We have a situation here where our product engineers often change mac addresses on devices being developed. They do not do a decent job of managing this pool of addresses and hand them out to other engineering teams and no one keeps track and I end up with device flapping more often than I would want. Is there a way with Orion to monitor and alert on this? I was thinking something simple like just watching for the %SW_MATM-4-MACFLAP_NOTIF: message in an iOS switch log buffer and capturing that and emailing it out? We also have Arcsight in our environment if that helps.
I am pretty sure I could eventually muddle my way through this, but I'd rather not spend buckets of time and if someone else has done this and is kind enough to offer some pointers, that would be great.
Thanks