Every account against actual logins, every login by result and authentication method, every session — kept on each node, surviving restarts, shown in the management UI you already use.
Every account defined in the cluster next to what actually logged in: last login, sessions, time online, sources, clients.
Password, token or certificate, for every session. When the authentication backend reports the credential it verified, the method is confirmed; otherwise it is inferred from the SASL mechanism, the configured backends and the user database — and labelled as such.
Sources, clients, protocols and virtual hosts per account, with a daily history.
RabbitMQ checks a login in three steps. Each failure is recorded with the step that refused it and RabbitMQ's own reason:
By account, source and reason, per day.
Each node records what happens on it. Account totals are copied to every other node, and whatever could not be recorded is shown, with its time and reason.
The journal is made durable every second and replayed after the last snapshot. An orderly stop loses nothing; a hard crash at most one second, and is marked.
Account totals of every node live on the others. Wipe a node's disk, or remove it from the cluster: its accounts' history is still there, until you choose to forget it.
Each node writes only its own totals; copies carry versions and never move backwards. The cluster view takes exactly one copy per node.
An unclean stop, a disk alarm, or events dropped to keep the broker fast are recorded with their time range — not smoothed over.
It works only when connections open and close, in its own processes, and never blocks a connection or a message.
Connection storm: 6,000 connections per round (open, channel, close) from six clients, three rounds with the plugin disabled and enabled in turn on the same node, CPU time of the broker process minus its idle rate. Real workloads with long-lived connections see a small fraction of this. Numbers from a laptop; reproduce them with test/perf/bench.py.
The .ez for your broker's Erlang/OTP: otp25, otp26, or otp27 for OTP 27 – 29.
Into the plugins directory of every node.
On every node; it picks up connections already open.
rabbitmq-plugins enable \ rabbitmq_access_insight
| Where | Needs | |
|---|---|---|
| Access tab in the management UI | rabbitmq_management | monitoring or administrator users |
/api/access/v1/… on the management port | rabbitmq_management | same login as the management API |
rabbitmq_access_* on :15692/metrics | rabbitmq_prometheus | next to RabbitMQ's own metrics |
127.0.0.1:15693 | nothing | the plugin's own status page, API and metrics |
Nothing else is required: when a piece is missing, the tab and the status page say what it affects and how to enable it. It only observes — it never takes part in allowing a connection, and stores no passwords, tokens or message bodies.