Setting Syslog Notifications on WLC

[InquiringTech]

Where do you actually set the syslog on the C9800 WLC (in our case an EWC)?

I see something under Administration > Management > Logging but that doesn't seem to work

Then there is something under Configuration > Tags & Profiles > AP Join > ap profile > Management tab, under System Log:

I think this might be the actual spot for it? How do I set it up so that it sends messages for authentication issues for clients trying to join APs? I see a variety of Facility and Log Trap Values. What levels do I need to set to see this?

But I don't seem to be getting anything on our actual syslog from it. I configured it so that it should get messages from the management IP of the EWC.

[marce1000 · Accepted solution]

 - FYI : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/config-guide/b_wl_17_3_cg/m_syslog_server.html#id_135864

 M.

[InquiringTech]

Thanks. Now I am getting logs at my syslog server, but don't seem to be getting them for the client that is having trouble authenticating and joining the network for some reason, even with the wireless client syslog-detailed command and trap level 5 set (getting a lot of client exclusion messages for other, presumably rogue clients). But that's actually a bigger problem that I may make a separate thread for.

[balaji.bandi]

what radius you using for client to get authentication, if you using ISE it has all the information.

check below EWC Log level or post what config you have on the device ?

https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/17-1/config-guide/ewc_cg_17_11/enabling_syslog_messages_in_access_points_and_controller_for_syslog_server.html

[InquiringTech]

Thanks. That's useful. However this seems to be a very specific case and it isn't showing up even with that, or if I input the mac address of the client failing to authenticate. Also, there is no Radius server, it's just WPA2-PSK.

Anyway I'll create a separate thread for that since that goes outside the scope of this question.

[Rich R]

Have you done a radioactive trace for that client MAC?

And then put the result through https://cway.cisco.com/wireless-debug-analyzer/