Measuring Events on MARS

Unanswered Question
Apr 9th, 2008

Hi, I'd like to extract statistical data regarding the number of events that have been processed by a MARS Local controller. My MARS has got a limit of 5000 events when extracting raw messages (which is about 20 minutes of events in my setup): how can I get data regarding a day, week, etc.? Will a "Top Destination Port" report provide me with the total number of events or do those numbers refer to sessions ? I ran both "Top Destination Ports" and "Top Destinations" over the same period of time expecting the overall totals to be the same, but they were not and now I feel confused. Can someone provide some insight? Thank You

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
mhellman Wed, 04/09/2008 - 04:55

I don't think it's possible using the GUI. MARS does not allow reporting based on events, only sessions. It's kind of a curious limitation since the devices are rated based on events over time.

What you might be able to do is enable archiving and write a script to count the raw messages (i.e. newlines). Something like this on each raw message file should work:

# zcat rm-5330-533-1207744873_2008-04-09-12-40-31_2008-04-09-12-42-38.gz | wc -l

joe.favia Fri, 04/11/2008 - 04:33

I can get some data (1 day,2 days,1 week,1 month,1 year) from the SUMMARY page (on the top left hand side) although I'd like to understand whether the 1 day data regards the last 24 hrs. or if it refers to the previous calendar day? Thanks for your help!

mhellman Fri, 04/11/2008 - 05:27

absolutely, but you can't really report on it (for trending, management reports, etc), you have to manually capture it. The "one day" is updated throughout the day, at least a couple times an hour, so appears to be the last 24 hours as of the update time.

Actions

This Discussion