FreePBX "forgets" permit setting for SIP extension

Am I reading this right???

You have someone comprising an extension by you did not block the attacker? Even more, you have port 80 or 22 open to the WWW?

There’s no nice audit log at the moment, but have you tried searching the community?

https://wiki.freepbx.org/display/FPG/Asterisk+Logfiles

I suggest you taking a look at the firewall module and start locking things down…