How to Check Your Router Logs: What the Data Means and How to Use It

Your router is silently keeping a diary. Every time a device connects, a firewall rule fires, or a firmware update runs, the router writes an entry to its system log. Most people never look at these logs — and that’s a mistake. Router logs are one of the most powerful free tools for diagnosing network problems, catching unauthorized access, and understanding what’s actually happening on your home network.

How to Access Your Router Logs

All modern routers store logs in the admin interface. Open a browser and navigate to your router’s IP address — typically 192.168.1.1 or 192.168.0.1. Log in with your admin credentials (the default is usually admin / admin or printed on a sticker on the bottom of your router). From there, the path varies by brand:

ASUS Routers

Go to System Log → General Log. ASUS provides a detailed, searchable log with entries categorized by type. You can also navigate to the Wireless Log tab to see only wireless association events. Click Save to export a .txt file to your computer.

TP-Link Routers

Navigate to Advanced → System → System Log. TP-Link displays log entries in reverse chronological order. Use the Save Log button to download a local copy. The log level filter lets you show only errors, warnings, or informational messages.

Netgear Routers

Go to Advanced → Administration → Event Log. Netgear offers a unique Send Log button that emails the full log to an address you specify — handy for ongoing monitoring. The log is also filterable by event category.

Linksys Routers

Log in to your Linksys Smart Wi-Fi account, then go to Troubleshooting → Logs. Linksys separates logs into incoming and outgoing traffic, making it easier to spot unexpected outbound connections.

What You’ll See: Common Log Entry Types

Router logs can look intimidating at first. Here’s a breakdown of the most common entry types and what they mean.

DHCP Events

DHCP (Dynamic Host Configuration Protocol) events track when your router assigns IP addresses to devices. You’ll see the full DORA sequence: Discover, Offer, Request, and Acknowledge. Each entry includes the device’s MAC address, the IP address assigned, and the lease duration. If you spot a DHCPNAK (negative acknowledgment) or a DHCPDECLINE, your router tried to assign an IP that was already in use — a sign of an IP address conflict.

Firewall and Traffic Events

These are the most security-relevant entries. A typical firewall log entry looks like:

[DoS Attack: SYN/ACK Scan] from source: 203.0.113.42, port 443 — Monday, Apr 07 2026 02:14:33

Each entry typically includes: a timestamp, the source IP, the destination IP and port, the protocol (TCP/UDP), and the action taken (allow, block, or drop). Blocked entries are normal — routers block unsolicited inbound traffic constantly. What you’re looking for is unexpected outbound traffic from your devices, or repeated failed logins to your router’s admin panel.

System Events

System events record administrative activity: reboots, firmware updates, configuration changes, and admin logins. If you see an admin login at 3 a.m. that you didn’t perform, that’s a red flag. Similarly, unexpected reboots can indicate power issues or a router under sustained load.

Wireless Association Events

These logs show every device that connected to or disconnected from your WiFi, including the MAC address, band (2.4 GHz or 5 GHz), and signal strength at connection time. This is the fastest way to identify an unknown device on your network — compare the MAC addresses in the log against your known devices. See our guide on detecting WiFi intruders for a full walkthrough.

Reading Syslog Severity Levels

Most routers use the industry-standard syslog format (RFC 3164), which assigns a severity level from 0 to 7 to every message. Lower numbers mean higher severity:

• 0 — Emergency: System is unusable
• 1 — Alert: Immediate action required
• 2 — Critical: Critical conditions
• 3 — Error: Error conditions (worth investigating)
• 4 — Warning: Potentially problematic conditions
• 5 — Notice: Normal but significant events
• 6 — Informational: Routine messages (the bulk of normal activity)
• 7 — Debug: Verbose diagnostic output

For home troubleshooting, focus on levels 0–4. Level 6 (informational) entries make up the majority of log entries during normal operation and rarely indicate a problem on their own.

Using Logs to Diagnose Common Problems

Identifying Unauthorized Devices

Check the wireless association log and DHCP log for unfamiliar MAC addresses. If a MAC address doesn’t match any device you own, the first six characters identify the manufacturer — you can look this up with any MAC address lookup tool. An unexpected Samsung or Apple device at 2 a.m. could be a neighbor on your network. If you find one, change your WiFi password immediately and review our guide on securing your WiFi network.

Diagnosing Random Disconnects

If your WiFi keeps disconnecting, the system log will often show the cause. Look for DHCP lease failures, WAN interface status drops (the router briefly losing its internet connection), or repeated disassociation events on the wireless log that correlate with when the drops occur. A pattern of drops at specific times may indicate channel congestion or ISP instability.

Investigating Slow Speeds

Logs won’t directly display bandwidth usage, but they reveal important clues. A sudden spike in new DHCP assignments could mean unexpected devices joined and are consuming bandwidth. Error-level entries about hardware or radio restarts can explain random speed drops that seem to have no obvious cause.

Exporting and Clearing Logs

Router logs have limited on-device storage — most routers store the last few hundred to a few thousand entries before overwriting older data. If you’re investigating an intermittent issue, export the log regularly so you don’t lose the relevant window. All major router brands provide a Save Log or Export button that downloads a .txt or .log file.

To clear logs, look for a Clear History or Clear Memory option under Administration or Advanced Settings. Clearing logs doesn’t affect network performance — it simply wipes the stored event history.

Quick Reference: What to Look For

1. Unknown MAC addresses in DHCP or wireless association logs
2. Admin logins at unexpected times (especially overnight)
3. Repeated outbound connections to unfamiliar IP addresses
4. DHCPNAK or DHCPDECLINE entries indicating IP conflicts
5. Error or Critical severity entries in the system log
6. WAN interface status drops that correlate with connectivity issues

Router logs are an underused resource. Even a five-minute review once a week can surface problems before they become serious. If your logs consistently show security alerts or unusual device activity, consider upgrading to a router with better built-in security monitoring, or running a speed test to confirm your network is performing as expected.