Router Logs Explained With Examples

What a router log is

A router log is a running list of events the router decides to record, each with a time and a short message. Typical events include devices getting an address, WiFi connections and disconnections, firewall actions, internet connection changes and admin sign-ins.

Logs are mainly a troubleshooting tool. They help answer questions like “did the internet connection drop at 9 pm?” or “which device keeps reconnecting?” Their content, wording and length differ a lot between brands and models, so treat the examples below as illustrations, not exact output from your router.

How to find and open your router log

1. Connect to the router by WiFi or cable.
2. Open a browser and enter the router’s address. This is often the default gateway shown in your computer’s network details, or an address or name printed on the router’s label.
3. Sign in with the admin username and password. These are separate from your WiFi password. Check the label or manual if you have never changed them, or see where to find your router password and login.
4. Look under menus such as Logs, System Log, Event Log, Administration, Management or Advanced.
5. Open the log page. Some routers offer a download or email option, and some only display recent lines.

Some routers, mostly those managed through a phone app, hide the log or only show a simplified activity feed.

Example log entries and what they mean

The lines below are made-up examples in a common style. Your router will word them differently.

A device receives an address (DHCP)

Oct 14 08:12:03 DHCP: assigned 192.168.1.23 to a4:c3:f0:xx:xx:xx (Janes-Phone)

The router gave the device with that MAC address a local IP address. Many repeated lines for the same device can point to a device that keeps dropping and rejoining.

A WiFi device connects or leaves

Oct 14 08:12:01 WLAN: station a4:c3:f0:xx:xx:xx associated on 5GHz
Oct 14 11:40:55 WLAN: station a4:c3:f0:xx:xx:xx disassociated

Associated means the device joined that WiFi band, and disassociated means it left or was dropped. A phone leaving when you walk out is normal.

A firewall block

Oct 14 13:05:37 FW: blocked TCP 203.0.113.45:51234 -> WAN:23

The firewall refused an unsolicited incoming connection. Blocks from random outside addresses are common on any internet-connected router and are not by themselves a sign of a break-in.

The internet connection drops or comes back

Oct 14 02:14:09 WAN: link down
Oct 14 02:14:41 WAN: link up, obtained IP 198.51.100.7

This suggests the connection between your router and the modem or provider dropped for roughly half a minute. Repeated entries like this can help when you talk to your provider. For the causes themselves, see why your router keeps going out.

An admin sign-in

Oct 14 09:30:12 ADMIN: login success from 192.168.1.10
Oct 14 09:31:48 ADMIN: login failed from 192.168.1.54

These record someone opening the router’s settings. A failed login from a device you do not recognize is worth checking. The addresses in these examples are made up.

Common log types

• System log: startup, restarts, firmware, time sync
• Connection or WAN log: internet link and address changes
• DHCP log: address assignments
• Wireless log: device connections and disconnections
• Security or firewall log: blocked or flagged traffic
• Access or admin log: who opened the settings

Do logs show browsing history?

Usually not in any detail. Standard logs record events about devices and connections, not a list of pages you have visited. Some routers with filtering or parental controls can record blocked or visited domains. For the full picture, see does your router save browsing history.

Retention is often short. Some routers hold logs only in memory, so they can disappear after a restart, and many overwrite older lines once the log is full.

Spotting problems in a log

• Many reconnects from one device can mean weak signal, a power-saving setting or a device problem.
• Repeated WAN link down lines suggest a cable, modem or provider issue.
• Unknown device names or MAC addresses in the wireless or DHCP log may be a neighbor or guest. Some phones and laptops use a randomized (private) MAC address per network, which can make one device look like two.
• Many failed admin logins are a reason to change the router’s admin password.

If you find a device you do not want on your network, see how to remove devices from a Linksys router for the general idea, and consider changing your WiFi password.

Settings worth checking

• Clear log: most routers have a button to empty the log.
• Time settings: if the router clock is wrong, timestamps will be misleading. Enable network time if offered.
• Remote or external logging: some models can send logs to a computer or another device for longer storage. Turn this on only if you need it.
• Log level: some routers let you choose how much detail to record.

FAQ

How do I check the router logs? Sign in to the router’s admin page and look for a Logs, System Log or Administration menu.

Which routers track browsing history? Most basic home routers do not. Models with content filtering, parental controls or security services may log domains. Check your router’s documentation and settings.

How do I hide browsing history from the WiFi owner? Encryption (HTTPS) hides page content but not always which site you contacted. A reputable VPN can hide the sites from the network owner, though it shifts trust to the VPN provider. Consider whether using someone else’s network for sensitive activity is wise.