[OpenSIPS-Users] Help trace source of error: unknown URI param list excedeed

[Ovidiu Sas]

Hello Bogdan,

Bumping the default value from 5 to 10 shouldn't be a problem,
although I've never seen URIs with more than 5 unknown params.  Before
bumping the default value, we should investigate to see if those
unknown params are really 'unknown'.  Maybe some of those params
aren't really unknown and should be parsed.

@Adam
Did you had a chance to enable debug logs and collect such a URI?
All you need is to do is to enable the debug logs for a short period
of time and check syslogs.

-ovidiu

On Thu, Feb 14, 2013 at 3:33 AM, Bogdan-Andrei Iancu
<bogdan at opensips.org> wrote:
> Hi Ovidiu,
>
> It might be wiser to have a default value of 10 to avoid such issues in the
> future. What do you think ?
>
> Regards,
>
> Bogdan-Andrei Iancu
> OpenSIPS Founder and Developer
> http://www.opensips-solutions.com
>
>
>
> On 02/14/2013 01:08 AM, Ovidiu Sas wrote:
>>
>> It seems that you are having more then 5 unknown URI params.
>> One thing that you can do is to recompile with an increased number of
>> URI_MAX_U_PARAMS.
>> See parser/msg_parser.h and increase the URI_MAX_U_PARAMS from 5 to 10.
>> #define URI_MAX_U_PARAMS 10
>>
>> If you enable debug logs, you should be able to see the URI that is
>> causing issues.
>> you can temporarily increase the debug log and the restore it via fifo:
>> opensipsctl fifo debug 9
>> opensipsctl fifo debug 3
>>
>> Regards,
>> Ovidiu Sas
>>
>> On Wed, Feb 13, 2013 at 5:05 PM, Adam Raszynski<netcentrica at gmail.com>
>> wrote:
>>>
>>> Hi
>>>
>>> Recently I have discovered increasing amount of the following errors in
>>> my
>>> logs:
>>>
>>> Feb 13 09:36:59 node1 /usr/sbin/opensips[10458]: ERROR:core:parse_uri:
>>> unknown URI param list exceeded
>>>
>>> I see this error is repeated many thousands of times in my log
>>>
>>> Questions:
>>> - What does this error mean?
>>> - How to add source IP address of SIP request that caused error to log?
>>> Or
>>> how to add full SIP request body causing that error to log?
>>> - Is it a sign of any type of DOS attack?