Auditing
Audit records of operations performed in the IBM MQ Console and REST API can be produced by enabling queue manager command and configuration events, and on UNIX, Linux, and Windows significant state changes are recorded in the log files of the mqweb server.
Significant state changes
On UNIX, Linux, and Windows, the IBM MQ Console records significant state changes as messages in the logs of the mqweb server. Each message indicates the authenticated principal name that requested the operation.
Significant state changes, such as when queue managers are created, started, ended, or deleted, are logged in the mqweb server messages.log and console.log files at the [AUDIT] logging level. Each log entry indicates the authenticated principal name that requested the operation.
The messages.log and console.log files can be found in the following location:
- On UNIX, Linux, and Windows: MQ_DATA_PATH\web\installations\installationName\servers\mqweb\logs
For more information about configuring the mqweb server logging levels, see Configure logging.
Command and configuration events
We can optionally enable command and configuration events on the queue manager to provide information about most IBM MQ Console and REST API activity. For example, the creation of channels, and the inquiry of queues generate command and configuration events. For more information about enabling command and configuration events, see Control configuration, command and logger events.
For these command and configuration event messages, the MQIACF_EVENT_ORIGIN field is set to MQEVO_REST and the MQCACF_EVENT_APPL_IDENTITY field reports the first 32 characters of the authenticated principal name. If a user has the MQWebAdmin or MQWebAdminRO role, the MQCACF_EVENT_USER_ID field reports the mqweb server user ID, not the user name of the principal that issued the command. However, if the user has the MQWebUser role, the MQCACF_EVENT_USER_ID reports the user name of the principal that issued the command.
Parent topic: IBM MQ Console and REST API security
Related concepts