Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Inactive devices -- need HELP

Hi to ALL,

I have some problems with correlation Rule: Inactive reporting devices.

"System Rule: Inactive CS-MARS Reporting Device

This rule detects reporting devices that have not reported an event in the last hour. For chatty devices such as firewalls and IDS, this may indicate connectivity issues or an issue with the device themselves. This rule should be scoped down to only include chatty network infrastructure devices."

I noticed a strange behaviour of this rule:

1. When i added some group of chatty devices to this rule (Click edit Rule: Inactive reporting devices --->>> select field Devices --->>> Then add devices)

no one event triggered, even some devices had stopped to send logs to Cisco MARS (believe me this devices very chatty )

2. Then I saw some examples of configuration: when this devices was added as destination IP addresses to Rule: Inactive reporting devices and rule was triggered correctly when some problems occur with reporting devices

But during our new project we have changed schema of delivering logs and configure centralised Syslog server between Reporting devices and Cisco MARS. After that Rule: Inactive reporting devices stopped to trigger. Because all Logs have IP from centralised Syslog server (((

And built-in Cisco's rule don't work too

If anybody know how "step-by-step" to configure this correlation rule.

If anybody have experience with such problem please help.



New Member

Re: Inactive devices -- need HELP


Anybody can help me?

Anybody have some idea how to solve this problem?

Regards, Nickolas