WLC logs about client auth/deauth, assoc/deassoc?

[MUQ_1899_]

Hello, if I want to troubleshoot client deauthentication/dissociation where I can find logs? For example a client come to me and tells "I was just kicked out of the network. Why?" Are there any parmanent logs for the reason of this event? Syslog level of notification in the GUI does not collect such information.

On the older lightweight APs "show logging" was explaining a lot about why a client is deauthentication/dissociation for example.

I understand I can debug the client but what about a past event? Parmanent debug of this client?

[Ric Beeching]

Is this on a WLAN Controller? Ideally you'd use an external syslog server and export logs to that for searching through. Make sure you set the syslog level to something appropriate that will record auth/assoc events.

Cheers,

Ric

[MUQ_1899_]

What is that appropriate leve? Notification does not show that information. Debugging ?

[Ric Beeching]

Informational should be more than enough. 

Also if you are able to monitor a specific client then easiest way would be to perform the following command via CLI:

debug client <mac address> which will provide live events on auth/association.

Cheers,

Ric