LINICKX.com

Cisco Mars Event Correlation Diagram

nick — Mon, 26 Jan 2009 09:10:00 +0000

[caption id="attachment_772" align="alignnone" width="300" caption="Mars Events Diagram"][/caption]

Link to Cisco MARS Parser Packages

nick — Thu, 18 Dec 2008 12:20:00 +0000

One of the things MARS 6.x boasts is the ability to share custom parsers, the thing is finding the sharing page on the pro-net forum is a bit of a nightmare, well this thread found the answer ...

Link to Cisco Mars Custom Parser Packages

MARS: Zone product or package version does not match

nick — Wed, 03 Dec 2008 13:01:00 +0000

I've been having problems getting my Cisco MARS Local and Global controllers to synchronise their topologies. This error message vexed me for a few days, but thankfully Cisco's TAC solved it for me.

If you read Ciscos troubleshooting guides they will tell you to check that the MARS Local & Global controllers are running the same version, and to check that the SSL certificates are copied/pasted correctly.

If after checking the above Cisco recommendations and the additional basics ( network connectivity / ntp / timezones etc) check that both MARS boxes are running and have downloaded the same version of IPS signatures; under Admin -> IPS Signature Dynamic Update Settings -> Update Now.

It fixed the problem for me!