I'm running a Mars v6.0.7 - Since the release notes stated that Cisco IOS is updated to the release states from March, I expected Mars to recognize dot1x events from more recent releases (iirc about a year old).
But it seems as if it still doesn't recognize "%DOT1X-5-FAIL: Authentication failed for client ... "
Now that Cisco is "concentrating" it's efforts for the device support only on their own products, this lack of support for critical information is annoying...
* that is only my very personal opinion *
But I'm stating this here because there's allways the possibility of pebkac, meaning maybe I've missed something...
What I'd like to know is, if I've missed something or if I've still have to use my custom parsers to correlate on this type of events.