AID sent to syslog but not retrieved via getNetworkEvents

Meraki39 · ‎08-31-2022

Association IDs for connections to MRs seem to be getting sent to syslog:

1661977417.031486676 bldg_wifi_1_2 events type=association radio='1' vap='4' client_mac='FA:B2:B7:C3:55:AA' last_known_client_ip='0.0.0.0' channel='157' rssi='26' aid='1480343236'

but they are not available via the getNetworkEvents API call?

>>> pprint(kw)
{'clientName': 'FA:B2:B7:C3:55:AA',
'endingBefore': '2022-08-31T20:25:00Z',
'includedEventTypes': ['association'],
'productType': 'wireless',
'total_pages': 10}

>>>

>>> events = d.networks.getNetworkEvents(network_id,**kw)["events"]

...

>>>

>>> pprint(events[50])
{'clientDescription': 'fa:b2:b7:c3:55:aa',
'clientId': 'XXXXX',
'description': '802.11 association',
'deviceName': 'bldg-wifi-1-2',
'deviceSerial': 'QXXX...',
'eventData': {'channel': '157', 'rssi': '26'},
'networkId': 'L_XXX...',
'occurredAt': '2022-08-31T20:23:36.645857Z',
'ssidName': 'XXXXXX',
'ssidNumber': 4,
'type': 'association'}

>>>

>>> events[50]["aid"]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'aid'

>>>
>>> events[50]["eventData"]["aid"]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
KeyError: 'aid'

Using the 1.22.1 Python lib. Does anyone know if this is expected behavior?

sungod · ‎09-01-2022

The API data you pasted in has an association event that looks like it matches the syslog one. What are you missing?

{'clientDescription': 'fa:b2:b7:c3:55:aa',
'clientId': 'XXXXX',
'description': '802.11 association',
'deviceName': 'bldg-wifi-1-2',
'deviceSerial': 'QXXX...',
'eventData': {'channel': '157', 'rssi': '26'},
'networkId': 'L_XXX...',
'occurredAt': '2022-08-31T20:23:36.645857Z',
'ssidName': 'XXXXXX',
'ssidNumber': 4,
'type': 'association'}

Meraki39 · ‎09-01-2022

Thanks for checking in @sungod

I am not seeing the actual AID (1480343236) in the API data even though it gets sent to syslog.

Whats weird is that AID is included in other API events like disassociations and 8021x*

I'd like to be able to ... uh ... associate the initial association with the rest of the connection events but I'm guessing based on clientId, etc. without the real AID.

sungod · ‎09-01-2022

Ah, I misread.

According to https://developer.cisco.com/meraki/api-v1/#!get-network-events it should include the AID, it is clearly shown in the example response on the devnet site (pasted in below).

But I just ran a test, as you have found, it is not there on association events.

Looks like a bug, I suggest open a support case.

{
    "message": null,
    "pageStartAt": "2018-02-11T00:00:00.090210Z",
    "pageEndAt": "2018-02-11T00:00:00.090210Z",
    "events": [
        {
            "occurredAt": "2018-02-11T00:00:00.090210Z",
            "networkId": "N_24329156",
            "type": "association",
            "description": "802.11 association",
            "clientId": "k74272e",
            "clientDescription": "Miles's phone",
            "deviceSerial": "Q234-ABCD-5678",
            "deviceName": "My AP",
            "ssidNumber": 1,
            "ssidName": "My SSID",
            "eventData": {
                "radio": "1",
                "vap": "1",
                "client_mac": "22:33:44:55:66:77",
                "client_ip": "1.2.3.4",
                "channel": "36",
                "rssi": "12",
                "aid": "2104009183"
            }
        }
    ]
}

Meraki39 · ‎09-01-2022

Was hoping I was doing something wrong but thanks for confirming @sungod.

I'll update this post on case completion.