Help decoding log files

1

I need help trying to figure out what these logs are trying to say:

[Mar 25 19:41:42] NOTICE[650] dnsmgr.c: Managed DNS entries will be refreshed every 120 seconds.
[Mar 25 19:41:42] NOTICE[650] cdr.c: CDR simple logging enabled.
[Mar 25 19:41:42] NOTICE[650] loader.c: 57 modules will be loaded.
[Mar 25 19:41:43] WARNING[650] loader.c: Error loading module ‘res_crypto.so’: libssl.so.1.1: cannot open shared object file: No such file or directory
[Mar 25 19:41:43] NOTICE[756] chan_iax2.c: Rejected connect attempt from 107.5.119.108, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[757] chan_iax2.c: Rejected connect attempt from 68.36.36.125, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[758] chan_iax2.c: Rejected connect attempt from 68.36.33.45, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[759] chan_iax2.c: Rejected connect attempt from 68.36.60.2, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[760] chan_iax2.c: Rejected connect attempt from 24.247.249.98, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[762] chan_iax2.c: Rejected connect attempt from 68.36.59.192, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[759] chan_iax2.c: Rejected connect attempt from 207.174.244.5, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:43] NOTICE[760] chan_iax2.c: Rejected connect attempt from 166.170.21.64, request ‘50964@radio-secure’ does not exist
[Mar 25 19:41:44] WARNING[650] loader.c: Error loading module ‘res_crypto.so’: libssl.so.1.1: cannot open shared object file: No such file or directory
[Mar 25 19:41:44] WARNING[650] loader.c: Module ‘res_crypto.so’ could not be loaded.
[Mar 25 19:41:44] NOTICE[715] app_rpt.c: Normal Repeater Init 50964
[Mar 25 19:47:12] WARNING[761] chan_iax2.c: Resyncing the jb. last_delay 0, this delay 1457, threshold 1000, new offset -1457
[Mar 25 19:49:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 34.105.111.212 to 162.248.92.131
[Mar 25 20:03:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 162.248.92.131 to 34.105.111.212
[Mar 25 20:05:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 34.105.111.212 to 162.248.92.131
[Mar 25 20:07:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 162.248.92.131 to 34.105.111.212
[Mar 25 20:09:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 34.105.111.212 to 162.248.92.131
[Mar 25 20:13:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 162.248.92.131 to 34.105.111.212
[Mar 25 20:15:44] NOTICE[660] dnsmgr.c: host ‘register.allstarlink.org’ changed from 34.105.111.212 to 162.248.92.131

2

Looks to me as the beginning and the end of what you have shown are pretty normal,
but in the middle would indicate to me that a hack probe may have been taken place.
Make sure your iptables and fail2ban are running well.

While this looks somewhat normal as it comes from a extension that resembles a asl node, there are a number of ip’s coming within the same second for a connection attempt.

If you don’t have any defined iax extensions, they would never be able to connect to a pure asl system, they would have to be in the ‘nodelist’ with a matching registered node# and ip.
Not so if you have manually defined iax or sip extensions/trunks

3

OK thanks…it seemed like a lot going on for a working node but good to know it appears normal.