APF authorize the IBM MQ load libraries

APF-authorize various libraries. Some load modules might already be authorized.

  • We need to perform this task once for each z/OS system where we want to run IBM MQ .
  • If we are using queue sharing groups, we must ensure that the settings for IBM MQ are identical on each z/OS system in the sysplex.
  • We might need to perform this task when migrating from a previous version.
  • Use of Library Look aside (LLA):

    • Some IBM MQ usage can cause high Input/Output (IO) to load modules from libraries. This IO can be reduced by using the LLA facility of the operating system.
    • This high IO can occur during:

      • Applications with a high MQCONN/MQDISC rate, for example in a WLM stored procedure.
      • Loading channel exits. If we have channels that start and stop frequently, and use channel exits.

    • The member CSVLLAxx in SYS1.PARMLIB specifies the LLA setup. The inclusion of a library name in the LIBRARIES statement means that a program copy will always be taken from VLF(Virtual Lookaside Facility) and hence will not usually require I/O when heavily used.

      Inclusion in the FREEZE statement means that there is no I/O to get the relevant DD statement concatenation directories (this can often be more I/O than the program load itself ).

      Use the operating system command “ F LLA,REFRESH” after any changes to any of these libraries.

The IBM MQ load libraries thlqual.SCSQAUTH and thlqual.SCSQLINK must be APF-authorized. We must also APF-authorize the libraries for the national language feature (thlqual.SCSQANLx and thlqual.SCSQSNLx) and for the distributed queuing feature (thlqual.SCSQMVR1). If we are using Advanced Message Security we must also APF authorize the library thlqual.SDRQAUTH.

However, all load modules in the LPA are automatically APF-authorized. So are all members of the link list if the SYS1.PARMLIB member IEASYSpp contains the statement: 
LNKAUTH=LNKLST

LNKAUTH=LNKLST is the default if LNKAUTH is not specified.

Depending on what you choose to put in the LPA or linklist (see Update the z/OS link list and LPA ), you might not need to put the libraries in the APF link list

Note: We must APF-authorize all the libraries that we include in the IBM MQ STEPLIB. If you put a library that is not APF-authorized in the STEPLIB, the whole library concatenation loses its APF authorization.

The APF lists are in the SYS1.PARMLIB member PROGxx or IEAAPFaa. The lists contain the names of APF authorized z/OS libraries. The order of the entries in the lists is not significant. See the MVS Initialization and Tuning Reference manual for information about APF lists.

For more information about tuning the system, see SupportPac MP16

If we use PROGxx members with dynamic format, we need only issue the z/OS command SETPROG APF,ADD,DSNAME=hlq.SCSQ XXXX,VOLUME= YYYYYY for the changes to take effect: Where XXXX varies by the library name and where YYYYY is the volume. Otherwise, if we use static format or IEAAPFaa members, we must perform an IPL on your system.

Note that we must use the actual name of the library in the APF list. If you attempt to use the data set alias of the library, authorization fails.

Parent topic: Configure the z/OS system for IBM MQ


Related concepts