We have a number of devices that are quite "quiet" under normal conditions in our network -- rarely reporting activity to the CS-MARS device. This is normal for these devices.
I see this in both Cisco IPS v6 sensors and Cisco IOS switches with SNMP RO credentials reporting via syslog.
1) Are there configurations or techniques that these devices will generate a "timestamp" message every 30 or minutes?
2) Is there a way to change the CS-MARS "Inactive CS-MARS reporting device" (1000021) so it only triggers if the device has not sent a message in 24 hours rather than 1 hour?