Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

MARS

How can I archive the entire MARS database?, I can set up archiving but this only archives events as they occur?

3 REPLIES

Re: MARS

Archiving in MARS will backup everything. I assume you have it configured pointing to a NFS share?

Have a look at the following table to have an idea about the different data types and their backup interval(s):

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/bckRstrSby.html#wp1170096

Btw, there is a dedicated forum for MARS :)

http://forums.cisco.com/eforum/servlet/NetProf?page=MARS_discussion

Regards

Farrukh

Community Member

Re: MARS

But it only appears to back up the new events.. how do I get everything?

Re: MARS

It will backup everything! However dynamic data BEFORE you enabled archiving is not backed up, as mentioned on the above link:

"When archiving is enabled, dynamic data is written twice: once to the local database and once to the archive server. As such, the dynamic data that is archived includes only the data that is received or generated after you enable the data archive setting. Therefore, we recommend that you enable archiving before configuring your appliance to receive audit events from reporting devices. "

You can do a manual backup using the CLI, as described by the Cisco engineer here:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_user_info%26location%3D.2cbeaa98/18&author=ghalleen

Regards

Farrukh

P.S I have never tested this method

206
Views
0
Helpful
3
Replies
CreatePlease to create content