MQSC commands and the system command input queue on z/OS

Use this topic to understand how the command server processes MQSC commands directed to the system command input queue on z/OS .

Command security and command resource security are also used when the command server retrieves a message containing an MQSC command from the system command input queue. The user ID that is used for the authority checks is the one found in the UserIdentifier field in the message descriptor of the message containing the MQSC command. This user ID must have the required authorities on the queue manager where the command is processed. See Message context.

Messages containing MQSC commands are sent to the system command input queue in the following circumstances:

  • The operations and control panels send MQSC commands to the system command input queue of the target queue manager. The MQSC commands correspond to the actions you choose on the panels. The UserIdentifier field in each message is set to the TSO user ID of the administrator.
  • The COMMAND function of the IBM MQ utility program, CSQUTIL, sends the MQSC commands in the input data set to the system command input queue of the target queue manager. The COPY and EMPTY functions send DISPLAY QUEUE and DISPLAY STGCLASS commands. The UserIdentifier field in each message is set to the job user ID.
  • The MQSC commands in the CSQINPX data sets are sent to the system command input queue of the queue manager to which the channel initiator is connected. The UserIdentifier field in each message is set to the channel initiator address space user ID.

    No authority checks are performed when MQSC commands are issued from the CSQINP1 and CSQINP2 data sets. We can control who is allowed to update these data sets using RACF data set protection.

  • Within a queue sharing group, a channel initiator might send START CHANNEL commands to the system command input queue of the queue manager to which it is connected. A command is sent when an outbound channel that uses a shared transmission queue is started by triggering. The UserIdentifier field in each message is set to the channel initiator address space user ID.
  • An application can send MQSC commands to a system command input queue. By default, the UserIdentifier field in each message is set to the user ID associated with the application.
  • On UNIX, Linux, and Windows systems, the runmqsc control command can be used in indirect mode to send MQSC commands to the system command input queue of a queue manager on z/OS. The UserIdentifier field in each message is set to the user ID of the administrator who issued the runmqsc command.

Parent topic: Authority to administer IBM MQ on z/OS