Syslog Message Guide for WLC 440x 4.0x

Can anyone help me with a pointer to doco to explain the messages from these devices ?

Hey guys,
Maybe this is what you are looking for??
http://www.cisco.com/en/US/products/ps6366/products_configuration_guide_chapter09186a00806b0633.html
Hope this helps!
Rob

Similar Messages

Unterstanding syslog messages from our wlc

Hello,
we use two wlc 4402 (4.1.181.0) and several leightweight accesspoints (AIR-AP1010-E-K9 and AIR-AP1030-E-K9 ) connected to them.
On our syslog server we get a lot of messages from the two wlc, and there are 3 message types which I am a little bit afraid of.
1. ca. 10 times per hour we get the message
apf_80211.c:4792 APF-6-NO_CONFIG_CHANGES: Not saving 'apf.cfg' - no config changes."
Cisco system message guide:
Error Message %APF-6-NO_CONFIG_CHANGES: Not saving '[chars]' - no config changes.
Explanation Not saving - no config changes.
Recommended Action No action is required.
Does anybody know why we get this messages and if it's possibly to suppress them?
2. Intermittently (several times a day) we get the following message types:
a) [ERROR] spam_l2.c 723: Max retransmissions reached on AP 00:0B:85:56:63:40 (CONFIGURE_COMMAND^M , 2)"
b) [ERROR] spam_tmr.c 569: Did not receive hearbeat reply from AP 00:0b:85:56:ae:40"
The MAC address is not every time the same but one of our accesspoints.
On our network management system we get the following trap messages with nearly exactly the same timestamp:
14.01.2008 04:21:56 CET
AP ''00.0b.85.56.63.40'', interface ''0x1'' is down.
When Airespace AP's interface operation status goes down this trap will be sent.
bsnAPDot3MacAddress = 00.0b.85.56.63.40
bsnAPIfSlotId = 0x1
14.01.2008 04:21:56 CET
AP disassociated from Switch.
When an Airespace AP disassociates from a Airespace Switch, the AP disassociated notification will be sent with the dot3 MAC address of the Airespace AP. This will notify the management system to remove Airespace AP from this Airespace Switch.
bsnAPMacAddrTrapVariable =
14.01.2008 04:22:25 CET
AP associated with Switch.
When an Airespace AP Associates to a Airespace Switch, the AP associated notification will be sent with the dot3 MAC address of the Airespace AP. This will help the management system to discover the Airespace AP and add it to system.
bsnAPMacAddrTrapVariable =
bsnAPPortNumberTrapVariable = 1
Cisco system message guide:
a) Error Message %LWAPP-3-TX_ERR3: Max retransmissions for LWAPP control message reached on AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex] for [chars] (number of pending messages is [dec])
Explanation Maximum number of times an LWAPP control packet is transmitted before declaring the AP dead has been reached for this AP. The AP may not be on the network, or might have rebooted.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
b) Error Message %LWAPP-3-ECHO_ERR: Did not receive heartbeat reply; AP: [hex]:[hex]:[hex]:[hex]:[hex]:[hex]
Explanation Controller did not get a response for the AP heartbeat message. There may be connectivity issues between the AP and the controller.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
Because we don't see any network problems I'm wondering why the connection is lost.
Does anybody have an idea, perhaps CSCsh13928 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh13928, but we don't have much traffic on the wlans) ?
Is there any possibility to remotely check if the accesspoint rebooted?
If you need further information please give me a short feedback.
Many thanks in advance,
Thorsten Steffen

Thanks for the help.
I have set up to send email and syslog messages from the RME applications. LMS server immediately started to send messages to the email server but syslog messages are not forwarded to the syslog server. Everything was done according to your instructions except that the name of the first script (syslog_forward.pl) is made consistent with what the second script (.bat) refer to (forward1.pl). What's the problem? Do RME sends the standard syslog messages via UDP port 514?
Sincerely.

WLC syslog messages

Does anyone know where to find a overview for the controller's syslog messages ?
Regards
johann Folkestad

I think the WLC configuration guide has a chapter for error messages. This might have your necesary information.
http://www.cisco.com/en/US/products/ps6366/products_configuration_guide_chapter09186a008076ce82.html

ACE Syslog message for State change

Hi,
Is there a syslog message for a state-change for rservers, if so how could we enable this?
e.g. when probe fails state changes to 'probe-failed'
when all probes are successful state is 'operational'
Thank you
Bilal

Hi,
There is a syslog message something like below:
%ACE-3-251006: Health probe failed for server 10.80.10.10 on port 80 internal error: failed to setup a socket.
First enable logging on ACE.
ACE/Admin(config)# logging enable
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/config.html#wp1063750
read the section: Specifying Syslog Output Locations
logging buffered 3 should generate syslog in event of probe failure.
You can also set snmp to monitor it.
cesRealServerStateChange
CISCO-ENHANCED-
SLB-MIB
State of a real server configured in a server farm changed to a new state as a result of something other than a user intervention. This notification is sent for situations such as ARP failures, probe failures, and so on.
Hope that helps.
regards,
Ajay Kumar

Guide for Fault Message Type

Hi,
I search a guide for configuration a "Fault Message Type".
I have read, if there is a mapping error, XI will create a error handling in a xml-file.
But I can not find this file.
Can you help me please?
Thanks.
Regards
Stefan

Hi Stefan,
Exception can be declared in BPM steps like Transform,send,Block and handled in Exception Branch.
TO know more about BPM and its exception go throught this link,
http://help.sap.com/saphelp_nw04/helpdata/en/3c/831620a4f1044dba38b370f77835cc/frameset.htm
http://help.sap.com/saphelp_nw04/helpdata/en/3c/831620a4f1044dba38b370f77835cc/frameset.htm
Cheers,
Rashmi

ACS appliance1120 ACS 4.2.1.15 syslog message to syslog server

Hi All ,
I am using ACS 1120 appliance running ACS version 4.2.1.15 , I am pointing out all syslog message to my external syslog server (passed authentication , failed authentication , database replication , administration aduit ,tacacs accounting ) , but i could recieve only passed authentication log message to my external log server , no other log message except passed authentication is pushed to my external log server , But i could see failed attempts , database replication,administrtation audit log message locally on my acs appliance as CSV file ,
Syslog server configuration is configured under all logging (passed , failed , administration , tacacs accounting ) , but i am surprise to see only passed authentication logg is sent out from acs appliance , Is there any patch to be installed for logg message scripting ?? , please advise ..

Refer the link : https://supportforums.cisco.com/discussion/11513026/migrating-acs-420-421
you can directly upgrade from 4.2.0.124 to 5.6 : http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/migrate.html#98379

Syslog messages AP541

Hi community,
to find the reason for my connection problems to our network over a AP541N
I have configured the AP541 to send its syslog messages to a syslog server.
Now I am looking for a document where I can find informations about the received
messages.
For example, what means
hostapd: wlan0: IEEE 802.11 STA 78:a3:e4:3e:f7:19 deauthed from BSSID 00:21:29:03:18:40 reason 3
or
hostapd: wlan0: IEEE 802.11 STA 58:1f:aa:2c:96:4b disassociated from BSSID 00:21:29:03:18:40 reason 8
Are there documents where the messages are explained ?
Regards
Joachim

Here is a document for cisco wireless access controller client reason codes:
http://www.cisco.com/en/US/docs/wireless/controller/3.2/configuration/guide/c32err.html
Client Reason Code…Description…Meaning
0…noReasonCode…Normal operation.
1…unspecifiedReason…Client associated but no longer authorized.
2…previousAuthNotValid…Client associated but not authorized.
3…deauthenticationLeaving…The access point went offline, deauthenticating the client.
4…disassociationDueToInactivity…Client session timeout exceeded.
5…disassociationAPBusy…The access point is busy, performing load balancing, for example.
6…class2FrameFromNonAuthStation…Client attempted to transfer data before it was authenticated.
7…class2FrameFromNonAssStation…Client attempted to transfer data before it was associated.
8…disassociationStaHasLeft…Operating System moved the client to another access point using non-aggressive load balancing.
9…staReqAssociationWithoutAuth…Client not authorized yet, still attempting to associate with an access point.
99…missingReasonCode…Client momentarily in an unknown state.

Prime Infra 2.0 alert when syslog message received

Dear member,
May I know did prime infra 1.3, 2.0 can support alerted user when received a syslog message?
if yes, and configiuration guide for reference?
Regards

Hi Russ,
PI does not actually keep a record of the raw syslog messages it receives, and there is no report for syslogs. When PI receives a syslog, it will immediately process the message and convert it to an event/alarm.
Also, note that PI only processes severity 1 and 2 syslogs. The closest thing you can get to a syslog report
would be to run anadvanced search for events
For other alarms and events you can go to Operate > Alarms
& Events > Email Notification page. Make sure that the alarm categories that you
want to have notifications for also has the Enable checkbox checked.
Thanks-
Afroz
[Do rate the useful post]

Syslog Message

Hi all,
In my firewall ASA 5540,Every day I am getting the syslog message.
4
Jul 07 2014
08:57:39
[ Scanning] drop rate-2 exceeded. Current burst rate is 0 per second, max configured rate is 8; Current average rate is 7 per second, max configured rate is 4; Cumulative total count is 28683
Please explain about above mentioned syslog.

Hi Kabeer,
That is because of the threat detection value set on your ASA. This might be an attack.
Because of the scanning rate configured and the
threat-detection rate scanning-rate 3600
average-rate 15
command:
%ASA-4-733100: [144.60.88.2] drop rate-2 exceeded. Current burst rate is 0 per
second, max configured rate is 8; Current average rate is 5 per second, max
configured rate is 4; Cumulative total count is 38086
Recommended Action
Perform the following steps
according to the specified
object type that appears
in the message:
1.
If the object in the message is one of the following:
Firewall
Bad pkts
Rate limit
DoS attck
ACL drop
Conn limit
ICMP attck
Scanning
SYN attck
Inspect
Interface
Check whether the drop rate is ac
ceptable for the running environment.
2.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate
xxx command, where
xxx
is one of the following:
acl-drop
bad-packet-drop
conn-limit-drop
dos-drop
fw-drop
icmp-drop
inspect-drop
interface-drop
scanning-threat
syn-attack
3.
If the object in the message is a TCP or UDP port
, an IP address, or a
host drop, check whether
or not the drop rate is accepta
ble for the running environment.
4.
Adjust the threshold rate of the particular drop to an appropriate value by using the
threat-detection rate bad-packet-drop
command.
Note
If you do not want the drop rate exceed warning to appear, you can disable it by using
the
no threat-detection basic-threat command.
You can refer the below mentioned cisco document for more information.
http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs.pdf
Regards
Karthik

Syslog Messages Not Appearing

Hi, I'm hoping someone can help me get my syslog messages to appear when I'm logged into the switch via SSH on a Cisco 4510R Switch. The ones that appear when I shutdown/no shutdown interfaces, leave global config mode, all the basic messages I'm used to seeing when logged in via console, telnet, or ssh.
The show run command displays logging console critical, which is the default of (2) I believe.
In global config, I set logging monitor 2, and also tried both console and monitor at level 5. Nothing is showing up.
Show logging displays all the latest messages, but I'm used to these showing up as things are configured.
This is the way the switch was set up prior to my working here.
Does anyone have any idea why this, and how I can get it working?
Thanks.

According to your configuration guide the default is debugging ie. level 7 so I suspect this has been changed.
In regards to your question if you are logged in via a vty line then you need to change the monitor level but then you may also need to type -
"terminal monitor" or "term mon" for short.
if you want turn it off -
"terminal no monitor"
Jon

Cisco MARS Syslog messages

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";
mso-ansi-language:#0400;
mso-fareast-language:#0400;
mso-bidi-language:#0400;}
Hi,
I've recently noticed that ALL the syslog messages that are sent to our Cisco MARS device are then being sent to our syslog server. Besides the messages from our MARS device, the syslog server also gets the original syslog messages from our ASA and PIX firewalls (which, of course, also send to our MARS device). I would like to have MARS send syslog messages to the syslog server that pertain only to changes/events happening directly to the MARS device. Can anyone help me with this?
Thanks in advance!

Kerry;
To have CS-MARS specific incidents forward to your syslog server, you will most likely want to add an action to generate a syslog for the CS-MARS-specific inspection rules. These rules can be found by navigatng to:
RULES>Inspection Rules
from the Group: drop-down choose "System: CS-MARS Issues"
You can then edit the Action: section for the specific rules (one at a time) to add a syslog action. Specifics are outlined here:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/alerts.html
Scott

Cisco IOS Syslog Messages

Does anyone have a link that shows all the Cisco IOS syslog messages?
Such as this one for the ASA?
http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/syslog.html
Thanks in advance.

This guide should give you what you want.
http://www.cisco.com/en/US/docs/ios/system/messages/guide/consol_smg.html

Cisco ASA Connection Denied syslog messages

Hi,
Could you please provide the connection denied syslog messages, I'm not able to differentiate the messages from syslog guide
Regards,
Shalendra

Hi Shalendra,
For TCP connection denied syslog , 106001 is the id.
For protocol denied connection, 106002 is the id.
For connection denies due to logging permit-hostdown policy, 414006 is the id.
Refer to this link:
http://www9.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html#13063
Regards,
Shrinkhala

ISE 1.2 rejects RADIUS messages from 5508 WLC

The setup in ref is:
WLC 5508 HA pair running 7.6 talking to ISE 1.2 patch 7 (was 6).
Wireless users are authenticated fine, so the 5508 is a valid NAD in ISE, but...
When I setup active RADIUS fallback, so that the WLC can poll the ISE servers I get the message:
"The RADIUS request from a non-wireless device was dropped because the installed license is for wireless devices only"
Why would ISE drop a RADIUS message from a WLC which is a wireless device? Surely this is a mistake?

Hi Nicholas,
This is a known defect.
CSCug34679 ISE drop keep alive coming from WLC.
Symptom:
ISE drops keep alive authentications coming from the WLC, with message 11054 Request from a non-wireless device due to installed wireless license.
Conditions:
When only a wireless license is install on the ISE and using active keep alive on the WLC.
Workaround:
Use passive keep alive on the WLC and not active.
Regards,
Jatin Katyal
*Do rate helpful posts*

Installation Manual / Guide For IDES ECC 5.0 / 6.0

Hi All
Please any one send me a complete manul / guide for installtion of IDES 5.0 / 6.0. Or send me on xxxx.
Best reward Points Wait for You
Thanks In Advance
Message was edited by:
Yaroslav Zorenko
The distribution, participation in distributing or otherwise sending of this material is against the law. The material you are requesting is copyrighted material and available ONLY to customers of SAP. If you need such documents from the SAP Service Marketplace then you must have "S" user ID and login yourself to retrieve this material. If you do not have a "S" user ID then you should contact your own internal company groups responsible and request one or request them to retrieve the document for you.
By participating and sending such documents you are at risk for legal action and a removal of your account here on SDN and BPX.
DO NOT send material via email such as this! Further actions will result in officials within your company and your SAP Sales Account being notified and could result in legal action against you as an individual.

hi,
go to service market place for install guides go below link
https://websmp109.sap-ag.de/instguides
regards
ajai

Syslog Message Guide for WLC 440x 4.0x

Similar Messages

Maybe you are looking for