Wireless Access

Reply
Contributor II

Monitor for radar events with AMP

Hello,

 

My customer wants to pilot 80 MHz in their enterprise but wants to know the frequency of radar events on the DFS channels. I've set up their Airwave with a trigger for the following conditions:

 

Event type is Syslog

Syslog Category is Soft AP Daemon

Syslog Severity = Warning

Event Contents matches ARM

 

This is working great to see channel and power changes, but I'd like to know exactly how to filter for radar events where the AP actually has to change channel. Does anyone know if I can just change the Event Contents to "radar" for this purpose? Or should I be looking for a different string?

 

We haven't seen any radar events yet and we are only piloting on a small AP group, so I don't have any logs at my disposal to know for sure what filter should be applied.

Tim Haynie, ACMX #508, ACDX #384, ACCP, CWSP, CWAP, CWDP, CCNP R/S, CCNP Wireless, CCNA Security, CCDA
Guru Elite

Re: Monitor for radar events with AMP

Here's an example of the log message:

 

May 26 18:49:01  sapd[1795]: <404076> <WARN> |AP 11-LAB@w.x.y.z sapd|  AM 18:64:72:4c:38:f0: Radar detected on interface wifi0, channel 60, typeid 8

May 26 18:49:01  sapd[1795]: <404088> <WARN> |AP 11-LAB@w.x.y.z sapd|  AM 18:64:72:4c:38:f0: ARM HT Radar Detected Trigger Current Channel old 60+ new 52+/5

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Guru Elite

Re: Monitor for radar events with AMP

Make sure:

 

- You have Airwave listed as a syslog target on your controller

config t

logging <ip address of airwave>"

 

- Setup a trigger like below in Airwave:

Screenshot 2015-06-15 at 21.24.27.png

 

Your radar  syslog message will look like this:

 

Aug 27 10:21:23 :404076:  <WARN> |AP AR_COMLAB1@10.99.154.29 sapd|  AM 18:64:72:fb:30:50: Radar detected on interface wifi0, channel 132, typeid 7
Aug 27 10:21:24 :404088:  <WARN> |AP AR_COMLAB1@10.99.154.29 sapd|  AM 18:64:72:fb:30:50: ARM HT Radar Detected Trigger Current Channel old 132E new 100E/6


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Contributor II

Re: Monitor for radar events with AMP

Thanks cappalli and cjoseph, this is exactly the information I needed. Super useful to see actual logs to verify correctness.

Tim Haynie, ACMX #508, ACDX #384, ACCP, CWSP, CWAP, CWDP, CCNP R/S, CCNP Wireless, CCNA Security, CCDA
Contributor II

Re: Monitor for radar events with AMP

As an update, I wanted to mention that we discovered that the APs were sending SNMP traps for radar events as well.

 

wlsxAPChannelChange wlsxTrapAPMacAddress.0: 18:64:72:C6:3E:4C, wlsxTrapAPARMChangeReason.0: radarDetected(1), wlsxTrapAPChannelSec.0: eighty(4), wlsxTrapAPLocation.0: MTV-650-2-STE200-AP-2, wlsxTrapAPChannel.0: 140, wlsxTrapAPRadioNumber.0: 1, wlsxTrapTime: 6/17/2015 16:45:45 UTC-7, wlsxTrapAPPrevChannel.0: 60, wlsxTrapAPPrevChannelSec.0: eighty(4)
Tim Haynie, ACMX #508, ACDX #384, ACCP, CWSP, CWAP, CWDP, CCNP R/S, CCNP Wireless, CCNA Security, CCDA
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: