Measuring Events on MARS

Unanswered Question
Apr 9th, 2008
User Badges:

Hi, I'd like to extract statistical data regarding the number of events that have been processed by a MARS Local controller. My MARS has got a limit of 5000 events when extracting raw messages (which is about 20 minutes of events in my setup): how can I get data regarding a day, week, etc.? Will a "Top Destination Port" report provide me with the total number of events or do those numbers refer to sessions ? I ran both "Top Destination Ports" and "Top Destinations" over the same period of time expecting the overall totals to be the same, but they were not and now I feel confused. Can someone provide some insight? Thank You

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
mhellman Wed, 04/09/2008 - 04:55
User Badges:
  • Blue, 1500 points or more

I don't think it's possible using the GUI. MARS does not allow reporting based on events, only sessions. It's kind of a curious limitation since the devices are rated based on events over time.

What you might be able to do is enable archiving and write a script to count the raw messages (i.e. newlines). Something like this on each raw message file should work:

# zcat rm-5330-533-1207744873_2008-04-09-12-40-31_2008-04-09-12-42-38.gz | wc -l

joe.favia Fri, 04/11/2008 - 04:33
User Badges:

I can get some data (1 day,2 days,1 week,1 month,1 year) from the SUMMARY page (on the top left hand side) although I'd like to understand whether the 1 day data regards the last 24 hrs. or if it refers to the previous calendar day? Thanks for your help!

mhellman Fri, 04/11/2008 - 05:27
User Badges:
  • Blue, 1500 points or more

absolutely, but you can't really report on it (for trending, management reports, etc), you have to manually capture it. The "one day" is updated throughout the day, at least a couple times an hour, so appears to be the last 24 hours as of the update time.


This Discussion