[asterisk-users] Changing storm-prevention behaviour in logger.conf

[Barry Miller]

On Sun, Apr 18, 2010 at 08:21:57PM +0200, Remco Bressers wrote:
> 
> On Apr 18, 2010, at 12:40 AM, Barry Miller wrote:
> 
> > On Sat, Apr 17, 2010 at 11:14:23PM +0200, Remco Bressers wrote:
> >> Dear List,
> >> 
> >> According to https://issues.asterisk.org/view.php?id=14905 there is a storm
> >> prevention mechanism in newer Asterisks. If i look in my logfile, i see : 
> >> 
> >> [2010-04-17 15:12:01] NOTICE[1190] chan_sip.c: Registration from '"xxxx"
> >> <sip:xxx at xxx.xxx.xxx.xxx>' failed for 'xx.xx.xx.xx' - Wrong password
> >> [2010-04-17 15:12:01] NOTICE[1190] chan_sip.c: Last message repeated 3
> >> times
> >> 
> >> This IS a good thing to do, but i want to disable this behaviour. We are
> >> using fail2ban to ban scripts and people from the Asterisk system. On
> >> version 1.4.23 this worked fine, but now this mechanism is in place, i
> >> cannot use fail2ban anymore.
> >> 
> >> Is there any option to disable this behaviour, or even better, add it to
> >> logger.conf so anybody can decide what to do? I just want all logging and it seems impossible now.
> >> Maybe a patch on the source?
> > 
> > If you use a newer version of rsyslogd to do your logging, there is a
> > global configuration directive:
> > 
> > 	$RepeatedMsgReduction off
> > 
> > that will do what you are asking.  The issue #14905 patch you mention is
> > not in 1.6.2.x.
> 
> 
> Hi,
> 
> Well, this sounds fair, but this happened after an upgrade to 1.4.29 from 1.4.23. Nothing else changed in my setup after that.
> 
> My logger.conf :
> 
> [general]
> dateformat=%F %T
> 
> [logfiles]
> console => notice,warning,error
> messages => notice,warning,error
> 
> This tells me i'm not using the syslog feature at all and /var/log/asterisk/messages is generated by Asterisk and not by syslogd 

Hi.

First, I'm sorry I didn't look more closely at your in your example.  Of
course you're not using syslog, but rather asterisk's own logging.

Second, I just downloaded 1.4.29.  The patch that does the "message
repeated" stuff is just not there, as Tilghman said.  Is it possible that
someone applied that patch to your source?  Have you tried downloading
the 1.4.29 tarball again and recompiling?  If you installed asterisk as
a package from somebody's repo, I can't really say, but it seems highly
unlikely that the patch would be present.

I hope this helps a little bit.

-- 
Barry