MARS archiving

[mohamed-djeddi]

Hi everyone,

I know that archiving start from the time you set up the archiving, but  I want to manually archive the event from CS-MARS is there a way to do it?

Thanks

Moh

[Scott Fringer · Accepted solution]

Moh;

  Data archiving is the preferred method as it allows the CS-MARS to continue receiving events while the data archive occurs.

  As of CS-MARS release 6.0.1; for a one-time 'snap-shot' of the events currently stored on the CS-MARS you can make use of the pnexport facility of the command-line.  The pnexport facility is described here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/command/reference/cref1.html#wp1137699

Scott

[mohamed-djeddi]

Thanks Scott,

MARS won't receive any data while doing pnexport, correct?

Thanks,

Moh

[Scott Fringer · Accepted solution]

Moh;

  That is correct, CS-MARS stops receiving data during the pnexport.  Once the pnexport is complete, you will need to restart/reboot the CS-MARS to regain event processing.

Scott

[mohamed-djeddi]

Thank you so much Scott