Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Report on Devices Not Sending

I am trying to think up a way of creating a report that would show devices that MARS hasnt received a log from in X days. I ran a report for all devices with the reporting devices ranked by session, and I noticed about 20 of my devices were not on the list. So this just got me thinking, it would be nice to reverse that, and if the device hasnt sent a log in the past day, report on it or send an email. I just cant figure out how to do it. Anyone have any ideas?

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Report on Devices Not Sending

Search for event type "Inactive CS-MARS reporting device"

If a device does not send any log data for a period of one hour, this event will fire.

An easy way to do this is to go to Management > Event Management and find Event ID 1000021. It's the 2nd item in the list. Click the "q" link next to the description to do a query on this Event. Adjust the time period as necessary then submit.

RJ

1 REPLY
Cisco Employee

Re: Report on Devices Not Sending

Search for event type "Inactive CS-MARS reporting device"

If a device does not send any log data for a period of one hour, this event will fire.

An easy way to do this is to go to Management > Event Management and find Event ID 1000021. It's the 2nd item in the list. Click the "q" link next to the description to do a query on this Event. Adjust the time period as necessary then submit.

RJ

122
Views
5
Helpful
1
Replies
CreatePlease login to create content