VoIP.infoThe independent guide to business communications.
VoIP.info Guide

PBX logs and packet captures: useful evidence with limited exposure

Collect enough to diagnose a call while protecting identities, secrets and audio.

Reviewed 2026-10-18Foundational

A trace can reveal more than an error

SIP logs may contain numbers, names, addresses and authentication-related material. Media captures can contain conversation content when decodable. Recordings and voicemail have their own access and retention implications.

Scope the collection

Capture one reproducible call or a narrow incident interval. Note the timestamp, direction and affected leg. Prefer read-only status checks before enabling broad protocol logging on a busy PBX.

Preserve diagnostic value when redacting

Remove secrets and private identities while keeping relationships consistent. A sanitized address should refer to the same participant throughout the extract. Keep methods, response order and relevant SDP structure so the recipient can still understand the failure.

Finish the investigation cleanly

Restore previous logging levels and remove temporary collection rules. Store retained evidence under the organization's access and retention policy. Do not upload complete archives to public forums when a short sanitized exchange would answer the technical question.

Keep FreePBX log access and retention inside the privacy boundary

The FreePBX Asterisk Logfile Settings guide scopes logger levels, files, rotation and temporary capture while preserving the module security-update and administrator-access boundary.

Govern facility snapshots, video and door events

A GSC3570 can involve local storage, camera snapshots, SIP history and alarm or door actions. Define collection, access, export, retention and deletion per data type; a removable card or optional file service is not an automatic evidence or privacy programme.

Govern 2N video, credential and access evidence separately

A 2N IP Verso 2.0 deployment may add camera, mobile, RFID, fingerprint, keypad and management records, while an IP One has a different fixed role. Define collection, retention, access and export for each data type; a device event is not proof of the person or final door state.

Bound SessionTalk push logs and caller data

SessionTalk says the push message contains some caller details and recommends a narrow SIP log for troubleshooting. The diagnostic limits capture, redacts identities and secrets, and restores logging after the reproduction.

Bound and dispose of in-memory SIP history

The PJSIP History guide treats retained SIP headers, SDP, identities, addresses and authentication material as restricted incident evidence.

Treat labels and build properties as operational data

The Prometheus metrics guide inventories exposed build, node, channel and bridge labels, restricts access and avoids copying credentials or unrestricted metric output into tickets.

Keep credentials and returned rows out of troubleshooting records

The func_odbc diagnostic retains timing, status and error-class evidence while redacting credentials, sensitive query values and customer rows.

Record transaction evidence without copying sensitive rows

The ODBC mutation diagnostic keeps IDs, status classes, timing and counts while redacting credentials and customer data.

Protect PJSIP Realtime evidence

The PJSIP Realtime diagnostic keeps object identity and error classes useful while redacting database credentials, auth material and customer configuration values.

Protect periodic-hook call evidence

The periodic-hook diagnostic retains hook and channel correlation while redacting caller data and secrets.

Keep secrets and excess personal data out of UserEvent

The AMI UserEvent guide uses opaque references, bounded logs and retention for custom headers.

Protect security-event evidence across every destination

Asterisk security records can contain account, session and address context. Follow the security-event guide and retain only the fields and custody required for the investigation.

Protect PhonerLite profiles, history and recordings separately

sipper.ini can contain reusable credentials, while the logbook, contacts, WAV files and transcripts carry different data. The diagnostic preserves custody for each.

Sanitize Linphone support logs before sharing

Linphone asks for version, reproduction and logs but warns against exposing passwords and other private data. The local-data guide preserves an internal original while bounding any support copy or upload.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Continue your research

Hub

VoIP security

Reduce PBX exposure, constrain calling permissions and prepare for accountable recovery.

Explore topic →
Guide · Asterisk 22 LTS

Secure an Asterisk PBX before adding paid calling

Review management access, endpoint identities and dialplan permissions as separate layers.

Read guide →
Guide · FreePBX Backup & Restore release/17.0 source, FreePBX advisories GHSA-5v7h-49gr-jcwr and GHSA-f6hc-rqxg-ch86, and Sangoma Filestore, backup, fwconsole and FreePBX 17 migration documentation reviewed October 12, 2026; the advisories identify affected Backup & Restore versions below 17.0.6 and 17.0.30 respectively, but repository or advisory state does not prove the installed module, archive custody, target handlers or restored runtime, and no PBX, archive, storage destination, credential, job, restore, module, endpoint, trunk or call was inspected or tested

FreePBX backup and restore: prove the recovery path

Choose backup scope, protect off-host storage and validate an isolated restore before relying on it.

Read guide →
Guide · FreePBX Asterisk Logfiles release/17.0 repository and security advisory, Sangoma module indexes and retention note, and current Asterisk logging documentation reviewed October 12, 2026; repository and advisory state do not prove the installed module version or patch state, the Sangoma retention note describes an older FreePBX Distro path rather than the FreePBX 17 Debian 12 baseline, and no PBX, module, file, logger channel, disk, rotation job, call or captured event was inspected or tested

FreePBX Asterisk Logfile Settings: generated channels, runtime and retention

Separate the installed Logfiles module, saved rows, generated logger configuration, loaded Asterisk channels, actual writes, rotation owner and retained evidence.

Read guide →
Device category · Grandstream current GSC3570 product, firmware, user, FAQ, peering and wiring documentation reviewed October 13, 2026; no control station, SIP account, PBX, camera, alarm input, relay, lock, credential, network, firmware, storage device, management service, door or emergency-release path was inspected or tested

IP facility control stations for SIP, video and door systems

Evaluate a wall or desk control station as separate SIP, video-monitoring, alarm-I/O, door-control, management and physical-safety paths.

Read guide →
Current device research · Grandstream current GSC3570 product page, general firmware table, datasheet, user manual, FAQ, peering guide and wiring diagrams reviewed October 13, 2026; the general firmware table listed 1.0.7.10, but no GSC3570, hardware revision, firmware image, SIP account, PBX, camera, alarm input, relay, lock, credential, network, SD card, management service, door or emergency-release path was inspected or tested

Grandstream GSC3570 facility control station

Evaluate the GSC3570 as a four-account SIP intercom and facility-control panel while keeping video, alarm I/O, relay ownership, storage, firmware and physical safety independently observable.

HD intercom and facility control station
Grandstream maintained a live product page and listed GSC3570 general firmware 1.0.7.10 at review. That does not prove regional availability, support term, hardware revision, installed firmware or suitability for a particular door or life-safety design.

Read guide →
Brand hub · Current 2N IP One and IP Verso 2.0 product, installation, configuration, support and firmware resources reviewed October 13, 2026; no intercom, module, credential, PBX, network, camera, relay, lock, sensor, mobile service, firmware, door or emergency-release path was inspected or tested

2N IP intercoms and door-entry endpoints

Navigate current 2N door-intercom references while keeping SIP, video, access credentials, relay wiring, management and physical-safety evidence separate.

Read guide →
Current device research · Current 2N IP One product specifications, support and firmware page, installation manual 3.3 and shared IP-intercom configuration manual 3.3 reviewed October 13, 2026; no intercom, order variant, firmware image, SIP account, PBX, camera, stream, credential, mobile service, switch output, lock, input, tamper circuit, PoE path, door or emergency release was inspected or tested

2N IP One compact video intercom

Evaluate the 2N IP One as a one-button SIP and video door station while keeping media, camera, relay, input, tamper, power, firmware and physical access separately observable.

Compact one-button SIP video door intercom
2N maintained live product, installation, configuration and support pages and listed OS 3.3.1 dated August 31, 2026 at review. This does not establish regional availability, installed hardware or firmware, support entitlement, compatible PBX, mobile-service eligibility or suitability for a particular door and life-safety design.

Read guide →
Current device research · Current 2N IP Verso 2.0 product specifications, support and firmware page, installation manual 3.3 and shared IP-intercom configuration manual 3.3 reviewed October 13, 2026; no main unit, module, frame, firmware image, SIP account, PBX, camera, stream, credential, reader, mobile service, relay, lock, input, PoE path, door or emergency release was inspected or tested

2N IP Verso 2.0 modular video intercom

Evaluate the 2N IP Verso 2.0 as a modular SIP door station whose main unit, camera, access modules, I/O, enclosure, firmware and physical-control path require an exact bill of material.

Modular SIP video and access-control intercom
2N maintained live product, installation, configuration and support pages and listed OS 3.3.1 dated August 31, 2026 at review. This does not establish which main-unit or module order numbers are available in a region, the installed bill of material, support entitlement, compatible PBX or suitability for a particular access and life-safety design.

Read guide →
Troubleshooting · Current SessionTalk push overview, registration-mode, receiving-call, troubleshooting and SessionCloud SIP-setting documentation reviewed October 14, 2026; the sources distinguish foreground SIP service, push-server registration, mode-specific handoff, PBX reachability, APNs or FCM delivery, device wake, secure proxy signaling and direct media, but do not prove one application, entitlement, account, credential, push profile, PBX, firewall, provider, platform service, device, registration, INVITE, call interface, packet, media stream or completed call, and none was inspected or tested

SessionTalk push call does not wake or complete

Follow one incoming call through foreground SIP control, selected registration mode, push-server binding, PBX reachability, APNs or FCM delivery, device wake, forwarded INVITE, answer and direct media.

Read guide →
Guide · Current Asterisk res_pjsip_history source plus official PJSIP history, troubleshooting, logging and CHANNEL documentation reviewed October 15, 2026; the history module has extended support status in current source and was introduced in Asterisk 13.8.0, while exact module availability, CLI grammar, loaded state, memory headroom, message volume, logger filters and retention policy remain installation specific; no host, module, process, memory state, endpoint, trunk, message, capture, credential, packet, dialog or live call was inspected or tested

Asterisk PJSIP History: bounded in-memory SIP evidence

Capture a short SIP interval in memory, filter it by supported fields and preserve one dialog without turning permanent tracing into a memory or privacy risk.

Read guide →
Troubleshooting · Current Asterisk res_pjsip_history source plus official PJSIP history, troubleshooting, logging and CHANNEL documentation reviewed October 15, 2026; the history module has extended support status in current source and was introduced in Asterisk 13.8.0, while exact module availability, CLI grammar, loaded state, memory headroom, message volume, logger filters and retention policy remain installation specific; no host, module, process, memory state, endpoint, trunk, message, capture, credential, packet, dialog or live call was inspected or tested

Asterisk PJSIP History is empty, incomplete or too noisy

Prove module state, capture timing, retained entries, filter grammar and call-leg identity before concluding that signaling is absent.

Read guide →
Guide · Current Asterisk 23 res_prometheus configuration, sample configuration, implementation, built-in HTTP-server guidance and official release history plus the Prometheus pull-model overview reviewed October 15, 2026; Asterisk documents res_prometheus from 17.0.0, while channel- and bridge-detail cardinality controls are version-specific and the installed branch, package, module providers, HTTP prefix, URI, authentication, network policy, scraper, label set, retention and alert rules remain deployment specific; no host, module, configuration, credential, HTTP route, scrape target, metric series, dashboard, alert, endpoint, registration, channel, bridge or live call was inspected or tested

Asterisk Prometheus metrics: module, HTTP route and cardinality boundaries

Expose a bounded, authenticated Asterisk metrics route, prove the installed metric providers and keep scrape success separate from call-service health.

Read guide →
Troubleshooting · Current Asterisk 23 res_prometheus configuration, sample configuration, implementation, built-in HTTP-server guidance and official release history plus the Prometheus pull-model overview reviewed October 15, 2026; Asterisk documents res_prometheus from 17.0.0, while channel- and bridge-detail cardinality controls are version-specific and the installed branch, package, module providers, HTTP prefix, URI, authentication, network policy, scraper, label set, retention and alert rules remain deployment specific; no host, module, configuration, credential, HTTP route, scrape target, metric series, dashboard, alert, endpoint, registration, channel, bridge or live call was inspected or tested

Asterisk Prometheus metrics are missing, stale or too large

Find the first failure among branch support, module state, HTTP path, authentication, provider families, scrape timing, labels and cardinality.

Read guide →
Guide · Current Asterisk ODBC setup guidance, upstream res_odbc and func_odbc samples, Asterisk 23 ODBC_FETCH and SQL escaping references, and security advisory AST-2022-003 reviewed October 15, 2026; installed ODBC driver, system DSN, Asterisk modules, configuration ownership, database schema, permissions, query plan, transaction policy and call-flow fallback remain deployment specific; no host, driver, DSN, module, credential, database, schema, query, row, transaction, channel or live call was inspected or tested

Asterisk func_odbc dialplan lookups: DSN, escaping, rows and latency

Design one bounded database-backed dialplan lookup without confusing a loaded connector, a successful query, a returned row and the final call-flow outcome.

Read guide →
Troubleshooting · Current Asterisk ODBC setup guidance, upstream res_odbc and func_odbc samples, Asterisk 23 ODBC_FETCH and SQL escaping references, and security advisory AST-2022-003 reviewed October 15, 2026; installed ODBC driver, system DSN, Asterisk modules, configuration ownership, database schema, permissions, query plan, transaction policy and call-flow fallback remain deployment specific; no host, driver, DSN, module, credential, database, schema, query, row, transaction, channel or live call was inspected or tested

Asterisk func_odbc returns empty, errors or delays the call

Find the first failure among module availability, connection naming, DSN and driver state, query execution, escaping, result cardinality and synchronous call-path latency.

Read guide →
Guide · Current Asterisk database-transaction guidance, latest generated ODBC transaction, commit and rollback references, upstream func_odbc and res_odbc samples, and res_odbc configuration guidance reviewed October 15, 2026; installed Asterisk branch, module packaging, driver, DSN, DBMS, schema, statements, account permissions, isolation support, transaction lifetime, concurrency, idempotency, retry policy and caller treatment remain deployment specific; no host, module, driver, DSN, credential, database, schema, statement, row, transaction, channel or live call was inspected or tested

Asterisk ODBC writes and transactions: commit, rollback and hangup safety

Design one authorized database write with a bounded func_odbc contract, named transaction, explicit completion and deterministic failure treatment.

Read guide →
Troubleshooting · Current Asterisk database-transaction guidance, latest generated ODBC transaction, commit and rollback references, upstream func_odbc and res_odbc samples, and res_odbc configuration guidance reviewed October 15, 2026; installed Asterisk branch, module packaging, driver, DSN, DBMS, schema, statements, account permissions, isolation support, transaction lifetime, concurrency, idempotency, retry policy and caller treatment remain deployment specific; no host, module, driver, DSN, credential, database, schema, statement, row, transaction, channel or live call was inspected or tested

Asterisk ODBC write commits, rolls back or duplicates data

Trace one database mutation from func_odbc input and affected rows through active transaction, commit or rollback, channel teardown and any later retry.

Read guide →
Guide · Current Asterisk Realtime architecture, PJSIP Realtime tutorial, Sorcery mapping and caching guidance, Realtime schema-management guidance, PJSIP troubleshooting guide, and upstream extconfig and sorcery samples reviewed October 15, 2026; installed Asterisk branch, packaged modules, mapping order, connector, DSN, driver, schema revision, database account, rows, cache policy, reload behavior and PJSIP runtime state remain deployment specific; no host, module, connector, credential, database, schema, row, cache, endpoint, registration, message, packet or live call was inspected or tested

Asterisk PJSIP Realtime: Sorcery mapping, schema and cache boundaries

Map one PJSIP object from Sorcery type and source order through Realtime family, connector, schema row, cache and runtime consumer.

Read guide →
Troubleshooting · Current Asterisk Realtime architecture, PJSIP Realtime tutorial, Sorcery mapping and caching guidance, Realtime schema-management guidance, PJSIP troubleshooting guide, and upstream extconfig and sorcery samples reviewed October 15, 2026; installed Asterisk branch, packaged modules, mapping order, connector, DSN, driver, schema revision, database account, rows, cache policy, reload behavior and PJSIP runtime state remain deployment specific; no host, module, connector, credential, database, schema, row, cache, endpoint, registration, message, packet or live call was inspected or tested

Asterisk PJSIP Realtime object is missing, stale or from the wrong source

Find the first divergence among Sorcery type, mapping order, Realtime family, connector, schema row, cache and PJSIP runtime view.

Read guide →
Guide · Current Asterisk branch-23-generated PERIODIC_HOOK, Playback and CHANNEL references plus branch 22 and 20 PERIODIC_HOOK references reviewed October 15, 2026; installed branch, func_periodic_hook availability, owner channel, hook ID, context, extension, whole-second interval, hook-channel dialplan, audio file, bridge and media topology, recording policy, load and teardown remain deployment specific; no host, module, dialplan, channel, hook, bridge, recording, audio stream or live call was inspected or tested

Asterisk periodic hooks: owner channel, async execution and injected audio

Attach one bounded periodic dialplan hook while keeping the owner channel, generated hook ID, asynchronous hook channel, interval, audio and teardown evidence separate.

Read guide →
Troubleshooting · Current Asterisk branch-23-generated PERIODIC_HOOK, Playback and CHANNEL references plus branch 22 and 20 PERIODIC_HOOK references reviewed October 15, 2026; installed branch, func_periodic_hook availability, owner channel, hook ID, context, extension, whole-second interval, hook-channel dialplan, audio file, bridge and media topology, recording policy, load and teardown remain deployment specific; no host, module, dialplan, channel, hook, bridge, recording, audio stream or live call was inspected or tested

Asterisk periodic hook is missing, duplicated or heard late

Find the first divergence among module availability, hook creation, retained ID, owner channel, async hook execution, playback, media injection and teardown.

Read guide →
Guide · Current Asterisk branch-23-generated AMI UserEvent action, UserEvent event and UserEvent dialplan-application references, matching branch-22 references, plus the official AMI event-filtering, command-syntax and Manager TCP/IP material reviewed October 16, 2026; installed branch, module, dialplan, manager permissions, session mask, filters, transport, parser, retry policy, schema and application outcome remain deployment specific; no PBX, module, dialplan, manager session, event stream, channel, bridge, endpoint, packet, media stream, business system or live call was inspected or tested

Asterisk AMI UserEvent custom telemetry

Design application-owned UserEvent names, headers and correlation keys while keeping AMI action responses, dialplan emission, event delivery and downstream outcomes independently observable.

Read guide →
Troubleshooting · Current Asterisk branch-23-generated AMI UserEvent action, UserEvent event and UserEvent dialplan-application references, matching branch-22 references, plus the official AMI event-filtering, command-syntax and Manager TCP/IP material reviewed October 16, 2026; installed branch, module, dialplan, manager permissions, session mask, filters, transport, parser, retry policy, schema and application outcome remain deployment specific; no PBX, module, dialplan, manager session, event stream, channel, bridge, endpoint, packet, media stream, business system or live call was inspected or tested

Asterisk AMI UserEvent is missing, duplicated or misleading

Trace one application-owned event from its AMI action or dialplan producer through event naming, USER permission, masks, filters, transport, parsing, idempotent storage and the separate business outcome.

Read guide →
Asterisk · Current first-party Asterisk security-framework, logging, command, configuration and source evidence reviewed October 18, 2026. Security-event generation, res_security_log module state, dynamic SECURITY level registration, logger channel configuration, destination path, file write, rotation, downstream parser, alert and enforcement action remain separate evidence. A security event is not by itself proof of compromise, and a written record is not proof of a ban or alert. No host, module, logger channel, file, permission, event, parser, firewall, packet, account or call was inspected or tested

Asterisk security-event logging: generation, channel and custody evidence

Trace a security event from the producing subsystem through res_security_log, the dynamic SECURITY level, logger channel, file custody, rotation and downstream consumers.

Read guide →
Troubleshooting · Current first-party Asterisk security-framework, logging, command, configuration and source evidence reviewed October 18, 2026. Security-event generation, res_security_log module state, dynamic SECURITY level registration, logger channel configuration, destination path, file write, rotation, downstream parser, alert and enforcement action remain separate evidence. A security event is not by itself proof of compromise, and a written record is not proof of a ban or alert. No host, module, logger channel, file, permission, event, parser, firewall, packet, account or call was inspected or tested

Asterisk security events are missing, too noisy or not reaching enforcement

Separate event generation, res_security_log state, dynamic logging level, channel path, file custody, rotation, parser, alert and defensive action.

Read guide →
Troubleshooting · Current first-party PhonerLite product, 3.46 stable and 3.47 beta release, profile, configuration-location, provisioning, audio-device, logbook, recording and transcription documentation reviewed October 18, 2026. Executable package, resolved configuration directory, active profile, credential-bearing sipper.ini, registration, call history, recording file, sound device and completed call remain separate evidence. No package, signature, Windows host, profile, credential, PBX, file, recording, transcription, headset, protected session or live call was inspected or tested

PhonerLite profile, history or settings are missing after an update

Trace the running package, write context, resolved data directory, files and active profile before restoring credentials, history, contacts, audio settings or recording links.

Read guide →
Client operations guide · Current Linphone stable Windows archive and first-party desktop file-tree, linphonerc, support-log and remote-provisioning documentation reviewed October 18, 2026. The archive lists desktop 6.2.3 dated September 22, 2026, while the file-tree and linphonerc pages explicitly describe desktop 4.2 and 4.3 layouts. Those older paths and filenames are investigation leads to verify on the running 6.2 build, not proof of its effective storage. No package, signature, workstation, configuration, database, contact, history row, credential, support upload, PBX, packet, media stream or call was inspected or tested

Linphone desktop local data: configuration, databases and support logs

Separate the distributed 6.2.3 package from version-scoped file-tree documentation, effective local state, provisioned values, databases and sanitized support logs.

Read guide →
Troubleshooting · Current Linphone stable Windows archive and first-party desktop file-tree, linphonerc, support-log and remote-provisioning documentation reviewed October 18, 2026. The archive lists desktop 6.2.3 dated September 22, 2026, while the file-tree and linphonerc pages explicitly describe desktop 4.2 and 4.3 layouts. Those older paths and filenames are investigation leads to verify on the running 6.2 build, not proof of its effective storage. No package, signature, workstation, configuration, database, contact, history row, credential, support upload, PBX, packet, media stream or call was inspected or tested

Linphone history, contacts or settings are missing after an update

Trace the exact desktop build, user profile, effective storage, configuration, databases and provisioning before restoring or sharing sensitive logs.

Read guide →