FAZ 7.6.7 - Locating Wireless Clients by Last Connected Access Point

​

Hi,

The datasets can combine different log types. You refer to them explicitly, for example:

$log-event
$log-traffic
$log-app-ctrl

And for your case try this dataset on Event Logs and see if this help:
 

select
    client_mac,
    ap,
    ap_serial,
    ssid,
    channel,
    radioband,
    last_event,
    from_dtime(last_seen_raw) as last_seen
from
(
    select
        lower(stamac) as client_mac,
        ap,
        sn as ap_serial,
        ssid,
        channel,
        radioband,
        action as last_event,
        dtime as last_seen_raw,
        row_number() over
        (
            partition by lower(stamac)
            order by dtime desc
        ) as rn
    from $log
    where
        $filter
        and subtype = 'wireless'
        and stamac is not null
        and ap is not null
        and action in (
            'client-authentication',
            'client-ip-detected',
            'client-idle',
            'client-leave-wtp'
        )
) t
where rn = 1
order by last_seen_raw desc

Thank you for that. Combining the logs makes things a whole lot easier. I’ve been able to pull the information I need and parse it into a dataset table correctly. Is there a way to turn this into a dashboard for my techs to easily find this info? For instance, they log into FAZ and are able to drill into a said dashboard by hostname to show the last time that device connected to a certain wireless access point?

I can’t seem to find the right combination under FortiView > Custom Views. TIA