IBM QRadar SOAR

 View Only
Expand all | Collapse all

Insistent messages on ActiveMQ

  • 1.  Insistent messages on ActiveMQ

    Posted Mon December 14, 2020 11:24 AM
    Hi all,

    There are some messages in ActiveMQ. I got result with query;

    'psql -c "select container,id from monapp.activemq_msgs order by id desc" co3'

    Output:
    container | id
    ------------------------------------------------+--------
    queue://actions.201.data_collector | 556435
    queue://actions.201.data_collector | 556433
    queue://actions.201.data_collector | 556431
    queue://actions.201.data_collector | 508920
    queue://actions.201.data_collector | 507138
    queue://actions.201.data_collector | 507130

    When i trigger rule which associated with data_collector queue, new messages work. But these 6 messages stay on activemq_msgs table.

    Do you have any idea how to troubleshoot that issue?

    ------------------------------
    Kirchoff
    ------------------------------


  • 2.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 02:49 AM
    Hi Kirchoff,

    Messages added to a message destination are tagged with a specific action ID. The function consuming and acknowledging the messages will only work with a specific action ID. If messages were added to the message destination by another rule which has a different action ID then the function will ignore them.

    More information can be found in https://www.ibm.com/support/pages/node/1159492. If you want to acknowledge these messages you can create a case for Resilient support and one of the team will provide you with a script. You will need to ensure you do not add any other messages to the message destination whilst you run the script otherwise you may be acknowledging messages that you want to be processed by the function.

    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message


  • 3.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 03:05 AM
    Hello Ben,

    Thanks for your reply.

    I don't understand why function will ignore them. Shouldn't it works in order-queue?

    Btw, the link that you provided does not work on me, it returns; 

    We're sorry!

    The page you're looking for may have been moved or deleted. Start a new search on ibm.com or visit one of the popular sites shown below.



    ------------------------------
    Kirchoff
    ------------------------------

    Original Message


  • 4.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 05:49 AM
    Hi Kirchoff,

    It seems the full stop at the end of the sentence made it into the hyperlink. Try https://www.ibm.com/support/pages/node/1159492 again.

    That must have been a design decision that I am not aware of. Acknowledging those six messages will remove them from the queue.

    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message


  • 5.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 06:58 AM
    Hi Ben,

    I wonder that which scenario does cause below case? Do you have a quick example?

    Messages added to a message destination are tagged with a specific action ID. The function consuming and acknowledging the messages will only work with a specific action ID. If messages were added to the message destination by another rule which has a different action ID then the function will ignore them.

    ------------------------------
    Kirchoff
    ------------------------------

    Original Message


  • 6.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 07:05 AM
    Hi Kirchoff,

    One example we see is if a rule is created to add messages to a message destination. The rule adds messages to the message destination and is deleted from the UI. Another rule is created to replace the deleted rule and it adds messages to the same message destination. There are now messages with different action IDs in the message destination.


    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message


  • 7.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 07:41 AM
    Hello Ben,

    Its more clear for me now, thanks for your example.

    So, let me explain what i understand.

    If there are two rules (1 auto, 1 menu item) and if two rules add exactly the same message to message destination in recent times, the older message will be ignored but it keeps stay on activemq_msg table in PSQL.

    So that means this case don't critical because function has been processed newer message instead of ignored message.

    The solution is acknowledge them by a script.

    Am i right?

    ------------------------------
    Kirchoff
    ------------------------------

    Original Message


  • 8.  RE: Insistent messages on ActiveMQ

    Posted Tue December 15, 2020 01:56 PM
    Hi Kirchoff,

    You can run sudo -u postgres -i psql -c "select id, encode(msg, 'escape') from monapp.activemq_msgs order by id" co3 to get all the messages in the message destination. If you pipe it to a text file and have thousands of messages be careful of your free disk.

    In the output search for "action_id." You can then use the interactive API GET /orgs/{org_id}/actions to return all the current actions. Those that have not been deleted will be listed in the API output and those not listed that you got from the sql have been deleted from Resilient.

    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message


  • 9.  RE: Insistent messages on ActiveMQ

    Posted Wed December 16, 2020 12:32 AM
    Hi Ben,

    I understood completely! Thanks for your helps.

    ------------------------------
    Kirchoff
    ------------------------------

    Original Message


  • 10.  RE: Insistent messages on ActiveMQ

    Posted Wed December 16, 2020 04:45 PM
    Hello Ben,

    I understood completely, thanks for your helps.

    ------------------------------
    Burak Karaduman
    ------------------------------

    Original Message