They're only logged in the Calls table, unless you have Radius spitting the
info out into text files somewhere.
One thing you might do is look at your mailserver logs for anything with a
matching IP address that happened to do something with mail at about the
same time that one person was nuked. It may not be precise, but it may
narrow down the possibilities.
As far as the Calls table goes, if the information is being stored there
correctly, you could run a simple script like the one below to find out who
had that IP address at what time...
select "End of Call"=CallDate,
Username,
"Seconds online"=AcctSessionTime
from Calls
where FramedAddress = '123.123.123.123' /* whatever the IP address was */
and AcctStatusType = 2 /* stop records */
order by CallDate
Josh Hillman
hillman@talstar.com