topic Re: MARS - events per second in Network Security

MARS - events per second

p-allen — Sun, 10 Mar 2019 10:46:34 GMT

How can I tell how many events per second our MARS 100 is receiving?

Re: MARS - events per second

mhellman — Fri, 31 Aug 2007 11:50:09 GMT

You can go into Admin->System Maintenance->View log files. Change the level to "info" and look for pnparser entries that look like this:

Thread 4101:PN-2016:message rate: 1416.305176 msgs/sec, total: 11200000 msgs, total avg rate: 723.042933 msgs/sec

Now, the last time I worked with Cisco TAC on a performance related issue...I was told these numbers weren't quite right(they were low), but they didn't tell me why. That was a long time ago though. We process over 90 million events/day on this MARS. That averages to over 1000 events/sec. At 7:30am on a weekday (even on a Friday morning before a holiday weekend), I would except numbers HIGHER than the average, not lower. So, I don't know what to think.

Re: MARS - events per second

jserevitch — Sat, 01 Sep 2007 17:37:21 GMT

from the summary page the second graph down on the left is what you will need to look at. Purple are netflow events and dark blue are non-netflow events. These are calculated per minute. By reviewing the graph it should be obvious what the sustained rates are as well as your peaks and troughs.

Re: MARS - events per second

p-allen — Tue, 04 Sep 2007 11:31:12 GMT

Thanks both of you. It looks like we are at 27 events per second. Still room to grow 🙂