CS-MARS Archiving procedure

[chrisgillies]

Got a customer with a CS-MARS-100E-K9 appliance, and we're looking at the archiving procedure on the device in order to back it up in case of future disaster recovery.

The limited documentation I can find seems to contradict itself, where in one place it says that the default archive/restore will also archive the OS as well as all config and dynamic data (implying that it is basically a disk image of the appliance), yet in another says that I'll need to re-image to the version of software that the data comes from before I can restore anything. Can anyone clear up the following:

1 - Does the archive procedure essentially run like a disk-image backup, where re-running the pnrestore will bring a blank appliance back up to (for example) version 4.2.2 with all the config and dynamic data present?

or

2 - Will I need to reinstall up to version 4.2.2 and then run the pnrestore?

Thanks in advance.

[mhellman]

The documentation pertaining to the pnrestore functionality is indeed horrible, but I've never really questioned that aspect of it.

At least certain parts of the archived data (the raw events and sessions) appear to be some sort of sql export. They are compressed text files. I would guess that the other database related information is not a disk image either, there are many files. The OS info might be, but I'm not sure it matters.

I have used pnrestore a couple times and it appears that all the work is done and then the system is rebooted. To me this would imply that the version of pnrestore being used is critical to the process. Trying to use the pnrestore that came with 3.x to restore 4.x data doesn't seem likely to succeed. If you're going to try it, I would be sure to get Cisco's input because even if it works in the current version, it may not 3 versions from now when you need it.

[pmccubbin]

I posed this same question to Dale Tesch, the author of an excellent Cisco Press book on the subject of MARS. He is a current Cisco employee who came aboard when Cisco bought Protego.

He said that more important than the version of software is the model size of the MARS box. For instance, you must restore data collected from a MARS 100 to another MARS 100 or larger. You couldn't reliably restore data collected from a MARS 100 to a MARS 50.

I didn't pin him down on whether this was true in a situation where you have version 3.x data collected from a MARS 100 box and you are trying to do a pnrestore to a box loaded with 4.x

Hope this helps.

[rbmcnutt]

You must match the version of the pnrestore command with the archive version. As subtle changes occur in the data, the pnrestore command is synchronized to ensure all data is properly restored.