FAQ

This page provides answers to frequently asked questions and solutions for common issues encountered during the configuration and operation of VoIPmonitor.

General & Scalability

How does VoIPmonitor scale for high traffic?

For a detailed guide on performance tuning, hardware recommendations, and optimizing the three main system bottlenecks (CPU, Disk I/O, Database), please refer to our comprehensive Scaling and Performance Tuning guide.

How do I manage disk space and database size?

VoIPmonitor uses separate mechanisms for cleaning PCAP files from the filesystem and CDRs from the database. For a complete walkthrough, see the Data Cleaning and Retention guide.

CDR (Call Detail Record) View

What does the small red icon in the CDR view mean?

The red icon () indicates which party in the call sent the `BYE` message first, effectively ending the call.

How can I use regular expressions to filter calls?

The filter bar in the CDR view supports regular expressions. This is useful for finding malformed or unusual data. For example, to find all calls where the caller number contains non-numeric characters, you can use a negative match:

!R(^[+]?[0-9]+$)

Why is there a delay between when a call ends and when it appears in the CDR view?

This delay is typically caused by the database's inability to keep up with the rate of incoming calls, creating a queue of SQL queries on the sensor. For solutions, please read:

• SQL queue is growing in a peaktime
• Minimizing Delay Between Call End and CDR Database Storage

How can I enable millisecond precision for timestamps in the CDR view?

By default, timestamps are stored with second precision. To enable millisecond precision, please follow the steps in this guide: How_to_enable_milliseconds_precision.

Platform & Environment Support

What hardware architectures does the sensor support?

The sensor is tested and supported on x86 (32/64-bit) and ARMv7/v8 architectures. If you encounter an error like `__sync_fetch_and_sub_8` on an older ARM device, you may need to upgrade your GCC compiler to version 4.8 or newer.

Can I run VoIPmonitor on AWS?

Yes, AWS is supported. For the license check to function correctly on some Amazon Machine Images (AMIs), you may need to adjust permissions on the root device file.

chmod 644 /dev/root

Is Docker or other container environments supported?

Yes, the GUI and sensor can run in a containerized environment. However, you must ensure that the content of `/proc/self/cgroup` does not change with every container restart. If it does, the hardware ID will change, and you will be prompted to update your license key after each reboot.

Are hosted/cloud databases (like Amazon RDS, Azure Database) supported?

Yes, VoIPmonitor requires a MySQL-compatible database (MySQL, MariaDB, Percona) and can connect to it regardless of its location. However, the database user requires `SUPER` privilege for creating functions and triggers.

What if my cloud database (like Azure) does not grant `SUPER` privilege?

If `SUPER` privilege is not available, you must manually set the following server variables in your cloud database configuration console:

 log_bin_trust_function_creators = ON

Additionally, ensure your database instance has sufficient performance (e.g., at least 1100 IOPS for 5000 concurrent calls on Azure).

Why is packet mirroring not working on VMWare ESXi 6.5+?

This is often caused by the vSwitch port group being set to VLAN 4095, which activates Virtual Guest Tagging (VGT). In this mode, the guest OS is expected to handle VLAN tags, which can disrupt sniffing.

• Solution: Edit the port group settings in vSphere and change the VLAN ID to a specific number (e.g., 0 or your monitoring VLAN ID) instead of 4095.

Configuration & Features

Why don't I see SIP packets on ports other than 5060?

By default, the sensor only listens for SIP traffic on UDP/TCP port 5060. To monitor additional SIP ports, you must explicitly define them in `voipmonitor.conf`. See the sipport configuration guide.

How do I enable IPv6 traffic processing?

By default, IPv6 is disabled. To enable it on a new installation, set `ipv6=yes` in `voipmonitor.conf`. If you have existing IPv4 data, enabling IPv6 requires a database migration. For detailed instructions, please see the IPv6 Enabling Guide.

How do I capture and view SIP `REGISTER` messages?

By default, `REGISTER` messages are not stored. To enable this, set `sip-register=yes` in `voipmonitor.conf`. For details on how active and failed registrations are stored and how to query them via the API, see the documentation on REGISTER monitoring.

How can I capture DTMF tones?

You can enable DTMF capture in `voipmonitor.conf`:

• For RFC2833 and SIP INFO methods, set:

dtmf2db = yes

• For inband DTMF (G.711 codec only, requires more CPU), set:

inbanddtmf = yes

How can I use the sensor's manager API securely?

Modern sniffer versions (32.0+) have API encryption enabled by default. Please refer to the Manager API Encryption guide for examples on how to use the API with or without encryption.

How does VoIPmonitor handle AudioCodes-tunneled traffic?

VoIPmonitor can process traffic encapsulated in AudioCodes' proprietary tunneling protocol. For setup details, see the AudioCodes Tunneling guide.

Licensing

How do I determine the number of license channels I need?

The license is based on the maximum number of concurrent calls during your peak hours. It is not based on the number of phones or endpoints. You can find your peak usage by navigating in the GUI to Tools -> System Status -> Concurrent calls, which shows data for the past 14 days. The system intelligently groups multiple call legs (e.g., for a single bridged call) so they only count as one channel towards your license.

What happens if my call volume temporarily exceeds my license limit?

If you have a sudden spike in calls (e.g., due to an attack or unexpected event) that exceeds your license, you have a 14-day grace period to resolve it. You must either:

1. Delete the CDRs from the spike period via the GUI filter and delete tools.
2. Upgrade your license to a higher channel count via the voipmonitor.org customer portal.

If the high usage persists for three consecutive days within the grace period, the license will be temporarily blocked until one of these actions is taken.

Audio & PCAP Files

How can I bulk download audio or PCAP files?

You can use the GUI API to script bulk downloads. Please see the guide: Bulk Download using API.

How do I convert existing WAV audio files to OGG to save space?

If you have existing recordings saved as `.wav` and wish to convert them to the more efficient `.ogg` format to save disk space, you can run the following sequence of commands directly in your spool directory (e.g., `/var/spool/voipmonitor`).

# Navigate to your spool directory first
cd /var/spool/voipmonitor

# Step 1: Find all .wav files and convert each one to .ogg using ffmpeg.
# This command preserves the original filename, only changing the extension.
find ./ -name '*.wav' -exec bash -c 'ffmpeg -i "$0" -vn -acodec libvorbis "${0%.wav}.ogg"' {} \;

# Step 2: After confirming the conversion was successful, delete all the original .wav files.
find ./ -name '*.wav' -exec rm -f {} \;

# Step 3: Set the web server user (e.g., www-data) as the owner of all files.
# This is crucial for the GUI to be able to read and play the new .ogg files.
chown -R www-data:www-data ./

Administration & Troubleshooting

How do I reset a lost admin password for the GUI?

Please follow the instructions in the User Management guide.

How do I fix a corrupted GUI installation or reinstall it?

A reinstallation can fix issues with corrupted files or incorrect permissions. See the guide here: Re-install_the_GUI.

The GUI stopped working after a server OS or PHP version upgrade. How do I fix it?

This usually requires re-running the GUI installation script to align with the new PHP version. See: GUI_Installation#Re-installing_the_GUI.

How do I reinstall or upgrade the sniffer to the latest version?

Instructions for downloading and installing the latest static binary are here: Latest_sniffer.

Can I run multiple instances of the sniffer on a single host?

Yes, this is possible for advanced use cases. See the guide: Multiple_sniffer_instancies.

What user actions are recorded in the Audit Log?

The Audit Log tracks the following security-sensitive actions in the GUI:

• Login / Logout
• Playing or downloading WAV/PCAP files
• Showing a FAX
• Using the batch download feature
• Applying a filter in the CDR view

PCI compliance

VoIPmonitor is designed to be PCI compliance-ready. You have granular control over what data is stored to disk and to the database.

How do I turn off audio recording and DTMF capture globally?

• To prevent RTP (audio) payload from being stored while still capturing headers for analysis, use `savertp=header` in `voipmonitor.conf`.
• To disable RTP capture entirely, use `savertp=no`.
• To prevent DTMF tones (from SIP INFO or RFC2833) from being saved to the database and PCAP files, use:

dtmf2db = no

dtmf2pcap = no

How do I selectively record or not record audio/DTMF?

VoIPmonitor's powerful Capture Rules allow you to define conditional logic. You can create rules based on IP address, telephone number, SIP domain, or any SIP header to selectively turn audio or DTMF recording ON or OFF for specific calls, enabling you to meet strict compliance requirements.

AI Summary for RAG

Summary: This document serves as a comprehensive FAQ and troubleshooting guide for common VoIPmonitor issues. It covers a wide range of topics, including call data and CDR analysis (red icons, regex filters, CDR delay), platform support (AWS, Docker, VMWare ESXi, cloud databases like Azure), system configuration (monitoring multiple SIP ports, IPv6, DTMF), and licensing (channel calculation, handling spikes). It also provides solutions for managing audio files (bulk download, WAV to OGG conversion) and administrative tasks like resetting passwords, reinstalling the GUI or sniffer, and understanding the Audit Log. A key section addresses PCI compliance, detailing how to selectively or globally disable audio and DTMF recording using capture rules and configuration settings. Keywords: faq, troubleshooting, cdr, red icon, regex, active calls, aws, docker, container, esxi, vlan 4095, azure, super privilege, sipport, ipv6, dtmf, license, concurrent channels, license spike, audio files, bulk download, wav, ogg, ffmpeg, pci compliance, capture rules, savertp, dtmf2db, audit log, reinstall, lost password, multiple instances Key Questions:

• Why is there a delay between active calls and the CDR view?
• How is VoIPmonitor licensing calculated for concurrent channels?
• What happens if my call traffic exceeds my license limit?
• How can I run VoIPmonitor in Docker or on AWS?
• Why is packet sniffing not working on my VMWare ESXi server?
• How do I enable monitoring for SIP traffic on a non-standard port?
• How can I convert all my recorded WAV files to OGG to save space?
• How do I selectively disable audio recording for certain calls to be PCI compliant?
• How do I enable IPv6 support on a system with existing data?
• How do I capture SIP REGISTER messages?