How to see a log of WiFi connect/disconnect events

consolelogswifi

I'm having trouble with my router, where the WiFi keeps disconnecting on most of our home devices, so I'm testing different settings on the router. (Seems to be affected by security protocol…)

I would like to see a log – on my MacBook Pro (10.11.5) – of WiFi connect/disconnect events so I can keep track.

What's the easiest way to do this? Can I use some kind of filter in Console, or is there a CLI command?

I tried filtering "link down on en0" in console in "All Messsages", but I have to click "Earlier" many times; I'd like to see all events from the past few days at once. And I'd also like to see which WiFi SSID was in use at the time of disconnect, which Console doesn't show me.

Sample filtered system.log events:

Apr 19 01:01:39 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 01:01:55 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 13:36:26 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 13:36:34 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 13:36:45 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 13:37:08 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 15:13:02 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 15:18:25 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 18:17:09 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 18:17:18 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 18:17:22 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 18:35:38 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 4 (Disassociated due to inactivity).
Apr 19 19:11:10 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 4 (Disassociated due to inactivity).
Apr 19 19:14:46 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 19:14:50 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 20:00:14 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:00:22 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 20:00:25 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 20:00:49 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:01:00 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:01:35 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:01:38 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 20:01:42 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 2 (Previous authentication no longer valid).
Apr 19 20:01:46 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:02:19 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:03:24 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:03:55 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:04:17 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:04:28 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
Apr 19 20:18:11 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 4 (Disassociated due to inactivity).
Apr 19 20:19:20 Zmbp kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).

Best Answer

To see all log messages generated by the kernel during the last day that contain the text AirPort: Link Down, you can do:

log show --predicate '(processImagePath contains "kernel") && (eventMessage contains "AirPort: Link Down")' --style syslog --last 1d

Reach the man page of log(1) for much (much!) more info.

Edit: Ah, I see you’re on 10.11. What I’m describing will only work on 10.12 with its new unified logging system. My apologies!

Related Question