I'm running a Mars v6.0.7 - Since the release notes stated that Cisco IOS is updated to the release states from March, I expected Mars to recognize dot1x events from more recent releases (iirc about a year old).
But it seems as if it still doesn't recognize "%DOT1X-5-FAIL: Authentication failed for client ... "
Now that Cisco is "concentrating" it's efforts for the device support only on their own products, this lack of support for critical information is annoying...
* that is only my very personal opinion *
But I'm stating this here because there's allways the possibility of pebkac, meaning maybe I've missed something...
What I'd like to know is, if I've missed something or if I've still have to use my custom parsers to correlate on this type of events.
It does not appear that "%DOT1X-5-FAIL: Authentication failed for client ... " is parsed by CS-MARS release 6.0.7 for any supported release of IOS. You can request that your Cisco account team submit a product enhancement request on your behalf to add parsing support for this message. At this time, you will need to continue using your custom parser.