Koozali.org: home of the SME Server

Obsolete Releases => SME VoIP (Asterisk, SAIL etc) => Topic started by: compsos on August 06, 2012, 12:46:08 PM

Title: Does anyone know what this means?
Post by: compsos on August 06, 2012, 12:46:08 PM

We have a system with this turning up in the system message log (ie) /var/log/messages not the asterisk one

Code: [Select]

Aug  6 14:33:01 server root: Enforcer -> Hung up SIP/501-00000064 out of credit
Aug  6 14:36:01 server root: Enforcer -> Hung up SIP/501-00000066 out of credit
Aug  6 14:53:01 server root: Enforcer -> Hung up SIP/501-00000079 out of credit
We have checked and it has nothing to do with the VOIP provider but only happens on one extension. The error codes in Asterisk do not talk of an Enforcer. I think it may be benign but just in case someone knows of the source of the message. Thanks.

Title: Re: Does anyone know what this means?
Post by: compsos on August 14, 2012, 10:43:34 AM

Have a second independent system doing this. And it breaks the current call when it happens. The carrier has turned up blanks.

Any ideas anyone?

Title: Re: Does anyone know what this means?
Post by: compsos on August 14, 2012, 01:33:11 PM

Could it be from a Juniper switch inside the Telstra system? Do we have anyone with carrier level experience?

Title: Re: Does anyone know what this means?
Post by: SARK devs on August 14, 2012, 11:12:57 PM

I have no idea what the message means but if it were one of my phones I'd wonder if someone has compromised the phone itself and is attempting to send calls from it.  We have seen such things in the past and one of the big carriers here suffered from it for a while with a particular phone type but I can't remember which one.

Best

S

Title: Re: Does anyone know what this means?
Post by: compsos on August 14, 2012, 11:24:04 PM

Thanks Jeff
We have seen this on 2 independent systems. The first is a straight Telstra Business connection using a Yealink phone. The 2nd a TPG but offnet meaning via Telstra equipment using a Snom M9. It is not external hijack as I watch the message appear and the call dropped.

We have done some research and it looks like Enforcer from Juniper switches used for ALG and BGP controls. Telstra does use Juniper switches. Now just need to find some way of proving the source of the message. Was thinking of a sip trace from the M9. Any suggestions?

Title: Re: Does anyone know what this means?
Post by: compsos on August 25, 2012, 01:15:59 AM

If you get this message, it appears to be caused by a routine trying to limit calls to a max duration but if the script does not get the default 14400 value but zero it cuts off the call.
To stop this behaviour # out the line in /etc/cron.d/sark file.
Jeff is there a way of blocking it's reactivation during reinstalls or upgrades?
Also maybe changing the syslog output from "Out of Credit" to something like "Max call duration reached" along with a reference back to the srkEnforcer script seeing as this was logged in the system log and not asterisk?

Title: Re: Does anyone know what this means?
Post by: SARK devs on August 26, 2012, 12:43:45 PM

Hello Gordon

This bug has been fixed in 3.2.0-15 and 4.0.0-7.   If you apply either of these releases they will fix any existing issues you may have with this limiter.

The 3.2 release is available from the download site.  The 4.x alpha will be available shortly.

Kind Regards

S

Title: Re: Does anyone know what this means?
Post by: SARK devs on August 26, 2012, 09:52:57 PM

please hold on applying the above update. Ther may still be an issue with it and we are working through it.

Best

Jeff

Title: Re: Does anyone know what this means?
Post by: SARK devs on August 27, 2012, 07:21:10 PM

3.2.0-16 should fix.

Please let me know how you get on with it.

S

Title: Re: Does anyone know what this means?
Post by: compsos on September 08, 2012, 07:09:35 AM

So far have not seen any problems with 3.2.0-16. Thanks Jeff