Cheat Sheet
Kafka & RabbitMQ CLI
Every flag you reach for when debugging a queue or a topic: Kafka 4.0 tools with --bootstrap-server only, RabbitMQ operator tools, rabbitmqadmin v2 and the matching aws sqs commands.
Kafka 4.0
Source checked
RabbitMQ
Man pages
AWS CLI 2
Help verified
01
Chapter 1 - Conventions
Read This First
Kafka tools live in the bin/ folder of the Kafka distribution as kafka-*.sh (Windows: bin/windows/*.bat). In Kafka 4.0 the tools talk to brokers only through --bootstrap-server host:port. The old --zookeeper option is gone with ZooKeeper, and --broker-list is not an option of the 4.0 console producer (checked in the 4.0 source). For client security settings add --command-config file.properties (admin tools) or --consumer.config / --producer.config (console clients).
| Variable used below | Meaning |
|---|---|
$BS | Your bootstrap servers, for example localhost:9092 or broker1:9092,broker2:9092 |
$T | Topic name |
$G | Consumer group id |
Safe habit
Tools that change things (--alter, --delete, --execute) deserve a dry run or a describe first. kafka-consumer-groups.sh --reset-offsets is a dry run unless you add --execute.
02
Chapter 2 - kafka-topics.sh
Topics
Flags checked against the Kafka 4.0 TopicCommand source.
| Command or flag | What it does | Gotcha |
|---|---|---|
--bootstrap-server $BS --list | List topics | --exclude-internal hides __consumer_offsets and friends |
--create --topic $T --partitions 6 --replication-factor 3 | Create a topic | Replication factor cannot exceed the broker count; --if-not-exists makes it idempotent |
--create ... --config retention.ms=604800000 | Set topic configs at creation | Repeat --config per key |
--describe --topic $T | Partitions, leaders, replicas, ISR | Without --topic it describes every topic; --topic-id selects by id |
--describe --under-replicated-partitions | Only partitions whose ISR is smaller than the replica set | Non-empty output = something is lagging or down |
--describe --unavailable-partitions | Partitions with no leader | Clients cannot produce or consume these |
--describe --under-min-isr-partitions | ISR below the min.insync.replicas setting | With acks=all producers get NotEnoughReplicas errors |
--describe --at-min-isr-partitions | ISR exactly at the minimum | One more failure stops writes: a warning sign |
--describe --topics-with-overrides | Topics that have config overrides | Quick audit of non-default settings |
--alter --topic $T --partitions 12 | Increase the partition count | Cannot decrease; key-to-partition mapping changes for new records |
--delete --topic $T | Delete a topic | Needs delete.topic.enable on the cluster (default true); data is gone |
--command-config client.properties | Client properties file (SASL, TLS) | Needed on secured clusters, otherwise timeouts |
--config / --delete-config on --alter | Alter topic configs | The --delete-config option on this tool is deprecated since 4.0: use kafka-configs.sh |
03
Chapter 3 - Console producer and consumer
Producing and Consuming from the Shell
For smoke tests and debugging, not for load.
| Command or flag | What it does | Gotcha |
|---|---|---|
kafka-console-producer.sh --bootstrap-server $BS --topic $T | Send each typed line as a record | Ctrl-D ends it; value only, no key by default |
--property parse.key=true --property key.separator=: | Treat key:value lines as key and value | A line without the separator fails unless ignore.error=true |
--property parse.headers=true | Parse record headers from the line | Format is controlled by headers.delimiter and related properties |
--producer-property acks=all | Set any producer config | Repeatable; or load a file with --producer.config |
--compression-codec gzip | Compress batches | --sync sends one record at a time and is slow |
kafka-console-consumer.sh --bootstrap-server $BS --topic $T --from-beginning | Read from the earliest offset | Only applies when the group has no committed offsets |
--group $G | Use a named group (commits offsets) | Without it the tool makes a random group each run, which pollutes the group list |
--max-messages 10 | Exit after N records | Good for scripts |
--partition 2 --offset 100 | Read one partition from an offset | --offset accepts a number, earliest or latest, and needs --partition |
--timeout-ms 5000 | Exit if no record arrives for this long | Otherwise it runs until you stop it |
--property print.key=true | Also print the key | Others: print.timestamp, print.offset, print.partition, print.headers, print.value, key.separator |
--isolation-level read_committed | Hide records of open or aborted transactions | Default is read_uncommitted |
--key-deserializer / --value-deserializer | Pick a deserializer class | Default prints bytes as strings; binary data looks garbled |
--consumer-property k=v, --consumer.config f | Set any consumer config | Property options override the file |
--include "orders.*" | Subscribe by regex | Use instead of --topic |
04
Chapter 4 - kafka-consumer-groups.sh
Groups, Lag and Offset Resets
Flags checked against the Kafka 4.0 ConsumerGroupCommandOptions source.
| Command or flag | What it does | Gotcha |
|---|---|---|
--bootstrap-server $BS --list | List group ids | --state (and --type) filter the list |
--describe --group $G | Per partition: current offset, log end offset, LAG, consumer id, host | A - consumer id means the partition has no active owner |
--describe --all-groups | Describe every group | Can be heavy on large clusters |
--describe --group $G --members [--verbose] | Members and, with verbose, their assignments | Shows rebalance victims quickly |
--describe --group $G --state | Group state and coordinator | States: Stable, PreparingRebalance, Empty, Dead and others |
--describe --group $G --offsets | Offsets only (the default view) | Lag is only an estimate at the moment of the call |
--reset-offsets --group $G --topic $T --to-earliest | Plan a reset to the beginning | Dry run by default; the group must have no active members |
--to-latest / --to-offset N / --shift-by -100 | Other reset targets | --shift-by takes a negative number to rewind |
--to-datetime 2026-10-31T00:00:00.000 | Reset to the first offset at or after a time | Format YYYY-MM-DDTHH:mm:SS.sss |
--by-duration PT1H | Reset to a point in the past | ISO-8601 duration |
--to-current | Reset to the current committed offset | Mostly useful with --topic scoping |
--all-topics | Apply the reset to every topic the group consumed | Use --topic t:0,1,2 to select partitions |
--execute / --dry-run / --export | Apply the reset / show only / write a CSV | --from-file applies a CSV back; always dry-run first |
--delete --group $G | Delete a group | Fails if the group still has members |
--delete-offsets --group $G --topic $T | Forget a group's offsets for a topic | Group must not be consuming that topic |
05
Chapter 5 - Configs, offsets, logs, perf
kafka-configs, kafka-get-offsets, kafka-dump-log, perf tests
Inspect and tune without touching application code.
| Command or flag | What it does | Gotcha |
|---|---|---|
kafka-configs.sh --bootstrap-server $BS --entity-type topics --entity-name $T --describe | Show topic overrides | --all also lists static and default configs |
... --alter --add-config retention.ms=86400000 | Set a topic config | Several keys: --add-config k1=v1,k2=v2; values with commas go in square brackets |
... --alter --delete-config retention.ms | Remove an override (back to the default) | Applies to topics, brokers, clients, users and more |
--entity-type brokers --entity-name 1 --alter --add-config ... | Dynamic per-broker config | --entity-default sets it for all brokers |
--entity-type clients / users | Client or user quotas | Needs the right entity combination |
kafka-get-offsets.sh --bootstrap-server $BS --topic $T | Latest offset per partition | Default --time is latest |
--time -2 (or earliest) | Earliest offsets | Also -3 / max-timestamp, -4 / earliest-local, -5 / latest-tiered, or a timestamp in ms |
--topic-partitions "t1:0,t2:1-3" | Select partitions with a pattern | Use either --topic or --topic-partitions |
kafka-dump-log.sh --files <segment>.log --print-data-log | Read a segment file, including record contents | Run on a broker data directory; do not point at a live active segment without care |
--deep-iteration, --max-message-size, --verify-index-only | Look inside compressed batches; raise size; check index files | Decoders exist for internal topics: --offsets-decoder, --transaction-log-decoder, --cluster-metadata-decoder |
kafka-producer-perf-test.sh --topic $T --num-records 100000 --record-size 1024 --throughput -1 --producer-props bootstrap.servers=$BS acks=all | Producer load test | --throughput -1 means no throttle; also --payload-file, --print-metrics, --transactional-id; use a test topic |
kafka-consumer-perf-test.sh | Consumer load test | Exists in 4.0; see its --help for flags |
06
Chapter 6 - Other Kafka tools
Cluster, Reassignment, Quorum
Present in the 4.0 bin/ folder (checked in the repository). Run each with --help for its flags.
| Tool | Use | Gotcha |
|---|---|---|
kafka-metadata-quorum.sh | Describe the KRaft controller quorum (describe --status, --replication) | Can connect with --bootstrap-server or --bootstrap-controller |
kafka-storage.sh | Format storage and generate a cluster id for KRaft | format must run before the first start; formatting an existing directory is destructive |
kafka-features.sh | Describe and upgrade feature levels | Finalizing a level may block downgrades |
kafka-reassign-partitions.sh | Move replicas between brokers | Throttle the move to protect traffic; verify before and after |
kafka-leader-election.sh | Trigger preferred or unclean leader election | Unclean election can lose data |
kafka-log-dirs.sh | Describe log directories and sizes per broker | Good for disk questions |
kafka-delete-records.sh | Delete records before an offset | Takes a JSON file; cannot be undone |
kafka-acls.sh | Manage ACLs | Need an authorizer configured |
kafka-broker-api-versions.sh | Show API versions a broker supports | First step for client compatibility questions |
kafka-transactions.sh | Inspect and abort hanging transactions | Use only after understanding the producer state |
kafka-groups.sh | List groups of all types (listed in the 4.0 bin/) | Check --help; consumer group tool remains the main one |
07
Chapter 7 - Worked sequence
Find Lag, Peek, Reset
Stop the consuming application before the --execute step; a group with active members cannot be reset.
A typical diagnosis sequence (commands only; output varies, so none is shown)
$ BS=localhost:9092
$ bin/kafka-topics.sh --bootstrap-server $BS --describe --under-replicated-partitions
$ bin/kafka-consumer-groups.sh --bootstrap-server $BS --describe --group orders-service
$ bin/kafka-get-offsets.sh --bootstrap-server $BS --topic orders --time latest
$ bin/kafka-console-consumer.sh --bootstrap-server $BS --topic orders --partition 3 --offset 1200 \
--max-messages 5 --property print.key=true --property print.offset=true --property print.timestamp=true
$ bin/kafka-consumer-groups.sh --bootstrap-server $BS --group orders-service --topic orders \
--reset-offsets --to-datetime 2026-10-31T09:00:00.000 # dry run
$ bin/kafka-consumer-groups.sh --bootstrap-server $BS --group orders-service --topic orders \
--reset-offsets --to-datetime 2026-10-31T09:00:00.000 --execute
08
Chapter 8 - RabbitMQ: rabbitmqctl
Operator Commands
Command names checked against the rabbitmqctl man page (rabbitmqctl.8 in the RabbitMQ server repository, main branch). Use -p vhost for a virtual host and -n rabbit@host for another node; rabbitmqctl help lists everything.
| Command or flag | What it does | Gotcha |
|---|---|---|
rabbitmqctl status | Node status: versions, memory, alarms, listeners | Use rabbitmq-diagnostics status too |
rabbitmqctl cluster_status | Cluster members, disk and RAM nodes, partitions, alarms | Look for "Network Partitions" |
rabbitmqctl list_queues name messages_ready messages_unacknowledged consumers type | Queue table with the columns you pick | Add -p vhost; counts can lag a few seconds; --offline and --online filter by queue availability |
rabbitmqctl list_exchanges name type, list_bindings | Topology | Bindings show source, destination and routing key |
rabbitmqctl list_consumers | Consumers per queue | Zero consumers on a growing queue = stuck application |
rabbitmqctl list_connections name state, list_channels | Client connections and channels | Many channels per connection can be a leak |
rabbitmqctl close_connection <pid> "reason" | Close one connection | Use the pid from list_connections |
rabbitmqctl purge_queue q | Delete all ready messages in a queue | Unacked messages stay |
rabbitmqctl delete_queue q [--if-empty] | Delete a queue | --if-empty / --if-unused guard against surprises |
rabbitmqctl add_user u p / list_users / change_password / delete_user | User management | The password appears in shell history; prefer a prompt or hash_password flows |
rabbitmqctl set_user_tags u administrator | Management UI roles | Tags are not permissions |
rabbitmqctl add_vhost v / list_vhosts / delete_vhost v | Virtual hosts | Deleting a vhost deletes its queues and messages |
rabbitmqctl set_permissions -p v u ".*" ".*" ".*" | Configure, write, read regexes for a user on a vhost | Order is configure, write, read; empty string = nothing |
rabbitmqctl set_policy -p v name "^orders-" '{"max-length":10000}' --apply-to queues | Apply optional arguments to matching queues | list_policies shows them; check --priority when several patterns match the same queue |
rabbitmqctl stop_app / start_app / reset | Stop or start the application, wipe node state | reset removes all data on the node; used when changing cluster membership |
rabbitmqctl join_cluster rabbit@seed | Join this node to a cluster | Run stop_app first and start_app after |
rabbitmqctl forget_cluster_node rabbit@dead | Remove a dead node from the cluster | Only for nodes that will not come back |
rabbitmqctl enable_feature_flag all, list_feature_flags | Feature flags | Enable all flags before an upgrade to the next major version |
rabbitmqctl set_vm_memory_high_watermark 0.6 | Change the memory alarm threshold at runtime | Resets on restart; set it in the config file too |
rabbitmqctl shutdown, await_startup, wait | Stop the node and the Erlang VM; wait for startup | Preferred in scripts over killing the process |
09
Chapter 9 - RabbitMQ: diagnostics, queues, plugins
Health and Quorum Queue Tools
Names checked against rabbitmq-diagnostics.8 and rabbitmq-queues.8 (RabbitMQ server repository, main).
| Command or flag | What it does | Gotcha |
|---|---|---|
rabbitmq-diagnostics status | Rich node status | First command when someone says "RabbitMQ is slow" |
rabbitmq-diagnostics ping | Is the node reachable by CLI tools | Checks CLI to node connectivity only |
rabbitmq-diagnostics check_running | Is the application running | Exit code is non-zero if not, good for probes |
rabbitmq-diagnostics check_local_alarms, check_alarms | Memory and disk alarms (this node / cluster) | An alarm blocks publishers |
rabbitmq-diagnostics check_port_connectivity, check_port_listener 5672 | Are the listener ports open | Expects --longnames on long-name nodes |
rabbitmq-diagnostics memory_breakdown --unit MB | Where the memory is | Large binary or queue_procs points at message backlog |
rabbitmq-diagnostics listeners | Protocols and ports | Confirms TLS and plugin listeners |
rabbitmq-diagnostics cluster_status, environment, report | Cluster view, runtime environment, a long support report | report output is what support asks for |
rabbitmq-diagnostics log_tail -N 100 | Last log lines from the node | Works remotely via -n |
rabbitmq-diagnostics maybe_stuck | Find possibly stuck Erlang processes | Diagnostic, not proof |
rabbitmq-queues quorum_status q --vhost v | Raft members, leader and log state of a quorum queue | Missing members mean reduced fault tolerance |
rabbitmq-queues add_member q rabbit@n --vhost v, delete_member | Change quorum queue replicas | Odd member counts are preferred |
rabbitmq-queues rebalance quorum, transfer_leadership | Spread or move leaders | Leaders concentrate on one node after restarts |
rabbitmq-queues check_if_node_is_quorum_critical | Would stopping this node break a quorum | Run before maintenance, also exposed as rabbitmq-diagnostics check_if_node_is_quorum_critical |
rabbitmq-plugins enable rabbitmq_management | Enable a plugin | Takes effect on a running node without a restart for most plugins |
10
Chapter 10 - RabbitMQ: rabbitmqadmin v2
The HTTP API CLI
There are two generations. rabbitmqadmin v2 (the rabbitmqadmin-ng project) is a standalone native binary and is what the current RabbitMQ documentation describes. v1 was a Python script served by the management plugin. The syntax differs: v2 uses named options (--name "q"), v1 used name="q" arguments. It needs the rabbitmq_management plugin (HTTP API). Syntax below is from the RabbitMQ documentation page "rabbitmqadmin v2".
| Command or flag | What it does | Gotcha |
|---|---|---|
rabbitmqadmin help, rabbitmqadmin queues help declare | Command groups and per-command help | Group names include queues, exchanges, bindings, vhosts, users, permissions, policies, connections, channels, consumers, definitions, health_check |
rabbitmqadmin show overview | Cluster overview and rates | Use --non-interactive in scripts |
rabbitmqadmin queues list, --vhost "v" queues list | List queues | --vhost goes before the group |
rabbitmqadmin --vhost "v" queues declare --name "q" --type "quorum" --durable true | Create a queue | Types: classic, quorum, stream |
rabbitmqadmin --vhost "v" queues show --name "q" --columns "name,type,messages,consumers" | Show one queue | --columns limits the output |
rabbitmqadmin --vhost "v" queues purge --name "q", queues delete --name "q" --idempotently | Purge / delete | --idempotently makes delete not fail if absent |
rabbitmqadmin --vhost "v" exchanges declare --name "x" --type "topic" --durable true | Create an exchange | Types include direct, fanout, topic, headers |
rabbitmqadmin --vhost "v" bindings declare --source "x" --destination-type "queue" --destination "q" --routing-key "orders.created" | Bind | Source is an exchange; destination a queue or exchange |
rabbitmqadmin vhosts declare --name "v" --default-queue-type "quorum" | Create a vhost | vhosts delete --name "v"; vhosts delete_multiple --name-pattern "^test-" --dry-run previews bulk deletion |
rabbitmqadmin users declare --name "u" --password "p" --tags "monitoring", permissions declare ... | Users and permissions | --password-hash avoids plain text; permissions take --configure, --read, --write regexes |
rabbitmqadmin definitions export --file defs.json, definitions import --file defs.json | Back up or restore topology | --transformations exclude_users,exclude_permissions removes parts on export |
rabbitmqadmin health_check local_alarms | Health checks over the HTTP API | Others: cluster_wide_alarms, node_is_quorum_critical, port_listener --port 5672 |
rabbitmqadmin rebalance queues | Rebalance queue leaders across nodes | Optionally scoped with --vhost |
rabbitmqadmin connections close --name "..." | Close a connection | Name as printed by connections list |
11
Chapter 11 - AWS SQS CLI
The aws sqs Commands
Subcommands and option names verified with aws sqs help on AWS CLI 2.32.25. SQS is the queue counterpart of the RabbitMQ commands above. Queue URLs look like https://sqs.REGION.amazonaws.com/ACCOUNT/NAME.
| Command or flag | What it does | Gotcha |
|---|---|---|
aws sqs create-queue --queue-name q --attributes VisibilityTimeout=60 | Create a queue | FIFO queue names must end in .fifo and need FifoQueue=true |
aws sqs list-queues [--queue-name-prefix p] | List queues | Returns URLs |
aws sqs get-queue-url --queue-name q | Resolve name to URL | Add --queue-owner-aws-account-id for cross-account |
aws sqs get-queue-attributes --queue-url U --attribute-names All | Settings and approximate counts | ApproximateNumberOfMessages, ...NotVisible, ...Delayed are approximate |
aws sqs set-queue-attributes --queue-url U --attributes file://a.json | Change visibility timeout, retention, redrive policy, ... | RedrivePolicy is a JSON string inside the JSON |
aws sqs send-message --queue-url U --message-body "hi" [--delay-seconds 10] | Send a message | FIFO needs --message-group-id (and a dedup id unless content-based dedup is on) |
aws sqs send-message-batch --queue-url U --entries file://e.json | Send up to ten messages | Per-entry failures are reported in the response, not as an error |
aws sqs receive-message --queue-url U --max-number-of-messages 10 --wait-time-seconds 20 | Receive messages with long polling | Without a wait time you short-poll and may get an empty reply even when messages exist |
... --visibility-timeout 60 --attribute-names All --message-attribute-names All | Per-call visibility timeout and attributes | Messages become visible again after the timeout unless deleted |
aws sqs delete-message --queue-url U --receipt-handle H | Acknowledge (delete) a received message | Receipt handle comes from receive-message and changes per receive |
aws sqs change-message-visibility --queue-url U --receipt-handle H --visibility-timeout 120 | Extend or shorten processing time | change-message-visibility-batch for many |
aws sqs purge-queue --queue-url U | Delete all messages | Also deletes in-flight messages; the deletion takes up to 60 seconds and cannot be undone |
aws sqs list-dead-letter-source-queues --queue-url DLQ_URL | Which queues use this as DLQ | Takes the DLQ URL |
aws sqs start-message-move-task --source-arn DLQ_ARN [--destination-arn Q_ARN] | Redrive from a DLQ | Also --max-number-of-messages-per-second; see list-message-move-tasks and cancel-message-move-task |
aws sqs tag-queue, list-queue-tags, add-permission, remove-permission | Tags and queue policy statements | Check the queue policy when cross-account access fails |
12
Chapter 12 - Common mistakes
Messaging CLI Mistakes
⚠ The ones that cost real time
- **
--broker-listor--zookeeperon Kafka 4.0.** Removed; use--bootstrap-server. - **Running the console consumer without
--group.** Each run creates a throwaway group. - Resetting offsets while the app is running. The reset is refused for active groups, or the app overwrites it.
- **Forgetting
--execute(or adding it too early).**--reset-offsetsis a dry run by default. - Decreasing partitions. Not possible; create a new topic and migrate.
- **
rabbitmqctl reseton a node you wanted to keep.** It wipes the node. - **Mixing v1 and v2
rabbitmqadminsyntax.**name="q"is v1,--name "q"is v2. - SQS short polling in scripts. Use
--wait-time-seconds 20. - **Treating
ApproximateNumberOfMessagesas exact.** It is eventually consistent. - Purging a production queue to "fix" a backlog. Messages are gone; move them to a DLQ or fix the consumer.
13
Chapter 13 - Go deeper
Long-form pages and what was checked
| Topic | Page |
|---|---|
| Kafka internals: partitions, replication, offsets | Kafka Architecture |
| Producer and consumer behaviour behind the flags | Kafka Producers & Consumers |
| Spring Kafka | Kafka with Spring |
| RabbitMQ concepts: exchanges, queues, quorum queues | RabbitMQ |
| SQS, SNS, MSK, Amazon MQ | AWS Messaging |
| Lag, DLQs, monitoring | Reliability & Operations |
Version note
Checked on 2026-10-31. Kafka 4.0: option names of kafka-topics, kafka-console-consumer, kafka-console-producer (including parse.key, key.separator, print.* properties), kafka-consumer-groups (including --dry-run as the default for reset), kafka-get-offsets (default --time latest), kafka-configs, kafka-dump-log and kafka-producer-perf-test against the 4.0 branch of the Apache Kafka source, and the tool list against the 4.0 bin/ folder. RabbitMQ: rabbitmqctl, rabbitmq-diagnostics and rabbitmq-queues command names against the man pages in the RabbitMQ server repository (main) and rabbitmqadmin v2 syntax against the RabbitMQ documentation page for rabbitmqadmin v2 (its command-group list has no publish or get-message commands, so none are shown). AWS: subcommands and option names against aws sqs help on AWS CLI 2.32.25 run locally. Not run: no Kafka, RabbitMQ or AWS account was used, so behaviour notes (for example RabbitMQ side effects such as reset wiping a node) come from the vendor documentation and experience, not from a run here.