MQ health check · Available now

A written health check of your MQ estate. No agent, no network access.

Send us exported logs and configuration. You get back a written findings report with a prioritised fix list in MQSC, then we walk through it with your team. It's a one-time, offline review, and the simplest way to find out what your estate is quietly building up to.

Why start here

The easiest first step for a security team to approve.

Nothing runs in your environment, so there's far less to review than for anything that connects to production.

01

No live agent

Nothing to install, nothing left running. You send files; we send a report.

02

No network access

We never connect to your queue managers. The exports are read-only display output and logs you collect yourself.

03

Identifiers can stay inside

Strip hostnames, queue managers, channels, queues and user IDs in your browser with the log analyser's sanitizer before sending. The report comes back in the same labels.

What you get

The report, section by section.

Risky depth trends, channels with repeated stops, dead-letter patterns, authority and configuration risks, z/OS structures, chronic problems, and a prioritised fix list with the MQSC to run. Below is a sample from a simulated estate, the same one you can click through in the live demo.

Download the sample report (PDF) ↓

Take it to your manager. Every name and number in it is demonstration data.

Sample Simulated estate (demonstration data). Not a customer's report.

MQ health check report

Demo bank · payments estate

Period 24 Sep to 23 Oct 2026 · exported 09:51 CDT

1act now
2act today
3chronic patterns
3queue managers reviewed
Prioritised fix list6 items, most urgent first. Every command is for your team to review and run; Abendly runs nothing.
Act now

1. PAYMENTS.INBOUND.QL QM_PAY01

Consumer payments-settle stalled at 09:42; depth 2,125 of 5,000 and rising 205 msgs/min at export. MAXDEPTH at about 10:05, 14 minutes later.

  1. MQSCDISPLAY CONN(*) TYPE(HANDLE) WHERE(OBJNAME EQ PAYMENTS.INBOUND.QL) read-onlyFind the stalled consumer
  2. AppRestart the consuming app payments-settle on payapp03 change, run by your teamApplication change, made by your team
  3. MQSCDISPLAY QLOCAL(PAYMENTS.INBOUND.QL) CURDEPTH read-onlyConfirm depth is falling
Today

2. ORDERS.OUTBOUND.QL QM_BANK01

The weekday-morning backlog for the 6th time in 30 days, steeper each time: 31,400 at export, rising 138 msgs/min, MAXDEPTH at about 12:05. Permanent fix: Run two orders-dispatch consumers all day (the queue already allows shared input), then confirm a weekday morning passes without the climb.

  1. MQSCDISPLAY QSTATUS(ORDERS.OUTBOUND.QL) TYPE(QUEUE) CURDEPTH IPPROCS MSGAGE read-onlyConfirm one consumer and the climb
  2. AppStart a second orders-dispatch instance change, run by your teamApplication change, made by your team (the queue allows shared input)
  3. MQSCDISPLAY QSTATUS(ORDERS.OUTBOUND.QL) TYPE(QUEUE) CURDEPTH IPPROCS read-onlyExpect IPPROCS(2) and depth falling
Today

3. SETLSTR1 QSG PSG1 · CF01

CF structure 54.3% used and projected full at about 20:40, before the 22:00 drain. Puts to SETTLE.SHARED.QL would then fail. Longer term: CSQI004I recommends indexing SETTLE.SHARED.QL by CORRELID so the nightly drain stops scanning past messages; plan that change with your z/OS team.

  1. MQSCDISPLAY CFSTATUS(SETLSTR1) TYPE(SUMMARY) read-onlyConfirm usage and entries in use
  2. z/OSD XCF,STR,STRNAME=PSG1SETLSTR1 read-onlyCheck current and maximum size in the CFRM policy
  3. z/OSSETXCF START,ALTER,STRNAME=PSG1SETLSTR1,SIZE=6291456 change, run by your teamExpand to 6 GB if the CFRM policy allows; run by your z/OS team
  4. MQSCDISPLAY CFSTATUS(SETLSTR1) TYPE(SUMMARY) read-onlyVerify the new size and usage
Planned fix

4. BANK.TO.CLEARING.SDR QM_BANK01

Stopped 3 times in 30 days when its security exit ended abnormally (last on 23 Oct, 03:14 to 03:22). Until now: START CHANNEL(BANK.TO.CLEARING.SDR) after each stop. Permanent fix: Raise the clrsecx failure with its vendor and move to a fixed exit level; until then the stops will recur.

  1. MQSCDISPLAY CHSTATUS(BANK.TO.CLEARING.SDR) read-onlyConfirm STATUS(STOPPED) and the substate
Planned fix

5. settlement-batch QM_PAY01

Rejected at connect with reason 2035 on 25 Sep and 23 Oct, both on credential-rotation nights. Permanent fix: Add the settlement-batch secret to the rotation runbook so it is deployed before the 02:45 batch.

  1. MQSCDISPLAY QMGR CONNAUTH read-onlyConfirm which AUTHINFO object applies
  2. MQSCDISPLAY AUTHINFO(SYSTEM.DEFAULT.AUTHINFO.IDPWOS) CHCKCLNT read-onlyConfirm CHCKCLNT(REQUIRED); do not relax it
Check

6. QM_PAY01 mqprd02

No dead-letter queue appears in this queue manager's export. Confirm DEADQ is set, so undeliverable messages are kept rather than blocking a channel.

  1. MQSCDISPLAY QMGR DEADQ read-onlyExpect the name of a defined dead-letter queue
Risky depth trends3 queues rising at export; two are on course for MAXDEPTH today.
QueueDepth / maxRateRunway
PAYMENTS.INBOUND.QLQM_PAY012,125 / 5,000+205/min14 min
ORDERS.OUTBOUND.QLQM_BANK0131,400 / 50,000+138/min2 h 14 min
SETTLE.SHARED.QLMQP1255,030 / CF-backed+330/minstructure full 20:40
PAYMENTS.INBOUND.QL: normal range shaded; the consumer's last get was at 09:42, and depth then rose 3.0× faster than its fastest normal rise.
Normal range at this time of day: 150 to 45001K2K3K4K5K09:0009:1509:3009:4510:00MAXDEPTH 5,00009:42 last getat this rate,full at 10:0508:51 · 29508:52 · 29508:53 · 29508:54 · 29408:55 · 29408:56 · 29308:57 · 29208:58 · 29108:59 · 28909:00 · 28809:01 · 28709:02 · 28609:03 · 28509:04 · 28409:05 · 28409:06 · 28409:07 · 28309:08 · 28309:09 · 28409:10 · 28409:11 · 28509:12 · 28609:13 · 28709:14 · 28809:15 · 28909:16 · 28909:17 · 29009:18 · 29109:19 · 29209:20 · 29209:21 · 28809:22 · 28409:23 · 27909:24 · 27509:25 · 27009:26 · 26609:27 · 26109:28 · 25709:29 · 25309:30 · 25009:31 · 25809:32 · 26709:33 · 27509:34 · 28309:35 · 29209:36 · 30009:37 · 29709:38 · 29309:39 · 29009:40 · 28709:41 · 28309:42 · 28009:43 · 48509:44 · 69009:45 · 89509:46 · 1,10009:47 · 1,30509:48 · 1,51009:49 · 1,71509:50 · 1,92009:51 · 2,1252,125 at 09:51

Scroll sideways for earlier data.

Show the numbers
PAYMENTS.INBOUND.QL depth by minute (every 5 min shown)
TimeDepth
08:51295
08:56293
09:01287
09:06284
09:11285
09:16289
09:21288
09:26266
09:31258
09:36300
09:41283
09:42280
09:461,100
09:512,125
10:055,000 (projected)
ORDERS.OUTBOUND.QL: peak depth on each weekday-morning backlog in 30 days. Each peak is higher than the last.
010K20K30K40K50KMAXDEPTH 50,00030 Sep: peak 18,20018.2K30 Sep7 Oct: peak 20,90020.9K7 Oct14 Oct: peak 22,70022.7K14 Oct16 Oct: peak 24,40024.4K16 Oct22 Oct: peak 27,10027.1K22 Oct23 Oct: 31,400 at 09:51 and still rising31.4K23 Octat 09:51,still rising

Scroll sideways for earlier data.

Show the numbers
ORDERS.OUTBOUND.QL peak depth per occurrence
DateDepth
30 Sep18,200 (peak)
7 Oct20,900 (peak)
14 Oct22,700 (peak)
16 Oct24,400 (peak)
22 Oct27,100 (peak)
23 Oct31,400 at 09:51, rising
Channels with repeated stops or retries9 channels in scope. One sender stopped 3 times in 30 days.

BANK.TO.CLEARING.SDR on QM_BANK01 stopped on 2 Oct, 11 Oct, 23 Oct. On 23 Oct: 03:14 RETRYING (AMQ9999E: channel ended abnormally; short retry 1 of 10); 03:14 STOPPED (Retry failed in the security exit; channel stopped); 03:22 RUNNING (START CHANNEL run by the on-call engineer). The sender channel's security exit (clrsecx) ended abnormally and the channel stopped. No network error came first, so the link to the clearing gateway was not the cause.

ChannelTypeStatus at exportSince
PAY.SVRCONNQM_PAY01SVRCONNRUNNING23 Oct 06:02
PAY.TO.BANKQM_PAY01SDRRUNNING22 Oct 05:58
PAY.TO.BANKQM_BANK01RCVRRUNNING22 Oct 05:58
BANK.TO.CLEARING.SDRQM_BANK01SDRRUNNING23 Oct 03:22
SETTLEMENT.OUT.SDRQM_BANK01SDRRUNNING22 Oct 06:00
CLEARING.TO.BANK.RCVRQM_BANK01RCVRINACTIVE (normal between returns)23 Oct 06:31
BANK.SVRCONNQM_BANK01SVRCONNRUNNING23 Oct 05:40
SETTLE.SVRCONNMQP1SVRCONNRUNNING23 Oct 00:05
CARDS.SVRCONNMQP1SVRCONNRUNNING22 Oct 04:50
Dead-letter and backout queuesEmpty at export. One queue manager has no dead-letter queue in its export.
QueueRoleDepth at export
PAYMENTS.BACKOUT.QLQM_PAY01Backout queue for poison messages0
SYSTEM.DEAD.LETTER.QUEUEQM_BANK01Dead-letter queue0
MQP1.DEAD.QUEUEMQP1Dead-letter queue0

QM_PAY01: no dead-letter queue in the export. If DEADQ is not set, a message that can't be delivered stops its channel instead of being set aside. See the fix list.

Authority and configurationConnection authentication is enforced where it should be; one application keeps missing credential rotations.
  • Keep: QM_PAY01 requires credentials from client connections (CONNAUTH with CHCKCLNT(REQUIRED)). Don't relax it to fix the batch failures below.
  • Recurring: settlement-batch was rejected with reason 2035 on 25 Sep and 23 Oct. The settlement-batch client connects through PAY.SVRCONN without credentials. QM_PAY01 requires them (CONNAUTH, CHCKCLNT(REQUIRED)), so every attempt fails with reason 2035 MQRC_NOT_AUTHORIZED.
  • Dependency: BANK.TO.CLEARING.SDR runs a third-party security exit (clrsecx); its failures caused every stop in the channel section.
z/OS: coupling facility structuresQueue-sharing group PSG1, coupling facility CF01. One structure fills before tonight's drain.
StructureSizeUsed at exportProjected
SETLSTR14 GB54.3%full at 20:40, before the 22:00 drain
APPLSTR11 GB38%under the 80% threshold
CSQSYSAPPL256 MB21%under the 80% threshold
CSQ_ADMIN64 MB9%under the 80% threshold

CSQI004I on MQP1, 22 Oct 23:12: The nightly SETLEOD job gets by correlation ID from a queue with no index, so each get scans past many messages and the drain runs slowly.

Chronic patterns3 problems recurred in 30 days. Each needs its permanent fix, not the temporary one again.

Weekday-morning backlog on ORDERS.OUTBOUND.QL

6 times: 30 Sep, 7 Oct, 14 Oct, 16 Oct, 22 Oct, 23 Oct (fingerprint FP-7Q2K).

Until now: Restart orders-dispatch, or start a second instance by hand, each morning it happens.

Permanent fix: Run two orders-dispatch consumers all day (the queue already allows shared input), then confirm a weekday morning passes without the climb.

Security exit failure stops BANK.TO.CLEARING.SDR

3 times: 2 Oct, 11 Oct, 23 Oct (fingerprint FP-3MX9).

Until now: START CHANNEL(BANK.TO.CLEARING.SDR) after each stop.

Permanent fix: Raise the clrsecx failure with its vendor and move to a fixed exit level; until then the stops will recur.

settlement-batch rejected after credential rotation

2 times: 25 Sep, 23 Oct (fingerprint FP-8D1C).

Until now: Deploy the new credential by hand after the batch fails.

Permanent fix: Add the settlement-batch secret to the rotation runbook so it is deployed before the 02:45 batch.

Scope, method and limitsWhat was analysed, and what this report can and cannot tell you.
  • Scope: QM_PAY01 (Linux (RHEL 9), MQ 9.3.0.15); QM_BANK01 (Linux (RHEL 9), MQ 9.3.0.15); MQP1 (z/OS, QSG PSG1, MQ 9.3.0). 14 queues, 9 channels.
  • Inputs: error logs, MQ event messages, queue and channel status, configuration display output and CF structure usage for 24 Sep to 23 Oct 2026, exported at 09:51 CDT.
  • Read-only: the analysis works from your exports. Nothing connects to your queue managers, and every command in this report is for your team to review and run.
  • Identifiers: if you strip identifiers before sending, the report uses the same labels (for example [QUEUE_1]) and your label map translates them back.
  • This sample: a simulated estate. The queue managers, queues, applications and numbers are demonstration data, the same estate as the live demo console.
BridgeIf your report shows problems that were building for hours or weeks before anyone noticed, that's exactly what the monitoring agent watches for, continuously. See it catch one in the live demo, or point it at one queue manager.
How it works

Export, analyse, report, review.

You stay in control of what leaves your network at every step.

  1. Scope

    A short call to agree the queue managers in scope, what to export and the report date. You get a fixed quote.

  2. Export

    You collect error logs and read-only display output, and strip identifiers if you want to.

  3. Analyse

    We analyse the exports with the Abendly engine, the same one behind the log analyser. No access to your systems.

  4. Report

    A written findings report with a prioritised fix list in MQSC, on the date agreed at scoping.

  5. Review call

    We walk your team through the findings. The fixes are yours to schedule and run.

What we'll ask for

Read-only exports you already know how to produce.

We send the exact list after scoping. It usually looks like this.

Distributed queue managers

  • Error logs for the period: AMQERR01.LOG to AMQERR03.LOG, and any FDC files
  • DISPLAY QMGR ALL, DISPLAY QLOCAL(*) ALL
  • DISPLAY CHANNEL(*) ALL, DISPLAY CHSTATUS(*) ALL
  • DISPLAY QSTATUS(*) TYPE(QUEUE) ALL
  • DISPLAY AUTHINFO(*) ALL, DISPLAY CHLAUTH(*) ALL

z/OS queue managers

  • Queue manager and channel initiator job logs, with CSQ console messages
  • The same DISPLAY output as distributed, per queue manager
  • DISPLAY CFSTATUS(*) TYPE(SUMMARY) for queue-sharing groups
  • Optional: messages from SYSTEM.ADMIN.*.EVENT queues, if you collect them
Read-onlyEvery command above only displays. Nothing in the health check changes your estate, and Abendly never runs anything: the fix list is for your engineers to review and run.
Pricing

A fixed quote before any work starts.

The health check is quoted after the scoping call, based on how much of the estate is in scope: the number of queue managers and whether z/OS is included. There's no public price list because two estates are rarely the same job. How Abendly is priced

Book a health check

Tell us about the estate.

We'll reply within one business day to set up the scoping call.

  • A short scoping call and a fixed quote
  • Read-only exports; identifiers can be stripped first
  • A written report and a review call with your team

We use these details only to reply about your health check. No marketing list. Privacy policy

Questions

Asked plainly.

Do you need access to our queue managers?
No. The health check works only from exports you send. Nothing is installed in your environment and nothing connects to your queue managers.
What if we can't send hostnames or queue manager names?
Strip them first. The log analyser's in-browser sanitizer replaces hostnames, queue managers, channels, queues and user IDs with stable labels before anything leaves your network. The report comes back in the same labels and your label map translates them back.
How is the health check priced?
It is quoted after a short scoping call, based on the estate in scope. You get a fixed quote before any work starts.
What happens after the report?
We walk through the findings with your team on a review call. The fixes are yours to schedule and run; Abendly runs nothing. If you want the same analysis running continuously, the monitoring agent is available as a design-partner pilot.