SSL CIPH error messages every 10 mins for IIB10 agent

Products

• DX Application Performance Management
• DX APM SaaS

Issue/Introduction

We currently have an IIB10 agent connected to an MQ queue manager and reporting metrics/statistics. The connection from the agent to the queue manager is secured by SSL using the TLS_RSA_WITH_AES_256_CBC_SHA256 cipher.

Everything seems to work fine, but every 10 minutes we see the following error appearing in the DX-APM logs:

1/20/22 01:52:42 PM GMT [WARN] [IntroscopeAgent.iib-ia] Incorrect cipherSpec
1/20/22 01:52:42 PM GMT [WARN] [IntroscopeAgent.iib-ia] MBStatisticsCleanup.getQueueDepth MQException error occured.Will try again after a interval.

this is accompanied by a corresponding error in the MQ logs:

20/01/22 12:17:57 - Process(31240.52709) User(mqm) Program(amqrmppa)
                    Host(myhost) Installation(<Installation1>)
                    VRMF(9.1.0.7) QMgr(<MYQUEUE>)
                    Time(2022-01-20T12:17:57.636Z)
                    RemoteHost(##.##.##.##)
                    CommentInsert1(<INTROSCOPE.SVR>)
                    CommentInsert2(myhost (##.##.##.##))

AMQ9639E: Remote channel '<INTROSCOPE.SVR>' did not specify a CipherSpec.

EXPLANATION:
Remote channel '<INTROSCOPE.SVR>' did not specify a CipherSpec when the local
channel expected one to be specified.

The remote host is 'myhost (##.##.##.##)'.

The channel did not start.
ACTION:
Change the remote channel '<INTROSCOPE.SVR>' on host 'myhost (##.##.##.##)'
to specify a CipherSpec so that both ends of the channel have matching
CipherSpecs.

The MQ channels all seem to start up for the agent for both the MQ and IIB DX APM agents.

Environment

• Release: 21.x, 20.x
• Component: Introscope

Resolution

Problem was resolved by setting the following property in the IIB extension bundle.properties

introscope.agent.iib.profiles.jms.connection.ssl.cipherspec=SSL_RSA_WITH_AES_256_CBC_SHA256

this is inconsistent with the MQ agent properties which uses the following format

introscope.agent.mq.monitor.profiles.CHANNELNAME.channel.ssl.cipherspec=TLS_RSA_WITH_AES_256_CBC_SHA256

The inconsistency will be addressed in a later release and both will the TLS format