topic Re: Cisco WLC syslog message list in Wireless

Cisco WLC syslog message list

ckochis — Mon, 21 Feb 2022 11:33:38 GMT

Is there a syslog message list for the WLCs? Can find router and ASA, but not WLC.

Re: Cisco WLC syslog message list

balaji.bandi — Mon, 21 Feb 2022 11:49:38 GMT

as per i know this is the only cisco have :

https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html

Re: Cisco WLC syslog message list

ckochis — Mon, 21 Feb 2022 23:41:22 GMT

Thanks, have found those. Configuration is not the issue. I am trying to create a filter on the syslog server to parse AP up/down events. I can pull them off the GUI, but it does not give level of the events. There has to be a wlc doc like this: Cisco ASA Series Syslog Messages - Messages Listed by Severity Level [Cisco Adaptive Security Appliance (ASA) Software] - Cisco

Re: Cisco WLC syslog message list

balaji.bandi — Tue, 22 Feb 2022 00:24:31 GMT

i do not believe you get kind of log which you see like ASA, WLC produces the Log as you see the document, in the syslog server, you can grep or regex based on the logs and generate an alerts

Re: Cisco WLC syslog message list

ckochis — Tue, 22 Feb 2022 11:40:22 GMT

I have it set at warning now, I receive the message on ap loss:
Syslog: *spamApTask3: Feb 19 21:58:57.456: %CAPWAP-3-ECHO_ERR: capwap_ac_sm.c:7389 Did not receive heartbeat reply; AP: 00:08:30:00:bc:00
GUI AP's Interface:0(802.11b) Operation State Down: Base Radio MAC:50:17:ff:ea:71:90 Cause=Heartbeat Timeout Status:NA
MAC difference is the AP MAC vs radio MAC; not sure why they mix them.
The message I see in GUI is
AP 'Slv-Cafe-Hall', MAC: 50:17:ff:ea:71:90 disassociated previously due to AP Reset. Uptime: 0 days, 00 h 01 m 33 s . Reason: power loss.
I do not see this in syslog, want to capture this message. The log list will tell what level to set the log.

Re: Cisco WLC syslog message list

Scott Fella — Tue, 22 Feb 2022 14:30:43 GMT

If you want specifics on what you will see from syslog, my suggestion is to open a TAC case or talk to your Cisco rep for help. Like what @balaji.bandi mentioned, you will not see everything from syslog. There are snmp traps that you would need to configure, but again, reach out to TAC for your questions on this.