A backout queue is your safety valve when application processing fails repeatedly. While BOTHRESH and BOQNAME are individual attributes, the backout queue usage pattern is how operations and developers work together: design paired queues, monitor backout depth, triage poison payloads, fix defects, and requeue safely. Without a dedicated backout queue, one bad message blocks a work queue; with a sloppy backout process, bad data is requeued twice and posts duplicate payments. This page walks through naming, MQSC definitions, runbooks, differences from the dead-letter queue, JMS poison handling, and requeue discipline for beginners.
ORDERS.IN is the work queue with BOTHRESH(3) BOQNAME('ORDERS.BO'). ORDERS.BO is a normal local queue (USAGE NORMAL) sized for incident volume. Consumers only get from ORDERS.IN in steady state. ORDERS.BO is read by support tools or a controlled repair program after human approval. Naming symmetry (.IN / .BO) helps on-call engineers find pairs in MQSC exports at 3 a.m.
| Queue | Role | Typical attributes |
|---|---|---|
| ORDERS.IN | Work / application input | BOTHRESH, BOQNAME, SHARE, MAXDEPTH |
| ORDERS.BO | Backout / poison hold | No BOQNAME; DEFPSIST YES; alert on depth |
| DEADQ | Queue manager DLQ | System-wide; different runbook |
123456DEFINE QLOCAL('ORDERS.BO') REPLACE MAXDEPTH(20000) + DEFPSIST(YES) GET(ENABLED) PUT(ENABLED) + DESCR('Backout for ORDERS.IN - no BOQNAME here') ALTER QLOCAL('ORDERS.IN') BOTHRESH(3) BOQNAME('ORDERS.BO') DISPLAY QLOCAL('ORDERS.IN') BOTHRESH BOQNAME DISPLAY QLOCAL('ORDERS.BO') CURDEPTH
Alert when CURDEPTH on any *.BO queue is greater than 0. On alert: capture MQMD (MsgId, CorrelId, BackoutCount), application logs, and message body (redact PII in tickets). Identify if defect is code deploy, bad vendor file, or data. Fix forward. Requeue using supported tools (amqsbcg samples, custom program with audit, or IBM MQ Explorer) only after root-cause sign-off. Document count requeued. If message is permanently invalid, archive and delete per retention policy—not silent purge.
Backout is deliberate application-level poison isolation. DLQ catches MQ routing failures, expired messages, and puts that fail including failed put to backout. Your runbook should list both. Teams that only monitor DLQ miss poison solely on ORDERS.BO. Teams that requeue DLQ messages without analysis repeat enterprise incidents.
Each critical work queue can point to its own backout queue (PAYMENTS.BO, INVENTORY.BO) or share one department backout queue—shared simplifies monitoring but mixes payloads. High-security flows often isolate backout per queue for clearer ownership. Never point many unrelated flows to one backout queue without labeling in message headers.
Enable poison message handling per client documentation so BOTHRESH and BOQNAME are honored on rollback. Session transacted mode is required for meaningful backout counting. Unit tests should include one poison message and assert arrival on BO after threshold.
The class line has a broken toy that stops everyone. After three failed tries, the teacher moves that toy to a side table (backout queue) so the line keeps moving. Adults fix the toy later at the side table.
Write a one-page runbook outline for ORDERS.BO depth alert.
Why should ORDERS.BO not have BOQNAME('ORDERS.BO')?
Message on DLQ after backout—name two possible causes.
1. Messages arrive on backout queue when:
2. Backout queue should usually:
3. Backout queue depth alert means:
4. DLQ differs because: