Trap reported with message "Realm=XYZ;URI= ;Reason=Too many nones"

Asset ID:	1-72-2113889.1
Update Date:	2017-06-20
Keywords:

Solution Type Problem Resolution Sure

Solution 2113889.1 : Trap reported with message "Realm=XYZ;URI= ;Reason=Too many nones"

Applies to:

Acme Packet 4600 - Version S-Cx6.3.x and later
Information in this document applies to any platform.

Symptoms

ACME 4600 running nnSCZ720m6.

At network operating center (NOC), customer received minor alarm which was translated to message " Realm=XYZ;URI= ;Reason=Too many nones", but there was no info about this alarm in ACME log.

Changes

No recent changes made in the system.

Cause

The message "Too many nones" occur whenever there is a demotion event. The nones means that there was no behavior based reason for the demotion. If an endpoint is promoted, this lasts just for 10 minutes, starting with the last SIP message seen. If within 10 minutes there are no new messages, the endpoint falls back grey list (i.e., is demoted).

Solution

As per customer system configuration, demotion events are not logged in acmelog, therefore we were not seeing any logs related to demotion events. It needs to be enabled under Media-manager :-

syslog-on-demote-to-deny disabled
syslog-on-demote-to-untrusted disabled

After, enabling the above parameters we can see the following logs in the acmelog :-

Feb 19 14:34:10.301 sipd03@SBC3_DOM: WARNING SigAddr[XYZ:10.10.10.10:0=low:PERMIT] ttl=48 exp=48 last=0 P=0 Demoted to Grey-List (nones)
Feb 19 14:53:21.118 sipd01@SBC3_DOM: WARNING SigAddr[XYZ:[2001:a61:11d2:9c00:c225:6ff:fe6d:92e]:0=low:PERMIT] ttl=48 exp=48 last=0 P=0 Demoted to Grey-List (nones)

An endpoint will first move from trusted to untrusted state which is known as "demotion to grey list" and when it goes from untrusted to deny state it will be logged as "demotion to black list".

Therefore, the parameter 'trap-on-demote-to-untrusted' and 'trap-on-demote-to-deny' will tell you about the demotion events related to an endpoint whether its in a grey list or black list and parameters 'syslog-on-demote-to-deny' and 'syslog-on-demote-to-untrusted' will log these events in acmelog.

Attachments

This solution has no attachment