Controller Based WLANs

The "show audit-trail" command can show you configuration commands that are typed on the command line or on the GUI.  It can also show you who is logging in and out.  but one limitation of this command is that it cannot by default show only  who is logging in and out of your controller.  In ArubaOS 6.3 there is a "show audit-trail login" command that shows ONLY logins and logouts

Oct  7 15:38:07  fpcli: USER: samuel has logged in from 10.30.56.149.
Oct  7 15:38:26  fpcli: USER: josephine has logged in from 10.30.56.149.
Oct  7 15:38:48  fpcli: USER: admin has logged in from 10.30.56.149.
Oct  7 15:39:25  fpcli: USER: robert connected from 10.30.56.149 has logged out.
Oct  7 15:39:47  fpcli: USER: samuel connected from 10.30.56.149 has logged out.
Oct  7 15:39:55  fpcli: USER: josephine connected from 10.30.56.149 has logged out.
Oct  7 15:42:54  fpcli: USER: josephine has logged in from 10.30.56.149.
Oct  7 15:45:51  webui[1547]: USER: robert has logged in from 10.30.56.103.
Oct  7 15:50:52  fpcli: USER: admin has logged in from 10.30.56.15.
Oct  7 15:58:20  fpcli: USER: josephine connected from 10.30.56.149 has logged out.
Oct  7 16:01:20  fpcli: USER: admin connected from 10.30.56.149 has logged out.

When logs are collected on the controller using "tar logs tech-support" or through the GUI, the audit trail login is saved to the file /var/log/oslog/audittrail-login_out.log"