cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
280
Views
0
Helpful
2
Replies

CS-MARS Question

tinu.karki
Level 1
Level 1

For a site with 300 users is the CS-MARS 20R sufficient or do we need to scale up to 110R?

2 Replies 2

diptanshusingh
Level 1
Level 1

i think it depends upon the eps your cs-mars is getting. try to find the eps rate which your mars-box is getting from your logging devices then according to that you can plan for the right box.

I agree with Diptanshu regarding trying to figure out your EPS (Events Per Second) rate first then sizing your box.

Then remember this guideline:

Size the box to be capable of handling 3 times the low end of your EPS (Events Per Second) and also to be capable of handling 6 times your estimated high side EPS.

Here are the guidelines for Generation 1 Boxes:

1. MARS 20

(EPS) = 500 Events Per Second

Netflow = 15,000 Events Per Second

Storage = 120gig (No RAID)

2. MARS 50

(EPS)= 1,000 Events Per Second

Netflow = 25,000 Events Per Second

Storage = 240gig

3. MARS 100e

(EPS) = 3,000 Events Per Second

Netflow = 75,000 Events Per Second

Storage = 750gig

4. MARS 100

(EPS) = 5,000 Events Per Second

Netflow = 150,000 Events Per Second

Storage = 750gig

5. MARS 200

(EPS) = 10,000 Events Per Second

Netflow = 300,000 Events Per Second

Storage = 1,000gig

I haven't worked much with the 2nd Generation of MARS boxes but here are some of the claims:

Next Generation MARS Appliances:

All the new MARS G2 appliances are 2U in form factor, have dual-PSU and have fewer disk drives, which offers an increase in overall reliability.

They will deliver up to 2x the storage and 1.5x the performance of the old generation 1 appliances.

These new appliances will run the v5 track of software, which offers many new enhancements.

New Gen2 Software Enhancements:

A new Enhanced pnrestore options to restore data in time slices.

New Support for raw messages greater than 500 bytes.

A New keyword search process.

Super New IP log enhancements for viewing IPS IP packets.

A licensing upgrade will be available for customers on 110R to upgrade to the 110 platform.

Hope this helps.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: