Has anyone been successful in finding a way to mimic the Device Down functionality from enVision in SA? I'm looking for something as simple a way to query when a particular device (IP or hostname) last sent logs. Maybe some alerting can be handled once this timestamp is found to trespass some threshold.
Log Decoder will have a feature in 10.2 SP2 that you can use to track this. The command /decoder logStats will return all devices and the number of logs received and the UTC timestamp of the last log received.
In 10.3, SA will have additional functionality that can be leveraged to alert on these metrics.