incident : inactive cs-mars reporting device

Unanswered Question
Nov 20th, 2007

Hi all,

I am new to MARS, just started the deployment. I have some querries,

- Will a minimum of SNMP RO community and log diversion from a reporting device be enough for the MARS to build incidents and sessions. Or is it that we have to provide telnet/ssh session to the MARS

- I have added some devices using the RO community (switches and routers). I am seeing this message (inactive cs-mars reporting device) although from one of the device I am sending netflow events that are appearing on the MARS.

- How can I verify that a particular device is sending logging information to the MARS.

Thanks in advance.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
acomiskey Mon, 11/26/2007 - 13:52

You should be able to get the raw logs from

Admin -> System Maintenance -> Retrieve Raw Messages

Select the device and the time range and click Submit.


This Discussion