Hi Matt, Here is link to the full capture and logs. sipxproxy was not in debug unfortunately. https://docs.google.com/open?id=0B6OtrM5F9wLsZFFrd2thYXBEVm8
Sven On Tue, Jul 3, 2012 at 4:38 PM, Matt White <[email protected]> wrote: > do you have the proxy log for the same time period? > > sipxbridge is throwing a timer already cancelled. which I havent seen > before. Normally this sounds like a typical SIP DoS but your log isn't > showing any sip vicious attempts that I can see, unless they occurred > earlier and java has already ran out of process and the attack has ended. > > Maybe a bit of the log prior to the onset of failed calls with give more > insight. Can you upload them (bridge and proxy) somewhere for us to look > at? > > -M > > >>> Sven Evensen <[email protected]> 07/03/12 9:47 AM >>> > We just had a serious fault at a customer where suddenly all calls were > failing. They have sipx 4.4 and a bit over 100 users. Normally they have > 5-10 simultaneous calls, but they could see in the "SIP Trunk SBC > Statistics" that there were over 40 connected calls and rising. I had to > recover service quickly but saw the "top cpu" looked normal, disk space ok > and and "free" memory ok. > > A quick look in wireshark and I saw many "DECLINE" coming back from SIP > trunk. Well I restarted the three main services "siptrunking, sipxproxy and > sipregistrar" and this recovered the fault. The SIP trunk is IP > authenticated so there was no re-register that could recover a faulty SIP > trunk. Therefore I believe the issue was in sipX. > > I have a capture of one of the first calls that was failing and it does > look very strange indeed. I also have the sipxbridge.log for that > call, luckily it was in debug mode. > > In the capture 192.168.3.44 is ip of SNOM phone, 193.246.242.135 is SIP > trunk (ACME packet to be precise). > > Customer said this had happened one time before, at least same symptoms. > > Sven > > -- > > *Sven Evensen, Operations Consultant* > > *OnRelay* > > Elizabeth House │ 39 York Road, London SE1 7NQ, UK │ +44 (0) 207 902 8123│ > mailto:[email protected] <[email protected]> │ > www.onrelay.com > > > This electronic message transmission contains information from OnRelay, > Ltd., that may be confidential or privileged. The information is intended > solely for the recipient and use by any other party is not authorised. If > you are not the intended recipient, be aware that any disclosure, copying, > distribution or use of the contents of this information or any attachment, > is prohibited. If you have received this electronic transmission in error, > please notify us immediately by electronic mail ([email protected]) and > delete this message, along with any attachments, from your computer. > Registered in England No 04006093 ¦ Registered Office 1st Floor, 236 Gray's > Inn Road, London WC1X 8HB > > > > _______________________________________________ > sipx-users mailing list > [email protected] > List Archive: http://list.sipfoundry.org/archive/sipx-users/ > -- *Sven Evensen, Operations Consultant* *OnRelay* Elizabeth House │ 39 York Road, London SE1 7NQ, UK │ +44 (0) 207 902 8123 │ mailto:[email protected] <[email protected]> │ www.onrelay.com This electronic message transmission contains information from OnRelay, Ltd., that may be confidential or privileged. The information is intended solely for the recipient and use by any other party is not authorised. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information or any attachment, is prohibited. If you have received this electronic transmission in error, please notify us immediately by electronic mail ([email protected]) and delete this message, along with any attachments, from your computer. Registered in England No 04006093 ¦ Registered Office 1st Floor, 236 Gray's Inn Road, London WC1X 8HB
_______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users/
