MQ

When you do an IBM MQ resource change with the REPLACE option like the following, is the action atomic? Does anyone know? By atomic, I mean the REPLACE happens in a way where no other IBM MQ functionality (e.g. IBM MQ is doing a CHLAUTH check on a starting channel) would see the resource missing while the REPLACE action is under way. 

SET CHLAUTH('MY.CHANNEL') TYPE(SSLPEERMAP) +
SSLPEER('CN=myserver.com') +
USERSRC(CHANNEL) CHCKCLNT(ASQMGR) ACTION(REPLACE)

------------------------------
Tim Zielke
------------------------------

Hi Tim,

Color me confused, but why would you compare a REPLACE action to a DELETE + CREATE and not just an ALTER when the object already exists?

The behavior of the REPLACE Action is define in the usage notes as follows (for distributed systems) see infocenter

REPLACEReplace the current configuration of a channel authentication record.For TYPE parameter options SSLPEERMAP, ADDRESSMAP, USERMAP and QMGRMAP, if the specified configuration exists, it is replaced with the new configuration. If it does not exist it is added.For TYPE parameter options BLOCKUSER and BLOCKADDR, the configuration specified replaces the current list, even if the current list is empty. If you replace the current list with an empty list, this acts like REMOVEALL.

As for the rest of your question, I would expect the action to be Atomic in the sense that it either works or gets rejected in its entirety.

I would also expect the REPLACE actions to be Stateless, which means that it can be repeated and does not rely on a specific state of the system (chlauth).

Thanks

F.J.

------------------------------
Francois Brandelik

Original Message:
Sent: Wed February 28, 2024 10:49 AM
From: Tim Zielke
Subject: Is REPLACE an Atomic Action?

When you do an IBM MQ resource change with the REPLACE option like the following, is the action atomic? Does anyone know? By atomic, I mean the REPLACE happens in a way where no other IBM MQ functionality (e.g. IBM MQ is doing a CHLAUTH check on a starting channel) would see the resource missing while the REPLACE action is under way. 

SET CHLAUTH('MY.CHANNEL') TYPE(SSLPEERMAP) +
SSLPEER('CN=myserver.com') +
USERSRC(CHANNEL) CHCKCLNT(ASQMGR) ACTION(REPLACE)

------------------------------
Tim Zielke
------------------------------

It is probably has more to do with semantics, but when I see the word REPLACE I tend to think of a remove and then add. I did check the manual again and found this doc that talks about the DEFINE REPLACE and ALTER being similar in function, which helps alleviate my initial concern.

https://www.ibm.com/docs/en/ibm-mq/9.2?topic=wlq-changing-local-queue-attributes-alter-qlocal-define-qlocal

"You can use the REPLACE attribute of either the ALTER and DEFINE command to replace an existing definition with the specified new definition. The difference between using ALTER and DEFINE is that ALTER with REPLACE does not change unspecified parameters, but DEFINE with REPLACE sets all the parameters."

It would make sense that REPLACE is an atomic function, or has some type of critical code section and locking to make sure that other parts of the queue manager are not trying to access the resource when it is being changed. If there is someone in the know that could confirm that, I would appreciate it.

Hi Tim,

Color me confused, but why would you compare a REPLACE action to a DELETE + CREATE and not just an ALTER when the object already exists?

The behavior of the REPLACE Action is define in the usage notes as follows (for distributed systems) see infocenter

REPLACEReplace the current configuration of a channel authentication record.For TYPE parameter options SSLPEERMAP, ADDRESSMAP, USERMAP and QMGRMAP, if the specified configuration exists, it is replaced with the new configuration. If it does not exist it is added.For TYPE parameter options BLOCKUSER and BLOCKADDR, the configuration specified replaces the current list, even if the current list is empty. If you replace the current list with an empty list, this acts like REMOVEALL.

As for the rest of your question, I would expect the action to be Atomic in the sense that it either works or gets rejected in its entirety.

I would also expect the REPLACE actions to be Stateless, which means that it can be repeated and does not rely on a specific state of the system (chlauth).

Thanks

F.J.

------------------------------
Francois Brandelik

Original Message:
Sent: Wed February 28, 2024 10:49 AM
From: Tim Zielke
Subject: Is REPLACE an Atomic Action?

When you do an IBM MQ resource change with the REPLACE option like the following, is the action atomic? Does anyone know? By atomic, I mean the REPLACE happens in a way where no other IBM MQ functionality (e.g. IBM MQ is doing a CHLAUTH check on a starting channel) would see the resource missing while the REPLACE action is under way. 

SET CHLAUTH('MY.CHANNEL') TYPE(SSLPEERMAP) +
SSLPEER('CN=myserver.com') +
USERSRC(CHANNEL) CHCKCLNT(ASQMGR) ACTION(REPLACE)

------------------------------
Tim Zielke
------------------------------

Unlike MQ objects (queues, namelists etc) which are atomically updated and controlled by the queue manager object layer, CHLAUTH records are stored as messages on the SYSTEM.CHLAUTH.DATA.QUEUE. Very like the cluster repository, CHLAUTH records are only backed by this queue, and are actually read/written to memory for general use. This memory is controlled by locking so that if an update is being done, none of the readers can be simultaneously viewing what could be partial data.

If your question is just an academic exercise, then there's your answer.

If you have suffered some behaviour that suggest that this is not working correctly, you should raise a case with IBM.

Cheers,
Morag

It is probably has more to do with semantics, but when I see the word REPLACE I tend to think of a remove and then add. I did check the manual again and found this doc that talks about the DEFINE REPLACE and ALTER being similar in function, which helps alleviate my initial concern.

https://www.ibm.com/docs/en/ibm-mq/9.2?topic=wlq-changing-local-queue-attributes-alter-qlocal-define-qlocal

"You can use the REPLACE attribute of either the ALTER and DEFINE command to replace an existing definition with the specified new definition. The difference between using ALTER and DEFINE is that ALTER with REPLACE does not change unspecified parameters, but DEFINE with REPLACE sets all the parameters."

It would make sense that REPLACE is an atomic function, or has some type of critical code section and locking to make sure that other parts of the queue manager are not trying to access the resource when it is being changed. If there is someone in the know that could confirm that, I would appreciate it.

Hi Tim,

Color me confused, but why would you compare a REPLACE action to a DELETE + CREATE and not just an ALTER when the object already exists?

The behavior of the REPLACE Action is define in the usage notes as follows (for distributed systems) see infocenter

REPLACEReplace the current configuration of a channel authentication record.For TYPE parameter options SSLPEERMAP, ADDRESSMAP, USERMAP and QMGRMAP, if the specified configuration exists, it is replaced with the new configuration. If it does not exist it is added.For TYPE parameter options BLOCKUSER and BLOCKADDR, the configuration specified replaces the current list, even if the current list is empty. If you replace the current list with an empty list, this acts like REMOVEALL.

As for the rest of your question, I would expect the action to be Atomic in the sense that it either works or gets rejected in its entirety.

I would also expect the REPLACE actions to be Stateless, which means that it can be repeated and does not rely on a specific state of the system (chlauth).

Thanks

F.J.

------------------------------
Francois Brandelik

Original Message:
Sent: Wed February 28, 2024 10:49 AM
From: Tim Zielke
Subject: Is REPLACE an Atomic Action?

When you do an IBM MQ resource change with the REPLACE option like the following, is the action atomic? Does anyone know? By atomic, I mean the REPLACE happens in a way where no other IBM MQ functionality (e.g. IBM MQ is doing a CHLAUTH check on a starting channel) would see the resource missing while the REPLACE action is under way. 

SET CHLAUTH('MY.CHANNEL') TYPE(SSLPEERMAP) +
SSLPEER('CN=myserver.com') +
USERSRC(CHANNEL) CHCKCLNT(ASQMGR) ACTION(REPLACE)

------------------------------
Tim Zielke
------------------------------