LWAPP AP1131 not logging to configured syslog server

[m.hierling]

Hi,

i configured my LWAPP Ap1131 to use a syslog server. I did it with a dhcp option and configuration on the controller. according to the boot message the ap gets both servers. But unfortunately none of the servers are used. The AP send there messages to 255.255.255.255. I grabed the attached file directly from the AP (show logging). The syslog server is reachable by the ap...

Interesting is the 7th line from the bottom, from where did the ap get the broadcast address for syslog?

any ideas, regards Martin

[Scott Fella]

All the traffic gets tunneled back to the wlc. If you take a look at your log, you can see that the syslog is defined in your wlc. this message can be caused by you already setting the syslog server on the wlc or just that fact that the ap will not communicate directly to the syslog server.

%LWAPP-3-CLIENTEVENTLOG: Not using log server settings obtained from DHCP. Log server already set from controller.

Configure the syslog server ip address on the wlc.

[m.hierling]

With LWAPP in mind you should assume that, but setting up a span port directly at the ap port i got the attached tcpdump. beside a bunch of LWAPP stuff (that i filtered out) i got plain old syslog messages LOCAL7.ERR.

I indeed configured wlc with a syslog server ip and facility 3, not 7.

And the messages i got on the wire doesnt hit my syslog, not even through wlc.

Martin

[Scott Fella]

I believe the reason that it didn't show up on your syslog, is that the ap has not yet joined the wlc. That info is what you can see if you are consoled into the ap or if you are running a debug, but you will not see that when using the syslog configured on the wlc. You can verify with TAC.... maybe they know of a workaround.

[m.hierling]

from what i can remeber it was also after joining the wlc. i will doubel check tomorrow with a aditional tcpdump.

[Scott Fella · Accepted solution]

I tried it on one of my lab ap's to see if the wlc would see the trap. If you look at the wlc Management | snmp | trap control, there are only two traps specified under Cisco AP Traps. You can always contact your local Cisco Wireless SE and have them put in your recommendation for future enhancement.

[m.hierling]

fella5,

i have double checked and you are right. After joining wlc the syslog messages disappears. But the also diddnt hit the syslog server. i will investigate further.

M.