1

I'm working with a product suite which uses RabbitMQ as a back end for service bus messaging. Many of the clients use software (NeuronESB) which is supposed to automatically configure exchanges, queues and channels as needed. Somewhere in the system exchanges in Rabbit are being deleted and not re-created, resulting in unexpected issues. Because of the size of the system and closed source nature of at least one of the service bus clients, an audit of code has been unsuccessful in determining the source of the deletion of these exchanges.

I have tried using the firehose functionality of Rabbit, but that only provides the messages being sent through Rabbit, not the internal activities I need.

What methods are available for logging the creation and deletion of exchanges in RabbitMQ? Ideally I would like to know the date, time and client IP of the deleter, but even just getting the date and time would allow me to narrow my search of logs to help find the offender.

psaxton
  • 1,693
  • 19
  • 24
  • Why don’t you just set permissions on the exchange such that deletion is not allowed? – theMayer Nov 27 '17 at 17:05
  • I would add that I cannot think of a legitimate reason why the configuration of exchanges would not be relatively static. – theMayer Nov 27 '17 at 17:06
  • Have you looked at the RabbitMQ server logs? – Alex Buyny Nov 27 '17 at 19:37
  • @theMayer I'm not certain how to remove delete permissions without removing all configure permissions. The exchanges are created as "durable" and without "auto delete". I agree, the configuration should be largely static, but unfortunately my dependencies do not. – psaxton Nov 27 '17 at 21:37
  • @AlexBuyny I'm poring through the rabbit log again, but so far having little success. I've tried searching for kewords "create", "delete" and "exchange". There are no logs containing "create" or "delete". Most "exchange" logs are in regards to not finding an exchange after it had been deleted, but the logs before it do not indicate when it was deleted. It does not appear that those events are logged. – psaxton Nov 27 '17 at 21:43
  • Permissions are set outside of the declaration - I've used rabbitmqctl to set permissions. – theMayer Nov 27 '17 at 22:26

1 Answers1

3

Try Events Exchange plugin that should do the trick.

If not working for some reason, the last resort I can think of:

Get a test environment with less clients/messages if you app is busy, then analyse your traffic with wireshark (it can understand amqp) to filter out requests to delete exchange.

Alex Buyny
  • 3,047
  • 19
  • 25
  • This must be a new feature - seems very helpful for server monitoring in general. – theMayer Nov 27 '17 at 22:28
  • Installed and enabled the events exchange plugin -- fantastic information. I can see the creation and deletion of exchanges as promised. It doesn't provide me a client address for initiation. Maybe logging with wireshark and using the event timestamps will help narrow it down. – psaxton Nov 27 '17 at 22:47