Do you see any core dump, crash, or reboot messages in the APs buffered log? All the buffered log content should be captured by the syslog if the configuration is correct, but these logs may not be present in the AP at all. You can check the APs buffered log with the command "show log buff", and you can filter for specific content by using the command "show log buff | include <x>" where <x> is a key word you want to focus on, like debug or crash or reboot. For example "show log buff | include reboot".
