Console Warning messages for invite and registration

[krishan]

hello everyone, my console is full with these messages, my registration timer is 120 seconds and all phones are at remote locations behind NAT, PBX is not behind NAT (its multi Tenant Environment) , I AM GETTING THESE MESSAGES FOR EVERY PHONE, I thing message for phones and BLF comes every 2 minutes for each phone. Debug messages for gateway are more frequent about every minute, is there any option that i turned ON by mistake or I can ignore them ? we have about 18 phones registered to this PBX


2022-01-26 08:50:02.061707 95.70% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [103@domain1.ca] from ip X.X.X.X
2022-01-26 08:50:04.721645 95.97% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile 'NAT' for [102@DOMAIN2.ca] from ip Y.Y.Y.Y
2022-01-26 08:50:06.261665 95.80% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [102@DOMAIN1.ca] from ip X.X.X.X
2022-01-26 08:50:07.461693 95.77% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [101@DOAMIN1.ca] from ip X.X.X.X
2022-01-26 08:16:36.121683 96.30% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [park+*5901@DOMAIN3.ca] from ip Z.Z.Z.Z
2022-01-26 08:16:36.401635 96.30% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [102@DOAMIN3.CA] from ip Z.Z.Z.Z
2022-01-26 08:16:36.661691 96.30% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [103@ovp.ucni.ca] from ip Z.Z.Z.Z
2022-01-26 08:16:36.941630 95.93% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [101@ovp.ucni.ca] from ip Z.Z.Z.Z
2022-01-26 08:16:37.201660 95.93% [WARNING] sofia_reg.c:1861 SIP auth challenge (INVITE) on sofia profile 'NAT' for [*780@DOAMIN3.CA] from ip Z.Z.Z.Z
2022-01-26 08:16:38.381696 95.63% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile 'NAT' for [104@DOMAIN3.ca] from ip Z.Z.Z.Z

2022-01-26 08:52:39.581692 96.60% [DEBUG] sofia_reg.c:2665 Changing expire time to 312 by request of proxy sip: Gateway PBX
2022-01-26 08:52:39.681665 96.60% [DEBUG] sofia_reg.c:2665 Changing expire time to 785 by request of proxy sip:sip.telnyx.com
2022-01-26 08:52:51.621851 96.37% [DEBUG] sofia_reg.c:2665 Changing expire time to 301 by request of proxy sip: gateway
2022-01-26 08:52:55.601653 96.63% [DEBUG] sofia_reg.c:2665 Changing expire time to 300 by request of proxy sip: gateway PBX IP
2022-01-26 08:53:09.621661 96.53% [DEBUG] sofia_reg.c:2665 Changing expire time to 317 by request of proxy sip: gateway PBX IP
2022-01-26 08:53:19.581746 96.73% [DEBUG] sofia_reg.c:2665 Changing expire time to 301 by request of proxy sip: gateway PBX IP

*** Gateway PBX is another PBX registered as Gateway to Fusion, Fusion version is 4.5.30

*** X.X.X.X, Y.Y.Y.Y, Z.Z.Z.Z ARE PUBLIC PUBLIC IPs for 3 different locations

Krishan

 

[Adrian Fretwell]

root@a2es-test-12:~# fs_cli
Type /help <enter> to see a list of commands


+OK log level  [7]
freeswitch@a2es-test-12>
freeswitch@a2es-test-12> fsctl loglevel ERR
+OK log level: ERR [3]

freeswitch@hvox4> /quit
root@a2es-test-12:~#

 

[DigitalDaz]

@Adrian Fretwell That will stop fail2ban working will it not? I think the auth failure message is warning.

 

[Adrian Fretwell]

@Adrian Fretwell That will stop fail2ban working will it not? I think the auth failure message is warning.

I think you are right. I don't rely on Fail2ban so don' t always consider it when looking at log output - my bad!

As you know, the auth challenge process is a normal part of the SIP INVITE/REGISTRATION process, so I don't like to see it in the logs under normal circumstances. I only ever run my logs at the ERR level, there is too much to look at otherwise - maybe that's the wrong thing to do but it works for me.

I tend to use mod_dptools:log in the dialplan and specify the log level when it is something I want to get noticed.

Are there any more commonly accepted strategies for reducing the amount of log output?

 

[DigitalDaz]

I usually have my log level set to warning and console loglevel set to a higher one like error

 

[krishan]

Thanks for replay, I can change log level but are these messages normal ? Or there is anything I need to change in setup other than log level

 

[DigitalDaz]

If you change the loglevel, fail2nban won't catch the baddies so just ignore it.

You can change the console loglevel in fs_cli by typing "console loglevel 3" for example

 

[krishan]

Thank you very much, I will try that

 

[DigitalDaz]

Just for your info, the console loglevel will be whatever you set it to, the file loglevel will remain at a higher level so that your fail2ban continues to work