Audits connections to one or more Qpid message brokers.
Exchange and Queue names are checked against a whitelist and if no match is found an alert is generated. If no broker-addr is supplied, ConnectionAudit connects to 'localhost:5672'. [broker-addr] syntax: [username/password@] hostname ip-address [:<port>] Examples: $ ConnectionAudit localhost:5672 $ ConnectionAudit 10.1.1.7:10000 $ ConnectionAudit guest/guest@broker-host:10000 Options: -h, --help show this help message and exit --sasl-mechanism=<mech> SASL mechanism for authentication (e.g. EXTERNAL, ANONYMOUS, PLAIN, CRAM-MD5, DIGEST-MD5, GSSAPI). SASL automatically picks the most secure available mechanism - use this option to override. --whitelist=<whitelist XML document> The fully qualified name of the whitelist XML file, default is ./whitelist.xml
An example whitelist is illustrated below, note that in this example the exchanges associated with management have been whitelisted to remove spurious alerts caused by the temporary management queues.
<?xml version="1.0" encoding="UTF-8"?> <whitelist> <exchangeWhitelist> <exchange>qmf.default.topic</exchange> <exchange>qmf.default.direct</exchange> <exchange>qpid.management</exchange> <exchange>amq.direct</exchange> <exchange></exchange> </exchangeWhitelist> <queueWhitelist> <queue>testqueue</queue> </queueWhitelist> </whitelist>
@author Fraser Adams