sipXecs instance goes offline after a certain date

Discussion:

Tim Byng

2012-06-25 16:33:37 UTC

This morning I came into work and found that I had issues with my sipXecs
instance. Here are the symptoms:

- Web admin / user portal down
- All phones not registered to sipXecs
- sipXecs not registered to ITSP
- sipXecs machine responds to ping
- sipXecs machine is accessible through putty

I rebooted the machine and noticed that the XFS service failed to start up.

I figured it might be a hardware failure, so I grabbed a known working
backup and restored it on my backup machine. This backup is a disk image,
not a sipXecs backup. I have tested this procedure a number of times in the
past (even with the same backup) and it has always worked as expected. This
time, however, I ran into the exact same symptoms as I did with the primary
machine. Based on this, the chances that it's a hardware issue are low
(same symptoms with two different machines).

The only thing that I could think of is that it had something to do with
the date and time. So I set the date in the bios to a day after the backup
was created, restored the backup again and voila, it worked! Once I set the
date back to the current date, the problem happened again.

My sipXecs reboots once a week Monday mornings, so the date in question was
likely sometime between June 18th and 25th.

I am using sipXecs 4.2.0.

Does anyone have any ideas what this could be? Since it's date related, I
was thinking that maybe it could be a virus that's dormant until a certain
date? I did a search, but didn't find anything that sounded like it could
be related. I'm not too familiar with viruses on Linux (or with Linux
itself).

Tony Graziano

2012-06-25 16:41:32 UTC

Permalink

I think you really need to :

1. Upgrade to 4.4
2. Get a snapshot if it happens again
3. CONFIRM that your system resources are available before assuming its a
sipx OR date tung. It's more likely a DOS attack and you aren't looking for
it...

Post by Tim Byng
This morning I came into work and found that I had issues with my sipXecs
- Web admin / user portal down
- All phones not registered to sipXecs
- sipXecs not registered to ITSP
- sipXecs machine responds to ping
- sipXecs machine is accessible through putty
I rebooted the machine and noticed that the XFS service failed to start up.
I figured it might be a hardware failure, so I grabbed a known working
backup and restored it on my backup machine. This backup is a disk image,
not a sipXecs backup. I have tested this procedure a number of times in the
past (even with the same backup) and it has always worked as expected. This
time, however, I ran into the exact same symptoms as I did with the primary
machine. Based on this, the chances that it's a hardware issue are low
(same symptoms with two different machines).
The only thing that I could think of is that it had something to do with
the date and time. So I set the date in the bios to a day after the backup
was created, restored the backup again and voila, it worked! Once I set the
date back to the current date, the problem happened again.
My sipXecs reboots once a week Monday mornings, so the date in question
was likely sometime between June 18th and 25th.
I am using sipXecs 4.2.0.
Does anyone have any ideas what this could be? Since it's date related, I
was thinking that maybe it could be a virus that's dormant until a certain
date? I did a search, but didn't find anything that sounded like it could
be related. I'm not too familiar with viruses on Linux (or with Linux
itself).
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/

--
~~~~~~~~~~~~~~~~~~
Tony Graziano, Manager
Telephone: 434.984.8430
sip: ***@voice.myitdepartment.net
Fax: 434.465.6833
~~~~~~~~~~~~~~~~~~
Linked-In Profile:
http://www.linkedin.com/pub/tony-graziano/14/4a6/7a4
Ask about our Internet Fax services!
~~~~~~~~~~~~~~~~~~

Using or developing for sipXecs from SIPFoundry? Ask me about sipX-CoLab
2013! <http://sipxcolab2013.eventbrite.com/?discount=tony2013%22>

--
LAN/Telephony/Security and Control Systems Helpdesk:
Telephone: 434.984.8426
sip: ***@voice.myitdepartment.net

Helpdesk Customers: http://myhelp.myitdepartment.net
Blog: http://blog.myitdepartment.net

Michael Picher

2012-06-25 17:05:53 UTC

Permalink

Certificate?

try re-generating your self signed certs...

On Mon, Jun 25, 2012 at 12:41 PM, Tony Graziano <

Post by Tony Graziano
1. Upgrade to 4.4
2. Get a snapshot if it happens again
3. CONFIRM that your system resources are available before assuming its a
sipx OR date tung. It's more likely a DOS attack and you aren't looking for
it...

--
~~~~~~~~~~~~~~~~~~
Tony Graziano, Manager
Telephone: 434.984.8430
Fax: 434.465.6833
~~~~~~~~~~~~~~~~~~
http://www.linkedin.com/pub/tony-graziano/14/4a6/7a4
Ask about our Internet Fax services!
~~~~~~~~~~~~~~~~~~
Using or developing for sipXecs from SIPFoundry? Ask me about sipX-CoLab
2013! <http://sipxcolab2013.eventbrite.com/?discount=tony2013%22>
Telephone: 434.984.8426
Helpdesk Customers: http://myhelp.myitdepartment.**net<http://myhelp.myitdepartment.net>
Blog: http://blog.myitdepartment.net
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/

--
Michael Picher, Director of Technical Services
eZuce, Inc.

300 Brickstone Square****

Suite 201****

Andover, MA. 01810
O.978-296-1005 X2015
M.207-956-0262
@mpicher <http://twitter.com/mpicher>
linkedin <http://www.linkedin.com/profile/view?id=35504760&trk=tab_pro>
www.ezuce.com

------------------------------------------------------------------------------------------------------------
There are 10 kinds of people in the world, those who understand binary and
those who don't.

Tim Byng

2012-06-25 17:09:11 UTC

Permalink

Post by Michael Picher
Certificate?
try re-generating your self signed certs...

I was thinking about that, too. I just figured that it was a long shot that
a cert expired error would basically bring the whole thing down. I'll give
that a try.

I'll also double check that it's not a DoS attack.

Tony Graziano

2012-06-25 17:18:55 UTC

Permalink

if it IS the certs, the vociemail system will not accept voicemails or
people wont be able to check voicemail. You can view the dates on the
certificate from your browser.

From the description, it sounds more likely (to me), this it is a resource

issue and noone has any of those real details.

Certificate?
try re-generating your self signed certs...
On Mon, Jun 25, 2012 at 12:41 PM, Tony Graziano <

Post by Tony Graziano
1. Upgrade to 4.4
2. Get a snapshot if it happens again
3. CONFIRM that your system resources are available before assuming its
a sipx OR date tung. It's more likely a DOS attack and you aren't looking
for it...

Post by Tim Byng
This morning I came into work and found that I had issues with my
- Web admin / user portal down
- All phones not registered to sipXecs
- sipXecs not registered to ITSP
- sipXecs machine responds to ping
- sipXecs machine is accessible through putty
I rebooted the machine and noticed that the XFS service failed to start up.
I figured it might be a hardware failure, so I grabbed a known working
backup and restored it on my backup machine. This backup is a disk image,
not a sipXecs backup. I have tested this procedure a number of times in the
past (even with the same backup) and it has always worked as expected. This
time, however, I ran into the exact same symptoms as I did with the primary
machine. Based on this, the chances that it's a hardware issue are low
(same symptoms with two different machines).
The only thing that I could think of is that it had something to do with
the date and time. So I set the date in the bios to a day after the backup
was created, restored the backup again and voila, it worked! Once I set the
date back to the current date, the problem happened again.
My sipXecs reboots once a week Monday mornings, so the date in question
was likely sometime between June 18th and 25th.
I am using sipXecs 4.2.0.
Does anyone have any ideas what this could be? Since it's date related,
I was thinking that maybe it could be a virus that's dormant until a
certain date? I did a search, but didn't find anything that sounded like it
could be related. I'm not too familiar with viruses on Linux (or with Linux
itself).
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/

--
Michael Picher, Director of Technical Services
eZuce, Inc.
300 Brickstone Square****
Suite 201****
Andover, MA. 01810
O.978-296-1005 X2015
M.207-956-0262
@mpicher <http://twitter.com/mpicher>
linkedin <http://www.linkedin.com/profile/view?id=35504760&trk=tab_pro>
www.ezuce.com
------------------------------------------------------------------------------------------------------------
There are 10 kinds of people in the world, those who understand binary and
those who don't.
_______________________________________________
sipx-users mailing list
List Archive: http://list.sipfoundry.org/archive/sipx-users/

Tim Byng

2012-06-25 17:37:43 UTC

Permalink

I checked my cert expiry date...it is today. If that's not what's causing
the problems, that would be one heck of a coincidence. I'll regenerate them
after lunch and see what happens.

Tim Byng

2012-06-25 18:54:19 UTC

Permalink

I re-generated the self signed certs and it has resolved the issue.
Thanks Michael!