OpenWrt logging: how to find out "wifi deauthentication"

You can poll the list of associated clients from one of the following commands:

• iw dev wlan0 station dump --> for nl80211/mac80211 compatible drivers

• wlc assoclist --> for proprietary broadcom-wl driver

• iwinfo wlan0 assoclist --> for libiwinfo abstraction available in OpenWrt trunk

Judging by hostapd in your logs the first one should work. Example output:

   root@OpenWrt ~ # iw dev wlan0 station dump
   Station 00:13:02:xx:xx:xx (on wlan0)
      inactive time:    0 ms
      rx bytes: 21835
      rx packets:   152
      tx bytes: 19772
      tx packets:   100
      tx retries:   6
      tx failed:    0
      signal:   -43 dBm
      signal avg:   -44 dBm
      tx bitrate:   36.0 MBit/s

Also hostapd reports disconnections (eg if run from commandline - surely there's a way to get this into logs):

root@OpenWrt ~ # hostapd -P /var/run/wifi-phy0.pid /var/run/hostapd-phy0.conf
Using interface wlan0 with hwaddr 94:0c:6d:xx:xx:xx and ssid 'marvin'
wlan0: STA 00:13:02:xx:xx:xx IEEE 802.11: authenticated
wlan0: STA 00:13:02:xx:xx:xx IEEE 802.11: associated (aid 1)
AP-STA-CONNECTED 00:13:02:xx:xx:xx
wlan0: STA 00:13:02:xx:xx:xx WPA: pairwise key handshake completed (RSN)
(...)
AP-STA-DISCONNECTED 00:13:02:xx:xx:xx

Alternatively you can connect to hostapd via its control socket using wpa-cli:

root@OpenWrt ~ # wpa_cli -p /var/run/hostapd-phy0       
wpa_cli v0.8.x
Copyright (c) 2004-2010, Jouni Malinen <[email protected]> and contributors

This program is free software. You can distribute it and/or modify it
under the terms of the GNU General Public License version 2.

Alternatively, this software may be distributed under the terms of the
BSD license. See README and COPYING for more details.


Selected interface 'wlan0'

Interactive mode
>
(...here client connects...)
<3>AP-STA-CONNECTED 00:13:02:xx:xx:xx
(...and here disconnects...)
<3>AP-STA-DISCONNECTED 00:13:02:xx:xx:xx