topic Re: What do the different MAC Event Actions mean? in ICX Switches

What do the different MAC Event Actions mean?

CUSDCasady — Fri, 15 May 2026 21:56:25 GMT

I'm trying to find documentation on what each of the MAC Event actions mean in the logs and I can't find it. Here is an example log entry:

May 15 07:45:27 MA_MDF MAC-Event: MAC:aaaa.aaaa.aaaa-VLAN:511-PORT:2/1/48-ACT:1::

I'm guessing Action 1 is MAC registration but can anyone point me to where these actions are defined?

va10462 — Thu, 25 Jun 2026 05:43:11 GMT

Hi ahmad,

A typical log event looks like this:
MA_MDF MAC-Event: MAC:aaaa.aaaa.aaaa-VLAN:511-PORT:2/1/48-ACT:1:: [1]

Common Action (ACT) Codes

While Ruckus provides limited public documentation on every integer, the action codes typically represent:

ACT: 1: Indicates a device has been dynamically learned or re-authenticated on the port (MAC Move).
ACT: 2: Indicates the MAC address was removed (usually when a device is unplugged or times out).
ACT: 4: Triggers when MAC notifications are turned off via CLI or when an invalid/unauthorized device connects

Thanks,

Vivek

CUSDCasady — Thu, 25 Jun 2026 15:33:54 GMT

Thank you!

I also see ACT 7 in the logs a lot. Do you know what that one means?