This is an excellent question!
You can migrate devices by using a seed file, though I believe the archived data couldn't migrate because the 110R runs a different version of software, that is, the 5.x train.
I checked the documentation and there were no clear cut explanations, except for this:
The version of MARS software running on the appliance to be restored must match the version recorded in the archive. For example, if the data archive is for version 4.1.4, you must reimage the MARS Appliance to version 4.1.4, not older or newer, before using the pnrestore command to recover the system configuration and events.
Since the newer MARS box you want to migrate to runs a different train of software my opinion is that you can't fully migrate from a 50 to a 110R.
Hope this helps.
I just spoke with Cisco and they are working on a tool to migrate data from 4.x to 5.x
No word on when this will be available.
Hope this helps.
This is been posted before but I'd like to hear any firsthand accounts from people who have done the migration. Thanks!
From the MARS 5.3.1 Release notes:
"Beginning with this release, you can migrate configuration and event data from a MARS Appliance running 4.x to a newer model running 5.x. For detailed instruction on how to perform this operation, see Migrating Data from Cisco Security MARS 4.x to 5.3.x. at the following URL:
Thanks in advance!
The export data process fails with the following error:
OOct 8 11:37:10.605 2007@LM_INFO@Thread 1024:START DATA EXPORTING...
Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: nfs_path = 10.24.9.153:/archivio/csmarsold/migration/nwmars01_2007-1
Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 01/01/01:00
Oct 8 11:37:10.683 2007@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchive
Oct 8 11:37:12.127 2007@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...
Oct 8 11:37:12.127 2007@LM_INFO@Thread 1024:Retrieving statistics of pn_report_result table...
Oct 8 11:37:12.141 2007@LM_INFO@Thread 1026:Entering data mover thread
Oct 8 11:39:58.980 2007@LM_ERROR@Thread 1024:SQL exception caught while exporting report result data: ORA-01652: unable to
extend temp segment by 64 in tablespace TEMP
Oct 8 11:39:58.980 2007@LM_ERROR@SQL statement executed: select /*+ INDEX_DESC (pn_report_result_ie2) */ REPORT_ID, RUN_T
IME, BUCKET_SIZE, ITEM_RANK, ITEM_COUNT, ITEM_VALUE, ITEM_TYPE, ZONE_ID from pn_report_result where RUN_TIME >= :1 and RUN_T
IME <= :2 order by run_time desc
Oct 8 11:39:58.980 2007@LM_INFO@Thread 1024:Total number of report result entries exported: 0
Oct 8 11:39:58.980 2007@LM_ERROR@Thread 1024:EXPORTING REPORT RESULTS FAILED!
Oct 8 11:39:58.980 2007@LM_CRITICAL@Thread 1024:PROGRAM ABORTS BECAUSE OF ERROR!
Now I don't know how to do !
Are you exporting from 4.3 to 5.3?
I mention this because the error:
"exception caught while exporting report result data: ORA-01652: unable to
extend temp segment by 64 in tablespace TEMP"
seems to indicate a mismatch in the database tables.
If you are expecting from 4.2 to 5.3 then this is the sort of error I would expect. The tables are changed when you go from one version to the next higher one.
I would recommend being at the parallel version of software 4.3 before you try to export to 5.3.
Let us know how you it turns out.
Hope this helps.
The only other thing would be to find out what this means:
"Oct 8 11:37:10.605 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 01/01/01:00"
Does this indicate a mismatch in the Time on the MARS box and the Time on the NFS box? If the times are more than 5 minutes off this could be your problem.
Let me know.
Hi, today the export finished successfully !
I think you cannot execute the pnexp the same day of the 4.3.1 upgrade.
During the night the system obtains the requirewd space