[asterisk-users] tired of "midget packet received" warnings

[Tzafrir Cohen]

On Sat, Nov 08, 2008 at 09:30:59PM +0200, Atis Lezdins wrote:
> On Sat, Nov 8, 2008 at 9:20 AM, Louis-David Mitterrand
> <vindex+lists-asterisk-users at apartia.org> wrote:
> > On Sat, Nov 08, 2008 at 02:33:18PM +1100, Rob Hillis wrote:
> >> Tzafrir Cohen wrote:
> >> > On Fri, Nov 07, 2008 at 09:29:20AM +0000, Tim Panton wrote:
> >> >
> >> >
> >> >> I'd take this warning seriously. It means that your monitoring app isn't
> >> >> monitoring what you think it is.
> >> >>
> >> >> I always want to know when I get malformed protocol packets in. It is
> >> >> always bad news, mostly either a misconfiguration (your case), an
> >> >> attack,
> >> >> (ie my firewall is not protecting this service) or a sign of a switch
> >> >> port going bad.
> >> >>
> >> >> Fix the cause not the symptom.
> >> >>
> >> >
> >> > Maybe it's me, but I think that "warning" should be regarding a problem
> >> > I can fix. Malformed network content does not neceserily fall under that
> >> > definition. "notice"?
> >> >
> >>
> >> Absolutely it does.  Warnings of malformed packets are often (as
> >> mentioned above) symptomatic of network problems.  Fix the network
> >> problem, fix the warning.
> >
> > C'mon, even firewalls give you the option of _not_ logging malformed
> > packets! fiaif does. Else your logfile would be the weak point of your
> > system.
> >
> > And what if you can't fix the source of these packets? And what if
> > friendly peers outside of your realm (likely to iax-call you, so can't
> > block them) sends these packets? There are holes in your logic.
> >
> > So asterisk has to be puritan of the lot? Holier than thou? Pro-life
> > with malformed packets? I see where this is going and I don't like it
> > one bit.
> >
> 
> Asterisk offers very much the same flexibility. You can disable
> specific log levels (for example warnings) in logger.conf 

Sure. And I can always run '2>/dev/null' . But this means I won't see
useful warnings. And I will ignore other imporant warnings.

> or you can
> log everything to syslog, where filter out this specific message.

Who needs log levels, then?

-- 
               Tzafrir Cohen
icq#16849755              jabber:tzafrir.cohen at xorcom.com
+972-50-7952406           mailto:tzafrir.cohen at xorcom.com
http://www.xorcom.com  iax:guest at local.xorcom.com/tzafrir