topic Re: ActiveMQ JMS connection in All Apps and Add-ons

ActiveMQ JMS connection

dimitryz — Mon, 28 Sep 2020 16:34:59 GMT

Hello,
I'm able to make a connection and also pool/browse messages from the queue.
My configuration is very similar to what described here :
http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/

from inputs.conf

[jms://queue/:dynamicQueues/TestQ2]

browse_mode = all

browse_queue_only = 1

durable = 0

index_message_header = 1

index_message_properties = 1

init_mode = jndi

jms_connection_factory_name = ConnectionFactory

jndi_initialcontext_factory = org.apache.activemq.jndi.ActiveMQInitialContextFactory

jndi_provider_url = tcp://192.168.1.10:61616

sourcetype = syslog

strip_newlines = 1

browse_frequency = -1

destination_user =

index = main

But I have some strange phenomena :

Let say I have 9 messages in Queue called TestQ2.

When I run source="jms://queue/:dynamicQueues/TestQ2"

I've got 9,890 events .

When I filtered it with

source="jms://queue/:dynamicQueues/TestQ2"|dedup event_id

I got 9 events.

Please assist.

Regards,
Dmitry

Re: ActiveMQ JMS connection

Damien_Dallimor — Tue, 13 May 2014 11:25:01 GMT

Because you have browse mode enabled. Browsing does not dequeue messages. And you have the frequency at -1 , so essentially it is in a constant browsing state of the same 9 messages.

Re: ActiveMQ JMS connection

dimitryz — Tue, 13 May 2014 14:03:23 GMT

Hello Damien,
and thank you for an answer.
I understand the point ,but what if I can't consume message ,I need only browse existing messages.
If I understand right this is what you mean when you use dequeue ?
When I change frequency to higher value,I see the same issue,but much slowly.
There are plenty of tools for browse (HermesJMS for example)
but I would like to offer to our client to use Splunk for JMS too.

Regards,
Dmitry

Re: ActiveMQ JMS connection

Damien_Dallimor — Tue, 13 May 2014 14:25:34 GMT

If you can't consume the message , and you have to use a queue (vs a topic) , then I suggest you use mirrored queues : http://activemq.apache.org/mirrored-queues.html

Then you can turn off browse mode and consume directly from that mirror queue and you'll only get 1 copy of each message indexed in Splunk.

Dequeue = take off the queue
Enqueue = put on the queue

Re: ActiveMQ JMS connection

nettrigger — Mon, 28 Sep 2020 17:04:11 GMT

Hello ! This post is great !

I need know something, how can i create the?

jms_connection_factory_name & jndi_initialcontext_factory

Any documentation fot this objects?

Regards in advance !

Re: ActiveMQ JMS connection

Damien_Dallimor — Tue, 15 Jul 2014 02:36:39 GMT

ActiveMQ have good documentation : http://activemq.apache.org/jndi-support.html