Permissions that need to be assigned for a RabbitMQ monitoring user

user_5761604 0
Viewed 5209

What permissions do I need to assign to a software, which will monitor my RabbitMQ server? The software agent should monitor most of the metrics explained and recommended in this document.

I think I have to create a user, e.g. monitoring and then give this user access to all virtual hosts which contain ressources that should be monitored.

I think when creating the user I have to assign it the tag monitoring which is a predefined tag.

What I do not understand is, what RegEx I need to assign to configure, write and read. The documentation contains a table with the permissions on ressources.

I think a monitoring software should not be able to create or delete ressources (configure permission) nor should it be able to ADD messages to a queue or READ and ACK messages from a queue. But for example it should be able to read the number of messages waiting in a queue to alert if a queue has a number of growing messages which are not retrieved.

Could anybody explain, what permissions and settings are required for such a monitoring user?

rabbitmq monitoring
3 Answers

Here is a quick guide from the beginning to the end while you are setting up RabbitMQ queues monitoring.

1) Create an account:

rabbitmqctl add_user monitoring password

2) Add monitoring tag (you can read more about RabbitMQ tags here https://www.rabbitmq.com/management.html)

rabbitmqctl set_user_tags monitoring monitoring

3) Now get the names of your virtual hosts:

rabbitmqctl list_vhosts

4) Add permission for monitoring user to virtual host:

rabbitmqctl set_permissions -p Some_Virtual_Host monitoring "" "" ""

5) Check if access is granted successfully:

curl -s -u monitoring:password http://localhost:15672/api/queues | jq

Look at the "messages" parameter

Optional) You can publish a fake message from the command line:

rabbitmqadmin publish --vhost=Some_Virtual_Host exchange=some_exchange routing_key=outgoing_routing_key payload="hello world"

Look at the "messages" again!

Tip: make sure to enable rabbitmq_management plugin in your RabbitMQ build to be able to execute these queries.

user_56899950

Figured that out myself with some testing. If someone is interested:

Create an account with monitoring tag Add that account to EVERY vhost that should be monitored and add empty strings ("") to configure, write and read permissions.

With a nice bash script you can then for example get the numbers of messages in every queue:

curl -u username:password \
 --silent \
 http://<ServerOrIP>:15672/api/queues/<vhostname> | jq '.[] | .name, .messages'
user_57616040
user_40703080
Related