MARS

networker99 · ‎05-27-2009

How can I archive the entire MARS database?, I can set up archiving but this only archives events as they occur?

Farrukh Haroon · ‎05-28-2009

Archiving in MARS will backup everything. I assume you have it configured pointing to a NFS share?

Have a look at the following table to have an idea about the different data types and their backup interval(s):

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/bckRstrSby.html#wp1170096

Btw, there is a dedicated forum for MARS :)

http://forums.cisco.com/eforum/servlet/NetProf?page=MARS_discussion

Regards

Farrukh

networker99 · ‎05-28-2009

But it only appears to back up the new events.. how do I get everything?

Farrukh Haroon · ‎05-28-2009

It will backup everything! However dynamic data BEFORE you enabled archiving is not backed up, as mentioned on the above link:

"When archiving is enabled, dynamic data is written twice: once to the local database and once to the archive server. As such, the dynamic data that is archived includes only the data that is received or generated after you enable the data archive setting. Therefore, we recommend that you enable archiving before configuring your appliance to receive audit events from reporting devices. "

You can do a manual backup using the CLI, as described by the Cisco engineer here:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_user_info%26location%3D.2cbeaa98/18&author=ghalleen

Regards

Farrukh

P.S I have never tested this method