Retrieve Raw Data from Mars

[ssweehinlew]

Is there any ways to retrieve Raw data by using cmd (putty, winscp), scripts rather than GUI method from Mars? By using GUI method, I can only retrieve raw data within short period of time at one time and require a lot of user intervention.

[Justin Teixeira]

Hi Ssweehinlew,

    You can get a composite of all of the raw messages the MARS receives, arranged chronologically, by configuring the archiving on the device.  Once archiving has been configured, check the archiving location to find a list of folders which are named with a date - each folder represents one day of archiving.  Within each folder you will find another folder named "ES" and in that folder you will find one or more gzip files beginning with the letters "rm".  These zip files contain flat files with all of the raw messages received for the particular day of the parent folder. Copy these gzip files to another location before opening them.

Other than this method and the GUI, there is no way to retrieve raw messages from the MARS.

-JT

[ssweehinlew]

I have configured the Windows NFS server according to the guide under the link 

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/5.3/installation/guide/admin.html#wp1182700

but it is keep showing Error: Invalid Remote Directory Permission Setting, unable to write.

Based on the NFS Activity log,

task= mount result=success

task=unmount result=success

within 1 second

Any idea?

[Farrukh Haroon]

Hello

Can you please recheck all the steps mentioned in the documented you posted?

A screenshot of the NTFS permissions page for your archive folder and the output of the below command would also help

cd C:\archive 

cacls MARSBackups

Please replace the above with the directory in your environment.

Regards

Farrukh

[ssweehinlew]

Hi,

I have re-created the new folder with c:\marsdata. It is still showing me the same result. 

Task = Mount success

Task = UMount success 

within 1 second.....

Is there any other ways to troubleshoot?