Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Getting Syslog data from WLC to ArcSight

Hi All

I am trying to get some syslog information from our WLC server into ArcSight Logger. I have setup a connector and am getting information across but it is not what I am after. I need to log when a client connects and disconnects from an access point, specifically;

Client Information ie, IP address, and/or MAC
Date/time and duration of the session
Which AP was used in the auth and de-auth

I guess my question is, Is this actually possible? and if so, how do I do it.

I have tried changing the syslog facility and the syslog level in the Management>Logs>Config menu but can't seem to narrow down the solution.

Thanks in advance


New Member

Hello Brent

Hello Brent

You can try to configure logging on AP. By default AP logging host -

(wlc2504) >show ap config general AP1130
Cisco AP system logging host.....................

(wlc2504) >config ap syslog host ?

global Configures the global system logging host for all Cisco AP
specific Configures the system logging host for a specific Cisco AP.

(wlc2504) >config ap logging syslog ?

level Syslog level.
facility Facility level.