cat /opt/etc/syslog-ng.d/wlceventd
# put wlceventd Assoc/ReAssoc/Disassoc messages into /opt/var/log/wlceventd.log
destination d_wlceventd {
file("/opt/var/log/wlceventd.log");
};
filter f_wlceventd {
( program("WLCEVENTD") or
program ("wlceventd") ) and
( message("ssoc") or
message("uth") );
};
log {
source(src);
filter(f_wlceventd);
destination(d_wlceventd);
flags(final);
};
#eof
grep 'WLCEVENTD' /opt/var/log/messages
May 9 17:19:40 RT-AC88U-BC40 syslog: WLCEVENTD wlceventd_proc_event(401): eth1: Disassoc F0:5C:77:C2:6D:C6, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
May 9 18:21:23 RT-AC88U-BC40 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth F0:5C:77:C2:6D:C6, status: 0, reason: d11 RC reserved (0)
May 9 18:21:23 RT-AC88U-BC40 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc F0:5C:77:C2:6D:C6, status: 0, reason: d11 RC reserved (0)
May 9 18:22:28 RT-AC88U-BC40 syslog: WLCEVENTD wlceventd_proc_event(420): eth1: Auth C0:B6:F9:16:68:B8, status: 0, reason: d11 RC reserved (0)
May 9 18:22:28 RT-AC88U-BC40 syslog: WLCEVENTD wlceventd_proc_event(449): eth1: Assoc C0:B6:F9:16:68:B8, status: 0, reason: d11 RC reserved (0)