This presentation covers all of the new features available on MQ for z/OS 9.2. Including zHyperWrite, data set encryption, AMS enhancements, simplified migration, and more!

1. What’s new with IBM MQ for z/OS
Sept 2020
Matt Leming: Architect, IBM MQ for z/OS
lemingma@uk.ibm.com
© 2020 IBM Corporation 1

2. On-premise, software
and the MQ Appliance
Run MQ yourself in
public or private clouds
Let IBM host MQ for
you with its managed
SaaS MQ service in
public clouds,
IBM Cloud and AWS
Run IBM MQ in any
location or cloud,
exactly as you
need it
© 2020 IBM Corporation 2
Kubernetes
AWS
Linux
Windows Solaris
AIX
IBMi
IBM Z
Appliance
zLinuxHPE NonStop
Azure
AWS
IBM Cloud Private

3. Mix and Match
Both are available under
the same license.
Both can interoperate, just
like any previous version
of MQ.
Continuous Delivery
New CD versions of MQ
are released
approximately every four
months, incrementally
introducing new product
capabilities.
Intended for those that can
continually integrate.
Long Term Support
Approximately every two
years a new LTS version is
released, rolling up many
of the CD capabilities into
a release with 5+3 support
attached.
Required by those looking
for fixed function.
In 2016 MQ introduced
a dual Long Term
Support and a
Continuous Delivery
model.
IBM MQ: long term support and continuous delivery
All the function delivered in the 9.1.x CD releases is available in the
long term support release V9.2 LTS
V9.0.3 CD V9.0.4 CD V9.0.5 CD
2019 2020
V9.1 LTS V9.1.1 CD V9.1.2 CD V9.1.3 CD
3
V9.1.4 CD V9.1.5 CD V9.2 LTS …
NEW
© 2020 IBM Corporation

4. MQ since 9.1 …
4
Uniform Cluster
automatic
application
rebalancing
Automatic TLS
CipherSpec
negotiation
Client
connectivity
with zCEE
Microsoft .NET
Core support
Developer
toolkit for
MacOS
Enhanced
Salesforce
Bridge
Full JSON-
syntax REST
administration
Permitted TLS
CipherSpec
control
REST messaging
performance
enhancements
JSON format
CCDT
MQ Appliance
HA event
notifications
WebSphere
Liberty MDB
pause
ini file and
MQSC injection
at startup
Escalating
queue manager
ending
MQFT REST list
resource
monitors
New consistent
MQ samples
New application
status checking
Channel
enabled AMS
policies for
z/OS
Browse
messages
using REST
Build toolkit for
zCEE
Idempotent
MQSC
commands
Rapid Uniform
Cluster
rebalancing
Improved
distributed
queue manager
restart times
Stream MQ
Appliance error
logs
Enhanced
Blockchain
Bridge
MFT REST
create file
transfer
FTP server
support on IBM
I for MFT
Highly available
MFT Agent
deployments
Automatic
Uniform Cluster
configuration
Packaged MQ
Internet
Passthru (IPT)
XA support in
Liberty for
decoupled JMS
connections
z/OS data set
encryption
support
MQ Appliance
admin activity
audit logging
Expanding
TLS 1.3
support
User controlled
application
naming
High speed
transfer over
long distances
with Fasp.io
Full HA-DR-HA
replicated data
queue manager
deployments
Increased queue
size support for
Distributed
New improved
Web Console
Distributed
queue size
control
Uniform Cluster
application
monitoring
Publish
messages over
REST
Java 11
application
support
.NET project
templates
Improved
MQIPT
management
Qpid JMS
shared
subscriptions
MQ Appliance
certificate
expiry
notifications
AMS HSM with
Oracle JRE
Simpler z/OS
backwards
migration
Simplified z/OS
installation of
MFT and CD
© 2020 IBM Corporation

5. MQ on z/OS

6. Optimize by exploiting zHyperWrite
Many customers use Metro Mirror (Synchronous
PPRC) with MQ to mirror their datasets
This protects against storage subsystem failure, and
can be part of an HA/DR strategy
Mirroring has a performance impact, even at zero
distance because the write from MQ doesn’t complete
until the writes to both primary and secondary
complete, and these happen in series
© 2019 IBM Corporation

7. zHyperWrite was introduced to minimize the
performance impact of Metro Mirror
Collaboration between DS8K and DFSMS, originally
done for Db2
With zHyperWrite the writes to primary and secondary
are issued in parallel at the DFSMS level, meaning
the write can complete earlier
If a zHyperWrite write fails then it falls-back
transparently to Metro Mirror
In 9.1.2 MQ added support for zHyperWrite for active
log datasets
Optimize by exploiting zHyperWrite
© 2019 IBM Corporation

8. © 2020 IBM Corporation8
Advanced Message Security
End-to-end message encryption is now even
easier to adopt, thanks to ever improving
performance
MQ 9.0 LTS started to drive down the overhead of
AMS with the introduction of the confidentiality
policy
MQ 9.0.1 CD was the point that all platforms
benefitted fully from those improvements
AMS on z/OS can now be as efficient as TLS just
on the channels

9. © 2020 IBM Corporation9
Advanced Message Security
End-to-end application-to-application encryption
may give you the highest level of security, but it’s
not always possible to use. For example, where
the applications are not AMS enabled or where the
originators or recipients of the messages are
outside of your domain
encrypted
Application to application
App App

10. © 2020 IBM Corporation10
Advanced Message Security
End-to-end application-to-application encryption
may give you the highest level of security, but it’s
not always possible to use. For example, where
the applications are not AMS enabled or where the
originators or recipients of the messages are
outside of your domain
MQ on Distributed has always had client level
interception to apply AMS policies once messages
reach or leave their first queue manager
encrypted
Queue manager entry
App App

11. © 2020 IBM Corporation11
Advanced Message Security
End-to-end application-to-application encryption
may give you the highest level of security, but it’s
not always possible to use. For example, where
the applications are not AMS enabled or where the
originators or recipients of the messages are
outside of your domain
MQ on Distributed has always had client level
interception to apply AMS policies once messages
reach or leave their first queue manager
MQ 9.1.3 on z/OS added the ability to apply those
policies at a queue manager-to-queue manager
boundary. This enables the use of AMS within one
domain without affecting another
encrypted
Organizational boundary
App App
ASPOLICY
REMOVE
New sender and receiver channel property,
SPLPROT controls the use of AMS policies for
inbound and outbound messages

12. 12
© 2019 IBM Corporation
MQ support for data set encryption
In 2017 z/OS added support for policy based data set
encryption in z/OS 2.2 and later
Until now this could only be used for the following MQ data
sets:
-BSDS
-CSQINP*
-Archive logs
9.1.4 adds support for active logs and page sets
9.1.5 add SMDS
Policies can’t be applied to existing data sets. Migration of
existing data is performed by doing a copy of the data into a
new data set which has an encryption policy attached
All members of a QSG must be at 9.1.4 if log encryption is
used and at 9.1.5 if SMDS encryption is used
BSDS Archives CSQINP*V*
V9.1.4 Page sets Active logs
SMDSV9.1.5

13. 13
Data set encryption: what about AMS?
AMS and data set encryption are complementary
technologies. For some scenarios dataset
encryption will be enough, for others AMS, or AMS
plus dataset encryption will be needed
© 2019 IBM Corporation
Application B
Application A
Channels
IBM MQ system
Queue Manager
Queue Manager
TLS Dataset
encryption
CF
Encryptio
n
AMS
Protected on the
network
Protected on
disk
Protected in
qmgr/chinit
memory
Protected in CF
Protected end to
end
Transparent to
***
NB: AMS is more efficient than data set encryption
but can be more complicated to configure

14. z/OS Container Extensions
New with z/OS 2.4, zCX allows you to run zLinux
applications in a Docker container directly on a z/OS
LPAR
Application developers can develop, and data
centers can operate, popular open source
packages, Linux applications, IBM software, and
third-party software together with z/OS applications
and data
Can run on zIIP, no need for IFL
Can exploit fast in memory network
Some interesting MQ options:
• Client concentrator
• Cluster full repository
http://www.redbooks.ibm.com/abstracts/sg248457.html
z/OS LPAR
zCX
MQ on zLinux
MQ on z/OS
MQ on z/OS
App
App
App
App
App
App Sender
receiver
channels
In memory
network
MQ running as client concentrator in zCX

15. CICS
IMS
DB2
MQ
…
z/OS
Connect
EE
Expose RESTful APIs to z Systems without writing any code.
z/OS Connect EE provides a single, RESTful entry point to your z systems assets and data
Enables reuse of existing assets, exposing them to environments where it is natural to use REST
Those new consumers do not need to understand or be aware of the specifics of the subsystems
No changes to subsystems required, all handled via configuration
Service Providers
© 2019 IBM Corporation

16. z/OS Connect EE update
In 2019 we moved the MQ service provider to be
part of z/OS Connect EE and added support or the
build toolkit
Now we have delivered support for MQ into the
z/OS Connect EE API toolkit
This allows much more powerful data transformation
support and removes the limitation of a 32KB max
message size
See:
https://www.ibm.com/support/knowledgecenter/SS4
SVW_3.0.0/scenarios/mq_sample.html
16
© 2019 IBM Corporation

17. Backwards migration changes
MQ on z/OS supports backwards migration to an
earlier release IF
• The queue manager was previously forwards
migrated from that release
• The earlier release is LTS
• The current release is LTS
• The earlier release has the migration and
coexistence PTFs applied
While this approach works, it is not perfect:
• Creation of the PTFs doesn’t typically start until
after the LTS ships
• The PTFs take some time to make it into an
RSU delaying customer’s ability to quickly pick
up an LTS
• Makes it harder for IBM to validate migration
code during development
17
© 2019 IBM Corporation
9.0.0 9.2.0
9.1.0 9.2.0
9.0.5 9.2.0

18. Backwards migration changes
From 9.2.0 we will no longer provide backwards
migration PTFs
Instead if a queue manager running at 9.2.0 needs
to be backwards migrated, and meets the necessary
criteria, the following command is run at 9.2.0
START QMGR BACKMIG(9.1.0)
This starts the queue manager up, performs the
necessary migration, and shuts the queue manager
down again
The queue manager can then be started up at the
earlier release
For 9.2.0 backwards migration will be supported to
9.0.0 and 9.1.0. Version 8.0.0 will not be supported
18
© 2019 IBM Corporation
9.0.0 9.2.0
9.1.0 9.2.0
9.0.5 9.2.0

19. MFT FMID installation changes
Over the last few CD releases we have been
simplifying the MQ on z/OS installation experience:
• No AMS enablement module
• No VUE enablement module
Currently MFT has its own set of SMP/E installation
scripts
In 9.2.0 the MFT FMID will be part of the base MQ
for z/OS installation media further simplifying the
installation process
MFT FMID should only be installed if entitled to:
• MQ Advanced
• MQ Advanced VUE
• MQ MFT (existing customers only)
Installation of the Connector Pack is still separate
19
© 2019 IBM Corporation
IBM MQ Advanced
Message Security for
z/OS
IBM MQ for z/OS
Connector Pack
IBM MQ Managed
File Transfer for z/OS

20. CD FMID changes
Currently there are a separate set of FMIDs for CD
and LTS releases.
The CD FMIDs are tied to a specific version and
release
Customers on the CD stream can either reinstall
each CD release from fresh or jump from release to
release using a PTF provided that the version and
release haven’t changed
Once an LTS release comes out, customers on CD
either skip the LTS release and move to the
subsequent CD and perform a fresh SMPE install
20
© 2019 IBM Corporation
CD installation choices today over an LTS
boundary
9.1.5
(SMPE/PTF)
9.2.0
(SMPE)
9.2.1
(SMPE)
CD installation choices today inside a version/release
9.1.1
(SMPE)
9.1.2
(SMPE/PTF)
9.1.3
(SMPE/PTF)
9.1.5
(SMPE/PTF)
9.2.1
(SMPE)

21. CD FMID changes
At 9.2.0 on z/OS we ship FMIDs for both CD and
LTS
The CD FMIDS will no longer be tied to a specific
version / release
This will allow customers on the CD stream to
maintain currency using either SMP/E or PTF even
when moving between version / release boundaries
21
© 2019 IBM Corporation
CD installation choices today over an LTS
boundary
9.1.5
(SMPE/PTF)
9.2.0
(SMPE)
9.2.1
(SMPE)
Changes once 9.2.0 is available
9.2.0 CD
(SMPE)
9.2.2 CD
(SMPE/PTF)
9.2.4 CD
(SMPE/PTF)
9.1.5
(SMPE/PTF)
9.2.1
(SMPE)
9.3.0 CD
(SMPE/PTF)
9.3.2 CD
(SMPE/PTF)

22. MQ for z/OS 9.2.0 Release Prereqs
• z/OS: 2.3 and later
• Db2: 12 and later
• CICS 5.2 and later
• IMS 14.1 and later
• Java 8 and 11
22
© 2019 IBM Corporation

23. Extend your MQ network

24. 24
A Global Messaging Network
IBM MQ Advanced and Aspera
At the heart of Aspera is the FASP protocol,
accelerating the speed of data transport across long
distances and poor networks
MQ Advanced brings you the benefits of this when
communicating between distant queue managers
Queue Manager
Gateway
Queue Manager
Gateway
TCP/IP TCP/IPFASP.io
ibm-messaging.github.io/mqperf/MQ914_fasp_gw.pdf
Bypass: 0ms network latency (no packet loss)
N1: 25ms network latency (no packet loss)
N2: 40ms network latency (0.1% packet loss)
N3: 50ms network latency (0.5% packet loss)
© 2020 IBM Corporation

25. 25
A Global Messaging Network
Internet Pass Through
Ownership
Messaging
Layer
Application
Client Bindings
Container(s)
Server Bindings
IBM Cloud Google Cloud
App App
App App
App App
App App App
On Premise
App App App
TCP/IP
IBM MQ
Multi-Cloud
Cluster
With a Hybrid Multi-Cloud Architecture connecting to
external MQ networks is becoming increasingly important.
Internet Pass Through (IPT) has been an IBM MQ support
Pac (MS81) for many years. It provides a proxy layer within
your architecture which can be useful when exposing MQ
outside of the organization data center.
MQ 9.1.4 aligned IPT with the MQ product delivery
MQ Advanced now provides an enhanced IPT entitlement
where a Hardware Security Module (HSM) can be used
with IPT.
Guidance on how to expose MQ is also provided here:
ibm.biz/MQSecureConn
© 2020 IBM Corporation

26. Managing MQ
Living with your enterprise messaging system

27. Building scalable and available solutions
JSON CCDT
Build your own JSON format CCDTs
Supports multiple channels of the same name on
different queue managers to simplify the
building of uniform clusters
Available with all 9.1.2+ clients
C, JMS, .NET, Node.js, Golang clients
© 2020 IBM Corporation27
011001101001011000
101010110110101011
011011010010111101
110111011110111101
110111011
{
“channel”:[
{
“name”:”ABC”,
”queueManager”:”A”
},
{
“name”:”ABC”,
”queueManager”:”B”
},
]
}

28. © 2020 IBM Corporation28
Making management simpler
Web console
Simple to use, web based administration for
Distributed, z/OS, Cloud and the Appliance
RESTful administration
Administer and manage your queue managers over
HTTPS
Logging and monitoring
Simplify the streaming of logs and metrics for
centralized storage and analyzes
DISPLAY
UPDATE
HTTPS MQSC
DEFINE
DELETE
JSON
JSON

29. 29
New Web Console
MQ 9.1.5 CD replaces the existing web
console with a new web console on the
Distributed platforms. This will be available in
9.2.0 for z/OS
Focus is on user experience and consistency
across IBM products
© 2020 IBM Corporation
https://community.ibm.com/community/user/imwuc/blogs/callum-jackson1/
2020/04/09/enhanced-web-console-in-ibm-mq-915

30. © 2020 IBM Corporation
MQSC command, in JSON
Send request body in HTTP POST to
admin/action/qmgr/{qmgrName}/mqsc
resource
New command type of “runCommandJson”
Existing command type of “runCommand”
can still be used to run a plain text MQSC
command
{
"type": "runCommandJSON",
"command": "define",
"qualifier": "qlocal",
"name": "q1",
"parameters": {
"descr": "My queue"
}
}
DEFINE QLOCAL(Q1) DESCR(‘My queue’)
Optional
additional
parametersPrimary
argument
(often an
object name)
Primary
command
keyword Secondary
command
keyword
JSON
equivalent
30
MQ 9.1.5 CD carries these APIs over into a new V2
of the REST API. Earlier APIs for per-object
manipulation have been stabilised at V1
www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.1.0/com.ibm.mq.pro.doc/q133690_.htm#q133690___restapiv2

31. © 2020 IBM Corporation31
Managing channel CipherSpecs
You no longer need to configure a matching single CipherSpec
on both ends of a channel
MQ has introduced a range of ANY_TLSxx and
ANY_TLSxx_OR_HIGHER CipherSpecs and MQ will
negotiate the most preferred CipherSpec available to both
ends
Migration between versions and ease of configuration are both
simplified
If you need more control over the exact CipherSpecs
appropriate to a queue manager, this can be configured
MQ is expanding its support of TLS 1.3 across its range of
platforms, languages and protocols
TLS 1.3 is available in MQ for z/OS V9.2.0 when running on
z/OS 2.4
CipherSpec A
CipherSpec ANY CipherSpec ANY
CipherSpec A

32. Simplified MFT Agent licensing
No need to track individual agents with MQ Advanced queue managers
© 2020 IBM Corporation32
Managed File Transfer
MFT manages your file transfers, and now it’s
even easier for you to manage MFT, including…
Redistributable MFT agent
Simply download and unpack
Failed transfer timeout
Automatically stop transfers after repeated failures
Resource monitor backups
Simple, single command to backup and restore resource monitors
MFT agent, transfer and resource monitor
monitoring through REST
File transfer initiation and resource monitor management
through simple REST calls
Highly available active/standby MFT agents
MQ9.1LTSMQ9.2LTS

33. Helping developers
Making it easy to build MQ into your applications

34. © 2020 IBM Corporation34
Getting Started
Teach yourself the basics of MQ
Build on top of simple samples
…and prove your skills
ibm.biz/learn-mq
ibm.biz/mq-dev-patterns

35. © 2020 IBM Corporation35
Developing applications
Build your applications simply, with no need for an
MQ installation
Pull Java directly from the Maven repository since MQ
9.0.4 CD
MQ 9.1.1 CD added the SDK to the MQ redistributable
client
The redistributable client is now available directly, no
need to log into IBM
MQ 9.1.4 CD added .NET clients to NuGet
Develop your applications on the platform of your
choice with the addition of the MacOS version of the
9.1.1 MQ client and SDK for Developers
(The MQ for MacOS toolkit includes runmqsc)
Maven
IBM
Mac for Developers
npm
ibm.biz/MQdownloads
ibm.biz/mqmacos
NuGet

36. © 2020 IBM Corporation36
Writing new applications
REST Messaging
Providing a very simple way to get messages in and
out of your MQ system
9.1.2 CD boosted the performance capability, 9.1.3
CD added message browse and 9.1.5 CD added
publish
.NET Core
9.1.1 CD brought support for .NET Core on Windows
9.1.2 CD added Linux support
Open Source language bindings
Write MQI applications in Node.js and Golang
New simpler JMS style API for Golang
github.com/ibm-messaging
.NET Core
Node.js MQI Golang MQI
REST
Golang JMS
Windows
Linux
put, get, browse,
publish
github.com/ibm-messaging

37. Run IBM MQ in any
location or cloud,
exactly as you
need it
© 2020 IBM Corporation 37
Kubernetes
AWS
Linux
Windows Solaris
AIX
IBMi
IBM Z
Appliance
zLinuxHPE NonStop
Azure
AWS
IBM Cloud Private
IBM Event Streams
IBM Event Streams

38. Thank you
Matt Leming
Architect, IBM MQ for z/OS
lemingma@uk.ibm.com
© 2020 IBM Corporation
38