Cisco WLC integration with PA - Client logout events from syslog messages

[Sunugopal]

Good day.

Is there any way to generate user logout events from syslog messages?

Firewall is receiving syslog messages with client disassociate events from WLC.

Tried  a syslog Parse Profile with Event String as " Client Disassociated: ", still no luck.

Thank you,

[OtakarKlier]

Hello,

While I have not configured this in the past, I did find the following article that may help. 

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/configur...

Regards,

[Sunugopal]

Thank you for the document.

I was following the same. 

Firewall receives client associate & disassociate messages.

Login events are created successfully.

But logout events are not generated when clients are dis associated.

[Sunugopal]

Update : 

issue resolved.

Changed the value of 'Address delimiter' to \s   (old value was \z) . 

Logout events are generated now.