What happened to the log and Attached Devices

[mor10]

What happened to the log and Attached Devices.  I had my router set to email me the list of attached devices every morning, but a couple of weeks ago it stopped including this list.  What changed?

[mor10 · Accepted solution]

Sorry, misunderstood the question.  After I had responded, I realized that my router is not getting the latest version when I ask it to check it self, so I did a manual check and found I was way behind. I have now installed 2,7,5,4, and I can see attached devices in the log again.

Problem solved.

Thanks.

[FURRYe38]

Does the router reporting any errors in emailing the logs to your email address. 
Select the SEND NOW button in the log area then look at the results to see if there is any problems.

What FW version is loaded? 

What Orbi model do you have? 

---

@mor10 wrote:

What happened to the log and Attached Devices.  I had my router set to email me the list of attached devices every morning, but a couple of weeks ago it stopped including this list.  What changed?

---

[CrimpOn]

My RBR50 stopped sending log files when v2.7.5.4 was released in Feb, 2023.  I can send a log manually, but the automatic send function no longer works.  Here's my setting:

I was a wee bit annoyed, having collected every log entry for four years. Was fascinating to see how the various DoS entries changed over time.  Oh, well.  Gone. Not coming back.  Get over it.

[mor10]

There are no errors logged. I have Known DoS disabled, so the only thing it typically sends are [remote login] and [Time synchronized with NTP server].

I have not made any changes to the internal firewall of the Orbi RBR50, so whatever it came with is still there.

[FURRYe38]

What FW version is loaded? 

[mor10 · Accepted solution]

Sorry, misunderstood the question.  After I had responded, I realized that my router is not getting the latest version when I ask it to check it self, so I did a manual check and found I was way behind. I have now installed 2,7,5,4, and I can see attached devices in the log again.

Problem solved.

Thanks.

[FURRYe38]

So email logs are now getting sent and working? 

[mor10]

Yes!

[FURRYe38]

Glad you got it working. Please mark your thread as solved so others will know. Be sure to save off a back up configuration to file for safe keeping. Saves time if a reset is needed.
https://kb.netgear.com/000062080/How-do-I-back-up-the-configuration-settings-on-my-Orbi-WiFi-System
Enjoy. 📡

[mor10]

Problem came back. I had my router RBR50 set to email me the list of attached devices every morning, but a couple of weeks ago it stopped including this list.  This time, there are no new firmware updates to install.  I have done a power cycle, manually uploaded the latest firmware and reset the router to default settings and restored my settings, but log is still only showing me logging in to try to solve this issue and some time syncs.

[mor10]

Problem came back. I had my router RBR50 set to email me the list of attached devices every morning, but a couple of weeks ago it stopped including this list.  This time, there are no new firmware updates to install.  I have done a power cycle, manually uploaded the latest firmware and reset the router to default settings and restored my settings, but log is still only showing me logging in to try to solve this issue and some time syncs.

[FURRYe38]

So are the logs being successfully sent from the RBR now? Even if you select the SEND button then check the log on the RBR to see if the log shows the log being sent successfully? 

[mor10]

The sending bit works fine, both at scheduled time and when I click manually to send. It just is not recording the events in the log it used to.

The graph below shows how it overnight on March 18 stopped sending any info about connected devices.  The graph is a product of my own MS Access database, where I import the daily logs directly from Outlook, to keep an aye on any suspicious devices connecting.

[CrimpOn]

---

@mor10 wrote:

I had my router RBR50 set to email me the list of attached devices every morning, but a couple of weeks ago it stopped including this list.

---

I am not aware of a feature to email a list of attached devices.  Is this "literally" what was happening, or did you use a program to extract DHCP assignments from the Orbi log and compare the MAC address to a list in the database?

Approximately how many devices are connected to this Orbi system?

[mor10]

Strictly speaking, what it used to send was a list of all device connections since the last log 24 hours ago. So what seem to have stopped is the logging of a device connecting.

[mor10]

While messing around in the settings, I discovered that my main PC, intentionally set to a fixed IP address, was registered with the wrong MAC ID.  As soon as I corrected this, the log has restarted to log connections again. Here is an example of one device connection:

[DHCP IP: 10.0.0.19] to MAC address 24:ee:9a:50:18:ec, Monday, April 01, 2024 13:54:01 

Same graph showing recognized connections.  By tomorrow the list should be back to normal.

[CrimpOn]

---

@mor10 wrote:

Strictly speaking, what it used to send was a list of all device connections since the last log 24 hours ago. So what seem to have stopped is the logging of a device connecting.

---

Thanks.  If the DHCP entries are being extracted from the log, then technically these are more likely devices renewing their existing lease with the router.  Like many residential routers, Netgear Orbi assigns IP addresses with a one day lease (actually 86,400 seconds). The DHCP protocol is for devices to attempt to renew the lease when 1/2 of the time remains.  I typically observe two renewals per day for devices that are constantly powered on.

There is a known memory leak problem with the RBR50 router which might be interfering with the log file mechanism.

On the Access Control page, how many devices appear in the three lists:

• Devices currently attached
• Allowed devices that are not currently attached
• Blocked devices that are not currently attached

[FURRYe38]

How many devices do you have? 

Also you maybe in a double NAT condition as well if the RBR is handing out 10.x IP addresses?