[Question] Permissions needed and behaviour of exporter

[paologallinaharbur]

Hello, first of all, thanks for building and maintaining this exporter! I have some questions regarding the Prometheus exporter permissions and, in general, how this component works.

• Is there a document going over the permissions required to run this exporter or use mqmetric package?
• I understand that the exporter needs to put messages to queues and therefore needs MQPUT for MQI calls. Is there any doc explaining which messages and why?
  • Do we need it "to put a message to SYSTEM.COMMAND.INPUT and open a model queue to get replies from." (https://github.com/ibm-messaging/mq-golang/issues/145)
• In a different issue they mention" temporary dynamic queues". Any particular permission is required to create them?
  • Are those related to non-durable subscriptions (model queues) and could be avoided with durable ones?

Thanks again for the help 😄

[ibmmqmet]

There's no specific document.

145 has detailed information from a z/OS perspective; on a different platform the settings are controlled differently. And the command queue has a different name. Mostly it's going to just require "DISPLAY" authority for the various object types. See https://www.ibm.com/docs/en/ibm-mq/9.3?topic=windows-authorizations-pcf-commands for more about authorisations.

Dynamic queues have no direct relationship to non-durable publications.

If you are not authorised to do something, then the queue manager will generate appropriate reports (error logs/events) so you can fix up the permissions.

[paologallinaharbur]

https://github.com/ibm-messaging/mq-metric-samples/pull/145 has detailed information from a z/OS perspective; on a different platform the settings are controlled differently. And the command queue has a different name. [...]

Have you linked the right issue? I only see a dependabot PR listing unrelated changes, unless I am missing something

Ok, to wrap up the answer is that it depends, but:

• usually it requires the DISPLAY.
• We can try to run it and if any additional permission is needed we can check related reports
• Regarding the MQI also it depends, but I understand that put -> MQPUT is required as well as get ->MQGET (with BROWSE), right?

Thanks again for your time and help!