Splunk JMS Modular Input v1.7.2

Overview

This is a Splunk modular input add-on for polling message queues and topics via the JMS interface.

It implements the Splunk Modular Inputs Framework

Why JMS ?

JMS is simply a messaging API and is a convenient means by which to write 1 modular input that can talk to several different underlying messaging providers : MQSeries(Websphere MQ), ActiveMQ, TibcoEMS, HornetQ, RabbitMQ,Native JMS, Weblogic JMS, Sonic MQ etc.. The modular input code is generic because it is programmed to the JMS interface. You can then supply messaging provider specific jar files at runtime. More details on JMS at Wikipedia

Dependencies

Setup

Activation Key

You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key

JNDI vs Local mode

For the most part you will setup your JMS connectivity using JNDI to obtain the remote JMS objects. However, you can bypass JNDI if you wish and use local instantiation. To this you must code an implementation of the com.splunk.modinput.jms.LocalJMSResourceFactory interface. You can then bundle the classes in a jar file and place them in $SPLUNKHOME/etc/apps/jmsta/bin/lib The configuration screen for creating a new JMS input allows you to choose local or jndi as the instantiation mode. So choose local , and then you can specify the name of implementation class, as well as any declarative paramaters you want to pass in.

Logging

Any log entries/errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log

These are also searchable in Splunk : index=_internal error jms.py

To turn on more verbose INFO level logging , set the logging level in the $SPLUNKHOME/etc/apps/jmsta/bin/jms.py script ie: ERROR , INFO

Third party jars

If you require specific JMS provider or JNDI Context implementation jars, then you can simply copy these to $SPLUNKHOME/etc/apps/jmsta/bin/lib

They will be automatically picked up upon restart

JVM Heap Size

The default heap maximum is 64MB. If you require a larger heap, then you can alter this in $SPLUNKHOME/etc/apps/jmsta/bin/jms.py on line 95

JVM System Properties

You can declare custom JVM System Properties when setting up new input stanzas. Note : these JVM System Properties will apply to the entire JVM context and all stanzas you have setup

Troubleshooting

Contact

www.baboonbones.com