Hi Abertay,
On an interface where the number of learned secure MAC addresses reaches the maximum value, the interface sends an alarm when receiving invalid MAC addresses.
For example:
Apr 20 2019 05:12:30-05:13S5700-28C-EI L2IFPPI/4/PORTSEC_ACTION_HAVEMAC_ALARM:OID 1.3.6.1.4.1.2011.5.25.315.3.2Interface (26/21) GigabitEthernet0/0/21receive insecure MAC-address, and MAC address is e024-7ffd-33e7,VLAN is 203, the port status is : 1. (1:restrict;2:protect;3:error-down)
You can find the mac address in the alarm.
Hope this helps you.