cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
597
Views
0
Helpful
10
Replies

CS-MARS migration from 50 to 110R

r.spiandorello
Level 1
Level 1

Hi, I'd like to know the better way to migrate a cs-mars 50 to the new 110R (with the new s.o. version).

thank you in advance

rs

10 Replies 10

pmccubbin
Level 5
Level 5

This is an excellent question!

You can migrate devices by using a seed file, though I believe the archived data couldn't migrate because the 110R runs a different version of software, that is, the 5.x train.

I checked the documentation and there were no clear cut explanations, except for this:

The version of MARS software running on the appliance to be restored must match the version recorded in the archive. For example, if the data archive is for version 4.1.4, you must reimage the MARS Appliance to version 4.1.4, not older or newer, before using the pnrestore command to recover the system configuration and events.

Since the newer MARS box you want to migrate to runs a different train of software my opinion is that you can't fully migrate from a 50 to a 110R.

Hope this helps.

I just spoke with Cisco and they are working on a tool to migrate data from 4.x to 5.x

No word on when this will be available.

Hope this helps.

Hi, do you have update about that ?

thank you in advance

greatings

RS

Nothing to date.

I will keep the forum updated.

Thanks.

This is been posted before but I'd like to hear any firsthand accounts from people who have done the migration. Thanks!

From the MARS 5.3.1 Release notes:

"Beginning with this release, you can migrate configuration and event data from a MARS Appliance running 4.x to a newer model running 5.x. For detailed instruction on how to perform this operation, see Migrating Data from Cisco Security MARS 4.x to 5.3.x. at the following URL:

http://www.cisco.com/en/US/products/ps6241/products_upgrade_guides09186a00808bbb7a.html

Thanks in advance!

Paul

The export data process fails with the following error:

OOct 8 11:37:10.605 2007@LM_INFO@Thread 1024:START DATA EXPORTING...

Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: nfs_path = 10.24.9.153:/archivio/csmarsold/migration/nwmars01_2007-1

0-08-11-36-02

Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 01/01/01:00

Oct 8 11:37:10.683 2007@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchive

Oct 8 11:37:12.127 2007@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...

Oct 8 11:37:12.127 2007@LM_INFO@Thread 1024:Retrieving statistics of pn_report_result table...

Oct 8 11:37:12.141 2007@LM_INFO@Thread 1026:Entering data mover thread

Oct 8 11:39:58.980 2007@LM_ERROR@Thread 1024:SQL exception caught while exporting report result data: ORA-01652: unable to

extend temp segment by 64 in tablespace TEMP

Oct 8 11:39:58.980 2007@LM_ERROR@SQL statement executed: select /*+ INDEX_DESC (pn_report_result_ie2) */ REPORT_ID, RUN_T

IME, BUCKET_SIZE, ITEM_RANK, ITEM_COUNT, ITEM_VALUE, ITEM_TYPE, ZONE_ID from pn_report_result where RUN_TIME >= :1 and RUN_T

IME <= :2 order by run_time desc

Oct 8 11:39:58.980 2007@LM_INFO@Thread 1024:Total number of report result entries exported: 0

Oct 8 11:39:58.980 2007@LM_ERROR@Thread 1024:EXPORTING REPORT RESULTS FAILED!

Oct 8 11:39:58.980 2007@LM_CRITICAL@Thread 1024:PROGRAM ABORTS BECAUSE OF ERROR!

Now I don't know how to do !

Hi Renato,

Are you exporting from 4.3 to 5.3?

I mention this because the error:

"exception caught while exporting report result data: ORA-01652: unable to

extend temp segment by 64 in tablespace TEMP"

seems to indicate a mismatch in the database tables.

If you are expecting from 4.2 to 5.3 then this is the sort of error I would expect. The tables are changed when you go from one version to the next higher one.

I would recommend being at the parallel version of software 4.3 before you try to export to 5.3.

Let us know how you it turns out.

Hope this helps.

Paul

Hi Paul, I confirm you I have a 4.3.1 version

Hi Renato,

The only other thing would be to find out what this means:

"Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 01/01/01:00"

Does this indicate a mismatch in the Time on the MARS box and the Time on the NFS box? If the times are more than 5 minutes off this could be your problem.

Let me know.

Paul

Hi, today the export finished successfully !

I think you cannot execute the pnexp the same day of the 4.3.1 upgrade.

During the night the system obtains the requirewd space

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: