I found a Fix! Settings to apply on Ruckus ZoneDirector Troubleshooting > Diagnostics > Enable "Client Association" in the debug logs. System > System Setting > Log Settings - Enable Remote syslog, use the IP Address of a Palo Alto User-ID Agent or the Management port on the firewall listening for syslog traffic Zone Director Settings Facility Name: Local0 Priority Level: Info Managed AP Settings Facility Name: Local1 Priority Level: Info I'm using Regex syslog filter to pull the required info. User login / IP Update event. Event Regex: operation=(update|add){1} Username Regex: sta_name(?:=.*\\|=)([A-Za-z0-9@._]+) Address Regex: sta_ip=([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) User Logout Event Event Regex: operation=(del){1} Username Regex: sta_name(?:=.*\\|=)([A-Za-z0-9@._]+) Address Regex: sta_ip=([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) Hope this helps!
... View more