Issue with MARS Performance

Answered Question
Dec 11th, 2008

I am having an issue with the performance of my MARS box and I am wondering if anyone has any thoughts before I open up a case with TAC.

I just got this applicance installed and up and running last week. Its a 110R (4500 events/second, 75,000 netflow/second), version 6.0.1 (3066) 30. It is currently receiving about 75 netflow/second and about 5 events/second. I have used 1.47% of the available capacity of the first partition. Obviously the system is being under utilized at this point.

However, pulling up reports and pages within MARS is terrible. For example, just going to the dashboard may take two or three refreshes before the page actually displays. Usually is just spins it wheels until I hit refresh and then it displays the page right away. The same thing with running a custom query. I will make something real simple, a specific event for all devices for the past 3 hours, and it will run and run and run for minutes and never display. Maybe after the third or fourth try will I get the report to come up.

I am wondering what the issue is here. I am running the latest release, its brand new and its under utilized. Please help if you have any ideas. Thanks!

I have this problem too.
0 votes
Correct Answer by hoffa2000 about 7 years 11 months ago

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
hoffa2000 Fri, 12/12/2008 - 05:01

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

patwill66_2 Wed, 01/14/2009 - 06:51

I did some testing and the servers that were local to the same subnet as MARS didnt seem to have an issue with the page freezing or timing out. Yesterday I removed my FWSM from that subnet and everything has been working fine ever since. The FWSM had a permit ip any any as well so its weird that it was actually having an effect.

Actions

This Discussion