EAPOL Logging



EAPOL Client Logging used to be able to be turned on in verbose mode and drop log files under /var/log, but it doesn't seem to be doing that any more in macOS Sierra. Essentially I'm trying to troubleshoot some 802.1X Wired Authentication issues on the client side. Does anyone know how to enable that in Sierra and where it gets logged?


Contributor III

It is no longer enabled in 10.12.x and up. You have to run a system diagnose to get EAPOL logging. You get it again by following these steps:

  1. Hold Option and click the Wi-Fi menu

  2. Choose 'Open Wireless Diagnostics'

  3. Go to Window > Logs

  4. Check the box for Wi-Fi and System

  5. Close Wireless Diagnostics

  6. Reproduce the issue and note the time

  7. Gather a sysdiagnose (Ctrl-Option-Cmd-Shift-Period)

When the sysdiagnose completes, open the system_logs.logarchive file within it in the Console and you can filter on 'eapolclient' there. Once there you should be able to find what you're looking for.

New Contributor III

If you would like to get the logs for this subsystem in 10.12+, you do not need to perform a sysdiagnose. Run the following command to see the last day's worth of logs:

log show --predicate 'subsystem contains "com.apple.eapol"' --info --debug --last 24h

Obviously, this timeframe can be modified to suit your needs.

If you'd like to see the logs in realtime, use log stream and omit the time:

log stream --predicate 'subsystem contains "com.apple.eapol"' --info --debug