I have a multi-tenant CUCM Cluster using a centralized SIP trunk to our carrier via Cisco CUBE. While looking through CCSIP messages debugs I noticed quite a few SIP Subscribe requests (from CUCM to CUBE) with an event type of presence. We are not running IM server at this point, only Unity Connection and UCCX in addition to CUCM (all are version 8.6x) CUBE replies with 489 Bad Event.
The subscribe request has an external number complete with leading 9. I suspect this has something to do with a DN that has been forwarded to an external number but given the diversity (geographically) of my user base it is difficult to determine for sure. Redacted trace listed below.
Thanks for anyone who can identify this. The CUBE is a reasonably busy gateway (normally runs between 80 and 100 concurrent calls) so even with conditional debugging it is a challenge and all of the Subscribes just make it worse:
CUCM TO CUBE:
Sep 5 11:23:35 edt: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
SUBSCRIBE sip:9##########@10.#.#.#:5060 SIP/2.0
Via: SIP/2.0/TCP 10.#.#.#:5060;branch=z9hG4bKbd23ec093698
From: <sip:79552094-483d-9d0f-81e1-1799308c98ce@10.#.#.#>;tag=1393737978
To: <sip:9##########@10.#.#.#>
Call-ID: 98efbb00-4091d577-32b38-20aa040a@10.4.170.32
CSeq: 101 SUBSCRIBE
Date: Fri, 05 Sep 2014 15:23:35 GMT
User-Agent: Cisco-CUCM8.6
Event: presence
Expires: 10800
Contact: <sip:79552094-483d-9d0f-81e1-1799308c98ce@10.4.170.32:5060;transport=tcp>
Accept: application/pidf+xml
Max-Forwards: 69
Content-Length: 0
CUBE TO CUCM:
Sep 5 11:23:35 edt: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
SIP/2.0 489 Bad Event - 'Malformed/Unsupported Event'
Via: SIP/2.0/TCP 10.#.#.#:5060;branch=z9hG4bKbd23ec093698
From: <sip:79552094-483d-9d0f-81e1-1799308c98ce@10.#.#.#>;tag=1393737978
To: <sip:9##########@10.#.#.#>;tag=ECB42288-308
Date: Fri, 05 Sep 2014 15:23:35 GMT
Call-ID: 98efbb00-4091d577-32b38-20aa040a@10.4.170.32
CSeq: 101 SUBSCRIBE
Allow-Events: telephone-event
Content-Length: 0
