Using LEM for 802.1x alerting

Hi all,

Just curious if any here on thwack have used the LEM to alert on 802.1x violations (via a custom rule). I have a case open with support but they can't seem to find it.

This is a bit tricky as the violation relies on two events:

DOT1X-5-FAIL

MAB-5-FAIL

These two events must be triggered by the same MAC address. I also tried looking for a single syslog event on the switches for this, but to no avail.

Thanks all.