Report Stopped Working

Unanswered Question
Mar 6th, 2009

I used to get the report "Activity: Spyware - Top Hosts". For the last few weeks the report shows nothing (no data). Any ideas on how to get this report populated again? I have rebooted MARS and that didn't help. Thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Farrukh Haroon Fri, 03/06/2009 - 23:07

The first step would be to check if the reporting device is actually feeding this data into MARS? Have you verified that.



PaulWelc Mon, 03/09/2009 - 08:39

Hi Farrukh, I'm not sure what feeds this report, is there a way to tell? I have an IPS in my ASA, also have Active Directory sending reports to MARS.

Event type: Penetrate/Backdoor/Spyware/Response

Query Type: Source IPs ranked by Sessions

Time: 1d-0h

PaulWelc Tue, 03/10/2009 - 06:44

Farrukh, great idea, the only problem I chose to show me the report for a month, and for a year and MARS immediately comes back without data. I know I had data from the last year in this report( probably 3 months ago). I choose "Year" then click "display report" and 1 second later it comes back blank like it didn't try to pull the data.

Farrukh Haroon Tue, 03/10/2009 - 06:50

Can you logon to the CLI (SSH) and restart the MARS services? Usually MARS should make this large time-span query as a

'Batch Query' (and not inline), which would be delivered to your email inbox (if configured).



PaulWelc Tue, 03/10/2009 - 06:53

I can try this, though I did reboot MARS last week and still didn't get the report. I double checked my IPS module in my ASA to make sure it is sending alerts to MARS, it is. Thanks for all of your help!


This Discussion