MARS data retention

ahuffer · ‎08-29-2008

We currently have MARS archiving every 10 days to an NFS mount that is configured in the web interface.

Our quesition essentially is if we didn't do the archive at all, what would be the expected retention level of the data inside the appliance. This of course depends on how much data is being sent, but we are curious as to whether there is a fixed timeframe that MARS automatically removes old data or at least begins to overwrite.

The only other thing we heard is that when an archive is executed to the NFS mount, that data is then removed from the database.

We are running MARS-100 (750GB), version 4.3.5 (2838).

Thanks for any help that can be provided!!!

/ahuffer/

Farrukh Haroon · ‎08-29-2008

The MARS from time to time generates events to tell you when your hard drives are expected to fill. Also there is a CLI command pndbusage to see this information. You can also query some MARS system events to find about this. For more information have a look at this:

http://ciscomars.blogspot.com/2006/10/cs-mars-database-info.html

Regards

Farrukh

mhellman · ‎08-29-2008

"We currently have MARS archiving every 10 days to an NFS mount that is configured in the web interface. "

that's not really possible, but I may just be misinterpreting what you're trying to say. The config data is backed up to the archive each night. event data is written throughout the day. Do you mean you have "Remote Storage Capacity in Days" set to 10 days?

"Our quesition essentially is if we didn't do the archive at all, what would be the expected retention level of the data inside the appliance"

I don't believe archiving has anything to do with the local retention of "dynamic data" on the MARS box. Farrukh mentioned a couple ways to dig into this. The event that triggers is "CS-MARS DB partition filling up causing the next partition to be purged soon". This event should create an incident in your queue. In the raw message it gives details about what is happening. It is essentially the same info provided by the CLI command "pndbusage". Here's an example:

"Current partition started on Wed Aug 27 23:05:07 CDT 2008 and uses 68.2% of its available capacity.

Switching to next partition is estimated for Sat Aug 30 14:01:48 CDT 2008.

4e+08 events, received between Mon Jul 28 09:14:05 CDT 2008 and Wed Jul 30 10:57:19 CDT 2008 will be purged."

This is from a 210 running at about 1/3 capacity and it keeps dynamic data for about 1 month. If you're running close to capacity, your dynamic data will get FIFO'd out faster than that.

"The only other thing we heard is that when an archive is executed to the NFS mount, that data is then removed from the database. "

I do not believe that is true. archiving isn't even required so I'm not sure how it could be tied in this manner. This could cause major problems if archiving was enabled but not working or slow for some reason.