Skip to main content
Solved

802.1x over ethernet - are there logs?

  • October 26, 2021
  • 2 replies
  • 117 views

dlondon
Forum|alt.badge.img+14

Hi,

 

Just wondering if anyone knows whether there is some sort of log on Mac's that shows what is happening during 802.1x connections and disconnections etc for wired 802.1x not wireless?

I can see in Console under the Machine name (devices) a bunch of things for eapolclient  in the All Messages pane but can't see this info in any logs 

Best answer by johnsz_tu

I'm not sure if they are stored in a file, but you can access the 802.1x wired logs with the following terminal commands:

View last 24 hours of logs

 

log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h

 

 

Stream the logs in real-time

 

log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug

 

 

I cant recall if this contains the 802.1x wireless logs in there as well, but it definitely has the wired logs as I recently used the real time command above to troubleshoot a 802.1x wired ethernet issue.

Hope that helps. 

2 replies

Forum|alt.badge.img+4
  • New Contributor
  • Answer
  • October 26, 2021

I'm not sure if they are stored in a file, but you can access the 802.1x wired logs with the following terminal commands:

View last 24 hours of logs

 

log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h

 

 

Stream the logs in real-time

 

log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug

 

 

I cant recall if this contains the 802.1x wireless logs in there as well, but it definitely has the wired logs as I recently used the real time command above to troubleshoot a 802.1x wired ethernet issue.

Hope that helps. 


dlondon
Forum|alt.badge.img+14
  • Author
  • Honored Contributor
  • October 27, 2021

Thanks @johnsz_tu  What was the issue for you on wired 802.1x?  We have seen a time when the client will re-authenticate and offers it's MAC address instead of the client cert to ISE and so hits the wrong rule and doesn't get access to anything