I am trying to think up a way of creating a report that would show devices that MARS hasnt received a log from in X days. I ran a report for all devices with the reporting devices ranked by session, and I noticed about 20 of my devices were not on the list. So this just got me thinking, it would be nice to reverse that, and if the device hasnt sent a log in the past day, report on it or send an email. I just cant figure out how to do it. Anyone have any ideas?
Search for event type "Inactive CS-MARS reporting device"
If a device does not send any log data for a period of one hour, this event will fire.
An easy way to do this is to go to Management > Event Management and find Event ID 1000021. It's the 2nd item in the list. Click the "q" link next to the description to do a query on this Event. Adjust the time period as necessary then submit.