When home internet becomes unstable, speeds drop, and devices periodically disconnect, the first thing users try is rebooting the router. However, if simple methods fail, a more in-depth diagnostic tool—system logs—comes to the rescue. Many modern routers offer an "Extended Logs" option in their interfaces. Enabling this option dramatically changes the volume and detail of the information recorded.
By default, most routers only log critical events to avoid filling the device's memory. However, for an engineer or advanced user, the advanced logging mode opens up a "black box" of wireless module operation. Extended logs They contain a detailed chronology of all processes: from client association attempts to packet losses and channel changes. Understanding what is written in these lines of code allows us to pinpoint the cause of failures, whether it's a hardware issue or external interference.
In this article, we'll take a detailed look at the differences between standard and advanced modes, the technical parameters displayed, and how to correctly interpret complex syslog entries. You'll learn to distinguish normal network operation from signs of a serious malfunction, using raw system data to improve connection quality.
The main difference between extended logs and standard logs
The standard logging mode, which is active by default on most routers (for example, TP-Link, Asus or Keenetic), records only key events in the device's lifecycle. Typically, these are the moments of power-on, obtaining an IP address from the provider, and critical errors that lead to connection interruptions. This approach saves processor resources and flash memory space, but provides too general a picture of what's happening.
Enabling the mode Extended Logs "Extended Logging" forces the system to record every wireless driver action. This includes airborne scanning, beacon frame exchanges, authentication attempts, and even channel status messages. The volume of data increases tenfold, so such logs are typically stored in RAM and cleared after a reboot unless uploading to a remote server is configured.
⚠️ Attention: Enabling maximum logging detail may create additional load on the router's CPU. On entry-level models with single-threaded processors, this could theoretically reduce overall network throughput by 5-10%.
The main purpose of switching to the extended mode is to be able to trace the chain of events leading up to the failure. While in the standard log you simply see the line "Wi-Fi Client Disconnected," the extended mode will indicate who initiated the disconnect (the client or the access point) and the Deauthentication Reason Code used. This is critical for diagnostics compatibility issues between old gadgets and new encryption standards.
Technical parameters in extended notation
When deep logging is enabled, the user is confronted with a data stream replete with technical terms and abbreviations. To analyze this information, it's necessary to understand the key parameters monitored by the wireless module. The most noticeable are the signal and noise level logs, which are displayed in real time.
One of the most important parameters is RSSI (Received Signal Strength Indicator). In logs, it's displayed as a negative value in dBm (e.g., -65 dBm). The closer the value is to zero, the better the signal. Advanced logs allow you to see the RSSI dynamics for each connected device, which helps identify moments when a client is at the edge of the coverage area and begins to lose packets.
Another critical parameter is SNR (Signal-to-Noise Ratio), or signal-to-noise ratio. Even with a high signal strength (RSSI), a low SNR indicates strong interference from neighboring networks or appliances. Advanced logs allow you to track how the SNR changes depending on the time of day and neighboring activity, which is a clear indication that a frequency change is needed.
- 📡 Channel Utilization — the percentage of a specific channel's occupancy, allowing one to assess the airtime congestion.
- 🔗 Association ID (AID) — a unique identifier assigned to a client when connecting to an access point.
- 🛡️ WPA Handshake — records of the handshake process during connection, useful for checking the operation of the authorization server.
- ⚡ Tx/Rx Rate — the current speed of data transmission and reception in real time for each client.
Detailed logs also frequently contain references to frame types (Management, Control, Data). Analysis of these frames can reveal anomalies. For example, an excess of control frames may indicate connection instability, with devices constantly reconnecting or searching for a better access point in the mesh system.
Verbosity levels in syslog
The system log (syslog), which is the basis of Linux-based logging (used in OpenWrt, DD-WRT (The router firmware supports several severity levels.) Understanding these severity levels is essential for proper information filtering. Advanced mode typically uses levels from "Debug" to "Info," which are ignored in normal mode.
The lowest level is DebugThis contains debugging information useful for driver developers. Enabling this level on a constantly running router is not recommended, as it generates a huge amount of data, quickly filling the buffer and overwriting more important entries. However, it is an indispensable tool for identifying the specific cause of a Wi-Fi driver crash.
The next level is - Notice And InfoThey contain information about the system's normal operation: successful client connection, DHCP address acquisition, and service startup. These levels are most often enabled in extended logging mode for home use. They allow you to reconstruct the chronology of actions without the unnecessary "noise" of debugging codes.
| Level | Code | Description | Usage |
|---|---|---|---|
| Debug | 7 | Debug messages | Finding bugs in drivers |
| Info | 6 | Information messages | Connection monitoring |
| Notice | 5 | Normal but significant events | Security audit |
| Warning | 4 | Warnings | Potential problems |
Verbosity level adjustment is often done via the command line or hidden firmware menus. For example, on some systems MikroTik or Ubiquiti You can flexibly configure which modules (wireless, system, dhcp) and with what detail will write data to the log file.
How to enable Debug level on OpenWrt?
To enable debug level in OpenWrt, edit the /etc/config/system file and add the log_level '7' option or use the logread -l 500 command to view the latest log entries. Be careful, as this will fill up memory very quickly.
Analysis of connection errors and disconnections
The most common reason for accessing extended logs is constant connection drops. The standard log may only show the disconnection, but extended mode will show the Reason Code. These codes are defined by the IEEE 802.11 standard and are a key to solving the problem. For example, Reason: 3 (Deauthenticated because sending station is leaving BSS) indicates that the device has decided to leave the network, perhaps by going to sleep or losing the signal.
If you see codes related to authentication failure or association timeout, this indicates problems with passwords, incompatible encryption methods (for example, trying to connect an older device to WPA3), or an overloaded router processor that cannot handle handshake requests.
A common problem in apartment buildings is the influence of neighboring networks. This can be reflected in logs as Channel Switch Announcement — a message indicating that the access point was forced to change channels due to detected radar (DFS) or strong interference. Advanced logs allow you to track the frequency of such channel switches.
- 🔌 Reason Code 1 — Unspecified reason (often a client driver glitch).
- 🚫 Reason Code 2 — Previous authentication is no longer valid (problems with security keys).
- 👋 Reason Code 3 — Deauthenticated because the sending station is leaving (the client left on his own).
- ⏳ Reason Code 4 — Disassociated due to inactivity (timeout due to inactivity).
By analyzing the timestamps of these events, you can correlate them with user actions. If interruptions occur at specific times, it's possible that parental control scripts or a Wi-Fi module reboot schedule are triggered, which you may have forgotten about.
⚠️ Attention: Interfaces and menu item names may vary depending on your router's firmware version. Manufacturers regularly update their software, changing the location of logging settings.
☑️ Wi-Fi Disconnect Diagnostics
Using logs to optimize your wireless network
Advanced logs are not only a troubleshooting tool but also a powerful tool for fine-tuning your network. By analyzing channel load and noise level data, you can manually select the clearest frequency, which is especially important for the 2.4 GHz band. Logs often show which channels neighbors are occupying and how strong their signal is.
Furthermore, detailed logging helps optimize roaming (seamless transition) in mesh systems. If a device locks onto a distant access point with a weak signal instead of switching to a nearby one, the logs will show the RSSI thresholds at which the switch occurs. This allows you to adjust the sensitivity of roaming agents for more consistent or, conversely, faster client switching.
Optimization This also applies to channel width selection. In the extended logs, you can see the number of retries (packet retransmissions). A high retries rate on a wide channel (e.g., 80 MHz) may indicate that in noisy environments, switching to 40 MHz is better for increased stability, at the expense of the theoretical maximum speed.
Another aspect is identifying "noisy" clients. Some devices may constantly broadcast requests or search for networks, creating unnecessary bandwidth consumption. In detailed logs, such devices often stand out due to the frequency of their access to the access point, even when they are not transmitting useful data.
Tools for reading and filtering logs
Viewing thousands of lines of text in a browser is a cumbersome and inefficient task. For professional analysis of extended logs, specialized tools are recommended. The easiest way is to download the log file to your computer and open it in a text editor. However, for in-depth analysis, command-line utilities or graphical analyzers are better.
If your router supports the remote syslog protocol (for example, OpenWrt or MikroTik), you can configure the sending of logs to your PC in real time. To do this, run a syslog server on the computer (for example, SolarWinds Kiwi Syslog for Windows or rsyslog (for Linux). This allows you to monitor the network's response live while you run tests.
To filter records in Linux/macOS, you can use powerful grep commands. For example, to find all events associated with a specific device MAC address, you can use the command:
grep"aa:bb:cc:dd:ee:ff" /var/log/messagesThere are also online decoders and analyzers that can convert hex dumps of packets from logs into a readable form.
- 🖥️ Notepad++ — an excellent editor for Windows with support for large files and syntax highlighting.
- 🐧 Grep/AWK — standard Linux tools for searching strings and extracting data using masks.
- 📊 Wireshark - although it is a traffic analyzer, it can import some log formats for visualization.
- ☁️ Remote Syslog Server — servers for collecting logs from multiple devices in one place.
Using the right tools turns a chaotic set of rows into a structured table of data that can be graphed and used to draw accurate conclusions about the health of your wireless infrastructure.
Is it safe to send router logs to developers?
Extended logs may contain your devices' MAC addresses, network names (SSIDs), and sometimes IP addresses. Before sending the log to technical support, we recommend checking the file for any personal information. MAC addresses are generally not a sensitive secret, but it's best to be cautious.
Why do logs disappear after rebooting the router?
Logs are stored in RAM, which is cleared when the power is turned off. To save the history, you can configure log export to an external device (USB drive) or a remote server, or use the "Save Log" function in the web interface before rebooting.
Can enabling extended logging "kill" a router?
Enabling logging is inherently hardware-safe. However, if the logging buffer overflows and the system fails to correctly handle the overflow (which can happen on very low-end models), a software crash or freeze may occur. Modern models implement this reliably.