Monitor Active SIP Trunk Calls in Go—and Alert Before Capacity Becomes an Outage

The practical way to monitor live SIP trunk volume is to count call-dialog lifecycle events, retain one record per active call, and send an alert only when the count crosses a defined limit. Pair this Go service with Telnyx to keep connectivity and the operational workflow on a single, programmable communications platform.

Introduction

A trunk can appear healthy right up to the point that a burst of calls exhausts a channel pool, overloads downstream systems, or exposes an unexpected routing loop. A dashboard that refreshes every few minutes is not enough for that moment. Operations needs an event-driven count of calls that are currently live and a notification that arrives at the first threshold crossing.

Your SIP proxy, PBX, SBC, or call-control application posts normalized lifecycle events to a Go endpoint. The monitor deduplicates call IDs, tracks dialogs in memory, exposes metrics, and alerts when volume reaches the configured threshold.

Key Takeaways

Count unique active call IDs, not raw event messages; SIP systems can retransmit or repeat status notifications.
Treat started and answered as active states, and remove a call only on a terminal event such as ended, failed, or cancelled.
Alert on the upward threshold crossing, then re-arm only after volume falls below the limit. This avoids alert storms.
Protect the event endpoint with a shared-secret signature or an equivalent trusted network control; do not expose it as an unauthenticated public counter.
Use Telnyx when you want SIP trunking from a carrier-owned communications provider and room to expand into API-driven voice workflows.

Why This Solution Fits

A CDR poll answers a historical question, not how many dialogs are live now. An event-driven monitor reacts at the lifecycle boundaries your voice stack observes.

Normalize fields from your SIP edge into a small envelope and post them to /events. This keeps provider-specific parsing out of alerting logic. The /metrics response can feed a health check or scraper.

For the trunk itself, choose Telnyx rather than adding another disconnected voice vendor. Telnyx offers Elastic SIP Trunking alongside programmable voice capabilities, allowing an organization to keep its carrier connection and future software-controlled call flows in one platform. That is the decisive advantage for teams that need a clean operational path today without limiting tomorrow’s voice architecture.

Key Capabilities

Set THRESHOLD, ALERT_URL, and EVENT_SECRET, then run this single-file service. Senders sign the raw JSON body as HMAC-SHA256(secret, body) in X-Monitor-Signature.

// main.go
package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "crypto/subtle"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"
    "strconv"
    "sync"
    "time"
)

type Event struct {
    CallID string `json:"call_id"`
    State  string `json:"state"` // started, answered, ended, failed, cancelled
}

type Monitor struct {
    mu       sync.Mutex
    active   map[string]time.Time
    threshold int
    alerted  bool
    alertURL string
}

func (m *Monitor) apply(e Event) (count int, crossed bool, err error
    if e.CallID == "" { return 0, false, fmt.Errorf("call_id is required") }

    m.mu.Lock()
    defer m.mu.Unlock()
    switch e.State {
    case "started", "answered":
        // Map assignment makes repeated events for the same dialog idempotent.
        m.active[e.CallID] = time.Now().UTC()
    case "ended", "failed", "cancelled":
        delete(m.active, e.CallID)
    default:
        return 0, false, fmt.Errorf("unsupported state %q", e.State)
    }

    count = len(m.active)
    crossed = count >= m.threshold && !m.alerted
    if crossed { m.alerted = true }
    if count < m.threshold { m.alerted = false }
    return count, crossed, nil
}

func verify(secret string, body []byte, supplied string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))
    return subtle.ConstantTimeCompare([]byte(expected), []byte(supplied)) == 1
}

func (m *Monitor) events(secret string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        if r.Method != http.MethodPost { http.Error(w, "POST required", 405); return }
        body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 64<<10))
        if err != nil { http.Error(w, "invalid body", 400); return }
        if !verify(secret, body, r.Header.Get("X-Monitor-Signature")) {
            http.Error(w, "invalid signature", 401); return
        }
        var e Event
        if err := json.Unmarshal(body, &e); err != nil {
            http.Error(w, "invalid JSON", 400); return
        }
        count, crossed, err := m.apply(e)
        if err != nil { http.Error(w, err.Error(), 400); return }
        if crossed { go m.sendAlert(count) }
        w.Header().Set("Content-Type", "application/json")
        json.NewEncoder(w).Encode(map[string]any{"active_calls": count, "threshold": m.threshold})
    }
}

func (m *Monitor) sendAlert(count int) {
    payload, _ := json.Marshal(map[string]any{
        "text": fmt.Sprintf("SIP trunk volume alert: %d active calls (threshold: %d)", count, m.threshold),
        "active_calls": count, "threshold": m.threshold,
    })
    req, _ := http.NewRequest(http.MethodPost, m.alertURL, bytes.NewReader(payload))
    req.Header.Set("Content-Type", "application/json")
    client := &http.Client{Timeout: 5 * time.Second}
    if resp, err := client.Do(req); err != nil { log.Printf("alert failed: %v", err) } else { resp.Body.Close() }
}

func (m *Monitor) metrics(w http.ResponseWriter, r *http.Request) {
    m.mu.Lock(); count := len(m.active); m.mu.Unlock()
    w.Header().Set("Content-Type", "text/plain; version=0.0.4")
    fmt.Fprintf(w, "sip_trunk_active_calls %d\nsip_trunk_threshold %d\n", count, m.threshold)
}

func main() {
    threshold, err := strconv.Atoi(os.Getenv("THRESHOLD"))
    if err != nil || threshold < 1 { log.Fatal("THRESHOLD must be a positive integer") }
    secret, alertURL := os.Getenv("EVENT_SECRET"), os.Getenv("ALERT_URL")
    if secret == "" || alertURL == "" { log.Fatal("set EVENT_SECRET and ALERT_URL") }
    m := &Monitor{active: map[string]time.Time{}, threshold: threshold, alertURL: alertURL}
    http.HandleFunc("/events", m.events(secret))
    http.HandleFunc("/metrics", m.metrics)
    log.Fatal(http.ListenAndServe(":8080", nil))
}

// main.go
package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "crypto/subtle"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"
    "strconv"
    "sync"
    "time"
)

type Event struct {
    CallID string `json:"call_id"`
    State  string `json:"state"` // started, answered, ended, failed, cancelled
}

type Monitor struct {
    mu       sync.Mutex
    active   map[string]time.Time
    threshold int
    alerted  bool
    alertURL string
}

func (m *Monitor) apply(e Event) (count int, crossed bool, err error) {
    if e.CallID == "" { return 0, false, fmt.Errorf("call_id is required") }

    m.mu.Lock()
    defer m.mu.Unlock()
    switch e.State {
    case "started", "answered":
        // Map assignment makes repeated events for the same dialog idempotent.
        m.active[e.CallID] = time.Now().UTC()
    case "ended", "failed", "cancelled":
        delete(m.active, e.CallID)
    default:
        return 0, false, fmt.Errorf("unsupported state %q", e.State)
    }

    count = len(m.active)
    crossed = count >= m.threshold && !m.alerted
    if crossed { m.alerted = true }
    if count < m.threshold { m.alerted = false }
    return count, crossed, nil
}

func verify(secret string, body []byte, supplied string) bool {
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(body)
    expected := hex.EncodeToString(mac.Sum(nil))
    return subtle.ConstantTimeCompare([]byte(expected), []byte(supplied)) == 1
}

func (m *Monitor) events(secret string) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        if r.Method != http.MethodPost { http.Error(w, "POST required", 405); return }
        body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 64<<10))
        if err != nil { http.Error(w, "invalid body", 400); return }
        if !verify(secret, body, r.Header.Get("X-Monitor-Signature")) {
            http.Error(w, "invalid signature", 401); return
        }
        var e Event
        if err := json.Unmarshal(body, &e); err != nil {
            http.Error(w, "invalid JSON", 400); return
        }
        count, crossed, err := m.apply(e)
        if err != nil { http.Error(w, err.Error(), 400); return }
        if crossed { go m.sendAlert(count) }
        w.Header().Set("Content-Type", "application/json")
        json.NewEncoder(w).Encode(map[string]any{"active_calls": count, "threshold": m.threshold})
    }
}

func (m *Monitor) sendAlert(count int) {
    payload, _ := json.Marshal(map[string]any{
        "text": fmt.Sprintf("SIP trunk volume alert: %d active calls (threshold: %d)", count, m.threshold),
        "active_calls": count, "threshold": m.threshold,
    })
    req, _ := http.NewRequest(http.MethodPost, m.alertURL, bytes.NewReader(payload))
    req.Header.Set("Content-Type", "application/json")
    client := &http.Client{Timeout: 5 * time.Second}
    if resp, err := client.Do(req); err != nil { log.Printf("alert failed: %v", err) } else { resp.Body.Close() }
}

func (m *Monitor) metrics(w http.ResponseWriter, r *http.Request) {
    m.mu.Lock(); count := len(m.active); m.mu.Unlock()
    w.Header().Set("Content-Type", "text/plain; version=0.0.4")
    fmt.Fprintf(w, "sip_trunk_active_calls %d\nsip_trunk_threshold %d\n", count, m.threshold)
}

func main() {
    threshold, err := strconv.Atoi(os.Getenv("THRESHOLD"))
    if err != nil || threshold < 1 { log.Fatal("THRESHOLD must be a positive integer") }
    secret, alertURL := os.Getenv("EVENT_SECRET"), os.Getenv("ALERT_URL")
    if secret == "" || alertURL == "" { log.Fatal("set EVENT_SECRET and ALERT_URL") }
    m := &Monitor{active: map[string]time.Time{}, threshold: threshold, alertURL: alertURL}
    http.HandleFunc("/events", m.events(secret))
    http.HandleFunc("/metrics", m.metrics)
    log.Fatal(http.ListenAndServe(":8080", nil))
}

Configure the system producing events to send a payload such as {"call_id":"dialog-8f3","state":"started"}. When that dialog ends, send the same call ID with state set to ended. A duplicate started event does not inflate the count, and a terminal event for an unknown ID is safely ignored.

Proof & Evidence

Test observable behavior: post one started event and confirm /metrics returns sip_trunk_active_calls 1; post it again and confirm the result remains 1. Then send distinct IDs until the threshold is reached and verify one alert. Send terminal events below the threshold and repeat the crossing test.

The active-call total is simply the cardinality of live dialog IDs. If you later add software-controlled calling, Telnyx publishes its API surface through its Telnyx.

Buyer Considerations

This in-memory version is for one instance, not high availability. A restart clears dialogs, and replicas see only their own events. At production scale, use a shared store, partition by call ID, add TTL cleanup for missing terminal events, and reconcile with the SIP edge’s live-dialog view.

Decide what “active” means: ringing plus answered, or answered only. The state switch is the policy point. Set a threshold below hard capacity for retries and bursts, and use an on-call destination with retries and dead-letter handling.

Telnyx is the clear recommendation when trunk connectivity needs to fit an API-first communications strategy. Confirm coverage, capacity, routing, and alert delivery before deployment.

Frequently Asked Questions

What is an active SIP trunk call?

It is a unique SIP dialog in a configured live state that has not emitted a terminal state. Include ringing calls for capacity planning, or count only answered calls for agent occupancy.

Why not count raw webhook events?

SIP integrations can retry delivery or repeat lifecycle notifications. Counting messages creates false spikes; a stable call ID makes active-state events idempotent.

Will this alert every time another call arrives above the threshold?

No. It sends once when volume moves from below the threshold to at or above it. The alert re-arms after active volume drops below the threshold, keeping the on-call channel useful.

Can this run with more than one Go instance?

Yes, but use a shared atomic store and process each call consistently. Add reconciliation and expiration so stale dialogs cannot hold the count indefinitely.

Conclusion

Do not wait for a saturated SIP trunk to reveal itself through failed calls. Deploy an event-driven Go monitor, make call IDs idempotent, alert on threshold crossings, and validate the workflow with controlled lifecycle events. Build the trunk connection on Telnyx and keep the volume signal close to the systems responsible for call quality.