Skip to main content

 

Cisco Meraki Documentation

How to Use the Meraki Event Log

  1. Last updated
  2. Save as PDF

Overview

The event log in the Cisco Meraki dashboard tracks events occurring across a network. This article describes how to navigate the event log and filter out extraneous information for troubleshooting and monitoring purposes.

To learn more, visit the Meraki Learning Hub and take the free online training course:

Monitoring, Reporting, and Alerts

Sign in with your Cisco SSO or create a free account to start training.

Step-by-step instructions

Using the event log

This is an image of the drop down for Event log per product type.

  1. In the Meraki dashboard, navigate to Network-wide > Monitor > Event Log.
  2. For networks containing a single device type: the event log automatically displays events for your network devices.
  3. For combined dashboard networks only: select the drop-down menu next to Event log at the top of the page. Choose one of the following options to view events for the specific device type:
    1. for access points: displays information about all Meraki MR access points in the network.
    2. for security appliances: displays information about the Meraki MX in the network.
    3. for switches: displays information about all Meraki MS switches in the network.
    4. for endpoints: displays information about all managed Systems Manager clients in the network.
    5. for cameras: displays information about all Meraki MV cameras in the network.
    6. for sensors: displays information about all Meraki MT sensors in the network.
  4. Review events in the Event log table. The following is expected behavior:
    1. Device offline and powered on: the device continues to gather event log data and stores it locally.
    2. Device returns online: the data uploads to the dashboard with the original event timestamps preserved

 

Filtering by client or Cisco Meraki device

Filtering events for a specific client or device can help isolate individual connectivity issues, including IP addressing and network authentication.

  1. In the Client field, enter the MAC address, hostname, or custom name of the client.
    Only events affecting that client are displayed. Other client information and device events are excluded.
  2. If available, use the product-specific field to filter events relevant to a specific device in the network.

This filter can help troubleshoot a particular Meraki device or a client connected directly to that device.

Filtering by date and time

The event log displays all client and endpoint events, starting with the most recent event by default. Adjust the time frame using the Before field to display only events that occurred at or before the specified time.

The event log uses the time zone configured for the network. For more information, see the Changing the Dashboard Network Time Zone.

Filtering by event type

Filtering by a single device or client can still return many events. Selecting specific event types to display—or excluding specific event types—reduces the amount of data to sort through.

Each Meraki product reports a different set of events, as described in the following subsections.

MX WAN appliance

The Meraki MX reports the following event types:

  • AnyConnect VPN:  AnyConnect VPN connectivity events
  • Appliance status: primary uplink events
  • Auth: splash page authentication
  • BGP: BGP notification and session events
  • Cellular: 3G/4G connectivity (see 3G/4G Cellular Failover with USB Modems)
  • Client VPN: Client VPN connectivity events
  • Client Status: client connectivity
  • DHCP: Dynamic Host Configuration Protocol (DHCP) leases and related errors (see Event type DHCP Lease Filling Up My Event log)
  • DHCPv6: DHCPv6 Neighbour Advertisements (NA) and Prefix Delegation (PD) events
  • Events dropped: generated when too many events occur too quickly
  • Filtering: content filtering and Security center URL blocks (see Content Filtering Powered By Cisco Talos)
  • IP conflict: detected IP conflicts on the network (see: Troubleshooting DHCP Conflicts)
  • Intrusion Detection: Intrusion Detection System (IDS) events (Advanced Security license only)
  • Meraki VPN: AutoVPN connectivity events
  • Network-Based Application Recognition (NBAR): (see Next-gen Traffic Analytics - Network-Based Application Recognition (NBAR) Integration)
  • All IPsec / Client VPN: non-Meraki and Client VPN connectivity events 
  • All IPsec VPN: non-Meraki VPN negotiation
  • OSPF: events related to Open Shortest Path First (OSPF) routing
  • RADIUS: events related to RADIUS and MAC Authentication Bypass (MAB) authentication
  • Radius Proxy: Radius Proxy and Radius Server status events
  • Route tracking: route connection change and network test events
  • Status: port carrier changes
  • VRRP: Virtual Router Redundancy Protocol (VRRP) warm spare transition
  • Web caching: web cache events

 

 

MR access point

Meraki MR access points report the following event types:

To learn more about specific events , see the  Common wireless event log messages.

Systems Manager endpoints

The following types of events will be reported by managed Systems Manager endpoints:

  • Command line: command line request events
  • Endpoint management: detailed information about changes in endpoint management
  • Live tools: recent usage of live tools on client endpoints
  • Remote desktop: usage of the remote desktop tool

MS switch

Meraki MS switches report the following event types:

  • 802.1X: events related to client authentication and de-authentication
  • Access Control: events related to client network access
  • DHCP: DHCP-related errors (when DHCP is enabled on a L3 interface)
  • Events dropped: generated when too many events occur too quickly
  • Multicast: events related to multicast
  • OSPF: events related to OSPF protocol
  • RADIUS: events specific to RADIUS protocol
  • Spanning Tree: events related to the Spanning Tree Protocol
  • Status: port carrier changes
  • Switch port: events related to switchports
  • Switch status: events related to power supply and temperature
  • VRRP: events related to Warm Spare

To learn more, visit MS event log Entries and Definitions.

MV smart camera

Meraki MV smart cameras report the following event types:

  • Camera: events related to camera components
  • DHCP: DHCP leases and related errors (see Event type DHCP Lease Filling Up My Event log)
  • Events dropped: generated when too many events occur too quickly
  • Status: port carrier changes

MT sensor

For a detailed list of event types reported by Meraki MT sensors, see  Common Sensor (MT) Event Log Messages

Catalyst switches

The For Catalyst Switches event log page behaves differently from the For Switches event log page. Unlike the MS switch, the For Catalyst Switches page does not include predefined event log types.

The Catalyst switches event log depends on the severity level of event logging set on the page (All, levels 0–7).

Message Logging Level Keywords 

Level keyword

Level

Description

Syslog definition

emergencies

0

System unstable

LOG_EMERG

alerts

1

Immediate action needed

LOG_ALERT

critical

2

Critical conditions

LOG_CRIT

errors

3

Error conditions

LOG_ERR

warnings

4

Warning conditions

LOG_WARNING

notifications

5

Normal but significant condition

LOG_NOTICE

informational

6

Informational messages only

LOG_INFO

debugging

7

Debugging messages

LOG_DEBUG

 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Reference
    Stage
    Final
  2. Tags
    1. CS_12432
    2. event
    3. event log
    4. filtering event log