Documentation › Client Logs

Client Logs

Client Logs record MQTT client connection and activity events in a structured, queryable format. Unlike Broker Logs which show raw Mosquitto output, Client Logs are captured by BunkerM's own logging service and presented in a clean table you can filter and search.

What Client Logs Show

Client Logs capture key lifecycle events for every MQTT client that interacts with your broker:

  • CONNECT - a client successfully connected to the broker
  • DISCONNECT - a client disconnected (cleanly or due to a timeout)
  • SUBSCRIBE - a client subscribed to a topic or topic pattern
  • PUBLISH - a client published a message (at higher verbosity settings)
  • AUTH_FAIL - a client failed to authenticate (wrong credentials or disabled account)

Each event is stored with structured metadata, making it easy to search and filter - much more convenient than grepping raw log text.

How to Access Client Logs

  1. Click Logs in the left sidebar.
  2. Select Client Logs.

The Client Logs page shows a table of recent events sorted by timestamp, newest first.

Information Shown Per Event

  • Timestamp - date and time the event occurred
  • Event Type - CONNECT, DISCONNECT, SUBSCRIBE, AUTH_FAIL, etc.
  • Client ID - the MQTT client identifier
  • Username - the username provided during authentication
  • IP Address - the remote IP address of the client
  • Protocol - MQTT protocol version (3.1, 3.1.1, or 5.0)
  • Topic - for SUBSCRIBE and PUBLISH events, the topic involved
  • Details - additional context specific to the event type

Event Types in Detail

CONNECT

Logged when a client successfully establishes an MQTT connection, including the client ID, username, IP address, protocol version, and keep-alive interval.

DISCONNECT

Logged when a client ends its MQTT session. The details field indicates whether the disconnect was clean (initiated by the client) or unexpected (keep-alive timeout, network drop, or forceful disconnect from the broker).

SUBSCRIBE

Logged when a client subscribes to a topic or wildcard pattern. The topic field shows the pattern the client subscribed to, along with the requested QoS level.

AUTH_FAIL

Logged when a client fails to authenticate. Reasons include wrong password, unknown username, or a disabled account. AUTH_FAIL events are particularly valuable for security auditing - a pattern of failures from the same IP or with the same username may indicate a brute-force attempt or misconfigured device.

Filtering Client Logs

Use the filter controls to find what you are looking for:

  • Filter by client ID - enter a full or partial client ID to see only events from that client.
  • Filter by event type - select one or more event types (e.g., show only AUTH_FAIL events).
  • Filter by username - filter events by the MQTT username.
  • Filter by IP address - see all events from a specific IP address.
  • Filter by time range - set a start and end time to narrow the view.

Multiple filters can be combined - all active filters are applied together (AND logic).

Troubleshooting with Client Logs

  • A device says it is connected but is not receiving messages - filter by the client ID and look for CONNECT events followed immediately by DISCONNECT events. A rapid connect-disconnect pattern may indicate a reconnect loop.
  • A device cannot connect - filter by the client ID and look for AUTH_FAIL events. If no events appear at all, the device may not be reaching the broker at all (network issue, wrong host or port).
  • Messages are not being delivered - filter by SUBSCRIBE events for the receiving client and verify it is subscribing to the correct topic pattern.
  • Security audit for a specific time window - set the time range filter and filter by AUTH_FAIL to see all authentication failures during that period.

Client Logs vs Broker Logs

  • Client Logs - structured table with queryable fields, easily filtered by client, event type, and time. Captured by BunkerM's logging service. Best for auditing and client-specific investigation.
  • Broker Logs - raw text output from Mosquitto, filtered by text search or log level. Includes broker-internal events. Best for broker-level troubleshooting and error analysis.
← Broker Logs MQTT Browser →