How to track user in WLC syslogs

[murraymwps]

I'm trying to track a users connection history looking at my 5520 syslogs. The client MAC is 3d61:c445:f8de and I've pulled the instances in the syslog of the MAC but I can't tell what AP it's connecting to. Is that info in these logs? If not, is there another way to find this?

2018-01-18 14:43:10 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 19:43:11.303: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90
2018-01-18 15:20:35 Local0.Info 172.31.1.8 HS_WLC5520: *sisfSwitcherTask: Jan 18 20:20:35.628: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=
2018-01-18 15:20:39 Local0.Info 172.31.1.8 HS_WLC5520: *SISF BT Process: Jan 18 20:20:40.028: %SISF-6-ENTRY_CHANGED: sisf_shim_utils.c:488 Entry changed A=fe80::cef:3d61:c445:f8de V=192 I=wireless:0 P=0005 M=7c:d1:c3:78:fe:90
2018-01-18 15:40:42 Local0.Info 172.31.1.6 HS_WLC5508: *sisfSwitcherTask: Jan 18 15:40:42.989: %SISF-6-ENTRY_CREATED: sisf_shim_utils.c:485 Entry created A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M=
2018-01-18 15:41:42 Local0.Info 172.31.1.6 HS_WLC5508: *SISF BT Process: Jan 18 15:41:43.598: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::cef:3d61:c445:f8de V=192 I=wired:13 P=0000 M=

[Flavio Miranda]

Hi

It is but not on this log apparently. Better ir you had a Prime or some sort of NMS.

 Or maybe a different level of log on syslog.

-If I helped you somehow, please, rate it as useful.-

[Saravanan Lakshmanan]

Enable Client connectivity traps. And forward to external traplog server.