All Apps and Add-ons

Is it correct that the AMQP Messaging Modular Input does not create its own MQueues on its own?

mathiask
Communicator

Maybe I misunderstand how the MQ should be used.

In my trials I used a publisher publishing a message to an exchange with a set of routing keys. The subscriber then would create its own exclusive Queue and binds it with the wished routing keys to the exchange.

Using the the AMQP MInput I could observe a channel but no queue. After I created an the corresponding queue the splunk AMQP client bound the configured routing keys and received the sent messages.

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

The Mod Input does not create queues. You connect to an existing defined queue.

Source is here : https://github.com/damiendallimore/SplunkModularInputsJavaFramework/tree/master/amqp

View solution in original post

Damien_Dallimor
Ultra Champion

The Mod Input does not create queues. You connect to an existing defined queue.

Source is here : https://github.com/damiendallimore/SplunkModularInputsJavaFramework/tree/master/amqp

mathiask
Communicator

Okay I just try to understand the reasoning behind it. In the "basic" rabbitMQ tutorials the pub and sub always make sure that the queue exists and therefore never encounter this problem.

Is it because as consumer/subscriber it is out of your scope/control what the AMQP compliant provider does and therefore "simply" (have to) assume that everything is already set up properly?

The quite real problem I ran into is that until I figured out what was the problem rabbitMQ created quite a log. Even more so when i restarted the MQ server/system which killed the non-persistent queue. The error log quickly grew to 12GB which then disabled the splunk indexer (<5GB) on my splunk test device. It feels a little bit like a local DoS ...
Of an operational perspective I need the error to know that there is something wrong, but it kinda sucks when this actually breaks the system 🙂 Sure I could turn off the ERROR log level, which would be kinda stupid ...

PS : the same problem arises with a bad password, but at a much slower rate ...

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...