Network Wide Configuration

Monitoring Network Wide Event Log

Sections: 

Resources: 

Overview: 

  • The Event Log in Cisco Meraki is a network wide feature that provides detailed records of network activity and events across your Meraki devices
  • The Event Log is an essential tool for monitoring, troubleshooting, and auditing network behavior in real time

Monitoring Event Log Overview

Event Log Page Menu

Network Wide Event Log

  • Per Cisco, each Meraki network accessible through the Meraki Dashboard will have its own event log and feature a clickable drop down menu to select the event log for particular devices including the following:
    • Security Appliances
    • Access Points
    • Switches
    • Cameras
    • Catalyst Switches

Important Cisco Notices

  • If a Meraki device is offline but remains powered on, it will continue to gather information that populates the event log and store it locally. Once the device comes back online, this information will then be uploaded to the Meraki Dashboard with the events keeping their original timestamps
  • The Meraki Dashboard can maintain event logs for up to three months unless the Client Privacy setting has been configured for a shorter timeframe
  • Event Logs are tied to the Dashboard network, not stored locally on the device. As such, swapping devices will not affect the event log, but moving devices to a new network will cause their event logs to be cleared. If a complete historical log is necessary, implementing a syslog server is recommended to maintain logs as long as needed

Event Log Features 

  • Filtering by Client or Device
  • Filtering by Date and Time
  • Filtering by Event Type

Event Log Page Overview

Event Log - Export to Excel Feature

MX Event Log 

    Meraki's MX Event Types

    • AnyConnect VPN
      • AnyConnect VPN connectivity events
    • Appliance Status
      • Primary uplink events
    • Auth
      • Splash page authentication
    • BGP
      • BGP notification and session events
    • Cellular
      • 3G/4G connectivity 
    • ClientVPN
      • Client VPN connectivity events
    • Client Status
      • Client connectivity 
    • DHCP
      • DHCP leases and related errors
    • DHCPv6
      • DHCPv6 NA and PD events
    • Events Dropped
      • Too many events were generated too quickly
    • Filtering
      • Content filtering and security center URL blocks
    • IP conflict
      • Detected IP conflicts on the network
    • Intrusion Detection
      • IDS (Advanced Security license only)
    • Meraki VPN
      • AutoVPN connectivity events
    • Network-Based Application Recognition
      • NBAR events
    • Non-Meraki / Client VPN
      • Non-Meraki and Client VPN connectivity events
    • Non-Meraki VPN
      • Non-Meraki VPN negotiation
    • OSPF
      • Events related to OSPF routing
    • RADIUS
      • Events related to RADIUS and MAB authentication
    • RADIUS Proxy
      • RADIUS proxy and RADIUS server status events
    • Route Tracking 
      • Route connection change and network test events
    • Status 
      • Port carrier changes
    • VRRP
      • Warm spare transition
    • Web caching
      • Web cache events

    MR Event Log 

      Meraki's MR Event Types

      • 802.11
        • Wireless association and disassociations
      • 802.1X
        • RADIUS authentication and deauthentications
      • AI-Enhanced RPM
        • AI-Powered AutoRF events
      • Adaptive Policy
        • Adaptive Policy state changes
      • Air Marshal
        • Packet floods and wireless security events
      • AutoRF
        • Channel scans and TX power changes
      • Auth
        • Splash page authentication
      • DFS
        • Events related to Dynamic Frequency Selection (DFS)
      • DHCP
        • DHCP leases and related errors
      • Events Dropped
        • Too many events were generated too quickly
      • IP conflict
        • Detected IP conflicts on the network
      • L3 roaming
        • Events related to wireless layer 3 roaming
      • Meraki VPN
        • VPN tunnel drops and connectivity events
      • Network-Based Application Recognition
        • NBAR events
      • RADIUS
        • Events related to RADIUS and MAB authentication
      • RADIUS Proxy
        • RADIUS proxy and RADIUS server status events
      • Status
        • Port carrier changes
      • WPA
        • WPA authentication & deauthentications

      MS Event Log 

        Meraki's MS Event Types

        • 802.1X
          • Events related to client authentication and de-authentication
        • Access Control
          • Events related to client network access
        • DHCP
          • DHCP-related errors (when DHCP is enabled on L3 interface)
        • Events Dropped
          • Too many events were generated too quickly
        • Multicast
          • Events related to multicast
        • OSPF
          • Events related to OSPF protocol
        • RADIUS
          • Events related to RADIUS protocol
        • Spanning Tree
          • Events related to the Spanning Tree Protocol
        • Status
          • Port carrier changes
        • Switch port
          • Events related to switchports
        • Switch status
          • Events related to power supply and temperature
        • VRRP
          • Events related to Warm Spare

        MV Event Log 

          Meraki's MV Event Types

          • Camera
            • Events related to camera components
          • DHCP
            • DHCP leases and related errors 
          • Events Dropped
            • Too many events were generated too quickly
          • Status
            • Port carrier changes