Wireless Access

There was a laptop stolen from our campus  late last month and I am trying to track down the last access point to have seen it online.  I know that it was in our Aruba system at some point because our network access machine logs the last time machines were online.

Unfortunately, when I search for the laptop's MAC address in our Airwave system, there is no log of it ever being there even though it was most definitely on our network at some point.

Any ideas why this might happen?

Option 1

You should do a search in your AirWave Daily logs - It's all depands on how much way back your AirWave saving   logs. (new clients  and client logs)

Option 2

Answers relative to AMP 7.5.5

How to  get current and historical logs of data usage by particular user on particular date or so..(Thanks to Rob Gin)

For current data (user is currently online using wifi), run a quick search for the user's username or mac address (can be partial).  The result will be the user's Client Detail page which will give useful data like current association time, current APs of association, signal quality and usage graphs, and more.  Historical association history for that user is also on the Client Detail page.  If user is not currently online, you can try using a Full Search of All Clients (note: username and role for active clients is in regular font, while historic not currently active clients are italicized).

The key here is to note how much data you're retaining in the AMP.  Check AMP Setup -> General tab -> Historical Data Retention box.  What's the counter for active and inactive client data set to?  If it's less than 30 days, then you may not have the data you're looking for as it would have already been aged out (though you may get lucky and possibly find the data in a past client session report - as long as reports are kept for a while).

In the interim, if that device should ever show up on the network again, you can setup a trigger (System -> Triggers).  Add a 'connected clients' trigger, here's an example:

You can also configure this alert to email you by checking the email option at the bottom.

"Check AMP Setup -> General tab -> Historical Data Retention"

I think this is what I needed.  Looks like the 14 days it was set to retain client association by default wasn't looking back far enough for me.  Thank you!