Problem Description : [RTP191] USM Under Authentication Failure Attacks alarm
Analysis Progress :
1) Check the alarm type and time occur
2) Check the version
3) Verify the alarm type
4) Log in to LMT tools to clear the alarm and check again, command as below
- CLR AFBLIST
- DSP AFBLIST
5) Go to DEV logs to check the history and get it for analysis (/opt/HUAWEI/cgp/workshop/omu/share/run_log/dev_log)
6) Open the logs and check the details
ERR M0256P201F63S04M 2019-03-27 21:58 [regdb.c:7083] <RegUpdateCDBBruteAttackInfo> RegAuthFailed impi[****8@example.com]; U=sip:****8@example.com;UI=10.0.100.237:5060;C=sip:****8@10.0.100.237:5060;UA=Huawei eSpace 7910 V200R003C30.
ERR M0256P201F63S04M 2019-03-27 21:58 [regshdr.c:6402] <RegSAuthAft401Proc> LogAi RegSAuthAft401Proc fail impu = sip:20048@example.com
ERR M0256P201F63S04M 2019-03-27 21:58 [regcb.c:655] <RegFreeCb> RegFreeCb: pstIMPU[sip:****8@example.com] ulSKId[0x100] ulSKStample[0x5c9c6288] ulSKMask[0x40c48e8]!
Root Cause : User tried to log in several time in a specific time
Solution Description : Alarm was manual clear by using LMT tools.
