29. května 2009 12:20Hi,
I have deployed OCS R2 stress kit. But the users dont seem to be logging in - The "Failed Logon" counters is same as the "Login Attempt". The Logging Tool displays the series of error described below:-
TL_WARN(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a52 (SIPStack,CRecvContext::Process:RecvContext.cpp(251))( 00000000049E4310 ) Exit, Parsing/receive failure Returned 0xC3E93C05(ERROR_BAD_MESSAGE_FORMAT)
TL_INFO(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a53 (SIPStack,CRecvContext::ProcessCompletion:RecvContext.cpp(155))( 00000000049E4230 ) Received 114 bytes
TL_ERROR(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a54 (SIPStack,CSIPMessage::ParseFirstTokenAndSeparator:SIPMessage.cpp(4975))Exit - did not successfully consume the first token (non-white space) in the start-line. Returned 0xC3E93C05(ERROR_BAD_MESSAGE_FORMAT)
TL_ERROR(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a55 (SIPStack,CRecvContext::CreateMessage:RecvContext.cpp(984))( 00000000049E4230 ) Exit - failed to parse the first token and separator.
TL_ERROR(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a56 (SIPStack,CRecvContext::ExtractMessageOrPostReceive:RecvContext.cpp(535))( 00000000049E4230 ) Failed to parse buffers, close connection. Returned 0xC3E93C05(ERROR_BAD_MESSAGE_FORMAT)
TL_INFO(TF_COMPONENT) 07D8.1348::05/29/2009-19:41:00.582.00001a57 ((Shared),IsEventThrottled:EventThrottle.cpp(121))Found Event (0x83e93859) To be throttled
TL_ERROR(TF_SECURITY) 07D8.1348::05/29/2009-19:41:00.582.00001a58 (SIPStack,SIPAdminLog::WriteSecurityEvent:SIPAdminLog.cpp(413))$$begin_record
Text: Data not recognized as a SIP message
Result-Code: 0xc3e93c05 ERROR_BAD_MESSAGE_FORMAT
Data: ????m???i??J :Lí?*3zFÄüð¼ UTL˜Á\÷ºŠ…¬*uA0?s????/?5????À?À?À?À??2?8???????(?????????pool1.oye.com??????????????????
The OCS Event Viewer is not very helpful and displays errors like -
Many security events have been identified by the proxy stack.
In the past 5 seconds, 30 security events have been identified by the proxy stack. A large number of security events could indicate that the server is under attack. The last event was:
Cause: The server may be under attack, or there might be a configuration problem that is causing errors.
Launch the Logging Tool from the Office Communications Server Management Console. Select the "SIPStack" component, the "Errors" level and the TF_SECURITY flag. Review the events reported to the trace log using the "Analyze Log Files" feature of the logging tool.I have already made the "<UserGlobalPassword>password</UserGlobalPassword >" change in the client XML.