VoIP.info Guide

Asterisk logging without permanent debug overload

Map configured destinations, console levels, call identifiers and a bounded protocol trace without leaving sensitive debug collection active.

Reviewed 2026-10-18Current Asterisk logging, runtime command, logger.conf, debug-collection, call-identifier and console-verbosity documentation reviewed September 30, 2026; no process, logger, trace, storage path or call testedIntermediateDocumentation based · not lab tested

Inventory the existing logging path first

Asterisk can send log messages to files, consoles and syslog, with destinations and message types configured in logger.conf. Record the exact running version, logger show channels output, core show settings output, log directory, syslog path where used, time source, timezone, retention owner and available storage before enabling anything new.

Root-console and remote-console verbosity are independent. Seeing more text in one attached console does not prove that a file channel contains the same records. Likewise, a configured file name does not prove that the expected message levels were enabled, storage was writable or an external collector accepted them.

Select the narrowest evidence source

Begin with normal warnings, errors and focused runtime state. A failed registration may need a short SIP exchange, an unexpected route may need dialplan execution and a media symptom may need SDP plus a separately authorized packet observation. Broad debug output is not automatically more probative. State the question, affected endpoint or trunk, test time and expected result first.

Asterisk's issue-tracker guide documents a temporary logger add channel path for Asterisk 13 and later. That runtime channel lasts until restart, logger reload or log rotation. Treat those lifecycle events as part of the capture plan; do not rotate or reload midway and then mistake a missing temporary channel for an absence of events.

Preserve levels, capture one reproduction and restore them

If PJSIP protocol logging is required, preserve the current verbose and debug levels, enable the logger immediately before one authorized reproduction and turn it off immediately afterward. The pair below is intentionally not a paste-as-one script. Restore the recorded prior levels rather than assuming zero was the site's baseline. Confirm cleanup with the installed help and runtime state.

The PJSIP logger shows SIP handled by that driver. It is not a packet capture, does not show every network drop and does not establish RTP delivery or audible media. Debug, DTMF and signaling output can be voluminous and sensitive; bound the call, duration and destination before collection.

Asterisk CLI — enable and disable around one authorized reproduction
pjsip set logger on
pjsip set logger off

Correlate identifiers without merging them

Asterisk's bracketed C-XXXXXXXX call identifier is not caller ID and is not the SIP Call-ID. It can bind logs from several channels and threads, while a transfer can create a new Asterisk call identifier and independent SIP legs can use different dialog identifiers. Preserve timestamp, Asterisk call ID, channel name, unique and linked identifiers, SIP Call-ID, CSeq and dialplan context as separate fields.

Compare a known-good control from the same logging scope. No event in one file means only that the event was not observed by that configured destination at that time. The responsible level, module, process, capture point or external collector may lie elsewhere.

Rotate, retain and share deliberately

Asterisk documents sequential, rotate and timestamp log-rotation strategies and warns that production debug output can fill files quickly. Size storage and retention before collection, monitor the actual filesystem and keep log growth from exhausting space used by voicemail, recordings or the database. logger rotate rotates and reopens files; it is a state-changing operation, not a read-only inspection.

Restrict originals, hash or otherwise identify the retained artifact, and make a redacted sharing copy. Remove credentials and authorization values while preserving method, status, sequence, time and sanitized addressing. Record the recipient, approved transfer channel and deletion date. Do not paste a full trace into a public ticket.

Close the diagnostic change

Confirm the protocol logger is off, temporary channels are removed or allowed to expire under the recorded lifecycle, console levels match the before state and storage is healthy. Preserve the original evidence before repair, then repeat the same bounded reproduction and control after the change.

No Asterisk process, logger channel, file, syslog destination, storage volume, PJSIP exchange, identifier, call, packet, credential or cleanup action was inspected or tested for this guide.

Keep the queue log outside ordinary channel assumptions

Asterisk queue events have dedicated enablement, filename and file-versus-realtime controls. Use the queue-log diagnostic when the symptom is a missing queue record rather than assuming an ordinary logger channel or a broader debug level owns it.

Apply the evidence model to a FreePBX-managed logger

On FreePBX, use the Asterisk Logfile Settings guide to keep module version, GUI intent, generated include, loaded Asterisk channels, storage and operating-system rotation separate before enabling more detail.

Capture handler-stack and teardown evidence together

For teardown failures, the hangup-handler diagnostic correlates CLI stack state, AMI push/pop/run events, handler logs and the final channel hangup without treating one log line as completion.

Log the event boundary, not just a speech label

The TALK_DETECT diagnostic correlates channel identifiers, threshold values, audiohook order, media evidence and consumer timestamps.

Correlate queue priority with entry, offers and exits

The FreePBX queue-priority diagnostic uses queue-log records with channel identity and the effective QUEUE_PRIO value rather than treating answer order as sufficient evidence.

Correlate group decisions with exact channel identity

The channel-group diagnostic records unique IDs, group lists, count reads, branch decisions and teardown instead of inferring occupancy from one call log line.

Correlate fax logs with one session ID and channel

The res_fax diagnostic keeps FAXOPT results, channel identity, signaling, media and file handling together while bounding temporary debugging and redacting document content.

Correlate quality fields without flattening call legs

The RTCP diagnostic aligns channel logs, RTCP reports, packet evidence and bridge transitions while keeping sensitive media capture bounded.

Correlate a response value with the exact SIP transaction

Use the PJSIP response-header diagnostic to retain Call-ID, INVITE CSeq, callee identity, final status, header match and instance without logging the full response by default.

Log one bounded AoR and contact lookup

The AoR/contact diagnostic records object names, contact identifiers, fields and collection time without dumping credentials or the full inventory.

Log one endpoint field with channel identity

The PJSIP endpoint diagnostic records endpoint, field, channel, direction and collection time without dumping authentication or unrestricted configuration data.

Log DTMF mode, direction and duration without sensitive digits

The runtime DTMF diagnostic correlates one channel value with bounded begin/end and protocol evidence while keeping PINs out of shared logs.

Correlate REFER, ChannelTransfer and NOTIFY without flattening states

The transfer-event diagnostic preserves Call-ID, channel, bridge, event consumer and final transfer outcome as distinct records.

Correlate handler execution with the emitted From field

The From-parameter diagnostic keeps release, module, channel, placement, write timing, packet and peer response as separate evidence.

Trace NOTIFY construction, routing, response and action separately

The PJSIP NOTIFY diagnostic aligns invocation, target, emitted request and peer response without claiming the endpoint completed an action.

Correlate the AMI action with registration events and SIP

The PJSIP action diagnostic keeps manager acceptance, outbound REGISTER, registrar response, Registry event and NextReg as separate timestamps.

Correlate inherited-header operations with the exact callee

The focused diagnostic records add, update or remove timing, child-channel creation, pre-dial execution and emitted SIP without inventing a read action.

Correlate refresh method, CSeq, SDP and media state

The focused session-refresh diagnostic preserves method support, glare, final response and post-refresh RTP as separate evidence.

Log selected names without dumping every header value

The inbound-header inventory guide preserves request identifiers and the approved value while avoiding broad logging of credentials, identity and routing fields.

Log the policy decision before PJSIPHangup terminates execution

Record the matched condition, channel and selected cause before calling PJSIPHangup(), then use the SIP trace to prove the first final response. The diagnostic avoids placing secrets or full captures in long-lived logs.

Log one redacted PJSIP channel tuple

The channel signaling guide records selector, leg, timestamp and value together, then removes temporary logging rather than retaining user, URI and address data broadly.

Correlate MessageSend status with the actual SIP transaction

Use the focused diagnostic to bind the destination expansion and application status to one MESSAGE Call-ID, CSeq, final response and endpoint result.

Use LOG_GROUP as a narrow channel selector

The LOG_GROUP guide shows how early channel assignment, replacement and clearing interact with a CLI group filter without being confused with call identifiers, log levels or files.

Keep frame filters separate from logger output

The FRAME_TRACE diagnostic checks trace selection, logger level, destination and time window before an empty console is represented as a missing event.

Log lock ownership without leaking protected state

The lock diagnostic records channel IDs, normalized lock name, result and duration while redacting sensitive shared values.

Log key identity and branch without leaking values

The AstDB diagnostic retains family, key, existence result and route while redacting sensitive stored values.

Log the evaluated instant, expression and branch

The wrong-branch diagnostic records a safe channel correlation, incident epoch, zone, exact timespec, selected target and later caller treatment without leaving broad debug enabled.

Log variable ownership without logging the value

The wrong-channel diagnostic records channel identifiers, write and read priorities, prefix form and existence separately while keeping secrets and customer values out of logs.

Preserve exception origin without exposing input

The missing-handler diagnostic captures redacted exception fields at handler entry and keeps custom reasons to an allow-listed vocabulary.

Log one evaluated result and reuse it

The dialplan lookup diagnostic records one redacted result and invocation count without repeating a potentially side-effecting function.

Keep PJSIP logger and PJSIP History distinct

The PJSIP History guide compares live protocol logging with the separate in-memory history module and its explicit off and clear lifecycle.

Keep metrics and event evidence distinct

The Prometheus metrics guide treats time-series counters and gauges as monitoring signals, not replacements for timestamped logs, SIP messages or call records.

Measure database-backed dialplan delay at the right boundary

The func_odbc diagnostic separates connection attempts, negative caching, query execution and later dialplan work without exposing credentials or rows.

Correlate write execution with transaction completion

The ODBC mutation diagnostic preserves redacted statement status, affected rows, transaction ID, completion and caller outcome without logging credentials or row data.

Log one Realtime object path without exposing its secrets

The PJSIP Realtime diagnostic retains names, timestamps, error classes and cache boundaries while redacting credentials and secret-valued columns.

Correlate periodic hook runs without permanent noise

The periodic-hook diagnostic logs hook ID, owner identity and bounded invocation timing, then removes temporary verbosity.

Log one bounded wait without retaining call payloads

The silence and noise diagnostic correlates application timing, channel identity, arguments and result while minimizing sensitive media evidence.

Correlate one bounded condition wait without logging secrets

The WaitForCondition diagnostic records expression ownership, writer timing, return status and next priority while minimizing retained data.

Log the conversion boundary without exposing caller data

The WaitUntil diagnostic correlates civil-time input, explicit zone and format, epoch, channel, timestamps, immediate status and next priority.

Log one Dial invocation as a bounded event timeline

The Dial diagnostic correlates loaded arguments, channel creation, signaling, answer, bridge, hangup, status and next priority without exposing credentials.

Log one Originate as a bounded multi-stage timeline

The Originate diagnostic correlates loaded arguments, wait mode, created channel, answer, destination entry, later Dial and workflow result.

Log Bridge as two channel lifecycles

The Bridge diagnostic correlates exact target resolution, answer, entry, leave, hangup, result and media.

Log holding roles and add operations as channel lifecycles

The BridgeWait and BridgeAdd diagnostic correlates handles, roles, membership, removal and results.

Log AMI bridge requests, snapshots and events as one chronology

The wrong-membership diagnostic correlates manager, bridge and channel identities.

Log the complete AMI transfer chronology

The AMI transfer diagnostic joins action, channel, bridge, dialplan and outcome evidence.

Log attended-transfer cancellation as a chronology

The CancelAtxfer diagnostic correlates action, feature configuration, channels, bridges, callbacks and media.

Log Local optimization as an event chronology

The Local optimization diagnostic correlates action, Begin, End, bridge changes and final media.

Log AMI list boundaries and counts

The channel snapshot diagnostic records each request, row, terminal event and lifecycle change.

Log AMI mask, filter and reconnect state

The AMI event diagnostic builds a raw-to-stored event chronology.

Log the producer, schema and correlation key

The UserEvent diagnostic compares producer logs, raw AMI frames, parsing and idempotent storage.

Log remote device-state ownership and list boundaries

The AMI device-state diagnostic preserves entity ID, cache intent, action response, raw rows and completion before comparing downstream state.

Log presence ownership without oversharing messages

The AMI presence-state diagnostic retains the provider, writer, boundaries and timestamps while minimizing personal subtype and message data.

Log extension state with its context and raw status

The AMI extension-state diagnostic retains Exten, Context, Hint, numeric status, status text and completion evidence.

Log the complete dialplan mutation key

The AMI dialplan diagnostic retains ActionID, context, extension, caller-ID suffix, priority, application, data and Replace intent.

Correlate configuration write and reload separately

The AMI configuration diagnostic retains ActionID, ordered operations, reload request, module log and loaded-state evidence.

Correlate module actions with registration logs

The module capability diagnostic uses load, dependency, parser and registration evidence to find the first divergence.

Correlate AMI requests without overreading message text

The AMI missing-action diagnostic retains ActionID, response, optional Message and registration logs without treating prose as a stable error taxonomy.

Correlate manager sessions without logging credentials

The AMI login diagnostic records session identity, ActionID, response and termination while redacting secret material.

Correlate core snapshots without logging secrets

The core-query diagnostic records node, session, ActionID and raw response while keeping credentials out of logs.

Correlate queue snapshots without recording credentials

The queue-snapshot diagnostic preserves node, session, filters, ActionID and completion while redacting caller and credential data.

Log mailbox query identity without exposing message or credential data

The mailbox-query diagnostic preserves node, session, ActionID, mailbox context and raw fields while requiring redaction.

Retain list framing without publishing user data

The voicemail-user diagnostic preserves action boundaries while requiring redaction.

Retain completed ConfBridge list transactions

The ConfBridge list diagnostic preserves the response, every row, completion event, ActionID and timestamps.

Audit the complete ConfBridge control transaction

The ConfBridge control diagnostic retains operator intent, exact target, response, events and bounded before-and-after snapshots.

Retain raw ConfBridge event intervals and connection gaps

The ConfBridge event diagnostic records filters, reconnects, identities, receipt times and effective talk-detection profile.

Capture profile resolution, digit receipt and application return

The ConfBridge menu diagnostic records bounded channel evidence without enabling permanent DTMF or media debugging.

Audit the AMI recording transaction and artifact lifecycle

The AMI recording diagnostic retains request, response, events and bounded filesystem evidence while redacting credentials and audio content.

Log the parking lifecycle without collapsing outcomes

The AMI parking diagnostic correlates request, assigned slot, terminal reason, retriever and media outcome while redacting personal data.

Log queue-member scope and state dimensions separately

The AMI queue-member diagnostic preserves interface, state interface, pause, penalty, status, in-call and wrap-up evidence.

Log queue control scope and postconditions separately

The AMI queue reload or reset diagnostic preserves action, source, parser, snapshot, statistic and history evidence.

Log queue caller request and postconditions separately

The queue caller-control diagnostic retains action, snapshot, lifecycle, dialplan and historical evidence.

Trace a QueueLog request into the exact active destination

The AMI QueueLog guide distinguishes active and rotated files, alternate backends, parser checkpoints and reports.

Route security events through their dedicated dynamic level

Use the security-event logging guide to separate event generation, res_security_log, the SECURITY level, channel configuration, file custody and downstream consumers.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.