What's new

Many log events - WLCEVENTD

eriddler

Occasional Visitor
Trying to figure out what is going on....hundreds of these occurring. I have AiMesh active with one main router and two nodes. Does this have anything to do with Roaming assistant?

Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:04 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:04 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:05 roamast: determine candidate node [4C:ED:FB:7F:CA:28](rssi: -48dbm) for client [7C:2E:BD:52:06:97](rssi: -93dbm) to roam
Feb 18 19:03:05 roamast: eth1: disconnect weak signal strength station [7c:2e:bd:52:06:97]
Feb 18 19:03:05 roamast: eth1: remove client [7c:2e:bd:52:06:97] from monitor list
Feb 18 19:03:05 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 7C:2E:BD:52:06:97, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:12 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 7C:2E:BD:52:06:97, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 7C:2E:BD:52:06:97, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:15 syslog: WLCEVENTD wlceventd_proc_event(401): eth1: Disassoc 4C:ED:FB:7F:CA:29, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Feb 18 19:03:16 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:16 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:24 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(401): eth1: Disassoc 4C:ED:FB:7F:CA:29, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Feb 18 19:03:28 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:28 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:35 roamast: determine candidate node [4C:ED:FB:7F:CA:28](rssi: -59dbm) for client [7C:2E:BD:52:06:97](rssi: -90dbm) to roam
Feb 18 19:03:35 roamast: eth1: disconnect weak signal strength station [7c:2e:bd:52:06:97]
Feb 18 19:03:35 roamast: eth1: remove client [7c:2e:bd:52:06:97] from monitor list
Feb 18 19:03:35 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 7C:2E:BD:52:06:97, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
 

wouterv

Very Senior Member
Trying to figure out what is going on....hundreds of these occurring. I have AiMesh active with one main router and two nodes. Does this have anything to do with Roaming assistant?
This is introduced due a firmware change some time ago and is related to the setting for the kind of messages to show in the System Log.
The kind of messages shown is defined with the severity level, the higher the number the more message types are shown.
In current firmware the default severity level is 6, this causes the WLCEVENTD messages.
A severity level of 5 will hide those messages.

The severity level can be shown and set with SSH commands:
  1. nvram get log_level
  2. nvram set log_level=5
  3. nvram commit
  4. reboot
 

Drifter

Occasional Visitor
I had the same issue with my AC 2900 last day.

I searched here and did few changes, don't know which change made the difference and continuous logging of WLCEVENTD disappeared
 

Butterfly Bones

Very Senior Member
Trying to figure out what is going on....hundreds of these occurring. I have AiMesh active with one main router and two nodes. Does this have anything to do with Roaming assistant?

Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:02 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Class 2 frame received from nonauthenticated station (6)
Feb 18 19:03:04 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:04 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:05 roamast: determine candidate node [4C:ED:FB:7F:CA:28](rssi: -48dbm) for client [7C:2E:BD:52:06:97](rssi: -93dbm) to roam
Feb 18 19:03:05 roamast: eth1: disconnect weak signal strength station [7c:2e:bd:52:06:97]
Feb 18 19:03:05 roamast: eth1: remove client [7c:2e:bd:52:06:97] from monitor list
Feb 18 19:03:05 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 7C:2E:BD:52:06:97, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:12 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 7C:2E:BD:52:06:97, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 7C:2E:BD:52:06:97, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:14 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:15 syslog: WLCEVENTD wlceventd_proc_event(401): eth1: Disassoc 4C:ED:FB:7F:CA:29, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Feb 18 19:03:16 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:16 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:24 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 4C:ED:FB:7F:CA:29, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:26 syslog: WLCEVENTD wlceventd_proc_event(401): eth1: Disassoc 4C:ED:FB:7F:CA:29, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Feb 18 19:03:28 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:28 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc 4C:ED:FB:7F:CA:29, status: 0, reason: d11 RC reserved (0)
Feb 18 19:03:35 roamast: determine candidate node [4C:ED:FB:7F:CA:28](rssi: -59dbm) for client [7C:2E:BD:52:06:97](rssi: -90dbm) to roam
Feb 18 19:03:35 roamast: eth1: disconnect weak signal strength station [7c:2e:bd:52:06:97]
Feb 18 19:03:35 roamast: eth1: remove client [7c:2e:bd:52:06:97] from monitor list
Feb 18 19:03:35 syslog: WLCEVENTD wlceventd_proc_event(386): eth1: Deauth_ind 7C:2E:BD:52:06:97, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)
Know issue.
https://www.snbforums.com/threads/r...13-is-now-available.57860/page-35#post-515660

https://www.snbforums.com/threads/a...384-45149-12-05-2018.50232/page-9#post-470731
 

tallytr

Senior Member
This is introduced due a firmware change some time ago and is related to the setting for the kind of messages to show in the System Log.
The kind of messages shown is defined with the severity level, the higher the number the more message types are shown.
In current firmware the default severity level is 6, this causes the WLCEVENTD messages.
A severity level of 5 will hide those messages.

The severity level can be shown and set with SSH commands:
  1. nvram get log_level
  2. nvram set log_level=5
  3. nvram commit
  4. reboot
Thank you!
I don't know why these WLCEVENTD messages bothered me but I changed the level to 5 using PuTTY SSH and they disappeared.
 

wouterv

Very Senior Member
Thank you!
I don't know why these WLCEVENTD messages bothered me but I changed the level to 5 using PuTTY SSH and they disappeared.
Good to hear.
I learned that the background of the issue is slightly different and shall be considered as a bug, but I didn't like the System Log consuming memory either.
By the way: Windows 10 by default supports SSH, no additional app is required.
 

bertilak

Occasional Visitor
I get a few WLCEVENTD messages like this:

Aug 28 07:15:03 syslog: WLCEVENTD wlceventd_proc_event(529): eth1: Assoc 00:BB:3A:C9:03:BE, status: Successful (0)
Aug 28 09:45:01 syslog: WLCEVENTD wlceventd_proc_event(500): eth1: Auth 44:91:60:F3:F1:A4, status: Successful (0)
Aug 28 09:45:01 syslog: WLCEVENTD wlceventd_proc_event(481): eth2: Disassoc 44:91:60:F3:F1:A4, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Aug 28 09:45:01 syslog: WLCEVENTD wlceventd_proc_event(529): eth1: Assoc 44:91:60:F3:F1:A4, status: Successful (0)
Aug 28 09:45:01 syslog: WLCEVENTD wlceventd_proc_event(481): eth2: Disassoc 44:91:60:F3:F1:A4, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)

I put it down to wireless clients coming and going and figure it is OK.

The MAC addresses seem like reasonable things to check in and out (e.g. 00:BB:3A:C9:03:BE is for a kindle).

My Log Level is set to default=info and log only more urgent than info.
 
Last edited:

tallytr

Senior Member
Makes you wonder why Asus wouldn't offer a simple pull down menu right in the router > Change logging level
 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top