clients disconnected - logs?

[Witek]

Hey All,

Folks in my network are complaining about being disconnected unexpectedly. I'm seeing a lot of those messages in the log:

User[42:42:13:70:d8:77] disconnects from WLAN[ABC] at AP[6@70:ca:97:2b:93:a0]
User[42:42:13:70:d8:77] leave WLAN[ABC] at AP[6@70:ca:97:2b:93:a0] with Session Time[275.05 sec] RX Bytes[13565616] TX Bytes[29169712]

Is there a way of getting more detailed logs for those events? I have tried turning on debugging logs as shown on a screenshot but it does not seem to be doing anything, I don't see any additional info in the logs.

Any help will be greatly appreciated.

Best,

Witek 

[sanjay_kumar]

Hi @Witek 
You can download the AP support file from the GUI by selecting the AP, which will tell you some extra information like "disconnection reason code" when the client disconnects.
You can find out the reason based on the "Reason code".

[Witek]

Hi @sanjay_kumar 

Thanks, I'll try that in the near future. So, just to be sure - this is not something that can be easily sent to a syslog server?

[sanjay_kumar]

Hi @Witek 

You can configure the Syslog server which will export all the messages on the AP to Syslog server.
Below are the steps:

1. Go to Admin & Services > System > System Info, and scroll down to the Log Settings section at the bottom of the page.
2. Enable the Remote Syslog option and enter the IP address of the syslog server in the field provided.
3. Select one of the following options to control the content of the logs:
• All Syslog: The controller sends all syslog messages configured in the Debug Logs section of the Admin & Services > Administration >
Diagnostics > Debug Info page.
• Client Connection Logs Only: The controller sends client connection logs only to the syslog server.
• Client Flow Data Only: The controller sends client flow data only to the syslog server.
4. Optionally, enable the Inherit remote syslog server for APs option.
Enabling this feature allows the controller to supply client association information to a third party application that can then deploy ACL
policies to a firewall based on client association information such as user name, IP, MAC address, etc. First, Unleashed retrieves client
association information, then reorganizes the information and sends it to the syslog server, from which it can be collected by the third
party software and sent to the firewall for access restrictions based on client association information.
5. Configure the Facility Name as follows:
• Keep Original: Retain the original facility name.
6. Set the Priority Level as follows:
• All: Include all syslog messages.

[Witek]

@sanjay_kumar 

Thanks. Those settings look a bit different in ZD 10.5.1 but I found them and enabled logging.

I have also tried to download the support file but I can't see any additional info there. Here's an example:

Log from the controller:

May 30 10:57:09 syslog: eventd_to_syslog():User[b0:be:83:64:5a:f9] disconnects from WLAN[ABC] at AP[6@28:b3:71:07:4b:00]
May 30 10:57:09 syslog: eventd_to_syslog():User[b0:be:83:64:5a:f9] leave WLAN[ABC] at AP[6@28:b3:71:07:4b:00] with Session Time[8662.63 sec] RX Bytes[261211872] TX Bytes[854904766]

And in the log downloaded from the said WAP, 6@28:b3:71:07:4b:00: 

May 30 10:56:24 6 daemon.err stainfo[1495]: sta_info_detection_msg_handler(741): Sending hostname IOCTL as MAC address for b0:be:83:64:5a:f9 return value:0
7Route found: xmitdev=br0, nexthop=10.50.50.8, saddr=10.50.50.104, pmtu=1500
7Neighbour found: nexthopmac=b4:79:c8:25:9a:e8
7Route found: xmitdev=br0, nexthop=10.50.50.9, saddr=10.50.50.104, pmtu=1500
7Neighbour found: nexthopmac=b4:79:c8:25:9d:68
7Route found: xmitdev=br0, nexthop=10.50.50.8, saddr=10.50.50.104, pmtu=1500
7Neighbour found: nexthopmac=b4:79:c8:25:9a:e8May 30 10:57:07 6 local2.err syslog: lwapp_get_sta_stats IEEE80211_RUCKUS_GET_STA_STATS=163 ioctl failed
May 30 10:57:09 6 local2.err syslog: lwapp_get_sta_stats IEEE80211_RUCKUS_GET_STA_STATS=163 ioctl failed
7Route found: xmitdev=br0, nexthop=10.50.50.9, saddr=10.50.50.104, pmtu=1500
7Neighbour found: nexthopmac=b4:79:c8:25:9d:68
May 30 10:57:28 6 local2.err syslog: lwapp_get_sta_stats IEEE80211_RUCKUS_GET_STA_STATS=163 ioctl failed
6wlan: [0:I:ANY] ol_ath_vdev_install_key_send: 3049: Is_group_key_valid=0 grp_key_idx=0
May 30 10:57:32 6 daemon.err stainfo[1495]: sta_info_detection_msg_handler(738): DHCP Option 12 (hostname) is not present for 0a:ae:9e:90:64:5e
May 30 10:57:32 6 daemon.err stainfo[1495]: sta_info_detection_msg_handler(741): Sending hostname IOCTL as MAC address for 0a:ae:9e:90:64:5ereturn value:0
6wlan: [0:I:ANY] ol_ath_vdev_install_key_send: 3049: Is_group_key_valid=0 grp_key_idx=0
4uif_skb_may_copy_expand skb_headroom:66 too small (needed header len:108)!
May 30 10:57:33 6 local2.err syslog: lwapp_get_sta_stats IEEE80211_RUCKUS_GET_STA_STATS=163 ioctl failed
7Route found: xmitdev=br0, nexthop=10.50.50.8, saddr=10.50.50.104, pmtu=1500
7Neighbour found: nexthopmac=b4:79:c8:25:9a:e8
6wlan: [0:I:ANY] ol_ath_vdev_install_key_send: 3049: Is_group_key_valid=0 grp_key_idx=0
May 30 10:57:55 6 daemon.err stainfo[1495]: sta_info_detection_msg_handler(738): DHCP Option 12 (hostname) is not present for 0a:ae:9e:90:64:5e
May 30 10:57:55 6 daemon.err stainfo[1495]: sta_info_detection_msg_handler(741): Sending hostname IOCTL as MAC address for 0a:ae:9e:90:64:5ereturn value:0
6wlan: [0:I:ANY] ol_ath_vdev_install_key_send: 3049: Is_group_key_valid=0 grp_key_idx=0
4uif_skb_may_copy_expand skb_headroom:66 too small (needed header len:108)!
May 30 10:58:06 6 local2.err syslog: lwapp_get_sta_stats IEEE80211_RUCKUS_GET_STA_STATS=163 ioctl failed

There's absolutely nothing else around the time of disconnection (10:55), there's also no other mention of the client's MAC address b0:be:83:64:5a:f9.

What am I missing?