In the world of wireless networks, connection stability often depends on invisible processes hidden deep within the router's software. When a user experiences sudden connection drops or abnormally low speeds, the first step for a competent technician is to analyze system logs known as logsHowever, the standard level of information is often insufficient to identify the root of the problem, which leads to the need to change logging settings.
Increasing the logging level is the process of switching the router's software to a more detailed event logging mode. Instead of only recording critical errors, the system begins storing information about every data packet, connection status, and interactions with client devices. This allows for a complete picture of what's happening on the air, but requires careful handling.
Regular users rarely delve into such deep settings, as it can lead to device memory overflow. However, for engineers and advanced administrators Debug mode is an indispensable tool. Understanding how it works will help you better diagnose home network problems or explain the nature of problems to a technical support specialist.
How system logging works
Any modern network equipment, be it MikroTik, Keenetic or corporate access points Ubiquiti, keeps continuous records of its actions. System log is a text file or buffer in RAM where timestamps and event descriptions are written. By default, most devices are set to Warning or Error, ignoring routine operations to save resources.
When leveling up to Debug or Verbose The volume of recorded information increases exponentially. The router begins recording not only the fact that the client was disconnected, but also the reason for the disconnection, the signal strength at the time of the connection loss, the number of packet retries (retransmissions), and even the contents of the control frames. This creates a huge load on the processor and memory.
⚠️ Warning: Continuous operation in maximum logging mode can lead to rapid wear of the router's flash memory due to intensive cyclic data overwriting.
Technically, this process is regulated by the parameter log level, which determines the severity threshold for logging an event. Various standards exist, such as syslog, where levels are assigned numerical values from 0 (Emergency) to 7 (Debug). For Wi-Fi problem analysis, we're typically interested in levels 6 (Informational) and 7 (Debug).
Levels of detail and their purpose
Not all logs are created equal, and understanding the gradation of levels helps avoid excessive data collection. Network equipment uses a standard classification that allows administrators to balance performance and information content. Choosing the right level depends on the specific problem you're trying to solve.
Below is a table describing the main logging levels found in router interfaces and operating systems:
| Level (Name) | Code | Description | When to use |
|---|---|---|---|
| Emergency | 0 | The system is unstable | Critical kernel crashes |
| Error | 3 | Function error | Basic monitoring |
| Notice | 5 | Normal but significant | Security audit |
| Info | 6 | Information messages | General analysis of the work |
| Debug | 7 | Debug messages | Deep diagnostics |
Mode Info This is useful for tracking new device connections and obtaining IP addresses via DHCP. It doesn't overload the system but provides a general overview of network activity. However, if a client complains of lag, this level of information won't be sufficient.
Mode Debug Opens the "gateways." Here you'll see the exchange of association frames, the WPA2/WPA3 four-way handshake, and Probe Requests from scanning devices. It's at this level that nuances become apparent, such as deauthentication of a specific client due to a timeout or encryption incompatibility.
Why do you need to increase the log level?
The main purpose of detailing is diagnosticsWhen Wi-Fi is working perfectly, logs are unnecessary. Problems arise when the user reports, "The internet is there, then not there." The standard indicators on the router are useless in this case, as they only show power and WAN connection, not the quality of the radio channel.
By using an elevated log level, you can identify hidden interference. For example, you might notice frequent channel changes or rate downgrades for specific clients. This indicates a powerful source of interference in the airwaves, forcing the router to switch to more stable but slower modulation methods.
This is also necessary for security analysis. If the level logs Debug If you see multiple login attempts with incorrect passwords or strange association requests from unknown MAC addresses, this signals a potential brute-force attack or network scanning by neighbors. Without detailed logs, such events remain invisible.
What is deauthentication?
Deauthentication is the process of breaking the connection between the client and the access point. In logs, this may appear as "Deauth reason 3" (the client has left) or "Deauth reason 2" (the previous authorization was invalid). Frequent deauthentications with an error code other than 3 often indicate a hardware or driver issue.
How to enable verbose logging
The procedure for activating extended logging depends on the equipment manufacturer and firmware version. In most home routers, these settings are hidden deep in the menu or accessible only through the command line. For professional equipment, such as Ubiquiti UniFi or MikroTik RouterOS, log management is moved to separate sections.
In the interface MikroTik you need to go to the menu System -> LoggingHere you can add a new rule by specifying topics, for example, wifi, and set the action memory or disk. For Keenetic the path lies through System -> Settings -> Event Log, where you need to select the components to be monitored.
If you are using Linux-like systems for the access point (OpenWrt, DD-WRT), control is often achieved through editing the configuration file /etc/config/system or using a utility logreadThe command to change the level on the fly may look like changing a parameter in the config.
☑️ Checklist before enabling logging
This is normal, as the processor is busy processing interrupts and writing data. In some cases, the web interface may even stop responding, so Telnet or SSH access is preferable.
⚠️ Note: Interfaces and menu item names may differ depending on the firmware version. Always consult the official documentation from your hardware manufacturer before making any changes.
Analysis of the obtained data
Getting logs is only half the battle. The real challenge is analyzing them. The data flow in debug mode can reach hundreds of lines per second. It's virtually impossible for a human to read this in real time, so the data needs to be saved to an external file or a remote location. Syslog server.
When analyzing, pay attention to timestamps. Correlate the moments of user complaints about slow internet with log entries. Look for keywords: disassoc (disconnection), retry (repeat), timeout (timeout). If you see a specific MAC address constantly disconnecting and reconnecting, the problem is most likely with the client device driver or its location.
For convenient reading of large data arrays, use specialized software, for example, Wireshark (if it is possible to make a traffic dump) or just text editors with support for large files and syntax highlighting, such as Notepad++ or VS CodeFiltering by the IP address or MAC address of the problematic device will significantly speed up the search.
Risks and limitations of debug mode
Despite its usefulness, the high-verbosity mode poses serious risks to network stability. Log buffer overflows are the most common issue. If memory runs out, the router may freeze, reboot, or begin dropping user traffic packets, leading to even greater connection problems.
Additionally, writing large amounts of data creates additional CPU load. On weak home routers, this can reduce the maximum Wi-Fi channel throughput by 10-20%. Therefore, enable Debug level should only be for a short time, sufficient to reproduce and fix the error.
Keep privacy in mind. Detailed logs may contain sensitive data, such as the MAC addresses of all devices in the area, SSIDs of neighboring networks, and technical information about clients. This data should be stored securely and deleted immediately after diagnostics.
After completing the troubleshooting session, be sure to return the logging level to the default value (usually Error or Warning). Leaving debug mode enabled will slowly but surely degrade the performance of your network equipment.
Can increasing the log level "break" the router?
Physical damage is impossible, but software failure is quite possible. A memory overflow or a frozen logging process may require a device reboot. In rare cases, if the file system is damaged by intensive writing, a factory reset may be necessary.
Where are the logs stored after power off?
If logs were written to RAM, they will disappear when the router is powered off or rebooted. To preserve the history, you need to configure logging to an external server (Syslog) or to a connected USB drive, if the router supports this feature.
Does this affect internet speed?
Yes, it can. Processing and writing thousands of additional lines of text requires CPU time. On powerful enterprise access points, the impact is unnoticeable, but on budget home models, latency (ping) can increase and speed can be reduced.