Unterstanding MacOS wifi logs
You’re now watching this thread. If you’ve opted in to email or web notifications, you’ll be notified when there’s activity. Click again to stop watching or visit your profile to manage watched threads and notifications.
You’ve stopped watching this thread and will no longer receive emails or web notifications when there’s activity. Click again to start watching.
I’m using a Macbook Pro mid 2014 (Big Sur) and try to investigate wifi connection problems.
My router (Fritz!Box 7590) shows in the logs that constantly every 10 minutes the Macbook has been logged of from the wifi network (802.11ac) and logged on again.
E.g. it shows that at 10:04:30 the device has been logged off and then at 10:04:34 logged on again.
I turned on wifi logging on my Macbook:
Unfortunately I don’t understand the contents of the wifi.log.
May anybody give me a hint if there are specific log messages that indicate the reason for logging off and logging on again?
I find useless messages in the wifi.log file. All devices connect to my AT&T 1Gb Fiber connection but the MacBook Pro. This device connected without issue prior to the Monterey upgrade, now it’s dead. Oddly, it completed the install, connecting repeatedly after two or three reboots. When finished, it claimed I connected, but that I had no internet. Switched to Linux device and Windows 10 device, no problem connecting there. Reboot MacBook, still no network configuration. Must be a DHCP problem.
Replies
hi, I don’t hope setting your network to less secure is the answer. Although this would fix a lot of problems 😉
I think the culprit is:
Code Block Wed Dec 2 10:04:29.904 Driver Event: _bsd_80211_event_callback: APPLE80211_M_ROAM_START (en0)
I have the same issue, which is very annoying for video calls.
(MBPro 2015/Big Sur and Fritzbox 7580 with Mesh using FB-Extender 3000)
No other devices seem to experience this issue.
My current knowledge is:
Running a
Code Block ping --apple-time 192.168.188.110 -i 0.1 13:21:12.730147 64 bytes from 192.168.188.110: icmp_seq=3750 ttl=64 time=1.214 ms 13:21:12.836592 64 bytes from 192.168.188.110: icmp_seq=3751 ttl=64 time=3.009 ms Request timeout for icmp_seq 3753 -snip- Request timeout for icmp_seq 3787 13:21:16.694166 64 bytes from 192.168.188.110: icmp_seq=3788 ttl=64 time=3.420 ms 13:21:16.805075 64 bytes from 192.168.188.110: icmp_seq=3789 ttl=64 time=4.709 ms
Code Block tail -f /var/log/wifi.log Tue Dec 15 13:21:12.857 Driver Event: _bsd_80211_event_callback: APPLE80211_M_ROAM_START (en0) Tue Dec 15 13:21:12.857 Info: Roaming started on interface en0 Tue Dec 15 13:21:12.857 Info: PRIORITY LOCK ADDED [client=airportd, type=4, interface=en0, priority=5] Tue Dec 15 13:21:12.859 Info: -[CWXPCInterfaceContext setAWDLOperatingMode:interface:error:]: attempting to set AWDL mode to 2 Tue Dec 15 13:21:12.859 Info: SUSPEND AWDL for interface en0, timeout=10.0s, reason=Roam, token=8 --- Snip / too long --- Tue Dec 15 13:21:16.648 installGTK: IGTK installed Tue Dec 15 13:21:16.648 Info: Roaming ended on interface en0 Tue Dec 15 13:21:16.648 Driver Event: _bsd_80211_event_callback: RSN_HANDSHAKE_DONE (en0) Tue Dec 15 13:21:16.649 Info: -[CWXPCInterfaceContext setRoamInProgress:reason:]_block_invoke: roam status metric data: CWAWDMetricRoamStatus: status:0 security: 2 profile:5 origin:(-49) target:(-57) latency:3.791029s Tue Dec 15 13:21:16.649 Info: -[CWAWDManager submitMetric:]: submitting metric id 0x90046 Tue Dec 15 13:21:16.649 Info: RESUME AWDL for interface en0, reason=Roam token=8 Tue Dec 15 13:21:16.649 Info: PRIORITY LOCK REMOVED [client=airportd, type=4, interface=en0, priority=5] Tue Dec 15 13:21:16.650 Info: -[CWXPCInterfaceContext setAWDLOperatingMode:interface:error:]: attempting to set AWDL mode to 0 Tue Dec 15 13:21:16.709 postMessage::1412 APPLE80211_M_BSSID_CHANGED received Tue Dec 15 13:21:16.709 P2P: _p2pSupEventCallback: APPLE80211_M_BSSID_CHANGED Tue Dec 15 13:21:16.709 Driver Event: _bsd_80211_event_callback: BSSID_CHANGED (en0) Tue Dec 15 13:21:16.709 Info: _bsd_80211_event_callback: Frequency Band updated Tue Dec 15 13:21:16.710 Offload: tcpKeepAliveActive: TCP keep-alive is active. Tue Dec 15 13:21:16.710 WoW: LPAS not supported on en0, applying legacy WoW behavior Tue Dec 15 13:21:16.710 WoW: WoW successfully ENABLED on en0
point to roaming, as the wifi cuts out between roaming start and end.
Unfortunately I have not found a solution yet.
If anyone can point me to disabling wifi-roaming, I would be grateful.
I tried setting the joinMode to strongest (was unset before) with no success.
Code Block /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport prefs JoinMode
Code Block sudo defaults write /Library/Preferences/com.apple.airport.opproam disabled -bool true
Debugging OSX airport wifi connection
I just got a preconfigured Macbook Air (with 10.8.3) that refuses to connect to my house WiFi and gives an uninformative «connection timeout» message. The router/modem is working, every other device in house is able to connect using the same network name and password. I verified I was entering the correct password by checking the router admin page. If there is such a thing as «too many devices» connected a router, I turned off all other network appliances/gadgets at home and tried connecting again with the Air. Still no luck. I also tried removing com.apple.airport.preferences.plist from /Library/Preferences/SystemConfiguration and restarting as suggested in a MacRumors post. Didn’t do anything. Another bizarre thing is this Macbook Air has no problem connecting to an open WiFi one of my neighbors have (yes, such people exist). I’m using WPA2 and don’t want to make my WiFi open. Has anyone encountered something like this? Also, is there something (preferably command line) tool that will give me more verbose diagnostics about why airport is not connecting?
1 Answer 1
I can answer the second of your questions (now, probably, long since fixed), about verbose wifi diagnostics, in case others have similar problems.
There’s an little-known OSX program called /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport which can do marvelous things. That’s a long command to type each time, so I added two lines to my .bash_profile. The first aliases my alias «wifi» to this command and the second allows the alias to work with the sudo command:
alias wifi='/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport' alias sudo='sudo ' The airport command has some options. Type (using my alias) wifi -h to get a short report or wifi -H to see them all. Among its functions are options to programmatically connect to a wifi router, turn on advanced diagnostics and even activate sniffing. Here are some helpful ones for your problem:
Information on the current state of the wifi:
Scan the available wifis and give a full report:
Turn on debug of user-level functions:
sudo wifi en1 debug +AllUserLand Turn on debug of driver-level functions:
sudo wifi en1 debug +AllDriver Turn on vendor-level functions:
sudo wifi en1 debug +AllVendor Direct the output to /var/log/wifi.log :
sudo wifi en1 debug +LogFile Start the console and point it to /var/log/wifi.log (the logs are listed in the left-hand column when you click the first icon in the top row: Show Log List).
Specific Wifi network connection history in OSX
Is there a way to see the history of connections to a specific wifi network in the last couple of months. The idea is to focus on one particular SSID and on which days my laptop connected to that network over a period of time. Is this logged or available for review after the fact?
History as in which SSIDs were used at any point in time, or just a list of SSIDs that have ever been used on the Mac?
@JesseP. Yeah. Actually interested in one particular SSID and on which days my laptop connected to that network over a period of time.
What exactly are you looking to accomplish with this info? Connecting to an SSID is not the same as connecting to a network; you can authenticate to an AP without actually being allowed on a network.
2 Answers 2
Specific WiFi network connection history in OSX
Try using the following command in Terminal
log show --predicate '(processImagePath contains "configd") && (eventMessage contains "en0: SSID ")' --style syslog --last 1d Change last 1d (1 day to any days you want to look)
It will list all Dates and Time when your Mac was connected to specified SSID (network name)
This is a sample from my Mac looking at 3 days
More about WiFi networks on your Mac..
If you have the option «Remember Networks» enabled, all Networks that you joined at one time will be there, even Years back.
You can also find the last log in information for each Network in your Keychain.
However, that does not tells you specific activity per Network, only the last log in time.
Depending what are you looking for you can find the detailed WiFi logs in /private/var/log/
Also you can use following command to show you the history (Years) for all Networks your Mac connected.
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences |grep LastConnected -A 7 Does Mac OS X keep a log of network connection addresses and dates/times?
I have lost a file containing my hours worked for a particular client over the last month. However, I am always connected to their wireless network whilst I am working for them. Is there anyway that I can view a record of connection start times, durations or disconnection times for a given wireless network in OS X? That way I can bill them accurately rather than just making up a figure! Thanks Pete
Console.app is the quick and dirty solution but for longer term issues, I found this tool useful on OS X superuser.com/a/980399/137921 . It’s $10 though.
2 Answers 2
Check out the various logs in /Applications/Utilities/Console.app .
system.log and /private/var/log/kernel.log look best (the latter was mentioned here for a similar issue). Just search them for «en1» or whatever your network’s interface is ( en0 is usually wired, en1 wireless).
These don’t say, however, what the network’s name was. But if you know the times roughly (check your email archive and version control software, for example), it might help a great deal.
If anyone else can offer any other insights (maybe a log of all connections made to a particular ip address or possibly a way of checking the router for a connection history with my laptop) I would be very grateful
@user56876 You might want to tell us the router model. And it only works if you have access to it at your client’s.
Daniel, I am looking through system.log, but can only see records from today and yesterday. Presumably there is an archive older logs that I can access in the same way. Could you tell me how I can access those? Thanks again. p.s. I can get access to the router, the model is ‘D-Link Wireless 108G MIMO ADSL 2/2+ Router’. I’m not an IT professional but know enough to log onto the router’s setup screen
@user Try the /private/var/log/system.log.X.bz2 files, they go back further. My kernel log goes back to when I installed the system in June, you might be more successful there.
While looking around /var/log on MacOS 10.11, I found this log file wifi.log. The following search will give you good perspective on the WiFi status change:
$ grep processAirPortStateChanges /var/log/wifi.log \ | grep connect \ | grep -v -e "old state=disconnected, new state=disconnected" \ -e "old state=connecting, new state=connecting" \ -e "old state=disconnected, new state=auto-join" \ -e "old state=auto-join, new state=connecting" \ | cut -d' ' -f1-5,12- Sample output (yes, my new Comcast router is being flakey thus I came across this question looking for log file myself):
Sun Apr 3 00:46:08.540 old state=connecting, new state=4 bars Sun Apr 3 01:46:50.509 old state=4 bars, new state=disconnected Sun Apr 3 01:46:52.839 old state=4 bars, new state=connecting Sun Apr 3 01:46:53.944 old state=connecting, new state=4 bars Sun Apr 3 02:47:36.283 old state=4 bars, new state=disconnected Sun Apr 3 02:47:37.900 old state=4 bars, new state=connecting Sun Apr 3 02:47:38.385 old state=connecting, new state=4 bars Sun Apr 3 03:49:38.732 old state=4 bars, new state=disconnected Sun Apr 3 04:50:24.289 old state=4 bars, new state=disconnected Sun Apr 3 04:50:26.313 old state=4 bars, new state=connecting Sun Apr 3 04:50:27.026 old state=connecting, new state=4 bars Sun Apr 3 05:51:10.288 old state=4 bars, new state=disconnected Sun Apr 3 06:35:17.291 old state=4 bars, new state=disconnected Sun Apr 3 06:35:19.983 old state=connecting, new state=4 bars Sun Apr 3 08:18:36.758 old state=4 bars, new state=disconnected Sun Apr 3 08:18:41.836 old state=4 bars, new state=connecting Sun Apr 3 08:18:42.187 old state=connecting, new state=4 bars