topic Re: How to configure audit logs for user device deactivation/ deletion in Wireless

How to configure audit logs for user device deactivation/ deletion

Auditor — Mon, 18 Jul 2022 10:21:17 GMT

Is there a way to obtain logs to identify when a user device was added/ deleted from a Cisco wireless controller? If so, how to configure such logs?

Re: How to configure audit logs for user device deactivation/ deletion

Mark Elsen — Mon, 18 Jul 2022 10:46:42 GMT

- Usually you will not have users on a WLC directly but through external repositories , frequently accessed through radius , like for instance through ISE for instance, the question then falls back to those platforms holding the user database(s).

Re: How to configure audit logs for user device deactivation/ deletion

Rich R — Mon, 18 Jul 2022 14:40:41 GMT

IOS-XE (9800) logs that by default in the syslogs depending on what level of logging you have configured.
%CLIENT_ORCH_LOG-7-CLIENT_MOVED_TO_RUN_STATE and %CLIENT_ORCH_LOG-7-CLIENT_MOVED_TO_DELETE_STATE amongst others.

Haven't checked myself but you could probably configure traps if you wanted to - at your own risk because will generate a lot of traps.

On AireOS you can configure SNMP traplogs - same warning as above. Will flood your management system with traps and create CPU load on the controller.

Of course if you just want to watch a specific device you could enable debugs for that MAC address.