IBM MQ Permissions for the IBM MQ Monitoring Agent
The Nodinite IBM MQ Monitoring Agent connects to each IBM MQ Queue Manager with the account you set in its Remote Configuration. Membership of the MQM group works, but least privileges are better: grant only the IBM MQ user rights the features you use need. This page is part of the Prerequisites for the IBM MQ Monitoring Agent. On this page, you will:
- ✅ Understand the IBM MQ object types and the wildcard pattern used in permissions
- ✅ See which permission each monitoring feature and Remote Action needs
- ✅ Pick a ready-to-run
setmqautpermission set, from queues only to full monitoring with Remote Actions - ✅ Fix
MQRC_NOT_AUTHORIZEDwhen the agent can't connect
Understanding IBM MQ Permissions
Before configuring permissions, it's important to understand what each permission flag does:
| Permission Flag | What It Does | Used For |
|---|---|---|
+connect |
Connect to the queue manager | ✅ Required - Must be able to connect to perform any monitoring or management |
+dsp |
Display object properties | ✅ Required - Query object state, configuration, and status |
+inq |
Inquire object attributes | ✅ Required - Read detailed metrics (message count, age, inhibit status) |
+put |
Put messages to a queue | PCF commands - Send PCF (Programmable Command Format) commands to IBM MQ; Remote Actions - post or resend a message |
+get |
Get (destructively read) messages from a queue | Remote Actions - Remove and purge messages; logging - read log queues; dynamic queue responses |
+browse |
Browse messages without removing them | Remote Actions - List and download messages |
IBM MQ Object Types
qmgr- Queue Manager (the IBM MQ instance itself)q- Queues (where messages are stored). The agent's own log suggestions write-t queue; both forms are validchannel- Channels (communication paths)clntconn- Client Connection Channels (remote client connections)listener- Listeners (network listeners for incoming connections)topic- Topics (publish/subscribe messaging)process- Processes (application definitions)namelist- Namelists (lists of object names)authinfo- Authentication Information (security configurations)service- Services (Windows services or Unix processes)comminfo- Communication Information (multicast configuration)
Wildcard Pattern
"**"- Matches all objects of the specified type
IBM MQ Permission Requirements Explained
The table below explains what each permission command does and whether it's required for Nodinite monitoring and management:
| Command | Object Type | Permissions | What It Does | Required For | Necessary? |
|---|---|---|---|---|---|
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp |
Queue Manager | Connect, Inquire, Display | Connect to the queue manager and query its properties (availability, connectivity status) | ✅ All monitoring - Required for queue manager monitoring | ✅ REQUIRED |
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +dsp +inq |
All Queues | Display, Inquire | Query queue state and metrics (message count, age, get/put inhibit status, quota, dead letter) | ✅ Queue Monitoring - If checkbox enabled | ✅ If monitoring queues |
setmqaut -m QM1 -n "**" -t topic -p "mqadmin" +dsp |
All Topics | Display | Query topic properties and subscriptions for publish/subscribe messaging - Topics are automatically discovered and monitored | ✅ Topic Monitoring - If checkbox enabled | ✅ If monitoring topics |
setmqaut -m QM1 -n "**" -t channel -p "mqadmin" +dsp |
All Channels | Display | Query channel state (started/stopped) and connection status | ✅ Channel Monitoring - If checkbox enabled | ✅ If monitoring channels |
setmqaut -m QM1 -n "**" -t process -p "mqadmin" +dsp |
All Processes | Display | Query process definitions (application configurations) | ❌ Not monitored - No process monitoring features documented | ❌ Not required |
setmqaut -m QM1 -n "**" -t namelist -p "mqadmin" +dsp |
All Namelists | Display | Query namelists (lists of object names for grouping) | ❌ Not monitored - No namelist monitoring features documented | ❌ Not required |
setmqaut -m QM1 -n "**" -t authinfo -p "mqadmin" +dsp |
All Auth Info | Display | Query authentication configuration (LDAP, OS, etc.) | ❌ Not monitored - No authinfo monitoring features documented | ❌ Not required |
setmqaut -m QM1 -n "**" -t clntconn -p "mqadmin" +dsp |
All Client Connections | Display | Query client connection channels (remote client access) | ✅ Channel Monitoring - Client connections are monitored as channel type | ✅ If monitoring channels |
setmqaut -m QM1 -n "**" -t listener -p "mqadmin" +dsp |
All Listeners | Display | Query listener state (started/stopped) for network listeners | ✅ Listener Monitoring - If checkbox enabled | ✅ If monitoring listeners |
setmqaut -m QM1 -n "**" -t service -p "mqadmin" +dsp |
All Services | Display | Query service definitions (Windows services/Unix processes) | ❌ Not monitored - No service monitoring features documented | ❌ Not required |
setmqaut -m QM1 -n "**" -t comminfo -p "mqadmin" +dsp |
All Comm Info | Display | Query multicast configuration for publish/subscribe | ❌ Not monitored - No comminfo monitoring features documented | ❌ Not required |
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put |
Admin Command Queue | Display, Inquire, Put | Send PCF commands to IBM MQ for querying objects and executing remote actions | ✅ All monitoring & Remote Actions - Used to send commands to IBM MQ | ✅ REQUIRED |
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq |
Model Queue | Display, Get, Inquire | Create dynamic temporary queues for command responses from IBM MQ | ✅ All monitoring & Remote Actions - Used to receive responses from IBM MQ | ✅ REQUIRED |
Note
About PCF Commands and Security:
The two commands above (
SYSTEM.ADMIN.COMMAND.QUEUEandSYSTEM.DEFAULT.MODEL.QUEUE) use PCF (Programmable Command Format), which is IBM's official administrative interface used by all monitoring tools (IBM MQ Explorer, Console, REST API, and Nodinite).Key Points:
- ✅ Object-level security is enforced - Access to
SYSTEM.ADMIN.COMMAND.QUEUEdoes NOT bypass permissions. IBM MQ still checks permissions on queues, topics, channels, and listeners.- ✅ Standard IBM interface - This is the only way to programmatically query IBM MQ. There is no alternative.
- ✅ Temporary queues are safe - Used only for command responses (metadata, not business messages). Should be auto-deleted by IBM MQ.
- ⚠️ IBM MQ 8.0.4 bug - Temporary queues may not be deleted properly. Upgrade to 8.0.5+ or 9.x to resolve.
For security-conscious customers: If you want to limit what Nodinite can query, restrict the other permissions (remove
+dsp +inqfrom object types you don't want monitored). The PCF commands will respect these restrictions.For detailed explanation: See FAQ - About PCF Commands and Security for complete information about PCF command flow, temporary queues, security architecture, and comparison with other monitoring tools.
Remote Actions Requiring Additional Permissions
The following remote actions available in Managing IBM MQ.md may require additional permissions beyond monitoring:
| Remote Action | Additional Permissions Required | Command |
|---|---|---|
| Purge Queue | +get on target queues. Purge reads every message destructively; it doesn't use a clear command, so +clr isn't needed |
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +get |
| Remove Message | +get on target queues |
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +get |
| Download Message and listing messages | +browse on target queues (messages are browsed, not removed) |
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +browse |
| Post or Resend Message | +put on the target queue |
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +put |
| Edit Thresholds | No additional permissions - configuration only | N/A - Stored in Nodinite database |
Note
If you plan to use these Remote Actions, add
+get,+browse, and+putto the relevant queues, as in Option E.
Optimized Permission Sets
Based on your monitoring configuration checkboxes (Queues, Topics, Channels, Listeners), choose the appropriate permission set below.
Important
Refresh the security cache after every change. Each set ends with
REFRESH SECURITY TYPE(AUTHSERV). Without it, a changedsetmqautmay not take effect at once.
Base Permissions (Always Required)
These permissions are always required for any Nodinite monitoring:
# Connect to Queue Manager - REQUIRED for all monitoring
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
# Admin Command Queue - REQUIRED to send PCF commands to IBM MQ
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
# Model Queue - REQUIRED to receive responses from IBM MQ via dynamic queues
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option A: Monitor Everything (Recommended)
Use this if
All checkboxes enabled (Queues + Topics + Channels + Listeners)
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Queue Monitoring (state, age, count, quota, dead letter)
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +dsp +inq
# Topic Monitoring (subscription status - automatically discovered)
setmqaut -m QM1 -n "**" -t topic -p "mqadmin" +dsp
# Channel Monitoring (state, includes client connections)
setmqaut -m QM1 -n "**" -t channel -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t clntconn -p "mqadmin" +dsp
# Listener Monitoring (state)
setmqaut -m QM1 -n "**" -t listener -p "mqadmin" +dsp
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option B: Monitor Queues Only
Use this if
Only Queues checkbox enabled
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Queue Monitoring ONLY
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +dsp +inq
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option B2: Monitor Topics Only
Use this if
Only Topics checkbox enabled
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Topic Monitoring ONLY (automatically discovers all topics)
setmqaut -m QM1 -n "**" -t topic -p "mqadmin" +dsp
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option C: Monitor Channels Only
Use this if
Only Channels checkbox enabled
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Channel Monitoring ONLY (includes client connections)
setmqaut -m QM1 -n "**" -t channel -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t clntconn -p "mqadmin" +dsp
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option D: Monitor Listeners Only
Use this if
Only Listeners checkbox enabled
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# Listener Monitoring ONLY
setmqaut -m QM1 -n "**" -t listener -p "mqadmin" +dsp
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option E: Full Monitoring + Remote Actions
Use this if
You want monitoring AND Remote Actions (Purge Queue, Remove Message, list and Download Message, Post or Resend Message)
# Base Permissions (always required)
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
# All Monitoring (queues, topics, channels, listeners)
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +dsp +inq
setmqaut -m QM1 -n "**" -t topic -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t channel -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t clntconn -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t listener -p "mqadmin" +dsp
# Remote Actions: purge and remove (+get), list and download (+browse), post and resend (+put)
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +get +browse +put
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Option F: IBM MQ Logging (Log Sources)
Use this if
The agent reads Log Events from IBM MQ log queues (Log Sources). It reads each log queue destructively under syncpoint, and moves a message it can't process to another queue.
# Connect to the Queue Manager
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect
# Read each log queue (replace with your queue names)
setmqaut -m QM1 -n "NODINITE.LOG.QUEUE" -t q -p "mqadmin" +get
# Put messages that can't be processed on this queue
setmqaut -m QM1 -n "NODINITE.LOG.ERROR" -t q -p "mqadmin" +put
# Apply the changes at once
echo "REFRESH SECURITY TYPE(AUTHSERV)" | runmqsc QM1
Tip
Security Best Practice: Start with Option A (Monitor Everything) for initial setup. Once you understand your monitoring needs, switch to a more restrictive option based on your checkbox configuration.
Legacy Permission Commands (For Reference)
The following commands were used in previous versions. They grant permissions to object types that some environments may not need based on monitoring configuration.
These commands are kept for backward compatibility but are not recommended for new installations:
setmqaut -m QM1 -t qmgr -p "mqadmin" +connect +inq +dsp
setmqaut -m QM1 -n "**" -t q -p "mqadmin" +dsp +inq
setmqaut -m QM1 -n "**" -t topic -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t channel -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t process -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t namelist -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t authinfo -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t clntconn -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t listener -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t service -p "mqadmin" +dsp
setmqaut -m QM1 -n "**" -t comminfo -p "mqadmin" +dsp
setmqaut -m QM1 -n SYSTEM.ADMIN.COMMAND.QUEUE -t q -p "mqadmin" +dsp +inq +put
setmqaut -m QM1 -n "SYSTEM.DEFAULT.MODEL.QUEUE" -t q -p "mqadmin" +dsp +get +inq
Warning
These legacy commands grant unnecessary permissions to object types that may not be monitored in your environment (processes, namelists, authinfo, services, comminfo). Use the Optimized Permission Sets above instead to follow the principle of least privilege and only grant permissions for the monitoring features you have enabled.
Troubleshooting MQRC_NOT_AUTHORIZED
When you log in to the IBM MQ Broker, the Nodinite IBM MQ Monitoring Agent may receive an MQRC_NOT_AUTHORIZED (2035) error. You will see this error in the Monitor Views and in the rolling Diagnostics file.
The agent's log names the fix. Look for the block titled ERROR: Authentication Failed (2035). It lists ready-made remediation commands for the agent's account:
- the Queue Manager:
+connect +inq +dsp; SYSTEM.ADMIN.COMMAND.QUEUEandSYSTEM.DEFAULT.MODEL.QUEUE, as in the Base Permissions;- all queues (
'**'):+inq +dsp +browse; - all channels (
'**'):+dsp; - and then
REFRESH SECURITY TYPE(AUTHSERV).
Run them, refresh the security cache, and the agent connects on its next poll.
Please review IBM's documentation 2035 MQRC_NOT_AUTHORIZED when connecting to IBM MQ from WebSphere Application Server to find and apply the proper solution for your environment.
Next Steps
Prerequisites for the IBM MQ Monitoring Agent
Configure the IBM MQ Monitoring Agent
Installing the IBM MQ Monitoring Agent
Related Topics
IBM MQ Monitoring Agent
FAQ - About PCF Commands and Security
Remote Actions
Troubleshooting