Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Measuring Events on MARS

Hi, I'd like to extract statistical data regarding the number of events that have been processed by a MARS Local controller. My MARS has got a limit of 5000 events when extracting raw messages (which is about 20 minutes of events in my setup): how can I get data regarding a day, week, etc.? Will a "Top Destination Port" report provide me with the total number of events or do those numbers refer to sessions ? I ran both "Top Destination Ports" and "Top Destinations" over the same period of time expecting the overall totals to be the same, but they were not and now I feel confused. Can someone provide some insight? Thank You

4 REPLIES
Gold

Re: Measuring Events on MARS

I don't think it's possible using the GUI. MARS does not allow reporting based on events, only sessions. It's kind of a curious limitation since the devices are rated based on events over time.

What you might be able to do is enable archiving and write a script to count the raw messages (i.e. newlines). Something like this on each raw message file should work:

# zcat rm-5330-533-1207744873_2008-04-09-12-40-31_2008-04-09-12-42-38.gz | wc -l

New Member

Re: Measuring Events on MARS

I can get some data (1 day,2 days,1 week,1 month,1 year) from the SUMMARY page (on the top left hand side) although I'd like to understand whether the 1 day data regards the last 24 hrs. or if it refers to the previous calendar day? Thanks for your help!

Gold

Re: Measuring Events on MARS

absolutely, but you can't really report on it (for trending, management reports, etc), you have to manually capture it. The "one day" is updated throughout the day, at least a couple times an hour, so appears to be the last 24 hours as of the update time.

New Member

Re: Measuring Events on MARS

I have looked at utilizing this window for rough trending as well, and I have learned that the "month" option appears to actually be five weeks. Just something to keep in mind if you try and use these numbers for something.

126
Views
4
Helpful
4
Replies