From what I understand of the controller messages, this one means that the client (mobile xx.xx.xx.xx.xx) mac address was associated to an unknown username (Open auth SSID or probing client), and then to another username. Username unknown still can't be removed as an association to this mac address.
This can be very normal, if the client is a windows box probing around. If not, and uf this problem creates issues in the network, I would try to troubleshoot it with a client a find what triggers the message before TAC case...
Transferring Crash file from standby: Login to the Active WLC in HA.
From CLI: (Cisco Controller) >transfer upload datatype crash (Cisco
Controller) >transfer upload filename (Cisco
Controller) >transfer upload mode tftp (Cisco Controller) >transfer
This is the start of a display filter cross reference between Wireshark
and OmniPeek. The 1st installment is a table of advanced filters. More
filters will be added as time allows. It is a living doc, so check back
for changes every so often Please feel f...