Blacklisted numbers generate excessive log entries

[RBS]

Each blocked ring generates multiple log entries per second, while still ringing.

It still gets a ringtone, I'd prefer it would just immediately drop the blocked number.

These logs are driving me crazy. Here is a screenshot of my own cellphone being blocked for ONE call.

 

[RBS]

Same goes for Activity Log:

Isn't there a way to just drop the blocked number instead of generating logs twice per second and tying up an incoming trunk channel?

Adding *black* to CID rule has no effect.

PS: Telnyx is our SIP provider

05/13/2018 12:24:39 PM - [Flow] Call(C:173): caller's number '9545551212' is in blacklist
05/13/2018 12:24:37 PM - [Flow] Call(C:172): caller's number '9545551212' is in blacklist
05/13/2018 12:24:36 PM - [Flow] Call(C:171): caller's number '9545551212' is in blacklist
05/13/2018 12:24:35 PM - [Flow] Call(C:170): caller's number '9545551212' is in blacklist
05/13/2018 12:24:34 PM - [Flow] Call(C:169): caller's number '9545551212' is in blacklist
05/13/2018 12:24:33 PM - [Flow] Call(C:168): caller's number '9545551212' is in blacklist
05/13/2018 12:24:32 PM - [Flow] Call(C:167): caller's number '9545551212' is in blacklist
05/13/2018 12:23:12 PM - [Flow] Call(C:166): caller's number '9545551212' is in blacklist
05/13/2018 12:23:11 PM - [Flow] Call(C:165): caller's number '9545551212' is in blacklist
05/13/2018 12:23:09 PM - [Flow] Call(C:164): caller's number '9545551212' is in blacklist
05/13/2018 12:23:08 PM - [Flow] Call(C:163): caller's number '9545551212' is in blacklist
05/13/2018 12:23:07 PM - [Flow] Call(C:162): caller's number '9545551212' is in blacklist
05/13/2018 12:23:06 PM - [Flow] Call(C:161): caller's number '9545551212' is in blacklist
05/13/2018 12:23:05 PM - [Flow] Call(C:160): caller's number '9545551212' is in blacklist
05/13/2018 12:23:04 PM - [Flow] Call(C:159): caller's number '9545551212' is in blacklist

 

[YiannisH_3CX]

Hello @RBS

Having a call log entry is normal for a blacklisted number as the call does arrive at the system from the provider. What i think is wrong in your case is that the provider does not respond correctly to the PBX blacklist response which is 603 Decline and tries to re-invite resulting in multiple attempts therefore multiple log entries.
I will try to check this and will let you know. Meanwhile can you confirm the PBX version you are using ? You can find the exact build number on the Dashboard, under the information column next to the licence info.

 

[RBS]

3CX Version Number 15.5.0

Here is a debug log for the blocked call from Telnyx:

And inbound settings (tried with "generate ringtone" and without. No effect).

 

[YiannisH_3CX]

Just checked as well and it seems like Telnyx responds correctly to the Decline message. However i cannot replicate the issue as i am only getting a single entry in the call log during an incoming call.

You mentioned something regarding a CID rule. Do you have a CID rule for the number that is in the blacklist?

 

[RBS]

No, since it wasn't working the only inbound rule is DID for the trunk.

 

[YiannisH_3CX]

I would recommend running a capture on the PBX and try the scenario again. Leave the capture running for a minute or so and check if there are any re-invites for the same call from Telnyx. It could be that is the upstream provider that keeps sending re-invites and Telnyx is only passing them through.

 

[RBS]

Here is the capture, it repeats basically the same thing every second, didn't see a point in pasting a wall of text for all of it. It appears there are no "reinvites" but simply regular "invites" that go out about twice per second.

05/14/2018 9:08:40 AM - Leg L:305.1[Line:10001<<954XXXXXXX] is terminated: Cause: BYE from PBX
05/14/2018 9:08:40 AM - [CM502001]: Source info: From: "+1954XXXXXXX"<sip:[email protected]>;tag=3H6U481ZB; To: <sip:[email protected]:5060>
05/14/2018 9:08:40 AM - [CM503013]: Call(C:305): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 192.xxx.xxx.10:5060 tid=389d.1187acac5da81d4d1ea0802d094d.0 Call-ID=c35910f9-d21a-1236-b78a-0220a0f0404:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.xxx.xxx.10;branch=z9hG4bK39d.1187acac5da81dd1ea08a602add094d.0
Via: SIP/2.0/UDP 10.XX.XX.XX:5090;received=10.XX.XX.XX;rport=5090;branch=z9hG4KHrv74FUXZFrpj
Max-Forwards: 67
Record-Route: <sip:192.xxx.xxx.10;r2=on;lr;ftag=3H6UNZv581ZB>
Record-Route: <sip:10.255.0.1;r2=on;lr;ftag=>
Contact: <sip:[email protected]:5090;alias=10.XX.XX.XX~5090~1>
To: <sip:[email protected]:5060>
From: "+1954XXXXXXX"<sip:[email protected]>;tag=3H64NZv581ZB
Call-ID: c3591f9-d21a-1236-b8a-0242a0f0404
CSeq: 122815596 INVITE
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, PRACK, NOTIFY
Content-Disposition: session
Content-Type: application/sdp
Supported: precondition, 100rel, timer, path, replaces
Privacy: none
P-Asserted-Identity: "+1954XXXXXXX"<sip:[email protected]>
u: talk,hold,conference,refer
Content-Length: 307

v=0
o=Telnyx 15229960 15267961 IN IP4 64.XX.XX.XX
s=Telnyx
c=IN IP4 64.XX.XX.XX
t=0 0
m=audio 23360 RTP/AVP 0 9 8 18 101
a=rtpmap:0 PCMU/8000
a=rtpmap:9 G722/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
05/14/2018 9:08:40 AM - [Flow] Call(C:305): caller's number '954XXXXXXX' is in blacklist
05/14/2018 9:08:40 AM - [CM503012]: Inbound office hours rule (TEL) for 10001 forwards to DN:800
05/14/2018 9:08:40 AM - [Flow] Looking for inbound target: called=1954XXXXXXX; caller="+1954XXXXXXX" <sip:954XXXXXXX@:5060>
05/14/2018 9:08:39 AM - Leg L:304.1[Line:10001<<954XXXXXXX] is terminated: Cause: BYE from PBX

It's very upsetting, as it messes up the daily call reports with junk.

 

[RBS]

Please tell me I don't have to clean wipe out a production PBX because of this log pollution.

 

[YiannisH_3CX]

If Telnyx sends a re-invite (basically a new Invite) for a declined call then that is causing your issue. However as i mentioned Telnyx appears to respond correctly when i tested this on our test accounts so it is probably the upstream provider that keeps sending Invites.
I would contact Telnyx and provide them with the capture of the call and ask them why they keep sending Invites since the call was rejected.

lease tell me I don't have to clean wipe out a production PBX because of this log pollution.

No you do not have to wipe the PBX as this is not a PBX issue. Once the issue is resolved from Telnyx side the spam in the logs will clear.

 

[RBS]

Thanks Yiannis, you're right, Telnyx confirmed that it is upstream not handling 603 properly and not stopping after first (or 20...) response.

Follow up question:

It is possible to reprogram 3cx to give a different response code that 603 on blacklisted numbers?
Or maybe send it to IVR or extension?
I'd do it even it if involves expert level (going manually into database, etc).

Since you can't import CSV into CID I wouldn't want to do it CID way.
Importing into blacklist in bulk is good, but I want it handled differently than 603.

 

[YiannisH_3CX]

Please note that the SIP responses for each scenario are hardcoded into the PBX and cannot be changed. And since this is used and respected by all of our supported providers i do not think this will change.