topic MARS - rule lag in Network Security https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644402#M92204 <P>I created a rule and renamed it and then incativated it; Yesterday morning. I am not only still seeing new incidents on this inactive rule, the email notifications that are set up on this rule still reflect the original name of the rule. Is there something under the hood that isn't refreshing on MARS?</P> Sun, 10 Mar 2019 10:15:25 GMT mmorris11 2019-03-10T10:15:25Z MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644402#M92204 <P>I created a rule and renamed it and then incativated it; Yesterday morning. I am not only still seeing new incidents on this inactive rule, the email notifications that are set up on this rule still reflect the original name of the rule. Is there something under the hood that isn't refreshing on MARS?</P> Sun, 10 Mar 2019 10:15:25 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644402#M92204 mmorris11 2019-03-10T10:15:25Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644403#M92205 <HTML><HEAD></HEAD><BODY><P>I experienced the same issues on my MARS boxes. It definitely appears that there is a large (sometimes up to 1 day) lag on rule changes. I would say to give it a day before you pull your hair out...</P></BODY></HTML> Tue, 03 Oct 2006 15:17:09 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644403#M92205 jwalker 2006-10-03T15:17:09Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644404#M92206 <HTML><HEAD></HEAD><BODY><P>That's about what I have observed. Holy cow! I opened a TAC case on it. They are duplicating now. I'll let you know.</P></BODY></HTML> Tue, 03 Oct 2006 16:30:17 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644404#M92206 mmorris11 2006-10-03T16:30:17Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644405#M92207 <HTML><HEAD></HEAD><BODY><P>I STILL had this rule firing when I came in this am. I rebooted the appliance and all is well. I don't care for the idea of having to reboot the MARS every time I do rule work. No word back from TAC yet.</P></BODY></HTML> Wed, 04 Oct 2006 13:45:58 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644405#M92207 mmorris11 2006-10-04T13:45:58Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644406#M92208 <HTML><HEAD></HEAD><BODY><P>Did you click "activate" after making the changes?</P></BODY></HTML> Wed, 04 Oct 2006 13:53:20 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644406#M92208 mhellman 2006-10-04T13:53:20Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644407#M92209 <HTML><HEAD></HEAD><BODY><P>No. Based on the definition of that control it should have no effect but I'll try it. In the meantime my workaround is to issue pnstop and pnstart from the CLI. The rule changes always take effect immediately. TAC responded back with:</P><P></P><P>Hi Mike,</P><P> </P><P>I'm still trying to recreate this with our developers.</P><P>We had some success and failures.</P><P>We are trying to find the reason for this behavior.</P><P>I will let you know as soon as we find out.</P><P> </P><P>For the temporary workaround, please create a new report instead of modifying the existing report.</P><P> </P><P>Thank you for your patience.</P><P> </P><P> </P><P> </P><P>Edward</P><P></P><P>I don't think he really gets the problem at all because if the rule changes are not taking effect it doesn't matter how many times you run a new report on it. It still reports according to how it thinks it is set up.</P><P></P><P>-mike</P></BODY></HTML> Thu, 05 Oct 2006 13:28:20 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644407#M92209 mmorris11 2006-10-05T13:28:20Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644408#M92210 <HTML><HEAD></HEAD><BODY><P>IME, rule changes have always required clicking the "activate" button. The documentation, which is admittedly not so good, states this in a few places.</P></BODY></HTML> Thu, 05 Oct 2006 16:35:44 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644408#M92210 mhellman 2006-10-05T16:35:44Z Re: MARS - rule lag https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644409#M92211 <HTML><HEAD></HEAD><BODY><P>Looks like your right. Thanks.</P></BODY></HTML> Fri, 06 Oct 2006 13:08:41 GMT https://community.cisco.com/t5/network-security/mars-rule-lag/m-p/644409#M92211 mmorris11 2006-10-06T13:08:41Z