CS-MARS 4.3 any support for VMWARE and NetApp servers

Unanswered Question
Jan 16th, 2009
User Badges:
  • Bronze, 100 points or more

I've been asked to look at adding vmware and netapp servers into MARS 4.3.


I've never worked on either OS, apart from vmware on windows. What issues if any should I be aware of?


Am I limited to receiving syslog data only, assuming these OS's will generate such data.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
rajett Tue, 01/20/2009 - 07:08
User Badges:
  • Cisco Employee,

You are limited to syslog data only unless it's a Window's platform. There you can use the snare agent to send information that is kept in one of the Windows Event Logs supported by snare.


Beware that you will need to configure custom parsing as those are not natively supported systems. If running on Windows or generic Linux, use MARS 6.0.1 or newer as the new DSF (Device Support Framework) functions now allow for extending native parsers with custom parser entries.

aacole Wed, 01/21/2009 - 02:23
User Badges:
  • Bronze, 100 points or more

Thanks, as I've not worked on MARS for a while I wasnt sure if there was any other way of supporting these OS's. I'm just going through the upgrade to 6.2 process, so may look at using the DSF functions.

Actions

This Discussion