Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

AP logging to the in-memory buffer and flash

Updated: April 10, 2026

Want to summarize with AI?

Log in

Describes access point logging capabilities to in-memory buffers and flash storage, covering terminal logging, syslog server configuration for AP profiles, GUI-based syslog settings, and verification commands.

AP always log messages to an in-memory buffer. Once the buffer reaches 40 KB, its contents are automatically written to flash memory, and a new buffer is created.

Administrators can manage and view these logs using AP commands.

  • show logging command to display the contents of the in-memory logging buffer

  • show flash syslogs command to list all log files stored in flash, along with other diagnostic files

  • <filename> command to display the contents of an individual log file stored in flash

  • copy syslogs <filename> command to transfer a specific syslog file to an external server. To see available options for this command, use copy syslogs <filename>

AP logging to terminal

Access points support real-time logging of messages to an active SSH terminal session, which can be enabled or disabled using the terminal monitor and terminal monitor disable commands.

Administrators can enable real-time logging to an SSH terminal session using the terminal monitor command. To disable real-time logging to the session, use the terminal monitor disable command. In addition to SSH terminal sessions, APs send a subset of log messages to the serial console, providing another method for real-time monitoring.

Configure AP logging to a syslog server

Use the syslog command in the AP join profile to configure the destination IP address for syslog messages and manage which messages are sent based on severity and facility levels.

Configure the syslog host

  • Use the syslog host <IP address> command to specify the destination IP address for syslog messages.

  • By default, the syslog host is 255.255.255.255 , the IPv4 limited broadcast address.

  • Configure IP helper addresses on the AP subnet router to forward broadcasts to one or more syslog servers.

  • To reset the syslog host to 255.255.255.255 , use either the default syslog host or no syslog host command.

  • To prevent the AP from sending syslog messages entirely, use syslog host 0.0.0.0 .

  • If a subnet contains more than 20 access points, do not log to the broadcast address. This prevents flooding the broadcast domain with log messages. Configure a specific syslog destination IP address.

  • If you do not use the AP syslog feature, set the syslog host to 0.0.0.0 by entering the syslog host 0.0.0.0 command.

Filter messages by severity

  • Use the syslog level <levelname> command to filter messages based on severity.

  • By default, the severity level is informational ( severity=6 ), which means the system sends all messages except debugging logs to the server.

Filter messages by facility

  • Use the syslog facility <facilityname> command to filter messages based on the facility code (facility name).

  • By default, the facility is kernel ( kern , code=0 ), so the system sends only kernel-related messages.

  • To send messages from all facilities, configure the facility as local7 .

  • The configured facility name is included in the facility field of transmitted syslog messages.

Note

Most AP log messages use the kern facility, while terminal access logs such as SSH and console access use the auth facility.

Secured syslog transmission

  • Use the syslog secured command to enable Transport Layer Security (TLS), as defined in RFC 5425, to transmit syslog messages securely instead of using UDP.

  • TLS-based syslog transmission is supported starting with software versions 17.9.6 and 17.12.1 (released in June 2023 and December 2023, respectively).

View syslog settings

To display the current syslog settings for an AP, use the show capwap client configuration command.

Configure a syslog server for an AP profile (CLI)

Configure a syslog server for an AP profile.

This ensures access points send system log messages to a specified remote server for central monitoring and troubleshooting.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure an AP profile. Then, enter the AP profile configuration mode.

Example:

Device(config)# ap profile ap-profile
3.

Configure the facility parameter used by syslog messages.

Example:

Device(config-ap-profile)# syslog facility
4.

Enter the Syslog server IP address and parameters to define where the AP profile sends log messages.

Example:

Device(config-ap-profile)# syslog host ip-address
5.

Set the syslog server logging level to determine which messages the AP profile sends.

Example:

Device(config-ap-profile)# syslog level {alerts | critical | debugging | emergencies | errors | informational | notifications | warnings}

Example:

Device(config-ap-profile)# syslog level

The syslog server supports these logging levels:

  • emergencies —Signifies severity 0. Indicates that the system is not usable.

  • alerts —Signifies severity 1. Indicates that an immediate action is required.

  • critical —Signifies severity 2. Indicates a critical condition.

  • errors —Signifies severity 3. Indicates an error condition.

  • warnings —Signifies severity 4. Indicates a warning condition.

  • notifications —Signifies severity 5. Indicates normal, but significant, conditions.

  • informational —Signifies severity 6. Indicates informational messages.

  • debugging —Signifies severity 7. Indicates debugging messages.

Note

Select a syslog level to enable it and all lower levels.

If you enable the critical syslog level, alerts and emergencies are also enabled.

6.

Return to privileged EXEC mode.

Example:

Device(config-ap-profile)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The syslog server is configured for the specified AP profile. APs that use this profile will send log messages with the selected severity levels to the designated remote server.

Configure the AP syslog settings (GUI)

Set up syslog parameters for access points. This enables monitoring and centralized logging of events.

Procedure

1.

Choose Configuration, then Tags and Profiles, then AP Join.

2.

Select the APs from the AP list.

The Edit AP Join Profile window is displayed.

3.

Click the Management tab.

4.

Select the Device tab.

5.

In the System Log section:

  1. From the Facility Value drop-down list, select a value.

  2. Enter the IP address in the Host IPv4 or IPv6 Address field.

  3. From the Log Trap Value drop-down list, select a value.

  4. To enable Secured, check the box. To disable Secured, clear the box.

6.

Click Update and Apply to Device

The selected APs are updated with the new syslog configuration, enabling centralized logging according to your specified parameters.

Verify syslog server configurations

Verify global syslog server settings for all APs

To view the global syslog server settings for all access points that joins the controller, use this command:

Device# show ap config general
Cisco AP Name : APA0F8.4984.5E48
=================================================

Cisco AP Identifier : a0f8.4985.d360
Country Code : IN
Regulatory Domain Allowed by Country : 802.11bg:-A 802.11a:-DN
AP Country Code : IN - India
AP Regulatory Domain
Slot 0 : -A
Slot 1 : -D
MAC Address : a0f8.4984.5e48
IP Address Configuration : DHCP
IP Address : 9.4.172.111
IP Netmask : 255.255.255.0
Gateway IP Address : 9.4.172.1
Fallback IP Address Being Used : 
Domain : 
Name Server : 
CAPWAP Path MTU : 1485
Telnet State : Disabled
SSH State : Disabled
Jumbo MTU Status : Disabled
Cisco AP Location : default location
Site Tag Name : ST1
RF Tag Name : default-rf-tag
Policy Tag Name : PT3
AP join Profile : default-ap-profile
Primary Cisco Controller Name : WLC2
Primary Cisco Controller IP Address : 9.4.172.31
Secondary Cisco Controller Name : Not Configured
Secondary Cisco Controller IP Address : 0.0.0.0
Tertiary Cisco Controller Name : Not Configured
Tertiary Cisco Controller IP Address : 0.0.0.0
Administrative State : Enabled
Operation State : Registered
AP Certificate type : Manufacturer Installed Certificate
AP Mode : Local
AP VLAN tagging state : Disabled
AP VLAN tag : 0
CAPWAP Preferred mode : Not Configured
AP Submode : Not Configured
Office Extend Mode : Disabled
Remote AP Debug : Disabled
Logging Trap Severity Level : notification
Software Version : 16.10.1.24
Boot Version : 1.1.2.4
Mini IOS Version : 0.0.0.0
Stats Reporting Period : 180
LED State : Enabled
PoE Pre-Standard Switch : Disabled
PoE Power Injector MAC Address : Disabled
Power Type/Mode : PoE/Full Power (normal mode)
Number of Slots : 3
AP Model : AIR-AP1852I-D-K9
IOS Version : 16.10.1.24
Reset Button : Disabled
AP Serial Number : KWC212904UB
Management Frame Protection Validation : Disabled
AP User Mode : Automatic
AP User Name : Not Configured
AP 802.1X User Mode : Global
AP 802.1X User Name : Not Configured
Cisco AP System Logging Host : 9.4.172.116
AP Up Time : 11 days 1 hour 15 minutes 52 seconds 
AP CAPWAP Up Time : 6 days 3 hours 11 minutes 6 seconds 
Join Date and Time : 09/05/2018 04:18:52
Join Taken Time : 3 minutes 1 second 
Join Priority : 1
Ethernet Port Duplex : Auto
Ethernet Port Speed : Auto
AP Link Latency : Disable
AP Lag Configuration Status : Disabled
AP Lag Operational Status : Disabled
Lag Support for AP : Yes
Rogue Detection : Enabled
Rogue Containment auto-rate : Disabled
Rogue Containment of standalone FlexConnect APs : Disabled
Rogue Detection Report Interval : 10
Rogue AP minimum RSSI : -90
Rogue AP minimum transient time : 0
AP TCP MSS Adjust : Enabled
AP TCP MSS Size : 1250
AP IPv6 TCP MSS Adjust : Enabled
AP IPv6 TCP MSS Size : 1250
Hyperlocation Admin Status : Disabled
Retransmit count : 5
Retransmit interval : 3
Fabric status : Disabled
FIPS status : Disabled
WLANCC status : Disabled
USB Module Type : USB Module
USB Module State : Enabled
USB Operational State : Disabled
USB Override : Disabled
Lawful-Interception Admin status : Disabled
Lawful-Interception Oper status : Disabled

Verify syslog server settings for a specific AP

To view the syslog server settings for a specific access point, use this command:

Device# show ap name <ap-name> config general
show ap name APA0F8.4984.5E48 config general
Cisco AP Name : APA0F8.4984.5E48
=================================================

Cisco AP Identifier : a0f8.4985.d360
Country Code : IN
Regulatory Domain Allowed by Country : 802.11bg:-A 802.11a:-DN
AP Country Code : IN - India
AP Regulatory Domain
Slot 0 : -A
Slot 1 : -D
MAC Address : a0f8.4984.5e48
IP Address Configuration : DHCP
IP Address : 9.4.172.111
IP Netmask : 255.255.255.0
Gateway IP Address : 9.4.172.1
Fallback IP Address Being Used : 
Domain : 
Name Server : 
CAPWAP Path MTU : 1485
Telnet State : Disabled
SSH State : Disabled
Jumbo MTU Status : Disabled
Cisco AP Location : default location
Site Tag Name : ST1
RF Tag Name : default-rf-tag
Policy Tag Name : PT3
AP join Profile : default-ap-profile
Primary Cisco Controller Name : WLC2
Primary Cisco Controller IP Address : 9.4.172.31
Secondary Cisco Controller Name : Not Configured
Secondary Cisco Controller IP Address : 0.0.0.0
Tertiary Cisco Controller Name : Not Configured
Tertiary Cisco Controller IP Address : 0.0.0.0
Administrative State : Enabled
Operation State : Registered
AP Certificate type : Manufacturer Installed Certificate
AP Mode : Local
AP VLAN tagging state : Disabled
AP VLAN tag : 0
CAPWAP Preferred mode : Not Configured
AP Submode : Not Configured
Office Extend Mode : Disabled
Remote AP Debug : Disabled
Logging Trap Severity Level : notification
Software Version : 16.10.1.24
Boot Version : 1.1.2.4
Mini IOS Version : 0.0.0.0
Stats Reporting Period : 180
LED State : Enabled
PoE Pre-Standard Switch : Disabled
PoE Power Injector MAC Address : Disabled
Power Type/Mode : PoE/Full Power (normal mode)
Number of Slots : 3
AP Model : AIR-AP1852I-D-K9
IOS Version : 16.10.1.24
Reset Button : Disabled
AP Serial Number : KWC212904UB
Management Frame Protection Validation : Disabled
AP User Mode : Automatic
AP User Name : Not Configured
AP 802.1X User Mode : Global
AP 802.1X User Name : Not Configured
Cisco AP System Logging Host : 9.4.172.116
AP Up Time : 11 days 1 hour 15 minutes 52 seconds 
AP CAPWAP Up Time : 6 days 3 hours 11 minutes 6 seconds 
Join Date and Time : 09/05/2018 04:18:52
Join Taken Time : 3 minutes 1 second 
Join Priority : 1
Ethernet Port Duplex : Auto
Ethernet Port Speed : Auto
AP Link Latency : Disable
AP Lag Configuration Status : Disabled
AP Lag Operational Status : Disabled
Lag Support for AP : Yes
Rogue Detection : Enabled
Rogue Containment auto-rate : Disabled
Rogue Containment of standalone FlexConnect APs : Disabled
Rogue Detection Report Interval : 10
Rogue AP minimum RSSI : -90
Rogue AP minimum transient time : 0
AP TCP MSS Adjust : Enabled
AP TCP MSS Size : 1250
AP IPv6 TCP MSS Adjust : Enabled
AP IPv6 TCP MSS Size : 1250
Hyperlocation Admin Status : Disabled
Retransmit count : 5
Retransmit interval : 3
Fabric status : Disabled
FIPS status : Disabled
WLANCC status : Disabled
USB Module Type : USB Module
USB Module State : Enabled
USB Operational State : Disabled
USB Override : Disabled
Lawful-Interception Admin status : Disabled
Lawful-Interception Oper status : Disabled