Excessive Log Growth (Event 10029) After Upgrade from Version 20 U6 to U7

[Andre Oliveira]

Good Afternoon, guys

After upgrading our 3CX system from Version 20 U6 to Version 20 U7, we have started observing recurring Event 10029 (Info) messages being generated in short time intervals. This is causing the journal and systemlog files to grow extremely fast, which impacts system performance and storage capacity.


Prior to the upgrade, our system was running smoothly without this issue. We have already analyzed the firewall rules and verified all relevant ports on the cloud environment hosting our 3CX instance, confirming they are correctly configured. Additionally, we tested the client's network and identified no issues. Importantly, this behavior was not present on Friday while still running U6, so it appears directly related to the U7 update.



Steps Taken to Troubleshoot:

Checked firewall rules and confirmed proper port forwarding.

• Verified there were no configuration changes in the cloud hosting environment since the upgrade.
• Tested the client's network to ensure there are no issues in connectivity or configuration.
• Monitored system to confirm that the issue arose specifically after the upgrade to Version U7.

Request for Support:
Could you provide guidance or suggestions to resolve this issue? Specifically, we would like to know:
If there are any configuration changes required for Version 20 U7 to prevent this rapid log growth.

1. If this is a known issue in Version 20 U7, are there any fixes or patches we should apply?
2. Whether there is a way to disable or suppress the generation of excessive Event 10029 messages, without impacting system functionality.

Thank you for your support on this matter!

 

[KyriacosS_3CX]

Hello,

Event 10029 is in relation to phone provisioning (https://www.3cx.com/docs/event-log/).

Can you check why/which phones are constantly requesting to be provisioned?

 

[Andre Oliveira]

Hello,

Yes, we have reviewed this behavior, and we can confirm that out of the 193 extensions we have, at least 150 are repeatedly showing this provisioning behavior.
By analyzing the syslog, we noticed that many of the events are recurring. Some key points we have already verified are:
Authentications: The authentications were reviewed and are working properly.

1. Firmware: The firmware versions are up-to-date. That said, I would like to point out that we are using Fanvil devices, and two of the models have firmware versions above the one officially supported. This update was necessary to resolve a separate issue. However, based on the syslog analysis, these cases represent a small fraction of the problem and don’t appear to be the primary cause.

At this point, I am still out of ideas on how to resolve the situation. Do you have any additional suggestions or recommendations for next steps?

 

[cwit]

Have got the same issue, I would imagine this is related to the issue that's been picked up and addressed in a hotfix for U7, 20.0.7.1060

https://www.3cx.com/blog/releases/v20-u7-hotfix/

syslog and journals are massive.

 

[TheodorosG_3CX]

Yes this is related with the hotfix that has been released:



Ensure you have proceeded with the hotifix first and then check again.