MQ reason code 2035 not authorized

When MQ reason code 2035 not authorized, the reason code tells you exactly what failed — each code below has a different cause and a different fix, so match the code first.

What it means

• 2035 (MQRC_NOT_AUTHORIZED): the user ID has no permission on the queue or queue manager — a security setup issue, never a network issue.
• 2059 (MQRC_Q_MGR_NOT_AVAILABLE): the queue manager is down, or the name or port in the connection is wrong.
• 2085 (MQRC_UNKNOWN_OBJECT_NAME): the queue name is misspelled, or the queue was never defined on the connected queue manager.
• 2087 (MQRC_UNKNOWN_REMOTE_Q_MGR): the remote queue manager name in the definition matches no known queue manager.
• 2009 (MQRC_CONNECTION_BROKEN): the network or channel dropped mid-conversation — check the channel and both error logs.

Common causes

• 2035: the OAM profile is missing — setmqaut was never run for the application ID.
• 2059: queue manager not started, or the client configuration names the wrong queue manager or port.
• 2085: typo in the queue name, or the object was defined on a different queue manager.
• 2087: remote queue definition names a queue manager with no matching channel or cluster entry.
• 2009: firewall idle timeout, a stopped channel, or the queue manager recycled during the call.

How to diagnose

• 2035: dspmqaut -m QM -n QUEUE -t q -p appid — shows exactly what the ID is allowed to do.
• 2059: dspmq — confirms whether the queue manager is actually running.
• 2085: DISPLAY Q(name) on the connected queue manager — proves whether the object exists there.
• 2087: DISPLAY QR(name), then compare RQMNAME with the target DISPLAY QMGR output.
• 2009: DISPLAY CHSTATUS(channel) and read AMQERR01.LOG on both ends for the drop reason.

How to fix it

• 2035: setmqaut -m QM -n QUEUE -t q -p appid +put +get — grant only what the application needs.
• 2059: start the queue manager with strmqm, or correct the queue manager name in the client configuration.
• 2085: correct the queue name, or DEFINE QLOCAL on the correct queue manager.
• 2087: fix RQMNAME, or define the matching sender and receiver channel pair.
• 2009: restart the channel, fix the network path, and make the application reconnect with backoff.

Example: MQ reason-code diagnosis

dspmqaut shows the effective permission — always check it before changing application code.

Interview tip

• Q: An application gets reason code 2035 in production but worked in test — the same pattern as MQ reason code 2035 not authorized. What happened?
• A: 2035 means not authorized: the test queue manager had a setmqaut grant for the application ID and production does not. I confirm with dspmqaut, then grant the minimum (+put/+get) on production. The code is fine — the security setup is incomplete.

Prevention checklist

• Script setmqaut grants as part of every MQ deployment.
• Validate queue and queue-manager names against DISPLAY output in a pre-flight check.
• Alert on 2009 and 2059 in the error logs — they signal infrastructure problems, not application bugs.