Creating WebSphere MQ Archive Criteria

This section describes how to create a new archive recording request.

1. From the Archive Recording - Monitor MQ Requests screen, type A (Add) in the selection column of any recording request and press Enter. The WebSphere MQ - Archive Criteria screen is displayed.
   WebSphere MQ - Archive Criteria Screen

   ---------------------- Websphere MQ - Archive Criteria    ----- Row 1 to 1 of 1
   Command ===>                                                   Scroll ===> PAGE
   
   
    Type OK to continue, PF1 for help, or CANCEL to exit.
   
   
    Name . . . . . . . .                      Exclude SYSTEM traffic ('/')
    Description. . . . . MQ TEST
   
   
    Repository Registry Dataset. . . 'USR2503.ARCH.MQ'
   
   
   Restrict collection to certain times (optional):
                  HH : MM : SS                  MM / DD / YYYY
   Start Time . . 00 : 00 : 00   Start Date . . 00 / 00 / 0000
   End Time . . . 00 : 00 : 00   End Date . . . 00 / 00 / 0000
   
   
   Send message content to SIEM tool (Enter "/" to select)
   
   
   S Ftr Act  QMGR Queue/Object name                            Jobname  Comp Reas
   * *** **** **** ******************************************** ******** **** ****
   _ 001 INCL
   * *** **** **** ******************************************** ******** **** ****
2. Enter a Name and optional Description for your new archive criteria. You can specify up to eight characters for the name. The name can be alphanumeric but must start with a letter.
3. Exclude SYSTEM traffic allows the exclusion of SYSTEM traffic from your archive recording request. Enter a slash (/) to exclude all traffic to queues beginning with SYSTEM (except for SYSTEM.DEFAULT queues, which will still be captured).

4. Enter the Repository Registry Dataset name. This dataset contains the index to this archive recording request. Specify a fully qualified dataset name. The repository registry dataset name can be up to 35 characters in length. The repository set created by this archive recording request will be based on the repository registry dataset name (for example, a repository registry dataset of A.B.C would result in repository set segments being created from A.B.C.#0000001 to A.B.C.#9999999).
   This is a required field that stores information to make searching more efficient. All other datasets are built based on this dataset name.

   Warning

   Important

   If you delete your registry by mistake, you can run HSREGEN to recreate it.

5. Fill in the start and end date and time that you want to activate and deactivate the request.
   • If you supply a start time, you must also supply a start date, and if you supply an end time, you must supply an end date.
   • To activate the request immediately, accept the default values of all zeros in both the Start Date and Start Time fields.
   • To activate and/or deactivate the request on a specific date, enter a two-digit month, two-digit day, and four-digit year.
   • To activate and/or deactivate the request at a specific time, enter a two-digit hour based on a 24-hour clock, a two-digit minute or press Tab to accept 00, and a two-digit second or press Tab to accept 00.
   • If you supply a start date, but accept all zeros for the start time, the request activates at midnight at the beginning of the start date.
   • To keep the request active until you STOP, FORCE, or CANCEL it, accept the default values of all zeros for both the End Date and End Time fields.
   • If you supply an end date, but accept all zeros for the end time, the request deactivates at midnight at the beginning of the end date. Therefore, to include records up to and including a specific day, enter the following day as the end date.
6. Select Send message content to SIEM tool to send WebSphere MQ data to your SIEM tool. Session Monitor must be configured to write data to your SIEM tool. For information on configuring SIEM support, see Configure-SIEM-Data-Delivery.

7. Enter the desired filter information:

   • Ftr is an arbitrary value assigned as a unique ID for each filter. This field cannot be modified.
   • Act allows INCLude or EXCLude as valid filter actions.
   • QMGR name is the name of the queue managers to monitor.
   • Queue/Object name is the name of objects defined on the specified queue manager.
   • Jobname is part of the origin context of the message (defined by the application that created the message).
   • Comp is the completion code. 0 is successful completion, 1 is a warning - partial completion, and 2 is call failed.
   • Reas is the reason code. This should be a zero (0) or a numeric reason code.

   Warning

   Important

   If you need more space for the queue manager or Queue/Object names, use the ‘S’elect line command.

8. Type OK on the Command line. If the information is invalid, a message will appear telling you what needs to be added or changed. If the information is complete, the Archive Criteria - Delete or Terminate message screen is displayed.

   Warning

   Important

   The request is not added until the initial segment is allocated.

   Archive Criteria - Delete or Terminate Message Screen

   ---------------------- Websphere MQ - Archive Criteria   ----- Row 1 to 1 of 1
   C +----------------------------------------------------------------+ ===> PAGE
     | ----------- Archive Criteria - Delete or Terminate ----------  |
     | Command ===>                                                   |
     |                                                                |
     | Session Monitor archive record requests create repository      | ')
     | segment datasets based on the registry dataset name. You must  |
     | specify what action to take if the archive recording request   |
     | encounters an existing dataset in the following range:         |
     |                                                                |
   R |   First. . USER235.ARCH.MQ.#0000001                            |
     |   Last . . USER235.ARCH.MQ.#9999999                            |
   S |                                                                |
   E | Existing dataset option: (Enter number to select)              |
     |   1  1. Delete existing datasets                               |
   S |      2. Terminate the archive request                          | Comp Reas
   * +----------------------------------------------------------------+ **** ****
   _ 001 INCL *    H06AC079.*
   * *** **** **** ******************************************** ******** **** ****

   WebSphere MQ archive recording requests create repository segment datasets based on the registry dataset name. You must specify what action to take if the archive recording request encounters an existing dataset in the specified range.

   Warning

   Important

   The purpose of the Archive Criteria - Delete or Terminate Message screen is to decide what to do when the next dataset segment in the repository set exists. This situation is not desirable because both options may have negative consequences. We strongly recommend that this situation be avoided. To help prevent this situation from occurring, have the security administrator ensure that only the global recording started task has ALTER authority to the repository set datasets after the archive record request has been initiated.

   The First and Last fields show the dataset name of the first and last repository dataset segment that can be used. These include the registry dataset name followed by “.#0000001” and “.#9999999”.

9. Select 1 or 2 and press Enter to continue. Your choices include:

   • 1. Delete existing datasets: Deletes the existing datasets and creates new datasets that have the same names and are allocated with the same options as the initial repository dataset segment. Specify this option if the archive recording request must remain active.

   • 2. Terminate the archive request: Terminates the archive request. The archive recording request will not start if any existing datasets match the repository dataset specification. Also, if a dataset is created later that matches the repository dataset specification, the archive request will terminate when it needs to switch to that dataset.

     Warning

     Important

     You must make a choice. There is no default value, and your previous choices are not remembered from session to session.

   • Use END or CANCEL to cancel the add archive request and return to the WebSphere MQ - Archive Criteria screen.

   After selecting 1 or 2, the Global Recording - Allocate Dataset screen is displayed allowing you to define your repository file without exiting Session Monitor. The repository is a sequential dataset with variable blocked format. The record length of this dataset is four less than the specified block size. A block size of 9004 (default) is recommended.

10. The Management Class, Storage Class, and Data Class are defined by the storage administrator at your site. Leave blank to accept the default class.
11. Specify the type of Space Units to be used to store the data. Valid values are: TRKS (Tracks), CYLS (Cylinders), BLKS (Blocks), BYTES, KB (kilobytes), or MB (megabytes). Space units combined with the primary and secondary quantities define the amount of space allocated for the dataset.
12. Specify the primary and secondary quantity of space units to allocate. After Global Recording fills the primary quantity, it allocates the secondary quantity.
13. After you have filled in this screen, press Enter. The Archive Recording - Monitor MQ Requests screen is displayed showing the new request in the list.