cf_block events missing from Meraki API (Get Network Events and Get Network Events Event Types)

[TheCat]

Hello,

We have noticed that cf_block events no longer appear when calling the Meraki API endpoints:

GET /networks/{networkId}/events

GET /networks/{networkId}/events/eventTypes

Previously, these events were available and could be filtered or retrieved programmatically. However, it seems that cf_block event types have been removed or relocated, and they are no longer returned by the API.

Could you please confirm whether cf_block events have been deprecated, moved to a different endpoint, or renamed under a new event category?

Monitoring these events is critical for our infrastructure, and we need to know the correct method or endpoint to programmatically retrieve them going forward.

Thank you in advance for your assistance.

Best regards,

Evgenii

[RaphaelL]

Hi ,

I just tried it and it still returns : 

https://api.meraki.com/api/v1/networks/L_XXXXXXXXXXXXX/events/eventTypes

  {
    "category": "Filtering",
    "type": "cf_block",
    "description": "Content filtering blocked URL"
  }

 https://api.meraki.com/api/v1/networks/L_XXXXXXXXX/events?productType=appliance&includedEventTypes[]...

{"message":"No  matching events found between Sep 17 11:15 and Oct 17 11:15.","pageStartAt":"2025-09-17T15:15:06.417862Z","pageEndAt":"2025-10-17T15:15:06.417862Z","events":[]}

[RaphaelL]

Does the network contains a MX ?

[TheCat]

Hi,

Unfortunately, the person responsible for the hardware side is currently unavailable.

From my understanding, the cf_block events are generated only by MX appliances, correct? If that’s the case, I’ll need to double-check whether there was any recent hardware replacement or upgrade that could have affected the event source.

Is there anything else I could verify (for example, specific configuration settings or firmware changes) to help identify why these events are no longer appearing in the API?

[Mloraditch]

Yes only MXs do CF. Have you verified the events occur on the dashboard side? If they aren't there, they will not be in the API either. Perhaps someone adjusted the content filtering settings.

[alemabrahao]

If you're using the Meraki Python SDK or similar tools, be cautious with the total_pages="all" parameter. It causes the call to hang when no matching events are found.

[sungod]

Yes.

There's a bug in rest_session.py, the loop breakout code is flawed (in both sync and async libraries), I reported it on github and to Meraki support, but afaik they never fixed it, I made my own patch. It was in a post on this forum but it's been 'archived' and I can't access it.

Look for _get_pages_legacy in whichever rest_session.py you are using

Add the indicated snippet of code...

    async def _get_pages_legacy(
            self,
            metadata,
            url,
            params=None,
            total_pages=-1,
            direction="next",
            event_log_end_time=None,
    ):
        if type(total_pages) == str and total_pages.lower() == "all":
            total_pages = -1
        elif type(total_pages) == str and total_pages.isnumeric():
            total_pages = int(total_pages)
        metadata["page"] = 1

        async with await self.request(metadata, "GET", url, params=params) as response:
            results = await response.json(content_type = None)

            # For event log endpoint when using 'next' direction, so results/events are sorted chronologically
            if (
                    type(results) == dict
                    and metadata["operation"] == "getNetworkEvents"
                    and direction == "next"
            ):
                results["events"] = results["events"][::-1]

            ###### added snippet
            elif (
                    type(results) == dict
                    and metadata["operation"] == "getNetworkEvents"
                    and direction == "prev"
            ):
                if len(results["events"]) == 0:
                    return results
            ###### to here

            links = response.links

[RaphaelL]

side note , but this is such a horrible bandaid imo... ( not refering to your code , but the official sdk )

            if direction == "next" and "next" in links:
                # Prevent getNetworkEvents from infinite loop as time goes forward
                if metadata["operation"] == "getNetworkEvents":
                    starting_after = urllib.parse.unquote(
                        str(links["next"]["url"]).split("startingAfter=")[1]
                    )
                    delta = datetime.now(timezone.utc) - datetime.fromisoformat(
                        starting_after
                    )
                    # Break out of loop if startingAfter returned from next link is within 5 minutes of current time
                    if delta.total_seconds() < 300:
                        break
                    # Or if the next page is past the specified window's end time
                    elif event_log_end_time and starting_after > event_log_end_time:
                        break

                metadata["page"] += 1
                nextlink = links["next"]["url"]
            elif direction == "prev" and "prev" in links:
                # Prevent getNetworkEvents from infinite loop as time goes backward (to epoch 0)
                if metadata["operation"] == "getNetworkEvents":
                    ending_before = urllib.parse.unquote(
                        str(links["prev"]["url"]).split("endingBefore=")[1]
                    )
                    # Break out of loop if endingBefore returned from prev link is before 2014
                    if ending_before < "2014-01-01":
                        break

                metadata["page"] += 1
                nextlink = links["prev"]["url"]
            else:
                break

[sungod]

Oh yes, it's 'interesting' 😀

Even in extreme testing I never managed to trigger the 2014 test, perhaps because I didn't have an org that old to try it with.

The workaround I use seems generally safe, been using it 2-3 years without problems. 

[sungod]

Just to add, it needs to be an MX with content filtering configured, if it's not there then there will be no cf_block messages

If it was working and has stopped without you changing anything, I would open a case with support - I've seen instances with other endpoints where the filters stopped working.