Why am I getting an error connecting to WebSphere MQ via JMS Messaging Modular Input?

[jgbricker]

I'm attempting to connect to a WebSphere MQ queue via a standalone Splunk Enterprise 6.3.1 server with the JMS Messaging Modular Input add-on version 1.5. I have followed the http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/ post.

Error:

02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/TEST.DVL.EIL.EEH.SPLUNK.TEST : Error connecting : javax.naming.No
InitialContextException: Cannot instantiate class: com.sun.jndi.fscontext.RefFSContextFactory [Root exception is java.lang.ClassNotFoundException: com.sun.jndi.fscontext.RefFSContextFactory]
02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:674)
02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)
02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.init(InitialContext.java:242)
02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.(InitialContext.java:216)
02-02-2016 08:37:03.256 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown So
urce)

Here is my jms_ta/bin/lib: (contains defaults plus websphere mq client jar files)

com.ibm.mq.commonservices.jar  com.ibm.mq.jmqi.jar  commons-codec-1.9.jar    httpasyncclient-4.1.jar        httpclient-cache-4.4.1.jar  jms.jar          log4j-1.2.16.jar
com.ibm.mq.headers.jar         com.ibm.mqjms.jar    commons-logging-1.2.jar  httpasyncclient-cache-4.1.jar  httpcore-4.4.1.jar          jmsmodinput.jar  splunk_tlsv12.jar
com.ibm.mq.jar                 com.ibm.mq.pcf.jar   connector.jar            httpclient-4.4.1.jar           httpcore-nio-4.4.1.jar      json.jar

Here is my jms_ta/local/inputs.conf

[jms://queue/TEST.DVL.EIL.EEH.SPLUNK.TEST]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = DEVSplunkCF
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/opt/splunk/etc/apps/jms_ta/local/
sourcetype = mq
strip_newlines = 1
browse_frequency = -1
disabled = 0

The .bindings file is in the local folder:

[splunk@tstsplunk01 jms_ta]$ ls -al local
total 32
drwxrwxr-x 2 splunk splunk  4096 Feb  2 08:25 .
drwxrwxr-x 8 splunk splunk  4096 Feb  2 08:32 ..
-rwxrwxr-x 1 splunk splunk 19151 Jan 13 15:58 .bindings
-rwxrwxr-x 1 splunk splunk   456 Feb  2 08:25 inputs.conf

Any assistance is much appreciated!

[jgbricker · Accepted solution]

Added Jar files for IBM WebSphere Client Connection to $SPLUNK_HOME/etc/apps/jms_ta/bin/lib. To correct errors related to MQ client connection.

[jgbricker]

It was a while ago but try downloading the appropriate MQ client and look through the files it gives you for the jars. Try this link https://m.ibm.com/https/www-01.ibm.com/software/integration/wmq/clients/

[butzowj]

Hi!

Can you point out where you got the jar files from?

Thanks!

[jgbricker]

I obtained the fscontext.jar and added it to the bin/lib folder, then restarted Splunk. Based on the error it appears I'm missing another Jar file. I'm trying to find a download that would give me all the relevant jar files. Any know if there is like a jndi kit i can get from oracle downloads? A link or the click pattern to get to the download would be excellent.

Error:

02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/TEST.DVL.EIL.EEH.SPLUNK.TEST : Error connecting : java.lang.NoCla
ssDefFoundError: com/sun/jndi/toolkit/chars/CharacterDecoder
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.sun.jndi.fscontext.RefFSContextFactory.createContext(RefFSContextFacto
ry.java:42)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.sun.jndi.fscontext.RefFSContextFactory.createContextAux(RefFSContextFa
ctory.java:47)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.sun.jndi.fscontext.FSContextFactory.getInitialContext(FSContextFactory
.java:49)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.init(InitialContext.java:242)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.(InitialContext.java:216)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown So
urce)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source
)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: java.lang.ClassNotFoundException: com.sun.jndi.toolkit.chars.CharacterDec
oder
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.security.AccessController.doPrivileged(Native Method)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
02-03-2016 11:09:20.457 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        ... 9 more

[Murali2888]

Are you sure you have the required jar files? A quick search shows that the fscontext.jar is required.
Can you try adding that?

[jgbricker]

any idea where I would obtain that jar file?