Solved: Issue with MARS Performance

patwill66_2 · ‎12-11-2008

I am having an issue with the performance of my MARS box and I am wondering if anyone has any thoughts before I open up a case with TAC.

I just got this applicance installed and up and running last week. Its a 110R (4500 events/second, 75,000 netflow/second), version 6.0.1 (3066) 30. It is currently receiving about 75 netflow/second and about 5 events/second. I have used 1.47% of the available capacity of the first partition. Obviously the system is being under utilized at this point.

However, pulling up reports and pages within MARS is terrible. For example, just going to the dashboard may take two or three refreshes before the page actually displays. Usually is just spins it wheels until I hit refresh and then it displays the page right away. The same thing with running a custom query. I will make something real simple, a specific event for all devices for the past 3 hours, and it will run and run and run for minutes and never display. Maybe after the third or fourth try will I get the report to come up.

I am wondering what the issue is here. I am running the latest release, its brand new and its under utilized. Please help if you have any ideas. Thanks!

hoffa2000 · ‎12-12-2008

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

View solution in original post

hoffa2000 · ‎12-12-2008

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

patwill66_2 · ‎01-14-2009

I did some testing and the servers that were local to the same subnet as MARS didnt seem to have an issue with the page freezing or timing out. Yesterday I removed my FWSM from that subnet and everything has been working fine ever since. The FWSM had a permit ip any any as well so its weird that it was actually having an effect.