Slow Queries

[patwill66_2]

Does anyone else have issues with slow queries? I am running ver 6.0.3 (3188) 31 and I have a 110R. It will take upwards of 10 minutes to generate a query from the past hour. It doesnt seem to help if its filtered for a device, or a keyword or anything. It just takes forever. It does seem to go a little quicker for devices that dont have many logs, but it still seems too slow. I have used other syslog products like Kiwi syslog, Orion syslog and Splunk and they are all very fast. MARS is painfully slow, almost to the point where its annoying to use. I just wanted to know if its just my system or if everyone has this issue.

[Farrukh Haroon]

It doesn't take that long. Its either that version or your box.

Try to restart the MARS services using the command line.

Regards

Farrukh

[dingall]

I have the same problem. It started when we upgraded the appliance from version 4 to version 6.

I had a TAC case open a few weeks back and was told it was a known issue in 6.0.2 (the workaround on Cisco's site was listed as "patience"!!) and that 6.0.3 would fix it. We've now upgraded to 6.0.3 and still have the same problem.

It's not a problem with the capacity of the appliance as it's only dealing with about 10% of the number of requests it's spec'd for so it looks like I'm going to have to go back to Cisco again.

If anyone has any suggestions in the meantime though I'd be happy to hear them!

[Mubasher Sultan - 2x CCIE # 20149 (R&S | Sec)]

Hi,

Did you solve this issue???

I am getting a same issue...

My Box = 110R & SW Version = 5.3.2 (2764)

Regards,

Mubasher