Which permissions are required for PCFAgent enquiries?

Question

I'm using a little application I wrote to enquire about the state of some queues on a QM. The enquiry itself is done using the PCFAgent/PCFMessageAgent java classes.

My question is: which (least) privileges must be granted to allow a certain MCA user to run monitoring PCF commands (in particular, MQCMD_INQUIRE_Q_STATUS and MQCMD_INQUIRE_Q)?

Note: by "monitoring" I mean that the commands should not alter the state of the queue manager in any appreciable way.

Answer 1

The program must be able to do the following:

• Connect & inquire on the QMgr
• Create a model queue using inquire, display and get authority against a suitable model queue (you'd generally define a dedicated one for this rather than using the default model queue)
• Put PCF messages on the command queue with inquire, display and put authority
• Inquire on the target queue with display authority

Dale Lane wrote a blog post a while back describing this for the general case of: Using WebSphere MQ Explorer as a read-only viewer. Since WMQ Explorer needs to display all objects of all object types it is a bit more permissive than you are asking for. However, the settings you need are a subset of the ones Dale provides and the post has a lot of good background on the configurations used. I could copy his setmqaut commands here but its worth reading the post.

Incidentally, if you have a v7.1 QMgr and a new WMQ Explorer (downloaded from SupportPac MS0T) there's a security wizard in WMQ Explorer that makes the same settings Dale recommends in his blog post.