cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
620
Views
0
Helpful
3
Replies

CS-MARS: reveal the "Unknown reporting devices"

rpluim
Level 1
Level 1

I get a lot of events from "unknown reporting devices". How can I reveal the IP adressen of this devices?

Many thanx in advance!

1 Accepted Solution

Accepted Solutions

loorimar
Level 1
Level 1

Click on an incident that is caused by unknown reporting devices. In the incident click the "expand all" button. In the "reporting device" column look for the little button which looks like a page with zeros accross and click on it. The "raw message" column shows you the IP address of the reporting device.

View solution in original post

3 Replies 3

loorimar
Level 1
Level 1

Click on an incident that is caused by unknown reporting devices. In the incident click the "expand all" button. In the "reporting device" column look for the little button which looks like a page with zeros accross and click on it. The "raw message" column shows you the IP address of the reporting device.

Thank you. This solved my problem!

Regards, Robbert

rajett
Cisco Employee
Cisco Employee

Click on Query/Reports. Edit Query Type.

In the pull down list "Result Format" choose "Unknown Event Report" and add in the time range you wish to run the report for.

Click "Apply" then "Submit"

If you do it for an extended amount of time, the button will automatically change from "submit inline" to "submit batch". If this happens you can find the report running in the background under the "Batch Query" subtab under "Query/Reports"

In that report you should find the unknown events and the IP addresses of the device responsible.

Raymond

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: