06-19-2007 01:46 AM - edited 03-09-2019 06:13 PM
Guys,
My question is how can I add Cisco wireless devices to MARS, since there is no option for AP. I added these devices as CiscoSwitchIOS12.2 I guess that's the best... How can I solve the inactivity issue, MARS reports sometime that it doscovered some inactive devices however they are up.
Bye
FCS
06-19-2007 06:07 AM
if the Cisco AP's emit the exact same syslog messages, you should be okay with that device type. I would guess that they have at least some different messages though. You can run a query for that device to see what is and isn't being mapped correctly.
If you have reporting devices that just aren't active every hour (don't generate syslog messages,etc ), you can exclude them in the "Inactive CS-MARS Reporting Device" rule using the "!=" option.
06-19-2007 07:36 AM
And what is the reason that some device become inactive or at least MARS think that the device is inactive?
06-19-2007 07:38 AM
If there are no events for a reporting device in an hour, that rule will fire.
06-19-2007 08:54 AM
How and what kind of query can I run?
Sorry, but I am beginer with MARS..
bye
FCS
06-19-2007 09:43 AM
Click on "Query/Reports"
Click on the "Edit" button to change the result format.
Change the query type to "Unknown Event Report"
(2nd result format from bottom). Click "Apply"
Click on the "Any" text in the device column.
Add the Wireless AP device. Remove the "Any" Device. Click "Apply".
Click "Submit Inline".
This should return any unknown events (i.e. unmapped) received from the device in the last 10 minutes.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide