Asterisk ARI logging channels: inventory, bounded capture and rotation

Inventory the runtime channel before changing it

GET /asterisk/logging returns the logging channels exposed by the running Asterisk instance. Each LogChannel object documents a channel path, type, enabled status and level configuration. Retain the exact instance identity, retrieval time and complete object before any mutation; a shared service URL can hide different channel inventories across nodes.

The ARI list is runtime evidence, not a copy of logger.conf, proof that a destination is writable, confirmation that a syslog receiver accepted records or evidence that the expected event occurred. Compare it with logger show channels, the effective log directory and the versioned configuration on the same host.

Constrain the name and level configuration

POST /asterisk/logging/{logChannelName} adds one case-sensitive channel and requires a configuration value describing its levels. Asterisk logging can target regular files, the console or syslog, and its documented levels include debug, notice, warning, error, DTMF, fax, security and bounded verbose levels. The wildcard * means all levels, including dynamic levels registered later.

Do not expose the path or configuration fields directly to untrusted input. Use an exact allowlist of approved destinations and level sets, reject path traversal or unapproved absolute paths, and decide storage capacity and data classification before creation. A documented 400 and 409 are different outcomes: correct the demonstrated parameter or creation conflict rather than retrying with broader levels or alternate names.

Treat a runtime channel as temporary until proven otherwise

Asterisk's debug-collection guide says a channel created dynamically through the CLI lasts until restart, logger-module reload or log rotation. The ARI logging endpoint does not document a stronger persistence guarantee. Treat an ARI-added channel as runtime state and verify it again after any lifecycle event that matters to the capture.

If persistence is required, reconcile the approved destination in version-controlled logger.conf and activate it through the site's normal change process. Do not assume that an accepted POST rewrote the configuration file or that a matching file left from an earlier run proves the current channel exists.

Rotate without turning rotation into evidence

PUT /asterisk/logging/{logChannelName}/rotate rotates one case-sensitive channel and returns 404 when it does not exist. Asterisk's CLI describes rotation as rotating and reopening log files, while logger.conf defines none, sequential, rotate and timestamp strategies and optional post-rotation commands. Record the active strategy and storage policy before invoking it.

An accepted rotation does not prove that the expected archive name exists, that compression or an external post-rotate action succeeded, that a shipper reopened the correct file or that retention protected the artifact. Verify the new and archived files, ownership, size, timestamps, hashes where required and downstream ingestion separately.

Capture one bounded event and keep identifiers distinct

State the diagnostic question, expected event, affected endpoint or trunk, time window and approved reproduction before enabling extra levels. Asterisk warns that production debug output is voluminous and can fill log files quickly. Keep debug, protocol and DTMF logging limited to the necessary channel and interval, monitor free space, then restore the recorded prior state.

Asterisk's bracketed C-XXXXXXXX value is a call identifier, not caller ID or the SIP Call-ID. Preserve it beside channel name, unique and linked identifiers, SIP Call-ID, CSeq, timestamp and dialplan context. One missing identifier or record in a selected channel establishes only that it was not observed there.

Delete the channel and close the evidence lifecycle

DELETE /asterisk/logging/{logChannelName} removes one case-sensitive runtime channel and returns 404 when it does not exist. Confirm the channel is absent from the ARI list and that no separate logger.conf, console, syslog or external-collector path remains active. Deletion of the runtime channel does not erase already written files or copies.

Restrict originals, create a separately redacted sharing copy, retain enough correlation to diagnose the event and apply an owner, expiry and approved transfer path. Remove credentials, authorization values and unnecessary message content. No Asterisk logger, file, storage target, collector, trace or call was tested for this guide.

Keep ARI log destinations separate from channel groups

Use the LOG_GROUP guide when the desired boundary is dialplan output for named channels; ARI-managed logging channels, logger destinations and CLI group filters remain separate controls.