Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

What does 'Inactive CS-MARS

1 REPLY
Community Member

Re: What does 'Inactive CS-MARS

The description of the event in CS Mars seems pretty self explanatory.

"This rule detects reporting devices that have not reported an event in the last hour. For chatty devices such as firewalls and IDS, this may indicate connectivity issues or an issue with the device themselves. This rule should be scoped down to only include chatty network infrastructure devices. "

If you wouldn't expect much traffic from this device then I wouldn't worry about it and I would tune the alert to not fire for the device. If you would, then its time to start troubleshooting.

93
Views
0
Helpful
1
Replies
CreatePlease to create content