public final class ConnectionAudit extends Object implements QmfEventListener
Exchange and Queue names are checked against a whitelist and if no match is found an alert is generated.
If no broker-addr is supplied, ConnectionAudit connects to 'localhost:5672'.
[broker-addr] syntax:
[username/password@] hostname
ip-address [:<port>]
Examples:
$ ConnectionAudit localhost:5672
$ ConnectionAudit 10.1.1.7:10000
$ ConnectionAudit guest/guest@broker-host:10000
Options:
-h, --help show this help message and exit
--sasl-mechanism=<mech>
SASL mechanism for authentication (e.g. EXTERNAL,
ANONYMOUS, PLAIN, CRAM-MD5, DIGEST-MD5, GSSAPI). SASL
automatically picks the most secure available
mechanism - use this option to override.
--whitelist=<whitelist XML document>
The fully qualified name of the whitelist XML file,
default is ./whitelist.xml
An example whitelist is illustrated below, note that in this example the exchanges associated with management
have been whitelisted to remove spurious alerts caused by the temporary management queues.
<?xml version="1.0" encoding="UTF-8"?>
<whitelist>
<exchangeWhitelist>
<exchange>qmf.default.topic</exchange>
<exchange>qmf.default.direct</exchange>
<exchange>qpid.management</exchange>
<exchange>amq.direct</exchange>
<exchange></exchange>
</exchangeWhitelist>
<queueWhitelist>
<queue>testqueue</queue>
</queueWhitelist>
</whitelist>
| Constructor and Description |
|---|
ConnectionAudit(String url,
String connectionOptions,
String whitelist)
Basic constructor.
|
public ConnectionAudit(String url, String connectionOptions, String whitelist)
url - the connection URL.connectionOptions - the options String to pass to ConnectionHelper.whitelist - the path name of the whitelist XML file.public void onEvent(WorkItem wi)
If we receive an EventReceivedWorkItem check if it is a subscribe event. If it is we check if the whitelist has changed, and if it has we re-read it. We then extract the queue name, exchange name, binding, connection address and timestamp and validate with the whitelsist.
If we receive an AgentRestartedWorkItem we revalidate all subscriptions as it's possible that a client connection could have been made to the broker before ConnectionAudit has successfully re-established its own connections.
onEvent in interface QmfEventListenerwi - a QMF2 WorkItem objectpublic static void main(String[] args)
args - the command line arguments.Copyright © 2006–2014 The Apache Software Foundation. All rights reserved.