How to get entire syslog from AP by WLC ?

DuJin0509 · ‎06-28-2016

Hello everyone,

I want to extract syslog from remote site AP, when I utilize "show ap eventlog" command on WLC, only a small fraction syslog has been displayed, and also found the reflash frequency is very slow, how to get the entire syslog via WLC ?

(DESCHWLC03) >show ap eventlog B281-01
AP event log download completed.
======================= AP Event log Contents =====================
*Oct 5 05:05:41.043: %CAPWAP-3-ERRORLOG: Retransmission count exceeded max, ignoring as the ethernet is overloaded
*Oct 5 05:05:44.044: %CAPWAP-3-ERRORLOG: Retransmission count exceeded max, ignoring as the ethernet is overloaded
*Oct 5 05:05:47.044: %CAPWAP-3-ERRORLOG: Retransmission count exceeded max, ignoring as the ethernet is overloaded
*Oct 5 05:05:50.044: %LWAPP-3-CLIENTEVENTLOG: Switching to Standalone mode
*Oct 5 05:05:50.176: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 163.157.156.101:5246
*Oct 5 05:05:50.177: %WIDS-5-DISABLED: IDS Signature is removed and disabled.
*Oct 5 05:05:50.178: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
*Oct 5 05:06:50.001: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 163.157.156.12 peer_port: 5246
*Oct 5 05:06:50.001: %CAPWAP-5-CHANGED: CAPWAP changed state to
*Oct 5 05:06:51.496: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 163.157.156.12 peer_port: 5246
*Oct 5 05:06:51.496: %CAPWAP-5-SENDJOIN: sending Join Re

Rasika Nayanajith · ‎06-28-2016

If you want to see what exactly going on at AP level, you need to get AP console logs available. If you troubleshoot AP join/disconnect issues it may be valuable (I know it is practically difficult to get if your APs already mounted)

Another option is directly get syslog from your AP to a syslog server. (again if AP having problem of getting IP, then there is no way to send those logs to your server)

HTH

Rasika