CS-MARS Question

Unanswered Question
Aug 22nd, 2007

For a site with 300 users is the CS-MARS 20R sufficient or do we need to scale up to 110R?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
diptanshusingh Wed, 08/22/2007 - 06:17

i think it depends upon the eps your cs-mars is getting. try to find the eps rate which your mars-box is getting from your logging devices then according to that you can plan for the right box.

pmccubbin Sat, 08/25/2007 - 03:33

I agree with Diptanshu regarding trying to figure out your EPS (Events Per Second) rate first then sizing your box.

Then remember this guideline:

Size the box to be capable of handling 3 times the low end of your EPS (Events Per Second) and also to be capable of handling 6 times your estimated high side EPS.

Here are the guidelines for Generation 1 Boxes:

1. MARS 20

(EPS) = 500 Events Per Second

Netflow = 15,000 Events Per Second

Storage = 120gig (No RAID)

2. MARS 50

(EPS)= 1,000 Events Per Second

Netflow = 25,000 Events Per Second

Storage = 240gig

3. MARS 100e

(EPS) = 3,000 Events Per Second

Netflow = 75,000 Events Per Second

Storage = 750gig

4. MARS 100

(EPS) = 5,000 Events Per Second

Netflow = 150,000 Events Per Second

Storage = 750gig

5. MARS 200

(EPS) = 10,000 Events Per Second

Netflow = 300,000 Events Per Second

Storage = 1,000gig

I haven't worked much with the 2nd Generation of MARS boxes but here are some of the claims:

Next Generation MARS Appliances:

All the new MARS G2 appliances are 2U in form factor, have dual-PSU and have fewer disk drives, which offers an increase in overall reliability.

They will deliver up to 2x the storage and 1.5x the performance of the old generation 1 appliances.

These new appliances will run the v5 track of software, which offers many new enhancements.

New Gen2 Software Enhancements:

A new Enhanced pnrestore options to restore data in time slices.

New Support for raw messages greater than 500 bytes.

A New keyword search process.

Super New IP log enhancements for viewing IPS IP packets.

A licensing upgrade will be available for customers on 110R to upgrade to the 110 platform.

Hope this helps.


This Discussion