Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Creating a query or report in MARS

I need to create reports for two things:

How many users (IPs) hit our website more than once per day,

and How many users browse our site for more than 20 minutes at a time.

Since these "events" are normal and not breaking any "rules" can I query or report on them?

I have an FWSM and an IDSM2 behind that (inside) logging to the MARS.

2 REPLIES
Gold

Re: Creating a query or report in MARS

Because of the way the HTTP protocol works,

what you're asking for would be very difficult [if not impossible] to do reliably based soley on events coming info CSMARS from FWSM and IDSM2.

If you really want to do this, your best bet is to use a tool to analyze the actual web server logs.

New Member

Re: Creating a query or report in MARS

Thanks, I needed a sanity check.

I was able to do a query that I believe gave me the "top source" ip's for my site but the duration was not doable.

-Scott

122
Views
4
Helpful
2
Replies
CreatePlease to create content