That is hard to tell from just these logs. As Colin suggested, would reach out to Aruba support, or your Aruba partner to get more information.
It could be as simple as the switch to which the AP is connected being rebooted.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check
https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------
Original Message:
Sent: Sep 09, 2021 04:25 AM
From: Adam Newson
Subject: Mobility Controller log output
172.30.140.190 is an AP, yes.
Could you elaborate on how the AP could have disconnected, please?
We're seeing it happen with some frequency and we have 7000 APs so it's difficult to monitor this en masse. As a lot of the APs on our network are managed by the institutions themselves, so we are somewhat powerless to how they configure things at the edge. So if there were certain things we could look out for/ advise then that would be appreciated.
Adam
------------------------------
Adam Newson
Original Message:
Sent: Sep 08, 2021 05:00 PM
From: Colin Joseph
Subject: Mobility Controller log output
If 172.30.140.90 is an AP, you should find out why it has disconnected.
Sep 8 11:05:16 isakmpd[10652]: <103103> <10652> <WARN> |ike| IKE SA Deletion: IKE2_delSa peer:172.30.140.190:4500 id:3570062324 errcode:OK saflags:0x30100009 arflags:0x5
Sep 8 11:05:16 isakmpd[10652]: <103103> <10652> <WARN> |ike| IPSec SA Deletion: IPSEC_delSa SPI:8576400 OppSPI:54c87400 Dst:172.30.140.190 Src:131.111.10.104 flags:1001 dstPort:0 srcPort:0
The rest of the logs are cosmetic.
I would run the following command to determine if the client had issues at the time:
show ap debug client-info client-mac <mac address of client>
I would have Aruba Technical Support look at other logs to assist in zeroing in on your issue.
------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
Original Message:
Sent: Sep 08, 2021 12:43 PM
From: Adam Newson
Subject: Mobility Controller log output
Recently our Mobility Controllers (10 per cluster x2 - running 8.7.1.4c) have been producing the following messages in the logs - are any of them of concern or in any way detrimental to the AP or the clients connected to them? A colleague of mine was onsite and was experiencing strange intermittent issues regarding reaching certain sites e.g. bbc.co.uk and another colleague who was unexpectedly disconnected from eduroam. The logs below show the output from some of our MCs during their time onsite. This occurred on multiple devices whilst connected to different APs/buildings. This output may not directly link with the issues explained but may point to something else?
<316234> <14216> <WARN> |wms| Cannot find Probe. At:handle_bss_channel_delete line:117 Probe f4:2e:7f:cd:84:60
Sep 8 13:46:05 localdb[17938]: <133006> <17938> <ERRS> |localdb| User admin Failed Authentication (Processing USER_REQUEST on UserDB)
Sep 8 13:46:05 localdb[17938]: <133019> <17938> <ERRS> |localdb| User admin was not found in the database
Sep 8 13:46:05 localdb[17938]: <133121> <17938> <WARN> |localdb| make_response: Sending USERDB_REJ-msg to 131.111.10.84:8214 with msgtype:23 id:78 reqtype:1 dbtype:0
Sep 8 11:08:53 KERNEL(c8:b5:ad:cd:e0:
2c@172.30.140.190): [ 181.318400] dfs_radar_enable: firpwr=0, rssi=0, height=0, prssi=0, inband=0, relpwr=0, relstep=0, maxlen=0
Sep 8 11:08:53 KERNEL(c8:b5:ad:cd:e0:
2c@172.30.140.190): [ 181.318431] Enabled radar detection on channel 5620
Sep 8 11:08:53 KERNEL(c8:b5:ad:cd:e0:
2c@172.30.140.190): [ 181.318431] dfs_radar_enable: duration multiplier is 72
Sep 8 11:05:16 isakmpd[10652]: <103103> <10652> <WARN> |ike| IKE SA Deletion: IKE2_delSa peer:172.30.140.190:4500 id:3570062324 errcode:OK saflags:0x30100009 arflags:0x5
Sep 8 11:05:16 isakmpd[10652]: <103103> <10652> <WARN> |ike| IPSec SA Deletion: IPSEC_delSa SPI:8576400 OppSPI:54c87400 Dst:172.30.140.190 Src:131.111.10.104 flags:1001 dstPort:0 srcPort:0
If anyone could help explain what they mean or understand their impact, that would be appreciated.
------------------------------
Adam Newson
------------------------------