Hi all,
I have been tasked to compile a list of MAC addresses that are failing NAC authorization on our switches.
I have the failed messages going to our syslog server and I can formuate a report writer script that can pull this information but what is the SQL command to filter the MAC address so that I only pull unique information from my list?
In other words, if I have a list of 10 failures from same MAC address, I want my SQL script to only show me the one MAC address that is failing
Anyone have any ideas?
Here is the SQL script I am trying to modify
SELECT SysLog.DateTime AS Date_Time,
Nodes.Site AS Site,
Nodes.Caption AS NodeName,
SysLog.MacInMessage AS Mac_In_Message,
SysLog.MessageType AS Message_Type,
Nodes.NodeID AS NodeID
FROM
((SysLog INNER JOIN SysLogFacilities SysLog_SysLogFacilities ON (SysLog.SysLogFacility = SysLog_SysLogFacilities.FacilityCode)) INNER JOIN SysLogSeverities SysLog_SysLogSeverities ON (SysLog.SysLogSeverity = SysLog_SysLogSeverities.SeverityCode)) LEFT OUTER JOIN Nodes ON (SysLog.IP = Nodes.IP_Address)
WHERE
( DateTime BETWEEN 40784 AND 40785 )
AND
(
(SysLog.MessageType = 'AUTHMGR-5-FAIL')
)
