MARS and Wireless AP

Unanswered Question
Jun 19th, 2007


My question is how can I add Cisco wireless devices to MARS, since there is no option for AP. I added these devices as CiscoSwitchIOS12.2 I guess that's the best... How can I solve the inactivity issue, MARS reports sometime that it doscovered some inactive devices however they are up.



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3.5 (2 ratings)
mhellman Tue, 06/19/2007 - 06:07

if the Cisco AP's emit the exact same syslog messages, you should be okay with that device type. I would guess that they have at least some different messages though. You can run a query for that device to see what is and isn't being mapped correctly.

If you have reporting devices that just aren't active every hour (don't generate syslog messages,etc ), you can exclude them in the "Inactive CS-MARS Reporting Device" rule using the "!=" option.

farkascsgy Tue, 06/19/2007 - 07:36

And what is the reason that some device become inactive or at least MARS think that the device is inactive?

mhellman Tue, 06/19/2007 - 07:38

If there are no events for a reporting device in an hour, that rule will fire.

farkascsgy Tue, 06/19/2007 - 08:54

How and what kind of query can I run?

Sorry, but I am beginer with MARS..



mhellman Tue, 06/19/2007 - 09:43

Click on "Query/Reports"

Click on the "Edit" button to change the result format.

Change the query type to "Unknown Event Report"

(2nd result format from bottom). Click "Apply"

Click on the "Any" text in the device column.

Add the Wireless AP device. Remove the "Any" Device. Click "Apply".

Click "Submit Inline".

This should return any unknown events (i.e. unmapped) received from the device in the last 10 minutes.


This Discussion