Flooding of logs

[Long Tran]

Hi all,

Last night, my jpos deployment was flooded (billions of logs, 20Gb) with messages as follows:

q2.log:

<log realm="channel/127.0.0.1:20403" at="Wed Jan 04 04:25:32 ICT 2017.813">

  <connect>

    localhost:20403

  </connect>

</log>

<log realm="stb_server.server.session/127.0.0.1:59397" at="Wed Jan 04 04:25:32 I

CT 2017.814">

  <session-start/>

</log>

<log realm="channel/127.0.0.1:20403" at="Wed Jan 04 04:25:33 ICT 2017.814">

  <receive>

    <isomsg direction="incoming">

      <!-- org.jpos.iso.packager.XMLPackager -->

    </isomsg>

  </receive>

</log>

<log realm="channel/127.0.0.1:20403" at="Wed Jan 04 04:25:33 ICT 2017.871">

  <receive>
....

and channel.log shows up as:

<log realm="org.jpos.q2.iso.QMUX" at="Wed Jan 04 04:25:33 ICT 2017.814">

  <warn>

    notify

 <iso-exception>

      MTI not available

      org.jpos.iso.ISOException: MTI not available

        at org.jpos.iso.ISOMsg.getMTI(ISOMsg.java:860)

        at org.jpos.q2.iso.QMUX.getKey(QMUX.java:184)

        at org.jpos.q2.iso.QMUX.notify(QMUX.java:163)

        at org.jpos.space.TSpace.notifyListeners(TSpace.java:261)

        at org.jpos.space.TSpace.out(TSpace.java:59)

        at org.jpos.q2.iso.ChannelAdaptor$Receiver.run(ChannelAdaptor.java:323)

        at java.lang.Thread.run(Thread.java:745)

    </iso-exception>

.....

This happened on just one of the QServers (I deployed 7 QServers in total). Has anyone experienced similar issues? Is it something to do with jPOS or with my deployments?

[Long Tran]

BTW, jPOS version is 1.9.8

[Andrés Alcarraz]

Hi,  someone is sending messages without content,  so mux cannot determine the mti which is needed by the default implementation of the getKey method.

Also those messages have no sense at all.

Who is connecting to that server?

Hope this helps to point you to the right direction.

--
--
jPOS is licensed under AGPL - free for community usage for your open-source project. Licenses are also available for commercial usage. Please support jPOS, contact: sa...@jpos.org
---
You received this message because you are subscribed to the Google Groups "jPOS Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jpos-users+...@googlegroups.com.
To post to this group, send email to jpos-...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jpos-users/613f55f7-93db-4b21-be91-20be58383184%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Andrés Alcarraz
Enviado desde mi Móvil

[chhil]

We have seen something like this,  may lead to discovering  load balancers or virus scanners probing the ports.

-chhil

To view this discussion on the web visit https://groups.google.com/d/msgid/jpos-users/CAACHDe2ckPOCTkBWMany-_Kk8W_faoF0WGi0ZCef%3DrMcyBcd-g%40mail.gmail.com.

[Long Tran]

Thanks chhil, perhaps this could be it, some virus scanners may be running at that point in time.