I noticed my MARS box is at signature level 358 released in mid Sept. I am using auto updates. The latest IPS signature release is 361. Any ideas why there is a delay for MARS to support the new signatures?
Mars is roughly a month behind. I don't check Mars' signature status regularly, so this could be the norm.
I had been checking one of our boxes quite frequently since the past few months and it almost always updated within 1-2 days of the signature release (IPS).
However I just checked now after looking at your post, and ours was also stuck at 358! I did a manual "Update Now" and it took me to:
Download Succeeded: CS-MARS downloaded IPS Signature file - IPS-CS-MARS-Sig-S360.zip
at Oct 21, 2008 08:34:16 AM
I wonder what is causing this.
Interesting. Sometime between my post and your post, MARS IPS S360 and S359 were posted. I guess the Cisco MARS team is a little behind.
Yup you are right, they were both release on oct 20:
It seems the XML is broken from Cisco, if I put the MARS update URL in the browser I get:
Whereas previously it would give a URL for the CCO download page AFAIR.
Also after seeing the above URL it seems a gap of 10-15 days between IPS and MARS signature releases is common.
There was an issue with the process that was to get the XML updates for the signature posted. That has been corrected and the signature updates were posted over the past weekend.
The MARS IPS signature updates should post to CCO approx. 24 hours after new IPS updates post.
We are facing the same issue again with MARS signature updates, anybody else facing the same issue?
MARS Version: 4.3
Download Failed: CS-MARS could not download IPS Signature file
at Dec 19, 2009 03:46:13 AM AST
If I manually put the MARS update URL in the browser:
xml version="1.0" encoding="UTF-8" ?>
We used to get this error as well, until I found this new URL embedded in MARS documentation:
Works ok for us now.
My MARS broke on December 2nd. I'm using the new URL and I get the same output as farrukh noted.
"This XML file does not appear to have any style information associated with it. The document tree is shown below.
back to manual updates :-(
Even tough I kept seeing the same input..parsing errors in the browser for the new link. it worked when I entered it into MARS! However the websites/IPs used by MARS to update the packages from the Cisco website have changed. So if you have a firewall blocking those, you might have to fix that.