[Freeswitch-users] load average is hight (Very urgent please)

[Chris Mylonas]

If you have ngrep installed on CentOS 5 (you will need the epel repo)
yum install ngrep

You can view port 5060 traffic quite easily with
ngrep -W byline port 5060


Your freeswitch logs probably have hundreds/thousands of registration attempts per minute - have a look at those
These rego attempts need to be processed, so each one takes a small amount of resources.
If you have one hundred or more rego attempts per second, then you'll certainly have a problem.
Your CPU also has 512KB of cache (very fast memory) - modern Xeon's have 24x this amount, so are a little bit more resilient to a strain on resources**

HTH
Chris

**I would imagine

On 14/05/2012, at 8:56 PM, ghallab wrote:

> Thank you for your quick replay.
> Could you tell me please how do you come to this conclusion?
> and if this is a brute-force, it can make my system slow all the time?
> On 05/14/2012 09:21 AM, Muhammad Shahzad wrote:
>> 
>> Seems like you system is under SIP brute-force attack. Somebody is trying to break into your freeswitch box. Just find that user's ip and block it in IPTables.
>> 
>> If problem persists and hacker comes from another IP then you probably need to configure Fail2Ban service.
>> 
>> Thank you.
>> 
>> 
>> On Mon, May 14, 2012 at 11:51 AM, ghallab <tarik.bts.gi at gmail.com> wrote:
>> Hi all,
>>  This days am experiencing a problem with Freeswitch: it seems that it needs more hardware resources and voicemail don't work any more and it make a long delay to process call transfer. should I compile the last version to revolve the problem or try to increase hardware resources? I notice that I have anther instance of FS running fine in the same conditions.  
>> I tried to collect the maximum information that I can:
>> OS version: CentOS release 5.4
>> the cpu info is:
>> http://pastebin.freeswitch.org/19039 
>> the mem info is:
>> http://pastebin.freeswitch.org/19040
>> 
>> the out  put of the command top is 
>> http://pastebin.freeswitch.org/19038
>> 
>> the number of calls when I made the test was:
>> 5 total.
>> 
>> the out put of gcore and gdb:
>> http://pastebin.freeswitch.org/19041
>> 
>> number of sofia's profiles:
>> 5 sofia profiles and 1 alias 
>> number of calls that I want:
>> 30  simultaneous calls 
>> 
>> I want also to notice that I get all the time some warning messages like 
>> 
>> 2012-05-11 14:36:10.716722 [WARNING] sofia_reg.c:1442 SIP auth challenge (REGISTER) on sofia profile 'internal' for [7351 at domain] from ip @ip   
>> 
>> 
>> 
>> 
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>> 
>> 
>> 
>> 
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>> 
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>> 
>> 
>> 
>> 
>> -- 
>> Muhammad Shahzad
>> -----------------------------------
>> CISCO Rich Media Communication Specialist (CRMCS)
>> CISCO Certified Network Associate (CCNA)
>> Cell: +92 334 422 40 88
>> MSN: shari_786pk at hotmail.com
>> Email: shaheryarkh at googlemail.com
>> 
>> 
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>> 
>> 
>> 
>> 
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>> 
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
> 
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
> 
> 
> 
> 
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20120514/8cc7880a/attachment-0001.html