Monitoring, Troubleshooting, and Reporting
Where to look
- Event log: per-network events such as client association, DHCP, VPN state changes, and security events.
- Change log: organization-wide record of configuration changes and who made them.
- Alerts: default alerts plus custom ones delivered by email, SMS, or webhook.
- Live tools: ping, traceroute, ARP/MAC tables, cable test, and packet capture on MX, MS, and MR.
Interpreting symptoms
An access point reporting online while clients fail to associate usually points to RF or authentication, not connectivity. High channel utilization with few clients suggests co-channel interference or a non-Wi-Fi interferer - check the RF spectrum view. A switch port reporting 802.1X failures points at RADIUS reachability, not cabling. A flapping uplink shows in the uplink status and event log rather than in client pages.
Reporting
Scheduled summary reports, uptime and usage summaries, and API-driven exports support capacity planning and compliance evidence. Reports are scoped to a network or organization, so choose the scope deliberately.
Traps
Configuration changes never appear in the event log - they appear in the change log. Packet capture on an MR only captures traffic for clients associated to that AP. Live tools test from the device's perspective, not the client's.
Rule of thumb: for "who changed it?" open the change log; for "what happened on the wire?" use the event log and live tools.
Worked example: users report intermittent drops on one floor. Check the event log for association events, the RF spectrum for interference, then run a packet capture on the suspect AP to confirm retransmissions.