cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1300
Views
0
Helpful
2
Replies

How to track user in WLC syslogs

murraymwps
Level 1
Level 1

I'm trying to track a users connection history looking at my 5520 syslogs. The client MAC is 3d61:c445:f8de and I've pulled the instances in the syslog of the MAC but I can't tell what AP it's connecting to. Is that info in these logs? If not, is there another way to find this?

 

 

2018-01-18 14:43:10 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 19:43:11.303: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90
2018-01-18 15:20:35 Local0.Info 172.31.1.8 HS_WLC5520: *sisfSwitcherTask: Jan 18 20:20:35.628: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=
2018-01-18 15:20:39 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 20:20:40.028: %SISF-6-ENTRY_CHANGED: sisf_shim_utils.c:488 Entry changed A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90
2018-01-18 15:40:42 Local0.Info 172.31.1.6 HS_WLC5508: *sisfSwitcherTask: Jan 18 15:40:42.989: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M=
2018-01-18 15:41:42 Local0.Info 172.31.1.6 HS_WLC5508: *SISF BT Process: Jan 18 15:41:43.598: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M=

2 Replies 2

Hi

It is but not on this log apparently. Better ir you had a Prime or some sort of NMS.

 Or maybe a different level of log on syslog.

 

 

 

-If I helped you somehow, please, rate it as useful.-

Saravanan Lakshmanan
Cisco Employee
Cisco Employee
Enable Client connectivity traps. And forward to external traplog server.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: