MQ Watcher
A read-only evidence explorer for Apache ActiveMQ Classic KahaDB stores — parse journal files locally, correlate message, ACK, subscription, and transaction evidence down to file and byte offset, without starting a broker or touching the store.
The working system
MQ Watcher is an investigation workbench for ActiveMQ Classic KahaDB stores. You point it at a store directory, it reads the journal files locally in your browser or CLI, and gives you correlated views of message, ACK, subscription, and transaction evidence — down to file and byte offset.
What it does
It parses KahaDB journal framing (batches, record headers, command envelopes, and checksums) and links related evidence. You can open multiple stores in tabs, compare two snapshots A/B, trace one exact JMSMessageID across all store evidence, keep incident notes, review journal retention, and export a redacted evidence bundle.
Why read-only matters
The tool reads stores without opening them for writing, loading product JARs, or starting recovery or compaction. This preserves the evidence under investigation, which can change when a broker store is opened with the wrong runtime or recovery path. The CLI binds to 127.0.0.1 only and has no upload endpoint.
Evidence flow
A Worker computes store identity from a content-based SHA-256 signature, so it survives directory renames and supports meaningful cross-snapshot comparison. Every fixture test hashes all source files before and after scanning and reports a failure if any byte changes. Unrecognized layouts keep the labels Unknown / Unsupported / Partial instead of being inferred.
Verified scope
Broker-generated fixtures are validated for ActiveMQ 5.13.5, 5.15.16, and 5.18.7 KahaDB stores across Queue, ACK, transaction, and durable Topic scenarios, with deterministic golden-result tests. v0.4.0's Message Trace feature is in release-candidate validation.
Where it stops
MQ Watcher shows what the store evidence supports. Each lead explains why it surfaced and where the evidence stops; root-cause analysis and recovery remain separate work.