Cisco WLC syslog message list

[ckochis]

Is there a syslog message list for the WLCs?  Can find router and ASA, but not WLC.

[balaji.bandi]

as per i know this is the only cisco have :

https://www.cisco.com/c/en/us/support/docs/wireless/4100-series-wireless-lan-controllers/107252-WLC-Syslog-Server.html

[ckochis]

Thanks, have found those. Configuration is not the issue. I am trying to create a filter on the syslog server to parse AP up/down events. I can pull them off the GUI, but it does not give level of the events. There has to be a wlc doc like this: Cisco ASA Series Syslog Messages - Messages Listed by Severity Level [Cisco Adaptive Security Appliance (ASA) Software] - Cisco

[balaji.bandi]

i do not believe you get kind of log which you see like ASA, WLC produces the Log as you see the document, in the syslog server, you can grep or regex based on the logs and generate an alerts

[ckochis]

I have it set at warning now, I receive the message on ap loss:
Syslog: *spamApTask3: Feb 19 21:58:57.456: %CAPWAP-3-ECHO_ERR: capwap_ac_sm.c:7389 Did not receive heartbeat reply; AP: 00:08:30:00:bc:00
GUI AP's Interface:0(802.11b) Operation State Down: Base Radio MAC:50:17:ff:ea:71:90 Cause=Heartbeat Timeout Status:NA
MAC difference is the AP MAC vs radio MAC; not sure why they mix them.
The message I see in GUI is
AP 'Slv-Cafe-Hall', MAC: 50:17:ff:ea:71:90 disassociated previously due to AP Reset. Uptime: 0 days, 00 h 01 m 33 s . Reason: power loss.
I do not see this in syslog, want to capture this message. The log list will tell what level to set the log.

[Scott Fella]

If you want specifics on what you will see from syslog, my suggestion is to open a TAC case or talk to your Cisco rep for help.  Like what @balaji.bandi mentioned, you will not see everything from syslog.  There are snmp traps that you would need to configure, but again, reach out to TAC for your questions on this.