This is a tangent from an issue I’ve been trying to track down the cause of & find a solution to. The next logical step there is to enable sip debugging in asterisk, however there’s a problem with this. (Creating a new thread for this as I can see it being of use for people in the future.) The warning in /etc/asterisk/logger_logfiles_additional.conf indicates that I should not do this through a shell because it’ll be overwritten next time the PBX config is saved, so I hunted around the internet looking for people who have done something similar.
At 2 am (yes I’m an insomniac), we were closed and there was no phone activity at all. With sip debugging turned on, the log file was growing at a rate of about a half a megabyte every second, presumably from keep-alives & such. At that rate, it would fill the relatively small file system the logs are stored on in just under 4 hours. 
To get around this, my plan is to set up logging of sip debug messages to a standalone machine. To that end, I grabbed an older laptop & just finished installing Debian on it. Still have to configure it to accept logs and rotate the old ones out, but that’s going to provide me with over 700 gigabytes of space (instead of just over 7) without danger of our phones being taken down if the file system does end up getting filled. Not having changed anything about the log files in the PBX (apart from how many it saves) before, I would like to ensure that my understanding of how to set it up is right.
If I go to Asterisk Logfile Settings and click on the Log Files tab, I should be able to just turn Debug off for the full log to prevent the local file system from being filled when I turn on sip debugging. To enable logging to a remote machine, I create a new log file and use a file name of ‘@1.2.3.4’ to direct it to the IP of the logging laptop, then simply select which event types to log - Debug, Error, Notice, Verbose, Warning. The laptop is configured to allow incoming unsolicited traffic through from the PBX IPs on port 513.
This will allow me to turn on sip debugging, have it be logged on the laptop, and leave the ‘full’ log be what it would have been without sip debugging turned on. Is my understanding correct?