NethVoice: reduce log verbosity

NethVoice logs are too verbose during normal operation.
Most of the lines are generated by Janus which is configured in info level.
Then, FreePBX, NethCTI middleware, NethCTI server, Satellite and Tancredi (in debug mode).

Also Kamailio produced a very large of useless log, it will be handled in a different issue.

The purpose is to keep the journal small, make real errors visible, and still allow raising the verbosity if needed.

Proposed solution

Lower the default log level of the components that currently run at their loudest setting, and expose each level as a module environment variable.

Component	Current default	Proposed default	Variable
Janus	5	3, warnings and errors	`JANUS_DEBUG_LEVEL`
Tancredi	`DEBUG`	`WARNING`	`TANCREDI_LOG_LEVEL` (new)
NethCTI middleware	debug mode	release mode	`NETHVOICE_MIDDLEWARE_GIN_MODE` (new)
Reports API	release mode	release mode	`REPORTS_GIN_MODE` (explicit)
FreePBX: supervisord, cron, PAM	every job start, end and session	failures only	`FREEPBX_LOG_LEVEL` (new)
Satellite	`INFO`, the image default	`WARNING`	`SATELLITE_LOG_LEVEL` (new)

On existing installations JANUS_DEBUG_LEVEL is lowered only when it still holds the old default of 5.

Satellite at INFO logged every RTP stream, every ARI channel event and every HTTP request, and uvicorn added its own access lines. The value also sets uvicorn's level.

For FreePBX the cron and PAM lines are few. The image replaces FreePBX's cron manager with a noop and ships no asterisk crontab: the spool is empty and /etc/crontab carries only the four stock run-parts entries, which run as root and at most hourly. FREEPBX_LOG_LEVEL is still worth having, but it removes little volume.

Most of what the FreePBX container writes comes out at container start: on an idle system a restart produces about 550 journal lines, largely fwconsole progress bars and blank lines, and then it stays silent. That is a separate problem and is not addressed here.

Please note that NethCTI middleware was running in debug mode with CORS checks disabled.

Testing versions: ns8-nethvoice:reduce_log_level, ns8-nethvoice-proxy:1.7.3-testing.6

Fresh install:

add-module ghcr.io/nethesis/nethvoice:reduce_log_level
add-module ghcr.io/nethesis/nethvoice-proxy:1.7.3-testing.6 1

Update an existing instance:

update-module ghcr.io/nethesis/nethvoice:reduce_log_level nethvoice1
update-module ghcr.io/nethesis/nethvoice-proxy:1.7.3-testing.6 nethvoice-proxy1

Read the logs of the instance with:

journalctl --since -10min

Test case 1: Janus, clean install

Install NethVoice on a clean node and complete the wizard
Create two users with a WebRTC extension
Log both into the CTI from a browser and call one from the other
Search for the janus log inside journald
No line like these must appear:

Got a Janus API request from janus.transport.http (0x7fc19408e550)
Got a keep-alive on session 7577379188318132
Session 7577379188318132 found... returning up to 10 messages
Detaching handle from JANUS SIP plugin; 0x7fc1d427b900
[7577379188318132] Handle detached, scheduling destruction
Destroying SIP session (unregistered user)...

Only warnings and errors must be there, and every line must start with [janus]

Test case 2: FreePBX, clean install

Install NethVoice on a clean node and complete the wizard
Wait five minutes, then search for the freepbx log inside journald
No line like this must appear:

2026-09-17 11:17:02,911 INFO reaped unknown pid 5042 (exit status 0)

Asterisk lines must still be there: make a call and check it is logged

Test case 3: Tancredi, clean install

Install NethVoice on a clean node and complete the wizard
Open the phones page and let a phone provision, or press "Reconfigure phones"
Search for tancredi log inside journald
No line like these must appear:

[2026-09-17T13:30:17.332420+00:00] provisioning.DEBUG: Using shipped pattern file "/usr/share/tancredi/data/patterns.d/akuvox.ini"
[2026-09-17T11:38:17.101123+00:00] upgrade.DEBUG: Launching upgrade script /usr/share/tancredi/scripts/upgrade.d/014-custom.php

No phone password or request body must appear anywhere in the log

Test case 4: CTI middleware, clean install

Install NethVoice on a clean node and complete the wizard
Log into the CTI and use it for a couple of minutes
Search for the nethcti-middleware log inside journald
Only lines with "proxied" should appear:

[GIN] 2026/09/17 - 15:11:03 | 200 |   44.735417ms |    2.119.67.169 | GET     "/user/me" [proxied]

Log into the CTI again and check it still works: the login must succeed and calls must be visible

Test case 5: Reports, clean install

Install NethVoice on a clean node and complete the wizard
Open the reports page and browse a couple of reports
Search for the reports-api log inside journald
No line like this must appear:

[GIN] 2026/09/17 - 15:11:11 | 200 |    1.734086ms |       127.0.0.1 | GET      "/settings"

The reports page must still show data

Test case 6: Satellite, clean install

Install NethVoice on a clean node and complete the wizard
Open Settings > Integrations and turn on call transcription
Make sure the users that will execute the call has call transcription permission
Make a call between two users and wait for it to end
Search for the satellite log inside journald
No line like these must appear:

2026-09-17 15:28:35,144 - rtp_server - INFO - rtp_server.py:125 - Ended RTP stream for port 20602
2026-09-17 15:28:36,731 - httpx - INFO - _client.py:1740 - HTTP Request: POST https://api.deepgram.com/v1/listen "HTTP/1.1 200 OK"

The transcription must still be produced and visible in the CTI

Test case 7: update from a previous version

Install the previous NethVoice version and complete the wizard
Update the instance to the version under test
Repeat the checks of test cases 1 to 6: all those lines must be gone
Check that nothing else changed: users, extensions and trunks must all still be there

Test case 8: raise every level back to debug

Start from an installation of the version under test
Edit the instance settings: runagent -m nethvoice1 vi environment
Set these values:

JANUS_DEBUG_LEVEL=5
TANCREDI_LOG_LEVEL=DEBUG
FREEPBX_LOG_LEVEL=debug
SATELLITE_LOG_LEVEL=DEBUG
NETHVOICE_MIDDLEWARE_GIN_MODE=debug
REPORTS_GIN_MODE=debug

Restart the instance: systemctl restart user@nethvoice1 (from root user)
Repeat the actions of test cases 1 to 6: call between two users, provision a phone, use the CTI, open the reports, turn on transcription
Every line listed in test cases 1 to 6 must now be back in the logs
Put the values back to 3, WARNING, warn, WARNING, release, release, restart again, and check the lines disappear again

Test case 9: proxy, clean install

Install the proxy and NethVoice on a clean node and complete the wizard
Register a few phones, some over TCP or TLS, and make a couple of calls, internal and through a trunk
Leave it running for at least one hour, then search for the kamailio log inside journald
Lines like these must be rare or gone:

ERROR: <core> [core/tcp_main.c:...]: tcpconn_do_send(): failed to send on 0x... (...): Connection reset by peer (104)
ERROR: <core> [core/tcp_main.c:...]: handle_ser_child(): received CON_ERROR for 0x... (id ...), refcnt 3, flags 0x...
ERROR: <core> [core/tcp_read.c:...]: tcp_read_req(): error reading - c: 0x... r: 0x... (-1)
ERROR: <core> [core/parser/parse_fline.c:...]: parse_first_line(): parse_first_line: bad message (offset: 0)
Malformed SIP request from 1.2.3.4:5060

Phones must stay registered and calls must work in both directions

Test case 10: proxy, security events still logged

Start from an installation of the proxy under test
Register a phone with the right password and leave it running for at least one hour, so it refreshes its registration a few times
No [SECURITY-AUTHFAIL] line must appear for that phone
Try to register a phone with a wrong password: a line like this must appear

WARNING: <script>: [SECURITY-AUTHFAIL] ... event=auth_failure method=REGISTER status=401 src_ip=<phone ip> user=<extension> ...

From a spare machine (its address gets blocked for 5 minutes), send a SIP request with a scanner tool, for example sipsak -s sip:test@<proxy address>: these lines must appear

WARNING: <script>: [SECURITY-SCANNER] ... event=scanner_ua method=OPTIONS src_ip=<machine ip> ... ua="sipsak ..." - script kiddies, dropping and blocking
WARNING: <script>: [R-BLOCKIP:...]: blocking OPTIONS from ... (IP:<machine ip>:...)

With CrowdSec installed and the NethVoice protection on, repeated wrong passwords must still get the address banned

Test case 11: proxy, update from a previous version

Install the previous proxy version, register phones and make a call
Update the proxy to the version under test
Repeat the checks of test cases 9 and 10
Phones must register again, calls must work, and the proxy settings page must show the same values as before

Test case 12: proxy, raise the log level

Start from an installation of the proxy under test
Temporary change, no restart: run runagent -m nethvoice-proxy1 podman exec kamailio kamcmd corex.debug 3, then register a phone: many more lines must appear in the log
Run runagent -m nethvoice-proxy1 podman exec kamailio kamcmd corex.debug 0: the extra lines must stop
Permanent change: edit the instance settings with runagent -m nethvoice-proxy1 vi environment and set KAMAILIO_LOG_LEVEL=3
Restart the proxy: systemctl restart user@nethvoice-proxy1 (from root user), register a phone and check the extra lines are there
Open the proxy settings page and save it without changing anything, then restart again: the extra lines must still be there
Set KAMAILIO_LOG_LEVEL=0, restart, and check the extra lines disappear

chore(timers): silence periodic unit logs

Tested on a two-node NS8 cluster.

Images: ghcr.io/nethesis/nethvoice:reduce_log_level and ghcr.io/nethesis/nethvoice-proxy:1.7.3-testing.6
Update path: NethVoice 1.7.9 + proxy 1.7.2 updated to the versions under test.
Fresh install: both versions under test installed on a clean node.
Traffic: calls and registrations generated with SIPp from a second host over UDP, TCP and TLS. CTI, Janus, Tancredi and reports were exercised through their APIs.

TC	Result	Notes
1 Janus	✅	No API request, keep-alive, detach or destroy lines. Every line starts with `[janus]`; only the startup banner is left besides warnings.
2 FreePBX	✅	On 1.7.9: 56 `reaped unknown pid`, 88 supervisord INFO and 48 CRON/pam lines. After the change: 0. Asterisk lines are still logged.
3 Tancredi	✅	No `provisioning.DEBUG` / `upgrade.DEBUG` lines, no secrets or request bodies in the log.
4 CTI middleware	✅	No `[GIN]` lines. Login works and calls show up in the history.
5 Reports	❌	See below.
6 Satellite	✅	Only warnings and errors at `WARNING`, transcription works.
7 Update from previous version	✅	Environment migrated (`JANUS_DEBUG_LEVEL` 5 → 3, new defaults added). Users, extensions, trunks and phones unchanged.
8 Raise every level to debug	✅	All the lines of TC 1–6 come back at debug and disappear again once the defaults are restored.
9 Proxy, 1h soak	✅	201 registrations over UDP/TCP/TLS and 7/7 calls OK. No `tcp_read_req`, `parse_first_line` or `Malformed SIP` lines.
10 Proxy security events	✅	No `SECURITY-AUTHFAIL` for correctly registered phones over 1h. A wrong password logs `SECURITY-AUTHFAIL`; a `sipsak` UA logs `SECURITY-SCANNER` + `R-BLOCKIP`. CrowdSec ban not tested.
11 Proxy update	✅	Settings preserved, phones register again and calls work.
12 Kamailio log level	✅	`kamcmd corex.debug` toggles the output at runtime. `KAMAILIO_LOG_LEVEL=3` survives a restart and a save from the settings page, and `0` silences it again.

TC5: reports-api still logs every request

With GIN_MODE=release (confirmed inside the container) reports-api still prints a line for every request:

[GIN] 2026/10/07 - 12:52:10 | 200 |    6.792974ms |       127.0.0.1 | GET      "/settings"

nethvoice-report builds its router with gin.Default() (api/main.go). gin.Default() always adds the request logger, whatever the mode. GIN_MODE=release only removes the [GIN-debug] route dump and disables the permissive CORS. The output is the same as on 1.7.9.

We need to decide whether:

we leave it as it is: the volume is low, one line per request to the reports page;
or we fix it in nethvoice-report: use gin.New() with gin.Recovery(), and add gin.Logger() only when GIN_MODE=debug. This matches what the middleware already does.

Release nethesis/ns8-nethvoice 1.7.10

Release nethesis/ns8-nethvoice-proxy 1.7.3

Navigation Menu

Repository navigation

NethVoice: reduce log verbosity #8173

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

NethVoice: reduce log verbosity #8173

Description

Activity

gsanchietti commented on Sep 18, 2026

6 remaining items

edospadoni commented on Oct 7, 2026

Amygos commented on Oct 12, 2026

Amygos commented on Oct 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions