12-11-2008 10:59 AM
I am having an issue with the performance of my MARS box and I am wondering if anyone has any thoughts before I open up a case with TAC.
I just got this applicance installed and up and running last week. Its a 110R (4500 events/second, 75,000 netflow/second), version 6.0.1 (3066) 30. It is currently receiving about 75 netflow/second and about 5 events/second. I have used 1.47% of the available capacity of the first partition. Obviously the system is being under utilized at this point.
However, pulling up reports and pages within MARS is terrible. For example, just going to the dashboard may take two or three refreshes before the page actually displays. Usually is just spins it wheels until I hit refresh and then it displays the page right away. The same thing with running a custom query. I will make something real simple, a specific event for all devices for the past 3 hours, and it will run and run and run for minutes and never display. Maybe after the third or fourth try will I get the report to come up.
I am wondering what the issue is here. I am running the latest release, its brand new and its under utilized. Please help if you have any ideas. Thanks!
Solved! Go to Solution.
12-12-2008 05:01 AM
Hi
I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.
I mostly access the MARS from within a routed "all access" network and has no problems there.
/Fredrik
12-12-2008 05:01 AM
Hi
I have the exact same problem when I access the MARS from certain points in our network. I haven't troubleshot my problem further than it might have something to do with my FWSM, I only have the same problem as you with having to refresh the dashboard when I access the MARS through a firewall with a static firewall entry.
I mostly access the MARS from within a routed "all access" network and has no problems there.
/Fredrik
01-14-2009 06:51 AM
I did some testing and the servers that were local to the same subnet as MARS didnt seem to have an issue with the page freezing or timing out. Yesterday I removed my FWSM from that subnet and everything has been working fine ever since. The FWSM had a permit ip any any as well so its weird that it was actually having an effect.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide