cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1065
Views
5
Helpful
4
Replies

pnrestore (simple) question

randytoni
Level 1
Level 1

hi all

my eyes are bleeding from trying to sort out the nuances in the docs regarding data restores.

what is the corrent command to restore just the event data (dynamic) from archive?  I don't need config or O/S restored


also, does the restore command stop any of the CS MARS processes?  i.e. is the box off line while the data is restored?

is there a reboot at the end of the process?

also would like some (even rough) idea as to how long it would take to import data - even some kind of benchmark estimates

my apologies if this info is anywhere in the docs - the CLI syntax is documented but it appears there are some typo's, etc. and I don't trust it.

thanks

1 Accepted Solution

Accepted Solutions

You're certainly welcome.

And yes, you're probably looking at several hours for the restore as both amount of data and available bandwidth between archive server and CS-MARS will impact timing.  It may be helpful to restore a single day's worth of data, time that process and then calculate the remaining days - granted, this is only a ballpark.

Scott

View solution in original post

4 Replies 4

Scott Fringer
Cisco Employee
Cisco Employee

The full command reference for pnrestore can be found here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/command/reference/cref1.html#wp1138977

There is not an option to exclude the configuration, as CS-MARS needs to ensure the configuration matches for the data being restored.

Services will be stopped as the configuration is restored and a reboot will be necessary.

The restore can take anywhere for under and hour to several hours depending on the amount of data being restored.

Scott

thanks Scott - we have about 2 months worth of archives - which represents the entire available disk space (@500 GB) on an older gen 1 apppliance (110E) - anybody want to hazard a guess as to restore time?  my gut feeling is several hours

thanks for the info...

You're certainly welcome.

And yes, you're probably looking at several hours for the restore as both amount of data and available bandwidth between archive server and CS-MARS will impact timing.  It may be helpful to restore a single day's worth of data, time that process and then calculate the remaining days - granted, this is only a ballpark.

Scott

thanks again - sanity checks appreciated.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: