Welcome to Cisco Support Community. We would love to have your feedback.
For an introduction to the new site, click here. And see here for current known issues.
Sounds like an obvious request. I need to trace some malware and I need to know in detail when each user is associated to an AP / SSID.
I can see some Syslog events like SISF-6-ENTRY_CHANGED. Nevertheless, I see nothing that explicitly tells me that an SSID association started or finished.
I was specifically looking for a mac address and if possible for the IP mapped to it.
I enabled the Debug level for Syslog messages and using the for Syslog facility the User process.
I don't have a WCS; just two WLC 5508.
Did you have this requirement?
I don't think you will get that info from syslog. You can try searching the forum to see, but here is a thread I did find.https://supportforums.cisco.com/thread/2171466Sent from Cisco Technical Support iPhone App