Cisco 9800 Client session realtime deauth (8540s had enhanced traps).

[ciscoritz]

Cisco 9800 Client session data realtime (8540s had enhanced traps)

is there a way on the 9800s to gather realtime client session data when deauth trap (i dont see it working when enabled in the snmp wireless traps section.)

8540s had this (but i cant find this trap on the 9800s.)
CISCO-LWAPP-DOT11-CLIENT-MIB::ciscoLwappDot11ClientDeAuthenticatedTrap

im not sure if MDT will have a way realtime to stream per deauth action.  this method but this was Very powerful in realtime data collection 

it had 
cldcClientSSID
cldcClientWlanProfileName
cldcClientDataBytesSent
cldcClientDataBytesReceived
cldcClientIPAddress
cLAPGroupVlanName
cldcClientRSSI
cldcClientSNR
cldcClientMacAddress

[marce1000]

  - SNMP MIB support is limited on the 9800 w.r.t aireos ; check https://software.cisco.com/download/home/286322605/type/280775088/release/   for availability of the specific trap you mentioned

 M.

[Rich R]

It certainly supports the config:
9800(config)#trapflags client dot11 ?
assocfail Association Fail Trap
associate Association Trap
authenticate Client Moved To Run State Trap
authfail Authentication Fail Trap
deauthenticate Deauthentication Trap
disassociate Disassociation Trap

Are you saying you've configured it but the WLC doesn't send the trap? 
If so then open a TAC case and get TAC to raise a bug for it to get it fixed.

[ciscoritz]

The problem is the deauthenticate Deauthentication Trap is there but the issue is it doesnt send the actual
CISCO-LWAPP-DOT11-CLIENT-MIB::ciscoLwappDot11ClientDeAuthenticatedTrap
with all the byte session data flows and such

[Rich R]

As Marce pointed out above SNMP support on 9800 is very limited as it is considered to be legacy and is replaced by streaming telemetry.  Many of the MIBs and traps which were there on IOS are no longer supported at all and as you have found those that are supported may lack functionality.
For client accounting data you can use radius accounting.

[ciscoritz]

Even with the MDT it's incorrect data as it comes in which is interesting

[Leo Laohoo]

If they can get telemetry to work properly (and without causing the switch, router, WLC to crash), Cisco wants everyone to migrate off SNMP. 

One of the most fundamental reason why is because other NMS vendors can do SNMP ping/poll better and a lot cheaper. 

[ciscoritz]

intresting enough theres not really any MDT equivalent to how the enhanced traps exit . they are semi stiched with MDT but not a good way to really get a good datapoint in the kvgpb (unless the TDL encoding

wsa-cl-event-delete-in-progress
Cisco-IOS-XE-wireless-events-oper:wsa-client-event
Cisco-IOS-XE-wireless-client-oper  /wireIess-client-oper:client-oper-data

but during that delete the MDT last update doesn't really give out the traffic stats during that session  or use traffic-stats 
if a 90sec period updat interval + delete we could match the data and somewhat i think get a picture of the stats but have to go through a few data sources to re-stitch (when your talking 20000 active clients it becomes a big set not as simple as querying API for client stats