Classify the first missing or excessive boundary
Choose one host, one exact time window, one expected security event and one configured destination. Record whether the symptom is no event at all, an event visible only on the console, an absent logger channel, a silent file, the wrong file, excessive legitimate events, rapid growth, a rotation gap, dropped collection, parser rejection, no alert or no enforcement action.
Preserve timezone, Asterisk version, module and channel inventories, destination path, file metadata, free space and the unmodified sample record. Do not change module loading, logger levels, file permissions, rotation and downstream rules in one step.
Prove event generation before blaming the file
Identify the expected event-producing subsystem and event subtype. Asterisk’s security framework separates generation from the logger consumer; no record can be written if the relevant code did not publish the event. Compare the exact service and transaction with ordinary protocol or application evidence rather than assuming that every failed call or packet must create a security event.
If a controlled test is justified, use an isolated authorized identity and preserve the exact test time and expected result. Do not use a production credential, repeatedly trigger lockouts or expose a new listener merely to make the log move.
Verify res_security_log and the dynamic SECURITY level
Confirm that res_security_log is present and loaded in the running process and that its load succeeded. The current source registers the SECURITY dynamic level and subscribes to the security topic during module load. A module file on disk is not loaded-state proof, and a successful module load is not proof that logger.conf routes the level anywhere.
Read logger show channels after the module and logger configuration are stable. Keep uppercase source-level registration, lowercase configuration spelling and the actual channel readback as separate observations rather than fixing capitalization by guesswork.
Trace the logger channel to the actual destination
Inspect the effective logger.conf, includes and configuration owner. Confirm that one destination selects security, then resolve a relative filename against astlogdir or verify the absolute path. Check the running service identity, directory traversal, ownership, mode, mount state, free space and whether another process replaced or moved the file.
Reload only the logger when that is the intended change, read the channels again and preserve the command result. A present file with an old timestamp, a write to a different host-suffixed filename and a syslog destination are different outcomes.
Separate volume, rotation and ingestion problems
When records are too noisy, group them by event subtype, service, account, session and remote address before suppressing anything. Successful or expected local authentication may be operationally normal even though it is security-related. Preserve the raw record and determine which producing activity explains the volume.
For apparent gaps, inspect rotation timestamps, archived names, compression or shipping, the logger queue, disk pressure and collector checkpoints. A collector lag, parser mismatch or rotated-file cursor error must not be rewritten as an Asterisk event-generation failure.
Correct one owner and retest the full custody chain
Correct only the demonstrated boundary: producing subsystem, module load, dynamic level, channel declaration, log directory, permissions, storage, rotation, collection, parser, alert rule or enforcement integration. Preserve rollback, then repeat one bounded authorized test and confirm each timestamp from source event through the final expected action.
Confirm that unrelated notice, debug and verbose traffic did not enter the dedicated destination and that sensitive fields remain protected. No host, module, logger channel, file, event, parser, alert, firewall, packet, account or call was inspected or tested for this diagnostic.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Asterisk: Security Event Logger ↗
- Asterisk: Security Event Generation ↗
- Asterisk: Security Framework Overview ↗
- Asterisk: Logging Configuration ↗
- Asterisk: Basic Logging Commands ↗
- Asterisk: Main Configuration File ↗
- Asterisk source: res_security_log ↗
- Asterisk source: logger.conf sample ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.