Cisco Works Integration with MARS

talha_490 · ‎07-21-2010

Can cisco works be integrated with MARS. I mean cisco works is acting as a syslog server for some switches. Can mars pull the records from Cisco Works and use it for its co-relation

jtaliafe · ‎07-21-2010

Although you can add syslog relay servers and have them forward the syslog messages to MARS Ciscoworks does not have the capability to forward the messages.

Thanks,

mikecrowe4ICS_2 · ‎09-07-2010

It might help to know that you can log to both servers (MARS & CiscoWorks) concurrently from the switch. Simply add an extra "logging host x.x.x.x" command to the switch, where x.x.x.x is the IP for the MARS appliance. You can do this for each destination log server you have, though I'm not sure what the limit of entries is.

Scott Fringer · ‎09-10-2010

As Michael pointed out, configuring two syslog destinations on your switch is possible, and allows the switch to send to both CiscoWorks and CS-MARS simultaneously. This affords the safety that should one system be down, the other system will continue to receive syslog events from the switches. Should you not wish to configure two logging destinations on your switch, you could configure your switches to send their syslogs to CS-MARS and configure CS-MARS to relay the received syslog messages to CiscoWorks. This options is outlined in the CS-MARS user guide:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/cfgOver.html#wpmkr181270

Scott