as link below: http://wiki.freeswitch.org/wiki/Mod_lua/Serving_Configuration  when registering (REGISTER) (register to sip phone) 2012-07-04 10:52:24.480734 [NOTICE] switch_cpp.cpp:1227 Debug from gen_dir_user_xml.lua, provided params: 'Event-Name: REQUEST_PARAMS Core-UUID: dc37b240-c596-11e1-b315-0daf7608d9db FreeSWITCH-Hostname: PBX FreeSWITCH-Switchname: PBX FreeSWITCH-IPv4: 192.168.10.89 FreeSWITCH-IPv6: %3A%3A1 Event-Date-Local: 2012-07-04%2010%3A52%3A24 Event-Date-GMT: Wed,%2004%20Jul%202012%2006%3A22%3A24%20GMT Event-Date-Timestamp: 1341382944480734 Event-Calling-File: sofia_reg.c Event-Calling-Function: sofia_reg_parse_auth Event-Calling-Line-Number: 2364 Event-Sequence: 1233 action: sip_auth sip_profile: internal sip_user_agent: eyeBeam%20release%201102q%20stamp%2051814 sip_auth_username: 1000 sip_auth_realm: 192.168.10.89 sip_auth_nonce: 9e86a118-c5a0-11e1-b324-0daf7608d9db sip_auth_uri: sip%3A192.168.10.89 sip_contact_user: 1000 sip_contact_host: 192.168.18.120 sip_to_user: 1000 sip_to_host: 192.168.10.89 sip_from_user: 1000 sip_from_host: 192.168.10.89 sip_request_host: 192.168.10.89 sip_auth_qop: auth sip_auth_cnonce: ccbce7a4be40e6660e1a39350b5610b9 sip_auth_nc: 00000001 sip_auth_response: b7c175e2b6680b43300a36aa3c50356a sip_auth_method: REGISTER key: id user: 1000 domain: 192.168.10.89 ip: 192.168.18.120 and when user want to logout(unregistered from sip phone) 2012-07-04 10:52:53.440720 [NOTICE] switch_cpp.cpp:1227 Debug from gen_dir_user_xml.lua, provided params: 'Event-Name: REQUEST_PARAMS Core-UUID: dc37b240-c596-11e1-b315-0daf7608d9db FreeSWITCH-Hostname: PBX FreeSWITCH-Switchname: PBX FreeSWITCH-IPv4: 192.168.10.89 FreeSWITCH-IPv6: %3A%3A1 Event-Date-Local: 2012-07-04%2010%3A52%3A53 Event-Date-GMT: Wed,%2004%20Jul%202012%2006%3A22%3A53%20GMT Event-Date-Timestamp: 1341382973440720 Event-Calling-File: sofia_reg.c Event-Calling-Function: sofia_reg_parse_auth Event-Calling-Line-Number: 2364 Event-Sequence: 1254 action: sip_auth sip_profile: internal sip_user_agent: eyeBeam%20release%201102q%20stamp%2051814 sip_auth_username: 1000 sip_auth_realm: 192.168.10.89 sip_auth_nonce: 9e86a118-c5a0-11e1-b324-0daf7608d9db sip_auth_uri: sip%3A192.168.10.89 sip_contact_user: 1000 sip_contact_host: 192.168.18.120 sip_to_user: 1000 sip_to_host: 192.168.10.89 sip_from_user: 1000 sip_from_host: 192.168.10.89 sip_request_host: 192.168.10.89 sip_auth_qop: auth sip_auth_cnonce: 6096bb96b4316b2a47bf52299b9156f5 sip_auth_nc: 00000002 sip_auth_response: 7bdb41c435cb7f46bc44b52fce5c7034 sip_auth_method: REGISTER key: id user: 1000 domain: 192.168.10.89 ip: 192.168.18.120 in both the event sip_auth_method is REGISTERED and every header parameter are the same, but in the second one the user is not registered now ! how to find out the different between them ?