Skip to main content
Cisco Meraki

Meraki Event Log

  1. Last updated
  2. Save as PDF

The event log can be used to track a number of events occurring across a network. This article describes how to navigate the event log and filter out extraneous information for troubleshooting and monitoring purposes.

Using the Event Log

Event_log.png

Each Meraki network has its own event log, accessible under Network-wide > Monitor > Event log. In a combined network, click the drop-down menu at the top of the page and select the event log for one of the following options:

  • for security appliances to display information about the MX security appliance in this network.
  • for access points to display information about all MR wireless access points in the network.
  • for devices to display information about all managed SM clients in the network.
  • for switches to display information about all MS switches in the network.
  • for cameras to display information about all MV cameras in the network.

Note: If a device is offline (and remains powered on), it will continue to gather the information that populates the event log and store it locally. Once the device comes back online, this information will then be uploaded to dashboard with the events keeping their original timestamps. 

Filtering the Event Log

While the event log provides a thorough timeline of events on the network, it is usually unnecessary to view all events across all devices. The following options are available to filter down the event log as needed:

Filtering by Client or Cisco Meraki Device

Filtering events to a specific client can help troubleshoot individual connectivity issues, including IP addressing and network authentication. Entering the MAC address, hostname, or custom name in the Client field will display only events affecting that client, excluding other client information and device events.

An additional, product-specific field can be used to filter to events relevant to a specific device in the network. This can be helpful when troubleshooting a particular Meraki device on the network, or a client connected directly to a specific device.

Filtering by Date and Time

The event log shows all events for clients and devices, starting with the most recent event by default. This time frame can be adjusted using the Before field, displaying only events that happened at or before the specified time.

The event log time shares the time zone set for the network itself. More information on changing this time zone can be found here.

Filtering by Event Type

Even when filtering by a single device or client, there can be quite a few events. Selecting specific events to display or excluding specific event types can significantly decrease the amount of data to sort through.

Each Meraki product offers a different variety of reported events, as listed below:

MX Security Appliance

The following types of events will be reported by MX security appliances:

  • Auth: Splash page authentication
  • BGP: BGP notification and session events
  • Cellular: 3G/4G connectivity
  • Client Status: Client connectivity
  • DHCP: DHCP leases and related errors
  • Events dropped: Too many events were generated too quickly, creating an Events Dropped event
  • Filtering: Content filtering blocks
  • Intrusion Detection: IDS (Advanced Security only)
  • IP conflict: Detected IP conflicts on the network
  • Appliance status: Primary uplink events
  • Status: Device status events
  • OSPF: Events related to OSPF routing
  • Route tracking: Route connection change and network test events
  • Meraki VPN: AutoVPN connectivity events
  • VRRP: Warm spare transition
  • Web caching: Web cache events
  • Non-Meraki / Client VPN: Non-Meraki and Client VPN connectivity events 
  • Bad Gateway: Events related to communication issues with the gateway.
    • There are two reasons why this event would be logged:
      • No_lan_connectivity - The gateway is not responding to ARP requests
      • No_inet_connectivity - The Internet and/or DNS connectivity tests are not passing
    • Troubleshooting
      • Check the physical connection (cables and ports) between the MX and gateway
      • Investigate the gateway to determine if traffic is received from the MX
      • Confirm that the gateway’s IP and port configuration is correct

Regarding Bad Gateway events: These events are logged as a result of the Connection Monitoring tests failing. For more information on these tests, please reference the Connection Monitoring article.

MR Access Points

The following types of events will be reported by MR access points:

  • 802.11: Wireless association and disassociations
  • 802.1X: RADIUS authentication and deauthentications
  • Auth: Splash page authentication
  • AutoRF: Channel scans and TX power changes
  • DFS: Events related to Dynamic Frequency Selection
  • DHCP: DHCP leases and related errors
  • Events dropped: Too many events were generated too quickly, creating an Events Dropped event
  • L3 roaming: Events related to Layer 3 Roaming
  • Status: Device status events
  • Meraki VPN: VPN tunnel drops and connectivity events
  • Air Marshal: Packet floods and wireless security events
  • WPA: WPA authentication and deauthentications

Learn more about Common wireless event log messages.

SM Clients

The following types of events will be reported by managed SM clients:

  • Command Line: Command line request events
  • Live Tools: Recent usage of live tools on client devices
  • MDM: Detailed information about changes in device management
  • Remote Desktop: Usage of the remote desktop tool

MS Switch

The following types of events will be reported by MS switches:

  • 802.1X: Events related to client authentication and de-authentication
  • Access Control: Events related to client network access
  • DHCP: Events related to DHCP lease events and errors
  • Events dropped: Too many events were generated too quickly thus creating an Events Dropped event
  • Multicast: Events related to multicast
  • OSPF: Events related to OSPF protocol
  • RADIUS: Events specific to RADIUS protocol
  • Spanning Tree: Events related to the Spanning Tree Protocol
  • Switch port: Events related to switchports
  • Switch status: Events related to power supply and temperature
  • VRRP: Events related to Warm Spare

Learn more about MS event log entries and definitions.

MV Cameras

The following types of events will be reported by MV cameras:

  • Camera: Events related to camera components
  • DHCP: DHCP leases and related errors
  • Events dropped: Too many events were generated too quickly, creating an Events Dropped event
  • Status: Device status events