tutorial

Monitoring Asterisk PBX with Vigilmon

Asterisk underlies FreePBX, 3CX, and countless VoIP systems worldwide. When it goes silent, calls drop and businesses lose revenue. Here's how to monitor Asterisk's AMI port, SIP port, ARI endpoint, and SSL certificates with Vigilmon.

Asterisk is the world's most widely deployed open-source telephony and PBX platform — the engine behind FreePBX, 3CX distributions, and countless custom VoIP deployments. A healthy Asterisk instance handles hundreds or thousands of simultaneous calls, but it fails in ways that are hard to detect from the outside: the process may be running while the SIP stack is deadlocked, the AMI port has stopped accepting connections, or a TLS certificate has expired and new encrypted calls fail silently. Vigilmon gives you external monitoring for every Asterisk-facing interface so you catch problems before they affect your callers.

What You'll Set Up

  • TCP port monitor for the Asterisk Manager Interface (AMI) on port 5038
  • TCP port monitor for SIP signaling on port 5060
  • HTTP monitor for the ARI (Asterisk REST Interface) info endpoint
  • SSL certificate alerts for SIPS/TLS SIP endpoints
  • Heartbeat monitor for dialplan availability

Prerequisites

  • Asterisk 18+ running on Linux (bare metal or Docker)
  • AMI enabled in manager.conf and accessible on TCP 5038
  • ARI enabled in ari.conf and accessible over HTTP
  • A free Vigilmon account

Step 1: Monitor the ARI Info Endpoint

The Asterisk REST Interface (ARI) exposes a /ari/asterisk/info endpoint that returns version and module information when Asterisk is healthy. This is the best HTTP-level liveness check available without writing custom dialplan.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the URL: http://YOUR_ASTERISK_HOST:8088/ari/asterisk/info
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Under Advanced, set Expected body contains to "asterisk" to verify the response is a real ARI payload.
  7. Click Save.

If ARI authentication is required (recommended for production), configure HTTP Basic auth in Vigilmon's Advanced settings using a read-only ARI user from ari.conf:

; ari.conf — add a read-only monitoring user
[monitoring]
type = user
password = YOUR_MONITOR_PASSWORD
read_only = yes

Then use http://monitoring:YOUR_MONITOR_PASSWORD@YOUR_ASTERISK_HOST:8088/ari/asterisk/info as the monitor URL, or configure Basic Auth separately in Vigilmon.

Step 2: Monitor the AMI Port (5038)

The Asterisk Manager Interface is the primary management channel — used by FreePBX, call control scripts, and monitoring integrations. A TCP check on port 5038 confirms the AMI is accepting connections.

  1. Click Add Monitor → TCP Port.
  2. Host: YOUR_ASTERISK_HOST, Port: 5038.
  3. Set Check interval to 1 minute.
  4. Click Save.

The AMI port being unreachable typically means Asterisk has crashed entirely or the manager socket is no longer bound. This is a higher-severity signal than a SIP check failure since it means Asterisk can't be remotely managed.

Step 3: Monitor the SIP Port (5060)

SIP signaling runs on TCP and UDP port 5060. A TCP check confirms Asterisk's SIP stack is listening and accepting connections — catching the case where Asterisk is partially up but the SIP module (chan_sip or pjsip) has failed to load.

  1. Click Add Monitor → TCP Port.
  2. Host: YOUR_ASTERISK_HOST, Port: 5060.
  3. Set Check interval to 1 minute.
  4. Click Save.

Note: for environments where SIP runs exclusively on UDP and TCP 5060 is not bound, use the ARI monitor (Step 1) as your primary liveness check instead.

Step 4: SSL Certificate Alerts for SIPS/TLS SIP

SIPS (SIP over TLS) runs on TCP port 5061. If your Asterisk instance accepts encrypted SIP connections from softphones or remote trunks, an expired TLS certificate causes all new TLS SIP registrations to fail. Add a TCP monitor for the TLS port and pair it with an SSL certificate expiry alert.

Add the SIPS port monitor:

  1. Click Add Monitor → TCP Port.
  2. Host: YOUR_ASTERISK_HOST, Port: 5061.
  3. Set Check interval to 2 minutes.
  4. Click Save.

For the SSL certificate itself, add a dedicated HTTPS monitor on any HTTPS interface your Asterisk host exposes (e.g. the ARI over HTTPS if configured):

  1. Click Add Monitor → HTTP / HTTPS.
  2. URL: https://YOUR_ASTERISK_HOST:8089/ari/asterisk/info (ARI over HTTPS).
  3. Enable Monitor SSL certificate.
  4. Set Alert when certificate expires in less than 21 days.
  5. Click Save.

A lapsed certificate on a SIPS endpoint causes encrypted SIP clients to fail registration silently — they show as registered in Asterisk logs but no calls complete.

Step 5: Heartbeat Monitoring for Dialplan Availability

Asterisk can be fully operational at the network level while a dialplan reload has introduced syntax errors that prevent calls from routing. Use a heartbeat monitor to verify that Asterisk is successfully executing dialplan by running a periodic AGI (Asterisk Gateway Interface) script or AMI action that pings Vigilmon on success.

In Vigilmon:

  1. Click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to 10 minutes.
  3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Create a dialplan extension that pings the heartbeat URL using CURL() from Asterisk's func_curl module:

; extensions.conf — add to a monitoring context
[monitoring]
exten => healthcheck,1,NoOp(Vigilmon heartbeat ping)
 same => n,Set(RESULT=${CURL(https://vigilmon.online/heartbeat/abc123)})
 same => n,Hangup()

Then call this extension periodically from an AMI action or asterisk -rx cron job:

# /etc/cron.d/asterisk-heartbeat — runs every 10 minutes
*/10 * * * * asterisk /usr/sbin/asterisk -rx "channel originate Local/healthcheck@monitoring application Wait 1" > /dev/null 2>&1

If the dialplan fails to load after a reload, the extension won't execute, the heartbeat goes silent, and Vigilmon alerts.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
  2. Set Consecutive failures before alert to 2 on the ARI and AMI monitors — Asterisk reloads can cause a brief connection reset.
  3. Add a Maintenance window before planned asterisk -rx reload operations to suppress expected probe failures during configuration changes.

Summary

| Monitor | Target | What It Catches | |---|---|---| | ARI info endpoint | :8088/ari/asterisk/info | Process down, ARI module failure | | TCP AMI | :5038 | Asterisk crash, management port lost | | TCP SIP | :5060 | SIP stack failure, chan_pjsip crash | | TCP SIPS | :5061 | TLS SIP port down | | SSL certificate | HTTPS/SIPS endpoint | Cert expiry, TLS renewal failure | | Cron heartbeat | Dialplan ping | Dialplan reload errors, routing failure |

Asterisk's flexibility makes it powerful, but that same flexibility means failures are often silent and hard to detect externally. With Vigilmon watching the AMI, SIP stack, ARI endpoint, and dialplan heartbeat, you'll catch outages before your callers notice dropped registrations or failed calls.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles