Created
April 13, 2012 04:48
-
-
Save garthk/2373773 to your computer and use it in GitHub Desktop.
Nutting out AMQP access control with logstash
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0xde81d48 @channel=0, @payload=#<Qrack::Protocol::Connection::Start:0x36673c9f @mechanisms="PLAIN AMQPLAIN", @server_properties={:capabilities=>{}, :copyright=>"Copyright (C) 2007-2012 VMware, Inc.", :information=>"Licensed under the MPL. See http://www.rabbitmq.com/", :platform=>"Erlang/OTP", :product=>"RabbitMQ", :version=>"2.8.1"}, @version_minor=0, @locales="en_US", @version_major=8>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x3efe0ce | |
| 9 @channel=0, @payload=#<Qrack::Protocol::Connection::StartOk:0x1901b54e @client_properties={:platform=>"Ruby", :product=>"Bunny", :information=>"http://github.com/ruby-amqp/bunny", :version=>"0.7.8"}, @response={:LOGIN=>"log_pusher", :PASSWORD=>"5adffb33ed2807d12234a6c75be9d022"}, @locale="en_US", @mechanism="AMQPLAIN">> | |
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0x2ed4a1d3 @channel=0, @payload=#<Qrack::Protocol::Connection::Tune:0x9cc3baa @frame_max=131072, @channel_max=0, @heartbeat=0>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x3f611aec @channel=0, @payload=#<Qrack::Protocol::Connection::TuneOk:0x2e9c76 @frame_max=131072, @channel_max=0, @heartbeat=0>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x74220711 @channel=0, @payload=#<Qrack::Protocol::Connection::Open:0x65fe28a7 @insist=nil, | |
| @capabilities="", @virtual_host="logging">> | |
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0x127208e4 @channel=0, @payload=#<Qrack::Protocol::Connection::OpenOk:0x7ca5ba31 @known_hosts="">> | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x646326e5 @channel=1, @payload=#<Qrack::Protocol::Channel::Open:0x298eb7e0 @out_of_band=nil>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0x10def14f @channel=1, @payload= | |
| > | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x1cb48230 @channel=1, @payload=#<Qrack::Protocol::Access::Request:0xecf2c09 @passive=true, @exclusive=nil, @realm="/data", @active=true, @write=true, @read=true>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0x4ce2db0 @channel=1, @payload=#<Qrack::Protocol::Access::RequestOk:0x7c198046 @ticket=1>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- send: #<Qrack::Transport::Method:0x45e881b6 @channel=1, @payload=#<Qrack::Protocol::Exchange::Declare:0x239bf795 @auto_delete=nil, @exchange="rawlogs", @durable=true, @type=:fanout, @ticket=1, @nowait=nil, @passive=nil, @arguments=nil, @internal=nil>> | |
| I, [2012-04-13 00:42:21#21996] INFO -- received: #<Qrack::Transport::Method:0x5dfa490 @channel=1, @payload=#<Qrack::Protocol::Channel::Close:0x1dacecf3 @class_id=40, @reply_text="ACCESS_REFUSED - access to exchange 'rawlogs' in vhost 'logging' refused for user 'log_pusher'", @reply_code=403, @method_id=10>> | |
| Bunny::ForcedChannelCloseError: Error Reply Code: 403 | |
| Error Reply Text: ACCESS_REFUSED - access to exchange 'rawlogs' in vhost 'logging' refused for user 'log_pusher' | |
| check_response at file:/root/logstash-1.1.0-monolithic.jar!/gems/bunny-0.7.8/lib | |
| /bunny/client08.rb:78 | |
| initialize at file:/root/logstash-1.1.0-monolithic.jar!/gems/bunny-0.7.8/lib | |
| /bunny/exchange08.rb:69 | |
| exchange at file:/root/logstash-1.1.0-monolithic.jar!/gems/bunny-0.7.8/lib/bunny/client08.rb:134 | |
| connect at file:/root/logstash-1.1.0-monolithic.jar!/logstash/outputs/amq | |
| p.rb:96 | |
| register at file:/root/logstash-1.1.0-monolithic.jar!/logstash/outputs/amq | |
| p.rb:62 | |
| run_output at file:/root/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:665 | |
| run_output at file:/root/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:66 | |
| 5 | |
| start_output at file:/root/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:33 | |
| 3 | |
| Exception in thread "LogStash::Agent" org.jruby.exceptions.RaiseException: (SystemExit) Error Reply Code: 403 | |
| Error Reply Text: ACCESS_REFUSED - access to exchange 'rawlogs' in vhost 'logging' | |
| refused for user 'log_pusher' | |
| at org.jruby.RubyThread.join(org/jruby/RubyThread.java:509) | |
| at LogStash::Agent.wait(file:/root/logstash-1.1.0-monolithic.jar!/logstash | |
| /agent.rb:312) | |
| at logstash.runner.main(logstash/runner.rb:40) | |
| at org.jruby.RubyArray.each(org/jruby/RubyArray.java:1612) | |
| at logstash.runner.main(logstash/runner.rb:40) | |
| at logstash.runner.(root)(logstash/runner.rb:108) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| root@host:~# rabbitmqctl list_permissions -p logging | |
| Listing permissions in vhost "logging" ... | |
| log_pusher .* .* | |
| admin .* .* .* | |
| log_indexer .* .* .* | |
| ...done. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
If I don't give the logstash user
confpermissions, it dies because it can't declare the exchange. I'd prefer that it use the existing exchange. Any ideas?