AID sent to syslog but not retrieved via getNetworkEvents

Meraki39
Comes here often

AID sent to syslog but not retrieved via getNetworkEvents

Association IDs for connections to MRs seem to be getting sent to syslog:

 

1661977417.031486676 bldg_wifi_1_2 events type=association radio='1' vap='4' client_mac='FA:B2:B7:C3:55:AA' last_known_client_ip='0.0.0.0' channel='157' rssi='26' aid='1480343236'

 

but they are not available via the getNetworkEvents API call?

 

>>> pprint(kw)
{'clientName': 'FA:B2:B7:C3:55:AA',
'endingBefore': '2022-08-31T20:25:00Z',
'includedEventTypes': ['association'],
'productType': 'wireless',
'total_pages': 10}

>>>

>>> events = d.networks.getNetworkEvents(network_id,**kw)["events"]

...

>>>

>>> pprint(events[50])
{'clientDescription': 'fa:b2:b7:c3:55:aa',
'clientId': 'XXXXX',
'description': '802.11 association',
'deviceName': 'bldg-wifi-1-2',
'deviceSerial': 'QXXX...',
'eventData': {'channel': '157', 'rssi': '26'},
'networkId': 'L_XXX...',
'occurredAt': '2022-08-31T20:23:36.645857Z',
'ssidName': 'XXXXXX',
'ssidNumber': 4,
'type': 'association'}

>>>

>>> events[50]["aid"]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'aid'

>>>
>>> events[50]["eventData"]["aid"]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'aid'

 

Using the 1.22.1 Python lib. Does anyone know if this is expected behavior?

4 Replies 4
sungod
Kind of a big deal

The API data you pasted in has an association event that looks like it matches the syslog one. What are you missing?

 

 

{'clientDescription': 'fa:b2:b7:c3:55:aa',
'clientId': 'XXXXX',
'description': '802.11 association',
'deviceName': 'bldg-wifi-1-2',
'deviceSerial': 'QXXX...',
'eventData': {'channel': '157', 'rssi': '26'},
'networkId': 'L_XXX...',
'occurredAt': '2022-08-31T20:23:36.645857Z',
'ssidName': 'XXXXXX',
'ssidNumber': 4,
'type': 'association'}

 

 

Meraki39
Comes here often

Thanks for checking in @sungod 

 

I am not seeing the actual AID (1480343236) in the API data even though it gets sent to syslog.

 

Whats weird is that AID is included in other API events like disassociations and 8021x*

 

I'd like to be able to ... uh ... associate the initial association with the rest of the connection events but I'm guessing based on clientId, etc. without the real AID.

 

sungod
Kind of a big deal

Ah, I misread.

 

According to https://developer.cisco.com/meraki/api-v1/#!get-network-events it should include the AID, it is clearly shown in the example response on the devnet site (pasted in below).

 

But I just ran a test, as you have found, it is not there on association events.

 

Looks like a bug, I suggest open a support case.

 

 

{
    "message": null,
    "pageStartAt": "2018-02-11T00:00:00.090210Z",
    "pageEndAt": "2018-02-11T00:00:00.090210Z",
    "events": [
        {
            "occurredAt": "2018-02-11T00:00:00.090210Z",
            "networkId": "N_24329156",
            "type": "association",
            "description": "802.11 association",
            "clientId": "k74272e",
            "clientDescription": "Miles's phone",
            "deviceSerial": "Q234-ABCD-5678",
            "deviceName": "My AP",
            "ssidNumber": 1,
            "ssidName": "My SSID",
            "eventData": {
                "radio": "1",
                "vap": "1",
                "client_mac": "22:33:44:55:66:77",
                "client_ip": "1.2.3.4",
                "channel": "36",
                "rssi": "12",
                "aid": "2104009183"
            }
        }
    ]
}

 

 

Meraki39
Comes here often

Was hoping I was doing something wrong but thanks for confirming @sungod.

I'll update this post on case completion.

Get notified when there are additional replies to this discussion.