802.1x over ethernet - are there logs?

dlondon
Valued Contributor

Hi,

 

Just wondering if anyone knows whether there is some sort of log on Mac's that shows what is happening during 802.1x connections and disconnections etc for wired 802.1x not wireless?

I can see in Console under the Machine name (devices) a bunch of things for eapolclient  in the All Messages pane but can't see this info in any logs 

1 ACCEPTED SOLUTION

johnsz_tu
New Contributor III

I'm not sure if they are stored in a file, but you can access the 802.1x wired logs with the following terminal commands:

View last 24 hours of logs

 

log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h

 

 

Stream the logs in real-time

 

log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug

 

 

I cant recall if this contains the 802.1x wireless logs in there as well, but it definitely has the wired logs as I recently used the real time command above to troubleshoot a 802.1x wired ethernet issue.

Hope that helps. 

View solution in original post

2 REPLIES 2

johnsz_tu
New Contributor III

I'm not sure if they are stored in a file, but you can access the 802.1x wired logs with the following terminal commands:

View last 24 hours of logs

 

log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h

 

 

Stream the logs in real-time

 

log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug

 

 

I cant recall if this contains the 802.1x wireless logs in there as well, but it definitely has the wired logs as I recently used the real time command above to troubleshoot a 802.1x wired ethernet issue.

Hope that helps. 

dlondon
Valued Contributor

Thanks @johnsz_tu  What was the issue for you on wired 802.1x?  We have seen a time when the client will re-authenticate and offers it's MAC address instead of the client cert to ISE and so hits the wrong rule and doesn't get access to anything