Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Issue with MARS Performance

I am having an issue with the performance of my MARS box and I am wondering if anyone has any thoughts before I open up a case with TAC.

I just got this applicance installed and up and running last week. Its a 110R (4500 events/second, 75,000 netflow/second), version 6.0.1 (3066) 30. It is currently receiving about 75 netflow/second and about 5 events/second. I have used 1.47% of the available capacity of the first partition. Obviously the system is being under utilized at this point.

However, pulling up reports and pages within MARS is terrible. For example, just going to the dashboard may take two or three refreshes before the page actually displays. Usually is just spins it wheels until I hit refresh and then it displays the page right away. The same thing with running a custom query. I will make something real simple, a specific event for all devices for the past 3 hours, and it will run and run and run for minutes and never display. Maybe after the third or fourth try will I get the report to come up.

I am wondering what the issue is here. I am running the latest release, its brand new and its under utilized. Please help if you have any ideas. Thanks!

  • MARS
1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: Issue with MARS Performance

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

2 REPLIES
New Member

Re: Issue with MARS Performance

Hi

I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.

I mostly access the MARS from within a routed "all access" network and has no problems there.

/Fredrik

New Member

Re: Issue with MARS Performance

I did some testing and the servers that were local to the same subnet as MARS didnt seem to have an issue with the page freezing or timing out. Yesterday I removed my FWSM from that subnet and everything has been working fine ever since. The FWSM had a permit ip any any as well so its weird that it was actually having an effect.

146
Views
0
Helpful
2
Replies