pnrestore (simple) question

Answered Question
May 21st, 2010
User Badges:

hi all


my eyes are bleeding from trying to sort out the nuances in the docs regarding data restores.


what is the corrent command to restore just the event data (dynamic) from archive?  I don't need config or O/S restored


also, does the restore command stop any of the CS MARS processes?  i.e. is the box off line while the data is restored?


is there a reboot at the end of the process?


also would like some (even rough) idea as to how long it would take to import data - even some kind of benchmark estimates


my apologies if this info is anywhere in the docs - the CLI syntax is documented but it appears there are some typo's, etc. and I don't trust it.


thanks

Correct Answer by Scott Fringer about 6 years 11 months ago

You're certainly welcome.


And yes, you're probably looking at several hours for the restore as both amount of data and available bandwidth between archive server and CS-MARS will impact timing.  It may be helpful to restore a single day's worth of data, time that process and then calculate the remaining days - granted, this is only a ballpark.


Scott

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Scott Fringer Mon, 05/24/2010 - 06:16
User Badges:
  • Cisco Employee,

The full command reference for pnrestore can be found here:


http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/command/reference/cref1.html#wp1138977


There is not an option to exclude the configuration, as CS-MARS needs to ensure the configuration matches for the data being restored.


Services will be stopped as the configuration is restored and a reboot will be necessary.


The restore can take anywhere for under and hour to several hours depending on the amount of data being restored.


Scott

randytoni Tue, 05/25/2010 - 07:04
User Badges:

thanks Scott - we have about 2 months worth of archives - which represents the entire available disk space (@500 GB) on an older gen 1 apppliance (110E) - anybody want to hazard a guess as to restore time?  my gut feeling is several hours


thanks for the info...

Correct Answer
Scott Fringer Tue, 05/25/2010 - 07:12
User Badges:
  • Cisco Employee,

You're certainly welcome.


And yes, you're probably looking at several hours for the restore as both amount of data and available bandwidth between archive server and CS-MARS will impact timing.  It may be helpful to restore a single day's worth of data, time that process and then calculate the remaining days - granted, this is only a ballpark.


Scott

Actions

This Discussion