Home > Default > MARS - events per second

MARS - events per second

November 30Hits:2
Advertisement
How can I tell how many events per second our MARS 100 is receiving?

Answers

You can go into Admin->System Maintenance->View log files. Change the level to "info" and look for pnparser entries that look like this:
Thread 4101:PN-2016:message rate: 1416.305176 msgs/sec, total: 11200000 msgs, total avg rate: 723.042933 msgs/sec
Now, the last time I worked with Cisco TAC on a performance related issue...I was told these numbers weren't quite right(they were low), but they didn't tell me why. That was a long time ago though. We process over 90 million events/day on this MARS. That averages to over 1000 events/sec. At 7:30am on a weekday (even on a Friday morning before a holiday weekend), I would except numbers HIGHER than the average, not lower. So, I don't know what to think.

Read other 4 answers

Tags:

Related Articles

  • How to convert Cisco IPS signatures to a MARS events - no keyword searchNovember 30

    I am trying to run a scheduled report looking for the new Microsoft exploit under the IPS S411 release, SIGID 19339.0 and I am trying to form the query looking for the event this falls under without using a keyword search on the SIGID. Does anyone kn

  • CS-MARS Event IDNovember 30

    HI, Is there a place for me to check/ follow up with the CS-MARS EVEN IT, so that I would be able to verify what is happening.I think, for example, to check Windows events you can go to Management -> Event Management, then change the drop down to Mic

  • List of MARS eventsNovember 30

    Hello, iam new to cisco mars a because we are about deploy this device i would like to know if is there list of events (events examples) generated by MARS Thanks M.I assume you're actually talking about incidents, which are the result of an inspectio

  • MARS - events per secondNovember 30

    How can I tell how many events per second our MARS 100 is receiving?You can go into Admin->System Maintenance->View log files. Change the level to "info" and look for pnparser entries that look like this: Thread 4101:PN-2016:message rate:

  • SSM MODULES and Mars events and local?November 30

    Is it possible to setup an AIP-SSM Module to log event alerts to Its local cache as well as the Mars Appliance. I say this because I ran some tests for alerts and never see them on the IPS module itself but i do see them on the Mars Appliance correct

  • CS-Mars Events/Incidents HistoryNovember 30

    Hello all i have a running CS-Mars, where it is configured for a daily backup using NFS protocol. On the backup server, a new folder named by the Day Date is created daily where some sub folders inside are created (cf,es,in,rr,st). 1. My question is

  • Event: NULL TCP PACKETNovember 30

    Hello all, we are incrementally receiving a lot of MARS events that comes from Cisco IDS, all those events are “ NULL TCP PACKET”, and the destination is always the same, a smtp ironport machine trough the 25 port, from diferent public IPs. Does

  • MARS and windows log timestampsNovember 30

    MARS 4.3.3 (2636) pulling logs off a windows 2003 server at 1 hour intervals. The MARS events seem to get timestamped in "clumps" at about 2-hour intervals e.g. 3000 events all timestamped within about a minute of 2:00, then nothing for a couple

  • Events from Imperva FW (SS-WAF-G2G)November 30

    Hi, Does anybody know what are the capabilities of MARS to support Imperva FireWalls? Maybe someone has this type of FW in their MARS environment? I am concerning about pulling as much info as possible to CS-MARS from this device. I would appreciate

  • Inactive CS-MARS reporting device (again)November 30

    I created a drop rule, dest and src ip's are "ANY", and the hostnames as seen in MARS. I chose to "drop" as action...not "log to db only". The event is "Inactive CS-MARS reporting device, device is "ANY", sever

Copyright (C) 2019 wisumpire.com, All Rights Reserved. webmaster#wisumpire.com 14 q. 0.950 s.