Registrations work by the client sending a REGISTER to the server, which returns 401 to challenge and client resends REGISTER with the authentication details.
The register has an expiry time. To remain registered the client must reREGISTER within this time, and each REGISTER has its own 401 authentication (to prevent replay attacks).
What you're seeing is a log message each time the registration is renewed. That's why you still see it even though FS is apparently idle.
The log message really is only informative. It logs at WARNING level so that you can use fail2ban while only logging serious messages so you don't get massive log files.
FS will log both the initial REGISTER/401 then at the 2nd REGISTER whether it succeeds or fails. Both are required to detect bots looking to break into an insecure or DDOS a SIP server, since the client might never send the 2nd REGISTER.
If you are not using fail2ban and want quieter logs, set the log-auth-failures param to false on the relevant Sofia profile. Add it if it doesn't exist.
mod_fail2ban provides native integration without having to log these messages for fail2ban to detect. If you use it you'll probably still need to set the above param. (Disclaimer: I haven't used the module).
Steve
Hi,
Thanks. If there is no activity for a while then calls drops out and I need to re-start the FS. I also see these messages frequently after each call and after
registration and while FS is idle.
Am not sure why is this happening.
I keep getting those messages every 5 mins.
Regards,
Archana
From: Mick Stevens [mailto:mick.stevens@smartipx.com]
Sent: 27 December 2012 12:49
To: Archana Venugopan
Subject: Re: [Freeswitch-users] repeated registration messages in logs
Hi Archana,
This is just your SIP client (softphone etc) sending keep alive/SIP re-register messages. You can normally adjust this in the settings of your client.
I find setting "reregister every 300 seconds" normally works ok for me.
--
Regards
Mick Stevens
Communications Technologist
Smart IPX Ltd
Tel/Fax. +44(0)20 7001 6869