VoIP.info Guide

PBX logs and packet captures: useful evidence with limited exposure

Collect enough to diagnose a call while protecting identities, secrets and audio.

Reviewed 2026-10-30Foundational

A trace can reveal more than an error

SIP logs may contain numbers, names, addresses and authentication-related material. Media captures can contain conversation content when decodable. Recordings and voicemail have their own access and retention implications.

Scope the collection

Capture one reproducible call or a narrow incident interval. Note the timestamp, direction and affected leg. Prefer read-only status checks before enabling broad protocol logging on a busy PBX.

Preserve diagnostic value when redacting

Remove secrets and private identities while keeping relationships consistent. A sanitized address should refer to the same participant throughout the extract. Keep methods, response order and relevant SDP structure so the recipient can still understand the failure.

Finish the investigation cleanly

Restore previous logging levels and remove temporary collection rules. Store retained evidence under the organization's access and retention policy. Do not upload complete archives to public forums when a short sanitized exchange would answer the technical question.

Keep FreePBX log access and retention inside the privacy boundary

The FreePBX Asterisk Logfile Settings guide scopes logger levels, files, rotation and temporary capture while preserving the module security-update and administrator-access boundary.

Govern facility snapshots, video and door events

A GSC3570 can involve local storage, camera snapshots, SIP history and alarm or door actions. Define collection, access, export, retention and deletion per data type; a removable card or optional file service is not an automatic evidence or privacy programme.

Govern 2N video, credential and access evidence separately

A 2N IP Verso 2.0 deployment may add camera, mobile, RFID, fingerprint, keypad and management records, while an IP One has a different fixed role. Define collection, retention, access and export for each data type; a device event is not proof of the person or final door state.

Bound SessionTalk push logs and caller data

SessionTalk says the push message contains some caller details and recommends a narrow SIP log for troubleshooting. The diagnostic limits capture, redacts identities and secrets, and restores logging after the reproduction.

Bound and dispose of in-memory SIP history

The PJSIP History guide treats retained SIP headers, SDP, identities, addresses and authentication material as restricted incident evidence.

Treat labels and build properties as operational data

The Prometheus metrics guide inventories exposed build, node, channel and bridge labels, restricts access and avoids copying credentials or unrestricted metric output into tickets.

Keep credentials and returned rows out of troubleshooting records

The func_odbc diagnostic retains timing, status and error-class evidence while redacting credentials, sensitive query values and customer rows.

Record transaction evidence without copying sensitive rows

The ODBC mutation diagnostic keeps IDs, status classes, timing and counts while redacting credentials and customer data.

Protect PJSIP Realtime evidence

The PJSIP Realtime diagnostic keeps object identity and error classes useful while redacting database credentials, auth material and customer configuration values.

Protect periodic-hook call evidence

The periodic-hook diagnostic retains hook and channel correlation while redacting caller data and secrets.

Keep secrets and excess personal data out of UserEvent

The AMI UserEvent guide uses opaque references, bounded logs and retention for custom headers.

Protect security-event evidence across every destination

Asterisk security records can contain account, session and address context. Follow the security-event guide and retain only the fields and custody required for the investigation.

Protect PhonerLite profiles, history and recordings separately

sipper.ini can contain reusable credentials, while the logbook, contacts, WAV files and transcripts carry different data. The diagnostic preserves custody for each.

Sanitize Linphone support logs before sharing

Linphone asks for version, reproduction and logs but warns against exposing passwords and other private data. The local-data guide preserves an internal original while bounding any support copy or upload.

Sanitize Linphone support evidence before sharing

The Linphone local-data guide separates local originals, redacted extracts, upload links, recipients and retention for desktop 6.x logs.

Protect PRI signaling evidence

The AMI PRI guide requires bounded retention and redaction for circuit identities, numbers and protocol details.

Bound Wave logs, screenshots and QR material

The Grandstream Wave diagnostic retains timestamps and state while removing passwords, tokens, QR codes and unnecessary caller data.

Sanitize RingCentral debug, HAR and analytics exports

The RingCentral diagnostic retains timestamps and state while removing tokens, addresses and unnecessary identity or call data.

Sanitize IAX2 peer, registry and call evidence

The IAX2 AMI evidence guide preserves timestamps and raw boundaries while removing credentials and unnecessary addresses or call data.

Protect rotated and collected log content

The AMI LoggerRotate guide retains minimal metadata and redacted bounded events across active, rotated and downstream copies.

Treat Zoom Phone problem reports as controlled data transfer

The Zoom Workplace client guide records authorization, occurrence time, necessary client logs and local cleanup without representing submission as diagnosis.

Redact VP59 cross-edition diagnostic records

The VP59 diagnostic preserves logs while excluding credentials, tokens, certificates and personal data.

Bound and sanitize NextivaONE HAR and local logs

The NextivaONE guide limits evidence to the authorized occurrence window and separates submission from diagnosis and restoration.

Bound Teams client logs and multi-account data

The Teams Phone client guide separates authorized collection, storage, export, sanitization, support submission and findings.

Bound Dialpad tests, error reports and debug logs

The Dialpad app guide separates authorized collection, sanitization, submission, support finding and verified restoration.

Handle core dumps as sensitive process memory

The crash and backtrace guide keeps raw artifacts private and requires review and redaction before public attachment.

Protect mmlog, refs and activity logs

The memory-growth guide requires restricted originals, redacted issue copies and recorded custody.

Bound 8x8 utility, app and support evidence

The 8x8 Work app guide separates authorized collection, sanitization, support submission, provider finding and verified restoration.

Restrict lock, backtrace and core artifacts

The deadlock-evidence guide requires controlled originals, reviewed redacted attachments and recorded custody.

Bound VBC app, quality and support evidence

The VBC app guide separates authorized collection, minimization, support submission, finding and verified restoration.

Restrict startup and shutdown artifacts

The restart diagnostic keeps raw logs controlled and shares only reviewed, minimized excerpts.

Minimize Aircall call, recording and support evidence

The Aircall Workspace guide separates authorized collection, customer content, call IDs, diagnostics, case findings and restoration.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.