CS-MARS: reveal the "Unknown reporting devices"

Answered Question

I get a lot of events from "unknown reporting devices". How can I reveal the IP adressen of this devices?


Many thanx in advance!

Correct Answer by loorimar about 8 years 10 months ago

Click on an incident that is caused by unknown reporting devices. In the incident click the "expand all" button. In the "reporting device" column look for the little button which looks like a page with zeros accross and click on it. The "raw message" column shows you the IP address of the reporting device.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
loorimar Tue, 09/23/2008 - 06:44
User Badges:

Click on an incident that is caused by unknown reporting devices. In the incident click the "expand all" button. In the "reporting device" column look for the little button which looks like a page with zeros accross and click on it. The "raw message" column shows you the IP address of the reporting device.

rajett Wed, 09/24/2008 - 05:44
User Badges:
  • Cisco Employee,

Click on Query/Reports. Edit Query Type.


In the pull down list "Result Format" choose "Unknown Event Report" and add in the time range you wish to run the report for.


Click "Apply" then "Submit"


If you do it for an extended amount of time, the button will automatically change from "submit inline" to "submit batch". If this happens you can find the report running in the background under the "Batch Query" subtab under "Query/Reports"


In that report you should find the unknown events and the IP addresses of the device responsible.


Raymond

Actions

This Discussion