Help pls - interpret messages from system log

[timbo1711]

Hello, this is my first post, so please be patient. I'm thankful this site exists - it has helped me a lot to understand my router(s), mesh, VPN, etc. I have an RT-AX88U Pro and RT-AX3000 in a mesh in my home (first is master, second is node to help cover house). I also have Wireguard enabled so that I can access data on a home server when I am away. When I first set this up 6 weeks or so ago, the system was really unstable. It got bad enough that the 88U was rebooting every 20 minutes or so. After some diagnostic steps, I exchanged the 88U for another new (thank you Micro Center!), and the stability improved dramatically. The mesh and VPN functions are now working so everything is quite stable. Nonetheless, there are almost 1000 entries in the system log every day, which seems really high. I try to study these, but my understanding isn't deep enough to interpret. FYI, we have about 15 devices in our home that are linking to the network (I have 2 SSIDs, 1 for 2.4, another for 5G)....TVs, phones, PCs, IPads, etc. I only enter the VPN from one laptop when I am away.

Over the last 3 days, there were 2949 messages. Here is a recap of message counts, where MACs and other details are stripped with notation "(etc)". These messages are in alpha sort order, so the sequence here is meaningless.

Count Pct Message Content

322 10.9% roamast: [EXAP]Deauth old sta in (etc)
183 6.2% roamast: eth6: disconnect weak signal strength station (etc)
183 6.2% roamast: eth6: remove client (etc) from monitor list
590 20.0% wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind (etc)
232 7.9% wlceventd: wlceventd_proc_event(662): eth6: Disassoc (etc)
525 17.8% wlceventd: wlceventd_proc_event(685): eth6: Auth (etc), status: Successful (0) (etc)
364 12.3% wlceventd: wlceventd_proc_event(695): eth7: ReAssoc (etc), status: Successful (0) (etc)
130 4.4% wlceventd: wlceventd_proc_event(722): eth6: Assoc (etc), status: Successful (0) (etc)
11 0.4% wlceventd: wlceventd_proc_event(722): eth7: Assoc (etc), status: Successful (0) (etc)

409 13.9% * all other messages
2949 100.0% ** total: 3 days of messages to System Log

I'm not sure whether these messages are "normal" or what. I think at least some of it is when we move in the house and the phones are moving thru the mesh from the AX88U to the AX3000, but I'm not sure.

Can anyone see any pattern here and tell me what is informational vs possibly problematic? Thanks much!

 

[drinkingbird]

Hello, this is my first post, so please be patient. I'm thankful this site exists - it has helped me a lot to understand my router(s), mesh, VPN, etc. I have an RT-AX88U Pro and RT-AX3000 in a mesh in my home (first is master, second is node to help cover house). I also have Wireguard enabled so that I can access data on a home server when I am away. When I first set this up 6 weeks or so ago, the system was really unstable. It got bad enough that the 88U was rebooting every 20 minutes or so. After some diagnostic steps, I exchanged the 88U for another new (thank you Micro Center!), and the stability improved dramatically. The mesh and VPN functions are now working so everything is quite stable. Nonetheless, there are almost 1000 entries in the system log every day, which seems really high. I try to study these, but my understanding isn't deep enough to interpret. FYI, we have about 15 devices in our home that are linking to the network (I have 2 SSIDs, 1 for 2.4, another for 5G)....TVs, phones, PCs, IPads, etc. I only enter the VPN from one laptop when I am away.

Over the last 3 days, there were 2949 messages. Here is a recap of message counts, where MACs and other details are stripped with notation "(etc)". These messages are in alpha sort order, so the sequence here is meaningless.

Count Pct Message Content

322 10.9% roamast: [EXAP]Deauth old sta in (etc)
183 6.2% roamast: eth6: disconnect weak signal strength station (etc)
183 6.2% roamast: eth6: remove client (etc) from monitor list
590 20.0% wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind (etc)
232 7.9% wlceventd: wlceventd_proc_event(662): eth6: Disassoc (etc)
525 17.8% wlceventd: wlceventd_proc_event(685): eth6: Auth (etc), status: Successful (0) (etc)
364 12.3% wlceventd: wlceventd_proc_event(695): eth7: ReAssoc (etc), status: Successful (0) (etc)
130 4.4% wlceventd: wlceventd_proc_event(722): eth6: Assoc (etc), status: Successful (0) (etc)
11 0.4% wlceventd: wlceventd_proc_event(722): eth7: Assoc (etc), status: Successful (0) (etc)

409 13.9% * all other messages
2949 100.0% ** total: 3 days of messages to System Log

I'm not sure whether these messages are "normal" or what. I think at least some of it is when we move in the house and the phones are moving thru the mesh from the AX88U to the AX3000, but I'm not sure.

Can anyone see any pattern here and tell me what is informational vs possibly problematic? Thanks much!

That's just wireless clients roaming between nodes (the roamast ones are where they're being forced to roam by roaming assistant). Normal.

 

[timbo1711]

Thanks DB, appreciate. And are ~1000 messages / day not unusual either? All comments appreciated....

 

[drinkingbird]

Thanks DB, appreciate. And are ~1000 messages / day not unusual either? All comments appreciated....

A client roaming to another AP generates like 5 or 6 log messages so seems reasonable if you're walking around with phones etc.

You can monitor and see if you think things are excessively roaming and if so try tweaking the settings, may be too aggressive, but I suspect it is normal. My single AP logs a ton just from me walking outside and back in, driving away and coming home, etc.

 

[timbo1711]

super helpful comments, thank you DB