cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
315
Views
4
Helpful
4
Replies

Measuring Events on MARS

joe.favia
Level 1
Level 1

Hi, I'd like to extract statistical data regarding the number of events that have been processed by a MARS Local controller. My MARS has got a limit of 5000 events when extracting raw messages (which is about 20 minutes of events in my setup): how can I get data regarding a day, week, etc.? Will a "Top Destination Port" report provide me with the total number of events or do those numbers refer to sessions ? I ran both "Top Destination Ports" and "Top Destinations" over the same period of time expecting the overall totals to be the same, but they were not and now I feel confused. Can someone provide some insight? Thank You

4 Replies 4

mhellman
Level 7
Level 7

I don't think it's possible using the GUI. MARS does not allow reporting based on events, only sessions. It's kind of a curious limitation since the devices are rated based on events over time.

What you might be able to do is enable archiving and write a script to count the raw messages (i.e. newlines). Something like this on each raw message file should work:

# zcat rm-5330-533-1207744873_2008-04-09-12-40-31_2008-04-09-12-42-38.gz | wc -l

I can get some data (1 day,2 days,1 week,1 month,1 year) from the SUMMARY page (on the top left hand side) although I'd like to understand whether the 1 day data regards the last 24 hrs. or if it refers to the previous calendar day? Thanks for your help!

absolutely, but you can't really report on it (for trending, management reports, etc), you have to manually capture it. The "one day" is updated throughout the day, at least a couple times an hour, so appears to be the last 24 hours as of the update time.

I have looked at utilizing this window for rough trending as well, and I have learned that the "month" option appears to actually be five weeks. Just something to keep in mind if you try and use these numbers for something.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: