STIGQter: STIG Summary: IBM MQ Appliance V9.0 AS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The MQ Appliance messaging server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.

DISA Rule

SV-89557r1_rule

Vulnerability Number

V-74883

Group Title

SRG-APP-000108-AS-000067

Rule Version

MQMH-AS-000610

Severity

CAT II

CCI(s)

• CCI-000139 - The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.
• CCI-001858 - The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.

Weight

10

Fix Recommendation

For each queue manager on the MQ Appliance, enable performance (PERFMEV) event logging.

From the MQ Appliance CLI, enter the following:

runmqsc [queue mgr name]
ALTER QMGR PERFMEV(ENABLED)
ALTER QLOCAL(SYSTEM.ADMIN.PERFM.EVENT) QDPHIEV(ENABLED)

Monitor the logs that send alerts based on the following failure codes:
MQRC_Q_FULL, MQRC_Q_MGR_NOT_ACTIVE, MQRC_Q_DEPTH_HIGH.

Check Contents

For each queue manager on the MQ Appliance for which performance events logging should be enabled, establish an SSH command line session as an admin user.

To access the MQ Appliance CLI, enter:
mqcli

To identify the queue managers, enter:
dspmq

To run the "runmqsc [queue mgr name]" command for each running queue manager identified, enter:
runmqsc [queue mgr name]
DIS QMGR PERFMEV
DIS QLOCAL(SYSTEM.ADMIN.PERFM.EVENT) QDPHIEV
end

If "QDPHIEV" or "PERFMEV" is not "ENABLED", this is a finding.

Ask the system administrator to demonstrate how they monitor an alert on MQ failure events.

Verify alarming is set for the following log events:
MQRC_Q_FULL, MQRC_Q_MGR_NOT_ACTIVE, MQRC_Q_DEPTH_HIGH

If the system admin does not monitor an alarm for the following error codes: MQRC_Q_FULL, MQRC_Q_MGR_NOT_ACTIVE, or MQRC_Q_DEPTH_HIGH, this is a finding.

Vulnerability Number

V-74883

Documentable

False

Rule Version

MQMH-AS-000610

Severity Override Guidance

For each queue manager on the MQ Appliance for which performance events logging should be enabled, establish an SSH command line session as an admin user.

To access the MQ Appliance CLI, enter:
mqcli

To identify the queue managers, enter:
dspmq

To run the "runmqsc [queue mgr name]" command for each running queue manager identified, enter:
runmqsc [queue mgr name]
DIS QMGR PERFMEV
DIS QLOCAL(SYSTEM.ADMIN.PERFM.EVENT) QDPHIEV
end

If "QDPHIEV" or "PERFMEV" is not "ENABLED", this is a finding.

Ask the system administrator to demonstrate how they monitor an alert on MQ failure events.

Verify alarming is set for the following log events:
MQRC_Q_FULL, MQRC_Q_MGR_NOT_ACTIVE, MQRC_Q_DEPTH_HIGH

If the system admin does not monitor an alarm for the following error codes: MQRC_Q_FULL, MQRC_Q_MGR_NOT_ACTIVE, or MQRC_Q_DEPTH_HIGH, this is a finding.

Check Content Reference

M

Target Key

3239

Comments