This morning, after some verification, I found some errors in my search headwith my SIP phones.
I have 150 polycom phone. They send their syslog to Universal Forwarders. Config file is:
[udp://172.16.72.70:514] source = sip_syslog sourcetype = polycom:siplab connection_host = none acceptFrom = 172.16.72.70 disabled = false index = ti-telephone
I think it is correc,t but I found lots of errors like:
Sep 1 14:47:13 172.16.86.70 Sep 1 10:47:21 172.16.86.70 0901104721|sys |*|03|0x9581bea0 (tPktProSys): memPartAlloc: block too big - 21848 in partition 0x94b6feec. date_hour = 14 date_mday = 1 date_minute = 47 date_month = september date_second = 13 date_wday = tuesday date_year = 2015 date_zone = local host = UniversalFowarders index = ti-telephone linecount = 1 punct = ___::_...____::_..._|__|*||_():_:____-____. source = sip_syslog sourcetype = polycom:sip splunk_server = IndexServer splunk_server_group = dmc_group_indexer timeendpos = 16 timestartpos = 0 unix_category = all_hosts unix_group = default
All other equipment (257) is working fine except the new phones recently added.
Do you have an idea of this error?
Thank you a lot