My understanding (from that page/table I first referenced) shows that syslog is only available from the Meraki devices directly, i.e., I need local (or at least network-reachable/routed) syslog-collectors for each. And, that syslog from the devices will not include config-changes or "critical" security-events. Thus the reason for wanting to collect everything from the mgmt-console. (We are, in fact, already collecting those logs from our 800 Meraki APs via syslog. So I am familiar with their contents.) re firewall/connection logs, I believe we are only seeing the AP auth/deauth events. So it's busy but not crazy busy. (By comparison, our public-facing firewalls generate 400M events/day!) re the 'getnetworkevents' API call, it sounds like I do need to script some sort of saved/on-disk 'state' for the Last Received Event. Bummer, more to script, I guess?
... View more
