<div>As suggested I enabled error logging via error_route to put in log full SIP message bodies</div><div><br></div>Unfortunetly it doesn't seem to work with this type of error:<div>ERROR:core:parse_uri: unknown URI param list excedeed</div>
<div><br></div><div>For other parse errors I see message dumps, but not for this</div><div><br></div><div>So for some reason I'm unable to catch this errors using error_route</div><div><br></div><div>Any hints?</div><div>
<div><br><br><div class="gmail_quote">2013/2/15 Bogdan-Andrei Iancu <span dir="ltr"><<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Ovidiu,<br>
<br>
Indeed, investigating a bit around would make sense :)<br>
<br>
Let;s see if Adam has some info for us.<div class="im HOEnZb"><br>
<br>
Regards,<br>
<br>
Bogdan-Andrei Iancu<br>
OpenSIPS Founder and Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><br>
<br>
<br></div><div class="HOEnZb"><div class="h5">
On 02/14/2013 04:24 PM, Ovidiu Sas wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello Bogdan,<br>
<br>
Bumping the default value from 5 to 10 shouldn't be a problem,<br>
although I've never seen URIs with more than 5 unknown params. Before<br>
bumping the default value, we should investigate to see if those<br>
unknown params are really 'unknown'. Maybe some of those params<br>
aren't really unknown and should be parsed.<br>
<br>
@Adam<br>
Did you had a chance to enable debug logs and collect such a URI?<br>
All you need is to do is to enable the debug logs for a short period<br>
of time and check syslogs.<br>
<br>
-ovidiu<br>
<br>
On Thu, Feb 14, 2013 at 3:33 AM, Bogdan-Andrei Iancu<br>
<<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Ovidiu,<br>
<br>
It might be wiser to have a default value of 10 to avoid such issues in the<br>
future. What do you think ?<br>
<br>
Regards,<br>
<br>
Bogdan-Andrei Iancu<br>
OpenSIPS Founder and Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.<u></u>com</a><br>
<br>
<br>
<br>
On 02/14/2013 01:08 AM, Ovidiu Sas wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
It seems that you are having more then 5 unknown URI params.<br>
One thing that you can do is to recompile with an increased number of<br>
URI_MAX_U_PARAMS.<br>
See parser/msg_parser.h and increase the URI_MAX_U_PARAMS from 5 to 10.<br>
#define URI_MAX_U_PARAMS 10<br>
<br>
If you enable debug logs, you should be able to see the URI that is<br>
causing issues.<br>
you can temporarily increase the debug log and the restore it via fifo:<br>
opensipsctl fifo debug 9<br>
opensipsctl fifo debug 3<br>
<br>
Regards,<br>
Ovidiu Sas<br>
<br>
On Wed, Feb 13, 2013 at 5:05 PM, Adam Raszynski<<a href="mailto:netcentrica@gmail.com" target="_blank">netcentrica@gmail.<u></u>com</a>><br>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi<br>
<br>
Recently I have discovered increasing amount of the following errors in<br>
my<br>
logs:<br>
<br>
Feb 13 09:36:59 node1 /usr/sbin/opensips[10458]: ERROR:core:parse_uri:<br>
unknown URI param list exceeded<br>
<br>
I see this error is repeated many thousands of times in my log<br>
<br>
Questions:<br>
- What does this error mean?<br>
- How to add source IP address of SIP request that caused error to log?<br>
Or<br>
how to add full SIP request body causing that error to log?<br>
- Is it a sign of any type of DOS attack?<br>
</blockquote></blockquote></blockquote></blockquote>
</div></div></blockquote></div><br></div></div>