What do the different MAC Event Actions mean?

[CUSDCasady]

I'm trying to find documentation on what each of the MAC Event actions mean in the logs and I can't find it. Here is an example log entry:

May 15 07:45:27 MA_MDF MAC-Event: MAC:aaaa.aaaa.aaaa-VLAN:511-PORT:2/1/48-ACT:1::

I'm guessing Action 1 is MAC registration but can anyone point me to where these actions are defined?

[va10462]

Hi ahmad,

A typical log event looks like this:
MA_MDF MAC-Event: MAC:aaaa.aaaa.aaaa-VLAN:511-PORT:2/1/48-ACT:1:: [1]

• MA_MDF: The name of the switch or the system log host identifier.
• MAC: The specific hardware address of the endpoint device.
• VLAN: The virtual LAN ID the port is assigned to.
• PORT: The exact physical interface (e.g., Slot 2, Module 1, Port 48).
• ACT: The action code or type of event being reported. [1, 2, 3]

Common Action (ACT) Codes

While Ruckus provides limited public documentation on every integer, the action codes typically represent:

• ACT: 1: Indicates a device has been dynamically learned or re-authenticated on the port (MAC Move).
• ACT: 2: Indicates the MAC address was removed (usually when a device is unplugged or times out).
• ACT: 4: Triggers when MAC notifications are turned off via CLI or when an invalid/unauthorized device connects

Thanks,

Vivek

[CUSDCasady]

Thank you!

I also see ACT 7 in the logs a lot. Do you know what that one means?