Sending MQ-client log-messages to Splunk

[UnitedMarsupials]

Our company uses Splunk to aggregate log-messages from (almost) all applications enterprise-wide. This includes our Java-applications, which use log4j -- and the Splunk-provided classes for forwarding events directly to Splunk-servers.

This works except, when our code calls into MQ client-classes (com.ibm.mq.allclient-9.3.1.0.jar). The MQ-code, apparently, uses some other logging framework of its own, resulting in mqjms.log.0 and similar files.

This brings me here with these questions:

• Can MQ client-code be configured to use an alternative logging-framework (such as log4j)?
• If not, can MQ logging-framework be configured to forward messages directly to Splunk on its own?
• If not, can MQ logging-framework be extended (by providing a new Java-class) to allow targeting a custom logging-destination?

At this time I'm unable to find answers to these questions among the documents in this repository. (Also, the ServerFault question remains unanswered.)

[stmassey]

There is no built in support for Splunk in the MQ Classes for JMS. I think you will need to use either of the techniques suggested at the ServerFault question:

1) Use a forwarder on the mqjms.log.0 (If you want to alter the format before that data is ingested, then you will need to write some code to condense the output into your desired format before ingestion).

2) Redirect jms log to system.out/err and redirect that using custom code for splunk to receive.

[UnitedMarsupials]

Thank you for the quick response, @stmassey.

There is no built in support for Splunk in the MQ Classes for JMS

Perhaps, there are provisions for extending whatever logging framework (homegrown?) the client is using? Such as by providing a custom class, that implements a documented interface (the com.ibm.msg.client.commonservices.provider.log.CSPLog)?

Asking because the "allclient" JAR-file has entries like: com/ibm/msg/client/commonservices/j2se/log/DefaultLogger.class, which implies, there may be an alternative -- non-default -- logger too. How would I provide one?

[stmassey]

The DefaultLogger uses an instance of java.util.logging. There is no provision for providing your own implementation.