Auditing

On UNIX, Linux , and Windows, the IBM MQ Console records significant state changes as messages in the logs of the mqweb server. Each message indicates the authenticated principal name that requested the operation.

Significant state changes, such as when queue managers are created, started, ended, or deleted, are logged in the mqweb server messages.log and console.log files at the [AUDIT] logging level. Each log entry indicates the authenticated principal name that requested the operation.

The messages.log and console.log files can be found in the following location:

• On UNIX, Linux, and Windows: MQ_DATA_DIRECTORY\web\installations\installationName\servers\mqweb\logs

For more information about configuring the logging levels, see Configure logging.

We can optionally enable command and configuration events to provide information about most IBM MQ Console activity. For example, the creation of channels, and the inquiry of queues generate command and configuration events. For more information about enabling command and configuration events, see Controlling configuration, command and logger events. For these command and configuration event messages, the MQIACF_EVENT_ORIGIN field is set to MQEVO_REST and the MQCACF_EVENT_APPL_IDENTITY field reports the first 32 characters of the authenticated principal name. If a user has the MQWebAdmin or MQWebAdminRO role, the MQCACF_EVENT_USER_ID field reports the user name of the principal that started the web server, not the user name of the principal that issued the command. However, if the user has the MQWebUser role, the MQCACF_EVENT_USER_ID reports the user name of the principal that issued the command.