do you have the proxy log for the same time period? sipxbridge is throwing a timer already cancelled. which I havent seen before. Normally this sounds like a typical SIP DoS but your log isn't showing any sip vicious attempts that I can see, unless they occurred earlier and java has already ran out of process and the attack has ended.
Maybe a bit of the log prior to the onset of failed calls with give more insight. Can you upload them (bridge and proxy) somewhere for us to look at? -M >>> Sven Evensen <[email protected]> 07/03/12 9:47 AM >>> We just had a serious fault at a customer where suddenly all calls were failing. They have sipx 4.4 and a bit over 100 users. Normally they have 5-10 simultaneous calls, but they could see in the "SIP Trunk SBC Statistics" that there were over 40 connected calls and rising. I had to recover service quickly but saw the "top cpu" looked normal, disk space ok and and "free" memory ok. A quick look in wireshark and I saw many "DECLINE" coming back from SIP trunk. Well I restarted the three main services "siptrunking, sipxproxy and sipregistrar" and this recovered the fault. The SIP trunk is IP authenticated so there was no re-register that could recover a faulty SIP trunk. Therefore I believe the issue was in sipX. I have a capture of one of the first calls that was failing and it does look very strange indeed. I also have the sipxbridge.log for that call, luckily it was in debug mode. In the capture 192.168.3.44 is ip of SNOM phone, 193.246.242.135 is SIP trunk (ACME packet to be precise). Customer said this had happened one time before, at least same symptoms. Sven -- Sven Evensen, Operations Consultant OnRelay Elizabeth House │ 39 York Road, London SE1 7NQ, UK │ +44 (0) 207 902 8123 │ mailto:[email protected] │ www.onrelay.com This electronic message transmission contains information from OnRelay, Ltd., that may be confidential or privileged. The information is intended solely for the recipient and use by any other party is not authorised. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information or any attachment, is prohibited. If you have received this electronic transmission in error, please notify us immediately by electronic mail ([email protected]) and delete this message, along with any attachments, from your computer. Registered in England No 04006093 | Registered Office 1st Floor, 236 Gray's Inn Road, London WC1X 8HB
_______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users/
