cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
295
Views
7
Helpful
5
Replies

MARS and Wireless AP

farkascsgy
Level 4
Level 4

Guys,

My question is how can I add Cisco wireless devices to MARS, since there is no option for AP. I added these devices as CiscoSwitchIOS12.2 I guess that's the best... How can I solve the inactivity issue, MARS reports sometime that it doscovered some inactive devices however they are up.

Bye

FCS

5 Replies 5

mhellman
Level 7
Level 7

if the Cisco AP's emit the exact same syslog messages, you should be okay with that device type. I would guess that they have at least some different messages though. You can run a query for that device to see what is and isn't being mapped correctly.

If you have reporting devices that just aren't active every hour (don't generate syslog messages,etc ), you can exclude them in the "Inactive CS-MARS Reporting Device" rule using the "!=" option.

And what is the reason that some device become inactive or at least MARS think that the device is inactive?

If there are no events for a reporting device in an hour, that rule will fire.

How and what kind of query can I run?

Sorry, but I am beginer with MARS..

bye

FCS

Click on "Query/Reports"

Click on the "Edit" button to change the result format.

Change the query type to "Unknown Event Report"

(2nd result format from bottom). Click "Apply"

Click on the "Any" text in the device column.

Add the Wireless AP device. Remove the "Any" Device. Click "Apply".

Click "Submit Inline".

This should return any unknown events (i.e. unmapped) received from the device in the last 10 minutes.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: