\/marketaylor.synology.me\/?p=401#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/marketaylor.synology.me\/"},{"@type":"ListItem","position":2,"name":"Formatting MQ Events as JSON"}]},{"@type":"WebSite","@id":"https:\/\/marketaylor.synology.me\/#website","url":"https:\/\/marketaylor.synology.me\/","name":"Mark Taylor's Blog","description":"Messaging, Music and Moving Around","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/marketaylor.synology.me\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/marketaylor.synology.me\/#\/schema\/person\/2d6f4113ff54187023e20c20186bbb3c","name":"Mark","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9a5ae091c43730194cba7cabb5d65c1dc3f48d05caaddec6ff2319a1ce66376f?s=96&d=mm&r=g","caption":"Mark"},"sameAs":["https:\/\/x.com\/marketaylor"],"url":"https:\/\/marketaylor.synology.me\/?author=1"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=401"}],"version-history":[{"count":5,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions"}],"predecessor-version":[{"id":407,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions\/407"}],"wp:attachment":[{"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/marketaylor.synology.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}