cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
1056
Views
10
Helpful
3
Replies
talha_490
Beginner

Cisco Works Integration with MARS

Can cisco works be integrated with MARS. I mean cisco works is acting as a syslog server for some switches. Can mars pull the records from Cisco Works and use it for its co-relation

3 REPLIES 3
jtaliafe
Cisco Employee

Although you can add syslog relay servers and have them forward the syslog messages to MARS Ciscoworks does not have the capability to forward the messages.

Thanks,

mikecrowe4ICS_2
Beginner

It might help to know that you can log to both servers (MARS & CiscoWorks) concurrently from the switch.  Simply add an extra "logging host x.x.x.x" command to the switch, where x.x.x.x is the IP for the MARS appliance.  You can do this for each destination log server you have, though I'm not sure what the limit of entries is.

As Michael pointed out, configuring two syslog destinations on your switch is possible, and allows the switch to send to both CiscoWorks and CS-MARS simultaneously.  This affords the safety that should one system be down, the other system will continue to receive syslog events from the switches.  Should you not wish to configure two logging destinations on your switch, you could configure your switches to send their syslogs to CS-MARS and configure CS-MARS to relay the received syslog messages to CiscoWorks.  This options is outlined in the CS-MARS user guide:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/cfgOver.html#wpmkr181270

Scott

Content for Community-Ad