Hi all,
Just curious if any here on thwack have used the LEM to alert on 802.1x violations (via a custom rule). I have a case open with support but they can't seem to find it.
This is a bit tricky as the violation relies on two events:
DOT1X-5-FAIL
MAB-5-FAIL
These two events must be triggered by the same MAC address. I also tried looking for a single syslog event on the switches for this, but to no avail.
Thanks all.
