This seems to be the same issue as is reported at https://issues.apache.org/jira/browse/AMQ-5854

When the transport fails the failover transport invokes transportListener.transportInterupted() which goes through all the consumers. If any consumers are using a transaction it tracks the messages that already have been delivered in org.apache.activemq.ActiveMQMessageConsumer#previouslyDeliveredMessages list. If the messages are not delivered to the same consumers after failover then the transaction will be rolled back.

However there seems to be a race condition between

• �transportListener.transportInterupted()

and

• org.apache.activemq.ActiveMQMessageConsumer#acknowledge() which is invoked by xa.end()

As part of the ActiveMQMessageConsumer#acknowledge() it checks for elements in the org.apache.activemq.ActiveMQMessageConsumer#previouslyDeliveredMessages list.
This list is populated by the a task kicked off by the �Failover transport when it invokes transportListener.transportInterupted() .

If acknowledge() wins the race then no messages will be in the org.apache.activemq.ActiveMQMessageConsumer#previouslyDeliveredMessages. The acknowledge() is not aware of any previously received message in the transaction, so it will complete successfully.

This can result in a scenario where xa transaction can complete successfully (after been recreated/replayed by the failover transport) but the message CAN be sent to another consumer. This result in it will be processed twice.