Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

5508 - Getting detailed user association events in Syslog

Hi everybody

Sounds like an obvious request. I need to trace some malware and I need to know in detail when each user is associated to an AP / SSID.

I can see some Syslog events like SISF-6-ENTRY_CHANGED. Nevertheless, I see nothing that explicitly tells me that an SSID association started or finished.

I was specifically looking for a mac address and if possible for the IP mapped to it.

I enabled the Debug level for Syslog messages and using the for Syslog facility the User process.

I don't have a WCS; just two WLC 5508.

Did you have this requirement?

Regards

Enrique Waizel

1 REPLY
Hall of Fame Super Silver

Re: 5508 - Getting detailed user association events in Syslog

I don't think you will get that info from syslog. You can try searching the forum to see, but here is a thread I did find.

https://supportforums.cisco.com/thread/2171466

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
136
Views
0
Helpful
1
Replies