Report Stopped Working

Unanswered Question
Mar 6th, 2009
User Badges:

I used to get the report "Activity: Spyware - Top Hosts". For the last few weeks the report shows nothing (no data). Any ideas on how to get this report populated again? I have rebooted MARS and that didn't help. Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Farrukh Haroon Fri, 03/06/2009 - 23:07
User Badges:
  • Red, 2250 points or more

The first step would be to check if the reporting device is actually feeding this data into MARS? Have you verified that.


Regards


Farrukh

PaulWelc Mon, 03/09/2009 - 08:39
User Badges:

Hi Farrukh, I'm not sure what feeds this report, is there a way to tell? I have an IPS in my ASA, also have Active Directory sending reports to MARS.


Event type: Penetrate/Backdoor/Spyware/Response

Query Type: Source IPs ranked by Sessions

Time: 1d-0h

PaulWelc Tue, 03/10/2009 - 06:44
User Badges:

Farrukh, great idea, the only problem I chose to show me the report for a month, and for a year and MARS immediately comes back without data. I know I had data from the last year in this report( probably 3 months ago). I choose "Year" then click "display report" and 1 second later it comes back blank like it didn't try to pull the data.

Farrukh Haroon Tue, 03/10/2009 - 06:50
User Badges:
  • Red, 2250 points or more

Can you logon to the CLI (SSH) and restart the MARS services? Usually MARS should make this large time-span query as a

'Batch Query' (and not inline), which would be delivered to your email inbox (if configured).


Regards


Farrukh

PaulWelc Tue, 03/10/2009 - 06:53
User Badges:

I can try this, though I did reboot MARS last week and still didn't get the report. I double checked my IPS module in my ASA to make sure it is sending alerts to MARS, it is. Thanks for all of your help!

Actions

This Discussion