After failover the Master has a bunch of bogus queues

[NashCat <st...@lifeway.com>]

We had a failover to the slave, after we failed back to the original master
there are a bunch of new bogus queues. Some of the queues are variations on
FOO.BAR some are just special characters, etc...   many of them look like
they were temp queues.  There are about 100 of there bogus queues. Has
anyone seen this happen before?  Also, We do not use FOO.BAR in development
or test. None of these look like something we had used before. Here are some
examples:

.FOO.BAR.swp
.FOO.BAR812485625.swp
.FOO.non-existant-1118595138.swp
Q.USR.T.NotifyCustomerPartyMaster.~1~  (Q.USR.T.NotifyCustomerPartyMaster is
a valid queue)
.DLQ.T.SyncItemMaster1490504133.swp
ADw-script AD4-alert(202) ADw-/script AD4-
%68%74%74%70%3a%2f%2fwww.example.com


--
View this message in context: http://activemq.2283324.n4.nabble.com/After-failover-the-Master-has-a-bunch-of-bogus-queues-tp3702225p3702225.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: After failover the Master has a bunch of bogus queues

[helloyulka <yu...@gmail.com>]

I have same problem too. NashCat aswered me on email :
"We had a PCI scan that was hitting all of our web applications, including
the ActiveMQ admin webapp. The PCI scan was hitting every link on the pages
and creating a bunch of queues/topics"

Thank your very much and good luck !



--
View this message in context: http://activemq.2283324.n4.nabble.com/After-failover-the-Master-has-a-bunch-of-bogus-queues-tp3702225p4667682.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: After failover the Master has a bunch of bogus queues

[NashCat <st...@lifeway.com>]

Dejan, Thanks for your response. I will look into that scenario but I think
that is unlikely since we are behind the firewall AND the PCI firewall.
Also, this is not the first time this has happened.

--
View this message in context: http://activemq.2283324.n4.nabble.com/After-failover-the-Master-has-a-bunch-of-bogus-queues-tp3702225p3704212.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: After failover the Master has a bunch of bogus queues

[Dejan Bosanac <de...@nighttale.net>]

Never seen something like this. It looks like someone tried to hack your
broker (probably over http)

Regards
-- 
Dejan Bosanac - http://twitter.com/dejanb
-----------------
The experts in open source integration and messaging - http://fusesource.com
ActiveMQ in Action - http://www.manning.com/snyder/
Blog - http://www.nighttale.net


On Thu, Jul 28, 2011 at 9:34 PM, NashCat <st...@lifeway.com> wrote:

> We are using ActiveMQ 5.4.2 in a Shared JDBC Master/Slave
>
> --
> View this message in context:
> http://activemq.2283324.n4.nabble.com/After-failover-the-Master-has-a-bunch-of-bogus-queues-tp3702225p3702269.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>

Re: After failover the Master has a bunch of bogus queues

[NashCat <st...@lifeway.com>]

We are using ActiveMQ 5.4.2 in a Shared JDBC Master/Slave

--
View this message in context: http://activemq.2283324.n4.nabble.com/After-failover-the-Master-has-a-bunch-of-bogus-queues-tp3702225p3702269.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.