Usefulness of rsyslog on EAP670?
In trying to troubleshoot device crash and client connection problems, I enabled rsyslog on the EAP670.
If I leave "More client detail log" disabled, it appears little to nothing gets logged. However, if I enable "More client detail log" I get reams and reams of what looks like individual packet trace data, showing only source/destination IP, MAC and port with no other detail, in a weird format that groups together 12 actual log lines into single lines with CRLF replaced by the string '#015#012' (easy enough to fix).
My question is: Is there anything in between no logging and logging of (apparently) all packets traversing the AP?
Here's a sample of one raw logged line:
$ sudo head -1 /var/log/192.168.10.253/system.log 2024-07-13T15:40:57-07:00 192.168.10.253 [1720910455.531109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900#015#012[1720910455.561109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.651109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.651109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.751109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.751109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.861109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.991109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910455.991109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443#015#012[1720910456.291109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=08:3a:8d:fa:45:9d IP SRC=192.168.10.234 IP DST=192.168.10.255 IP proto=17 SPT=51368 DPT=59387#015#012[1720910456.551109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900#015#012[1720910457.561109381] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900#015
And here's the same line after "fixing" the CRLF codes:
$ sudo head -1 /var/log/192.168.10.253/system.log | sed -E -e's/#012/\r/g;s/#015/\n/g' 2024-07-13T15:40:57-07:00 192.168.10.253 [1720910455.531109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900 [1720910455.561109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.651109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.651109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.751109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.751109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.861109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.991109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910455.991109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=172.212.75.57 IP proto=6 SPT=60100 DPT=443 [1720910456.291109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=08:3a:8d:fa:45:9d IP SRC=192.168.10.234 IP DST=192.168.10.255 IP proto=17 SPT=51368 DPT=59387 [1720910456.551109380] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900 [1720910457.561109381] AP MAC=74:fe:ce:fc:9f:24 MAC SRC=20:c1:9b:e6:cb:1b IP SRC=192.168.10.233 IP DST=239.255.255.250 IP proto=17 SPT=57182 DPT=1900
For reference, here's my rsyslogd configuration relating to the AP:
$template remote-incoming-logs,"/var/log/%HOSTNAME%/system.log" *.* ?remote-incoming-logs & ~