Home | Skip to Content | Skip to Search | Skip to Navigation | Skip to Footer |
Worldwide [change] |Register |About Cisco
Guest

Hierarchical Navigation

Cisco Security Monitoring, Analysis and Response System

Migrating Data from Cisco Security MARS 4.x to 5.3.x

Downloads

Table Of Contents

Migrating Data from Cisco Security MARS 4.3.x to 5.3.x

Before You Begin

Same Appliance Data Migration Work Flow

Different Appliance Data Migration Work Flow

pnexp Command: Migration Specific

pnimp Command: Migration Specific


Migrating Data from Cisco Security MARS 4.3.x to 5.3.x

Revised: September 12, 2008, OL-14671-01
Caution When migrating from 4.3.x to 5.3.x, the x is required to be the same number. For example, you can migrate from 4.3.5 to 5.3.5, but you cannot migrate from 4.3.2 to 5.3.5.

A primary difference between a 4.x and 5.x MARS Appliance is the underlying hardware; The 4.x versions run only on the following models: 20, 20R, 50, 100, 100e, 200, GC, and GCm. The 5.x versions run only on the following newer models: 110R, 110, 210, GC2R, and GC2.

When you move your configuration and event data from 4.x to 5.x, you are physically moving it from one appliance to another. This process is called data migration. In this document, we use the following terms and definitions:

•Source appliance. The older MARS Appliance running 4.x and the one for which the configuration and event data will be migrated. This appliance must be upgrade to 4.3.6 before the configuration data can be migrated.

•Target appliance. The newer MARS Appliance running 5.3.1 or later to that will assume the identify, responsibilities, and data store of the source appliance.

All of these tasks are command line interface commands, either from the MARS Appliance console or the NFS server console.

This chapter contains the following topics to guide you through this process:

•Before You Begin

•Same Appliance Data Migration Work Flow

•Different Appliance Data Migration Work Flow

For more information on using this feature, see the following commands:

•pnexp Command: Migration Specific

•pnimp Command: Migration Specific

For NFS archive server settings and command use details, see the Install and Setup Guide for Cisco Security Monitoring Analysis and Response System guide. For other configuration or administrative tasks, see one of the following guides, depending on the model of your appliance:

•User Guide for Cisco Security MARS Global Controller

•User Guide for Cisco Security MARS Local Controller

Before You Begin

Review the following notes before planning your data migration:

•On your NFS server, use mode 775 (or equivalent permissions) to support migrations from 4.x to 5.3.x.

Details. On your NFS server, you must use mode 775 to support a mixed environment of 4.x to 5.3.x software and when performing migrations from 4.x to 5.3.x. Due to difference of UID/GID between the 4.x to 5.x releases, you must allow r-x so an appliance running 5.3.x can import from files exported by a 4.x appliance.

•Migrate the Global Controller first and then the Local Controller. While a GC2 and GC2R can manage Local Controllers running 4.x software, a GCm or GC cannot manage a Local Controller running 5.x software. If you migrate a managed Local Controller first, it will revert to standalone mode.

Details. To migrate a Local Controller operating in managed mode, you must also migrate its managing Global Controller unless you plan to convert that Local Controller to standalone mode. If you plan to migrate both your Global Controller and Local Controller, migrate the Global Controller first and then the Local Controller. While a GC2 and GC2R can manage Local Controllers running 4.x software, the reverse is not possible (a GCm or GC cannot manage a Local Controller running 5.x software).

•Since a GC2R can only manage MARS models 20R, 20, 50, 25R, 25, and 55. Unless you have a GC2 to manage your appliances, do not attempt to migrate a MARS 20R, 20, or 50 to a MARS 110R, 110, 210. Instead, migrate these models to a 25R, 25, or 55 if you have a a GC2R.

•When migrating configuration and event data, the target appliance model must be a 5.x equivalent to or greater than the source 4.x appliance1 . For example, a MARS GCm can be migrated to either a MARS GC2R or MARS GC2; however, a MARS GC can only be migrated to a MARS GC2.

•When you import configuration data, it overwrites the configuration running on the target MARS Appliance and reboots the appliance. After rebooting, the target MARS Appliance assumes the IP address, hostname, and username/password of the source appliance from which the configuration archive was exported.

•To import archived event data, no minimum MARS software version is required to have created the archive; however, for configuration data exports, you must be running version 4.3.6 or later. Also, the MARS software version from which the configuration data is exported must be parallel with the target appliance version into which it will be imported.

Same Appliance Data Migration Work Flow

The most common customer scenario involves migrating a single appliance from 4.3.x to 6.0.1. This migration process differs slightly from one where the data is migrated from one appliance to a different appliance. It differs in the order of performing the steps.

This procedure describes the work flow to follow when migrating data from 4.3.6 to 6.0.1 on the same appliance. This procedure does not apply to migrating from one appliance to another (see Different Appliance Data Migration Work Flow), which can reduce the overall downtime of your MARS system.

Summary Steps

1. Export event data from the appliance.

2. Export config from the appliance.

3. Reimage the appliance.

4. Import config into appliance.

5. Import event data into appliance.

Note Depending on how large the data set is, exporting event data may take between several hours and a day. During the pnexp export operation, all MARS processes are stopped and the source appliance is unable to processing any events—the MARS Appliance is off line during the export.

To minimize the loss of event data, we recommend the following workflow:

Step 1 If the source appliance is attached to the network and operational, verify it is running version 4.3.6, and continue with Step 2. If source appliance is no longer available but it was running 4.3.6 and was configured to archive data, see Different Appliance Data Migration Work Flow. Otherwise, contact Cisco Technical Support for options.

To verify the running version, follow these steps:

a. Log in to the source appliance. For more information, see Log In to the Appliance via the Console.

b. At the [pnadmin]$ prompt, enter version to display the current version.

Result: The version number appears in the following format: major.minor.patch (build no.)

c. Verify that number is 4.3.6 (2841) or later. If not, upgrade the source appliance to 4.3.6 as described in Checklist for Upgrading the Appliance Software.

Note Do not re-image the source appliance at this time; you must upgrade to preserve configuration and event data.

Step 2 Assess the source appliance for the following requirements:

•If the source appliance is a managed Local Controller, suspend the Global Controller-to-Local Controller communication from the Global Controller's web interface.

•If the source appliance is a Global Controller, use it's web interface to suspend communications with all managed Local Controllers (Admin > System Setup > Local Controller Management).

Step 3 If archive is enabled on the appliance, disable it now using the web interface. For more information, see Configure the Data Archive Setting for the MARS Appliance.

Disabling archive at this stage, rather than earlier, ensures that the target appliance is configured to archive its data according to the same schedule as the source device. Disabling the source device ensures the two devices do not conflict.

Step 4 Determine whether to export event data from the source appliance. Event data is the data collected from reporting devices as well as derived by the MARS Appliance. If you have been archiving event data from the source appliance before this migration, you do not need to export the events from the source appliance. Select one of the following options:

•Import from archive. The archive does not need to be generated by a source appliance running 4.3.6.

•Export from source appliance. If you do not have an existing archive, export the event data from the source appliance to a NFS or SFTP remote server. To export event data from the source appliance, use the pnexp export data [remote-path] command. After export completes, continue with Step 5.

Tip Use the pnexp esti_time [MM/DD/YY:HH] command to estimate how long the event data export will take. Using this information, you can ensure that your time is not wasted waiting for the export to complete as well as ensure that the target appliance configuration is not delayed unnecessarily.

Note The times estimated by the export data and the esti_time commands assume a fast connection exists between the source appliance and the NFS or SFTP remote server, with data transfer speeds averaging 10 MB per second. If the actual transfer speeds are slower, the export operation can take much longer than estimated. We recommend using a remote server attached to a local network shared by the source appliance.

Caution If you have been archiving event data from the source appliance prior to this migration, the [remote-path] value for the export data [remote-path] command must not match the archive path used by the source appliance.

The following example specifies to export all event data received after 05/01/07:00 to the NFS server at 192.168.3.138. The event data is actually saved in a subdirectory of the [remote-path] value for the export data [remote-path] command. In this example, the path of the saved data is 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10. Write down this path as you must provide it in Step 10, where the event data is imported into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export data 192.168.3.138:/storage/mars_migration 05/01/07:0

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes

Estimated total number of events to export: 1401080357

Estimated time to export events: 12 hours 58 minutes

Estimated space for exported events: 66809 MB

Do you wish to continue (yes/no): yes

!!! The exported event data is saved at 

192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Restarting oracle ...

!!! Exporting data in background now, enter 'status' or 'log' to view data exporting 

status and/or logs.

The following tips provide guidance on successful export of the event data.

Tip As the event export process runs in the background, you can exit the pnexp> command prompt by entering the quit and subsequently log off from the source appliance. You can log back into the source appliance, enter pnexp and then log to check the data export status.

Q. How do I determine where the exported event data is saved?

A. To determine where the exported event data is saved, enter log all at the pnexp> command prompt. This command displays all log messages generated by the event data export process. The export path appears in the second line and resembles Parameter: nfs_path = 10.2.3.138:/storage/mars-migration/SJ-LC-220_2008-09-04-11-25-10, where 10.2.3.138 is the NFS or SFTP remote server and /storage/mars-migration/SJ-LC-220_2008-09-04-11-25-10 is the path to the exported event data. You are prompted to enter this path when you import event data into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> log all

!!! Enter 'Ctrl-C' to quit displaying log

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:START DATA EXPORTING...

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:Parameter: nfs_path = 
10.2.3.138:/storage/mars-migration/SJ-LC-220_2008-09-04-11-25-10

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:Parameter: event_start_time = 05/01/07:0

Sep  4 11:25:21.395 2008@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchive

Sep  4 11:25:22.677 2008@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...

Q. How do I determine whether the event data export is complete?

A. Event data export runs as a background process. To determine when event data export is complete, enter log at the pnexp> command prompt. This command displays the most recent log generated by the event data export process. If the log message resembles Sep 4 23:15:48.560 2008@LM_INFO@Thread 1024:DATA EXPORTING COMPLETED!, then the event data export is complete. Enter Ctrl-C to quit the log display.

Note If the remote server connection is slow, it may take a long time for messages to appear after the WAITING FOR THE DATA MOVER THREAD TO FINISH! message appears. This delay does not indicate that the event data export has halted; the export process is moving files from the source appliance to the remote server. Allow time for the process to complete. The final message to appear will be DATA EXPORTING COMPLETED!. To verify that files are being moved, enter the following command at the remote server command line to determine whether new files are being added:

cd <export-path>; du -hs .",

If new files are being written, the disk usage of the directory increases slowly.

Step 5 Export the configuration data from the appliance.

Configuration data details the MARS Appliance settings and network view, including IP addresses assigned to the network adapters, the hostname, user accounts, and reporting device or managed Local Controller details. You should export the latest configuration data from the source appliance to a NFS or SFTP remote server if it is still operational.

Note We recommend pulling the configuration data from the source appliance.

You can export the configuration data from the source appliance using the pnexp export config [remote-path] command. Continue with Step 6.

Write down the NFS or SFTP remote path where the configuration data is saved—it appears in the last line of the output of the pnexp export config [remote-path] command. You must specify this path when you import the configuration data into the target appliance. If the source appliance was configured to archive data, ensure that the specified remote-path value does not match the archive path of the source appliance. The configuration data export can take up to 10 minutes.

The following example specifies that the MARS Appliance should export the configuration data to the NFS server at 192.168.3.138. The last line of the output indicates the configuration data is saved at 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10, you are prompted to specify this path when you import configuration data into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export config 192.168.3.138:/storage/mars_migration

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes

!!! The exported config data is saved under sub-directory of 

192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Exporting config data now

Dumping configuration data, may take a while ...

Configuration dump finished.

Configdump to 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 
finished successfully.

Step 6 Reimage the appliance with the target image. To reimage the appliance, see Recovery Management.

Step 7 Use the pnimp import config [remote-path] command to import configuration data into the target appliance, whether that appliance model equivalent to or greater than the model of the source appliance.

The following example illustrates proper use. The first message reminds you to export the latest configuration data from the source appliance, as described in Step 5. Enter yes to continue. If you exported from the running source appliance, the <remote-path> value is the NFS or SFTP remote path you wrote down in Step 5. If the source appliance is no longer available and you are importing previously archived configuration data from the remote server, the <remote-path> value is the archive path used by the source appliance. 

[pnadmin]$ pnimp


pnimp> import config 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 


The most recent configuration archive from 4.3.6 release or later found on the NFS server 

was created at 2008-09-04-11-25-10. Because events received after the config archive was 

created may not be imported correctly later on when you try to import event data, so if 

possible, you should always use 'pnexp' to export a fresh copy of configuration from the 

Gen-1 MARS box before trying this command.


Do you wish to continue (yes/no) : yes


WARNING: this operation will overwrite current MARS box's configurations (both system and 

DB) and reboot the machine. After reboot, current MARS box will take over the IP address, 

hostname and MARS username/password of the MARS box from which the config archive was 

exported, please make sure there will be no IP address conflict.


Do you wish to continue (yes/no): yes


!!! Stopping CS-MARS processes ...


Invoking binary config importing procedure ...


Recreating the database schema.


Importing data into database ...


Configuration data binary import done.


Configrestore succeeded!


!!! Updating system settings ... 


Broadcast message from root (pts/5) (Wed Jun 13 15:23:46 2008):

Step 8 Verify the import in the target appliance using the pnimp config command (compare to the output of the pnexp config command as run on the source appliance). You can also use the web interface to verify that the appliance is receiving events. For more information, see Verify Connectivity with the Reporting and Mitigation Devices.

Step 9 Assess the target appliance for the following requirements:

•If you suspended Global Controller-to-Local Controller communications in Step 2, use the Global Controller's web interface to resume communications.

•If the target appliance is a Global Controller, use it's web interface to resume communications with all managed Local Controllers (Admin > System Setup > Local Controller Management).

Step 10 Use the pnimp import data [remote-path] command to import event data into the target appliance.

During the event import process, the target appliance continues to receive and process events.

The following example shows command syntax and expected output. You are initially prompted to import the most recent configuration data from the source appliance. To continue, enter yes. To import event data that was exported from the source appliance, the <remote-path> value for the import data <remote-path> command is the NFS or SFTP remote path written down in Step 4. To import event data previously archived by the source appliance, the <remote-path> value must match the archival path used by the source appliance. 

pnadmin]$ pnimp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnimp> import data 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 
01/01/07


Last imported configuration archive is from 

192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10/2008-09-04/CF/cf-4318-434

_2008-09-04-11-25-10.pna created at 2008-09-04-11-25-10. Because events received after the 

config archive was created may not be imported correctly, you should import a latest copy 

of configuration from the Gen-1 MARS box before trying this command if possible.


Do you wish to continue (yes/no): yes


Total number of days with data : 5

Total number of event archives to import: 89

Total number of report result archives to import: 1

Total number of statistics archives to import: 4

Total number of incident archives to import: 3

Estimated time to import all events: 2 hours 1 minutes

Do you wish to continue (yes/no): yes

!!! Importing data in background now, enter 'status' or 'log' to view data importing 

status and/or logs.

The following tips provide guidance on successful import of the event data.

Tip As the event import process runs in the background, you can exit the pnimp> command prompt by entering the quit and subsequently log off from the source appliance. You can log back into the source appliance, enter pnimp and then log to check the data import status.

Q. How do I determine a valid start date for the import command?

A. The import data [remote-path] [start-date] command requires a date that indicates the earliest event data to import. Event data timestamped with that start date through the most recent events is imported. To determine what dates are available, list the directory where the event data are saved on the NFS of SFTP remote server. The following example shows that the dates "14 September 2008" through "17 September 2008" are available. 

[root@storage2 ~]# ls /archive/migration/mars-rtp-1-test_2008-09-17-16-55-26/


2008-09-14  2008-09-15  2008-09-16  2008-09-17

Q. How do I determine whether event data import is complete?

A. Event data import runs as a background process. To determine when the event data import completes, enter log at the pnimp> command prompt. This command displays the most recent log generated by the event data import process. If the log message resembles Wed Sep 5 14:37:56 2008 INFO Data importing successfully completed!, then the import is complete. Enter Ctrl-C to quit the log display. 

[pnadmin]$ pnimp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnimp> log


Wed Sep  5 14:37:37 2008 INFO (Index builder 0) begin building raw message indexes for 
data in /pnarchive/DATA_POOL/2008-09-01/ES

Wed Sep  5 14:37:42 2008 INFO (Index builder 1) begin building raw message indexes for 
data in /pnarchive/DATA_POOL/2008-09-01/ES

Wed Sep  5 14:37:49 2008 INFO Finished index building

Wed Sep  5 14:37:55 2008 INFO Finished index building

Wed Sep  5 14:37:55 2008 INFO Unmounting 
10.2.3.138:/storage/hongbo/pnmars_2008-09-05-14-12-23 ...

Wed Sep  5 14:37:56 2008 INFO Data importing successfully completed!

Step 11 Issue a query over the imported event data to verify you can access them on the target appliance. Alternatively, you can also verify the import by looking at the import status log messages by entering log all at the pnimp command prompt. Both success and failure messages are generated.

Example success messages include: 

Mon Sep 17 21:05:19 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-99_2008-09-17-13-43-25_2008-09-17-13-56-21.gz imported!

Mon Sep 17 21:05:19 2008 INFO Importing file 
/mnt/migration/2008-09-17/ES/es-4318-436-98_2008-09-17-13-31-18_2008-09-17-13-43-25.gz

Mon Sep 17 21:05:27 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-98_2008-09-17-13-31-18_2008-09-17-13-43-25.gz imported!

Mon Sep 17 21:05:27 2008 INFO Importing file 
/mnt/migration/2008-09-17/ES/es-4318-436-97_2008-09-17-13-18-37_2008-09-17-13-31-18.gz

Mon Sep 17 21:05:34 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-97_2008-09-17-13-18-37_2008-09-17-13-31-18.gz imported!

Mon Sep 17 21:05:34 2008 INFO Importing file 
/mnt/migration/2008-09-17/ES/es-4318-436-96_2008-09-17-13-06-34_2008-09-17-13-18-37.gz

Mon Sep 17 21:05:41 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-96_2008-09-17-13-06-34_2008-09-17-13-18-37.gz imported!

Mon Sep 17 21:05:41 2008 INFO Importing file 
/mnt/migration/2008-09-17/ES/es-4318-436-95_2008-09-17-12-55-03_2008-09-17-13-06-34.gz

Mon Sep 17 21:05:49 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-95_2008-09-17-12-55-03_2008-09-17-13-06-34.gz imported!

Example error messages include: 

Mon Sep 17 21:05:49 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-95_2008-09-17-12-55-03_2008-09-17-13-06-34.gz imported with error!

Mon Sep 17 21:05:49 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-95_2008-09-17-12-55-03_2008-09-17-13-06-34.gz skipped because of 
error! 

Mon Sep 17 21:05:49 2008 OK 
/mnt/migration/2008-09-17/ES/es-4318-436-95_2008-09-17-12-55-03_2008-09-17-13-06-34.gz skipped!

Different Appliance Data Migration Work Flow

Depending on how large the data set is, exporting event data may take between several hours and a day. During the pnexp export operation, all MARS processes are stopped and the source appliance is unable to processing any events—the MARS Appliance is off line during the export.

To minimize down time, Cisco recommends exporting the configuration data, bringing that configuration up on the target appliance, and reconfiguring the source appliance to prevent it from receiving new events. With the target appliance up and receiving events, you can safely export the event data from the source appliance without losing event data due to that downtime.

Summary Steps

1. Export config from old appliance.

2. Take old appliance offline to stop receiving events.

3. Import config into new appliance.

4. Bring new appliance online to receive events.

5. Export event data from old appliance.

6. Import event data into new appliance.

Caution To avoid data loss, you may be required to closely monitor the configuration import on the target appliance. When the target appliance is online, you can export the event data from the source appliance unattended.

To minimize the loss of event data, Cisco recommends the following workflow:

Step 1 If the source appliance is attached to the network and operational, verify it is running version 4.3.6, and continue with Step 2. If source appliance is no longer available but it was running 4.3.6 and was configured to archive data, continue with Step 3. Otherwise, contact Cisco Technical Support for options.

To verify the running version, follow these steps:

a. Log in to the source appliance. For more information, see Log In to the Appliance via the Console, page 2.

b. At the [pnadmin]$ prompt, enter version to display the current version.

Result: The version number appears in the following format: major.minor.patch (build no.)

c. Verify that number is 4.3.6 (2841) or later. If not, then upgrade the source appliance to 4.3.6 as described in Checklist for Upgrading the Appliance Software, page 6.

Note Do not re-image the source appliance at this time; you must upgrade to preserve configuration and event data.

Step 2 Assess the source appliance for the following requirements:

•If the source appliance is a managed Local Controller, suspend the Global Controller-to-Local Controller communication from the Global Controller's web interface.

•If the source appliance is a Global Controller, use it's web interface to suspend communications with all managed Local Controllers (Admin > System Setup > Local Controller Management).

Step 3 Export the configuration data from the source appliance.

Configuration data details the MARS Appliance settings and network view, including IP addresses assigned to the network adapters, the hostname, user accounts, and reporting device or managed Local Controller details. You should export the latest configuration data from the source appliance to a NFS server if it is still operational.

Note Cisco recommends pulling the configuration data from the source appliance.

•If source appliance is operational. You can export the configuration data from the source appliance using the pnexp export config [nfs-path] command. Continue with Step 4.

Write down the NFS path where the configuration data is saved— it appears in the last line of the output of the pnexp export config [nfs-path] command. You must specify this path when you import the configuration data into the target appliance. If the source appliance was configured to archive data, ensure that the specified nfs-path value does not match the archive path of the source appliance. The configuration data export can take up to 10 minutes.

The following example specifies that the MARS Appliance should export the configuration data to the NFS server at 192.168.3.138. The last line of the output indicates the configuration data is saved at 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10, you are prompted to specify this path when you import configuration data into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export config 192.168.3.138:/storage/mars_migration

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes

!!! The exported config data is saved under sub-directory of 

192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Exporting config data now

Dumping configuration data, may take a while ...

Configuration dump finished.

Configdump to 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10 
finished successfully.

•If source appliance is no longer available. If the source appliance was running 4.3.6 and configured to archive data, verify at least one configuration archive from the 4.3.6 release exists in the NFS server's archives. To verify, run the following commands on the NFS server:

cd <archive_path>

find . -name cf-*-43*

If the second command returns with a list of file names that contain the substring "431", such as /2007-08-23/CF/cf-4318-431_2007-08-23-16-31-20.pna, then you can safely continue with Step 4. Otherwise, return to Step 1.

Step 4 Reconfigure the source appliance to use a different hostname and new IP addresses to avoid IP address and DNS conflicts that will conflict with the replacement appliance after the configuration data is imported. For more information, see ifconfig, page 20.

This configuration is a temporary measure; once you verify the target appliance is operation, you must permanent disable or reconfigure the source appliance as described in Step 12.

Step 5 If archive is enabled on the source appliance, disable it now using the web interface. For more information, see Configure the Data Archive Setting for the MARS Appliance, page 37.

Disabling archive at this stage, rather than earlier, ensures that the target appliance is configured to archive its data according to the same schedule as the source device. Disabling the source device ensures the two devices do not conflict.

Step 6 Use the pnimp import config [nfs-path] command to import configuration data into the target appliance, whether that appliance model equivalent to or greater than the model of the source appliance.

The following example illustrates proper use. The first message reminds you to export the latest configuration data from the source appliance, as described in Step 3. Enter yes to continue. If you exported from the running source appliance, the <nfs-path> value is the NFS path you wrote down in Step 3. If the source appliance is no longer available and you are importing previously archived configuration data from the NFS server, the <nfs-path> value is the archive path used by the source appliance. 

[pnadmin]$ pnimp


pnimp> import config 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10 


The most recent configuration archive from 4.3.6 release or later found on the NFS server 

was created at 2007-09-04-11-25-10. Because events received after the config archive was 

created may not be imported correctly later on when you try to import event data, so if 

possible, you should always use 'pnexp' to export a fresh copy of configuration from the 

Gen-1 MARS box before trying this command.


Do you wish to continue (yes/no) : yes


WARNING: this operation will overwrite current MARS box's configurations (both system and 

DB) and reboot the machine. After reboot, current MARS box will take over the IP address, 

hostname and MARS username/password of the MARS box from which the config archive was 

exported, please make sure there will be no IP address conflict.


Do you wish to continue (yes/no): yes


!!! Stopping CS-MARS processes ...


Invoking binary config importing procedure ...


Recreating the database schema.


Importing data into database ...


Configuration data binary import done.


Configrestore succeeded!


!!! Updating system settings ... 


Broadcast message from root (pts/5) (Wed Jun 13 15:23:46 2007):

Step 7 Verify the import in the target appliance using the pnimp config command (compare to the output of the pnexp config command as run on the source appliance). You can also use the web interface to verify that the appliance is receiving events. For more information, see Verify Connectivity with the Reporting and Mitigation Devices, page 27.

Step 8 Assess the target appliance for the following requirements:

•If you suspended Global Controller-to-Local Controller communications in Step 2, use the Global Controller's web interface to resume communications.

•If the target appliance is a Global Controller, use it's web interface to resume communications with all managed Local Controllers (Admin > System Setup > Local Controller Management).

Step 9 Determine whether to export event data from the source appliance. Event data is the data collected from reporting devices as well as derived by the MARS Appliance. If you have been archiving event data from the source appliance prior to this migration, you do not need to export the events from the source appliance. Select one of the following options:

•Import from archive. The archive does not need to be generated by a source appliance running 4.3.6. If you choose to import previously archived event data, determine whether the source appliance is a Global Controller. If it is not, continue with Step 10. If it is, shut down the Global Controller to avoid conflicts with the target appliance, and then continue with Step 10.

•Export from source appliance. If you do not have an existing archive, export the event data from the source appliance to a NFS server. To export event data from the source appliance, use the pnexp export data [nfs-path] command. After export completes, continue with Step 10.

Tip Use the pnexp esti_time [MM/DD/YY:HH] command to estimate how long the event data export will take. Using this information, you can ensure that your time is not wasted waiting for the export to complete as well as ensure that the target appliance configuration is not delayed unnecessarily.

Note The times estimated by the export data and the esti_time commands assume a fast connection exists between the source appliance and the NFS server, with data transfer speeds averaging 10 MB per second. If the actual transfer speeds are slower, the export operation can take much longer than estimated. Cisco recommends using a NFS server attached to a local network shared by the source appliance.

Caution If you have been archiving event data from the source appliance prior to this migration, the [nfs-path] value for the export data [nfs-path] command must not match the archive path used by the source appliance.

The following example specifies to export all event data received after 05/01/07:00 to the NFS server at 192.168.3.138. The event data is actually saved in a subdirectory of the [nfs-path] value for the export data [nfs-path] command. In this example, the path of the saved data is 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10. Write down this path as you must provide it in Step 10, where the event data is imported into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export data 192.168.3.138:/storage/mars_migration 05/01/07:0

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes

Estimated total number of events to export: 1401080357

Estimated time to export events: 12 hours 58 minutes

Estimated space for exported events: 66809 MB

Do you wish to continue (yes/no): yes

!!! The exported event data is saved at 

192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Restarting oracle ...

!!! Exporting data in background now, enter 'status' or 'log' to view data exporting 

status and/or logs.

The following tips provide guidance on successful export of the event data.

Tip As the event export process runs in the background, you can exit the pnexp> command prompt by entering the quit and subsequently log off from the source appliance. You can log back into the source appliance, enter pnexp and then log to check the data export status.

Q. How do I determine where the exported event data is saved?

A. To determine where the exported event data is saved, enter log all at the pnexp> command prompt. This command displays all log messages generated by the event data export process. The export path appears in the second line and resembles Parameter: nfs_path = 10.2.3.138:/storage/mars-migration/SJ-LC-220_2007-09-04-11-25-10, where 10.2.3.138 is the NFS server and /storage/mars-migration/SJ-LC-220_2007-09-04-11-25-10 is the path to the the exported event data. You are prompted to enter this path when you import event data into the target appliance. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> log all

!!! Enter 'Ctrl-C' to quit displaying log

Sep  4 11:25:21.293 2007@LM_INFO@Thread 1024:START DATA EXPORTING...

Sep  4 11:25:21.293 2007@LM_INFO@Thread 1024:Parameter: nfs_path = 
10.2.3.138:/storage/mars-migration/SJ-LC-220_2007-09-04-11-25-10

Sep  4 11:25:21.293 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 05/01/07:0

Sep  4 11:25:21.395 2007@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchive

Sep  4 11:25:22.677 2007@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...

Q. How do I determine whether the event data export is complete?

A. Event data export runs as a background process. To determine when event data export is complete, enter log at the pnexp> command prompt. This command displays the most recent log generated by the event data export process. If the log message resembles Sep 4 23:15:48.560 2007@LM_INFO@Thread 1024:DATA EXPORTING COMPLETED!, then the event data export is complete. Enter Ctrl-C to quit the log display.

Note If the NFS connection is slow, it may take a long time for messages to appear after the WAITING FOR THE DATA MOVER THREAD TO FINISH! message appears. This delay does not indicate that the event data export has halted; the export process is moving files from the source appliance to the NFS server. Allow time for the process to complete. The final message to appear will be DATA EXPORTING COMPLETED!. To verify that files are being moved, enter the following command at the NFS server command line to determine whether new files are being added:

cd <export-path>; du -hs .",

If new files are being written, the disk usage of the directory increases slowly.

Step 10 Use the pnimp import data [nfs-path] command to import event data into the target appliance.

During the event import process, the target appliance continues to receive and process events.

The following example shows command syntax and expected output. You are initially prompted to import the most recent configuration data from the source appliance. To continue, enter yes. To import event data that was exported from the source appliance, the <nfs-path> value for the import data <nfs-path> command is the NFS path written down in Step 9. To import event data previously archived by the source appliance, the <nfs-path> value must match the archival path used by the source appliance. 

pnadmin]$ pnimp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnimp> import data 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10 
01/01/07


Last imported configuration archive is from 

192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10/2007-09-04/CF/cf-4318-431

_2007-09-04-11-25-10.pna created at 2007-09-04-11-25-10. Because events received after the 

config archive was created may not be imported correctly, you should import a latest copy 

of configuration from the Gen-1 MARS box before trying this command if possible.


Do you wish to continue (yes/no): yes


Total number of days with data : 5

Total number of event archives to import: 89

Total number of report result archives to import: 1

Total number of statistics archives to import: 4

Total number of incident archives to import: 3

Estimated time to import all events: 2 hours 1 minutes

Do you wish to continue (yes/no): yes

!!! Importing data in background now, enter 'status' or 'log' to view data importing 

status and/or logs.

The following tips provide guidance on successful import of the event data.

Tip As the event import process runs in the background, you can exit the pnimp> command prompt by entering the quit and subsequently log off from the source appliance. You can log back into the source appliance, enter pnimp and then log to check the data import status.

Q. How do I determine a valid start date for the import command?

A. The import data [nfs-path] [start-date] command requires a date that indicates the earliest event data to import. Event data timestamped with that start date through the most recent events is imported. To determine what dates are available, list the directory where the event data are saved on the NFS server. The following example shows that the dates "14 September 2007" through "17 September 2007" are available. 

[root@storage2 ~]# ls /archive/migration/mars-rtp-1-test_2007-09-17-16-55-26/


2007-09-14  2007-09-15  2007-09-16  2007-09-17

Q. How do I determine whether event data import is complete?

A. Event data import runs as a background process. To determine when the event data import completes, enter log at the pnimp> command prompt. This command displays the most recent log generated by the event data import process. If the log message resembles Wed Sep 5 14:37:56 2007 INFO Data importing successfully completed!, then the import is complete. Enter Ctrl-C to quit the log display. 

[pnadmin]$ pnimp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnimp> log


Wed Sep  5 14:37:37 2007 INFO (Index builder 0) begin building raw message indexes for 
data in /pnarchive/DATA_POOL/2007-09-01/ES

Wed Sep  5 14:37:42 2007 INFO (Index builder 1) begin building raw message indexes for 
data in /pnarchive/DATA_POOL/2007-09-01/ES

Wed Sep  5 14:37:49 2007 INFO Finished index building

Wed Sep  5 14:37:55 2007 INFO Finished index building

Wed Sep  5 14:37:55 2007 INFO Unmounting 
10.2.3.138:/storage/hongbo/pnmars_2007-09-05-14-12-23 ...

Wed Sep  5 14:37:56 2007 INFO Data importing successfully completed!

Step 11 Issue a query over the imported event data to verify you can access them on the target appliance. Alternatively, you can also verify the import by looking at the import status log messages by entering log all at the pnimp command prompt. Both success and failure messages are generated.

Example success messages include: 

Mon Sep 17 21:05:19 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-99_2007-09-17-13-43-25_2007-09-17-13-56-21.gz imported!

Mon Sep 17 21:05:19 2007 INFO Importing file 
/mnt/migration/2007-09-17/ES/es-4318-431-98_2007-09-17-13-31-18_2007-09-17-13-43-25.gz

Mon Sep 17 21:05:27 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-98_2007-09-17-13-31-18_2007-09-17-13-43-25.gz imported!

Mon Sep 17 21:05:27 2007 INFO Importing file 
/mnt/migration/2007-09-17/ES/es-4318-431-97_2007-09-17-13-18-37_2007-09-17-13-31-18.gz

Mon Sep 17 21:05:34 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-97_2007-09-17-13-18-37_2007-09-17-13-31-18.gz imported!

Mon Sep 17 21:05:34 2007 INFO Importing file 
/mnt/migration/2007-09-17/ES/es-4318-431-96_2007-09-17-13-06-34_2007-09-17-13-18-37.gz

Mon Sep 17 21:05:41 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-96_2007-09-17-13-06-34_2007-09-17-13-18-37.gz imported!

Mon Sep 17 21:05:41 2007 INFO Importing file 
/mnt/migration/2007-09-17/ES/es-4318-431-95_2007-09-17-12-55-03_2007-09-17-13-06-34.gz

Mon Sep 17 21:05:49 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-95_2007-09-17-12-55-03_2007-09-17-13-06-34.gz imported!

Example error messages include: 

Mon Sep 17 21:05:49 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-95_2007-09-17-12-55-03_2007-09-17-13-06-34.gz imported with error!

Mon Sep 17 21:05:49 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-95_2007-09-17-12-55-03_2007-09-17-13-06-34.gz skipped because of 
error! 

Mon Sep 17 21:05:49 2007 OK 
/mnt/migration/2007-09-17/ES/es-4318-431-95_2007-09-17-12-55-03_2007-09-17-13-06-34.gz skipped!

Step 12 Permanently disable or reconfigure the source appliance.

Whether you imported the configuration data from a source appliance or a NFS archive server, you must permanently disable or reconfigure the source appliance to prevent network conflicts and to purge reporting devices and scheduled discoveries once you've confirmed a successful migration. After configuration data import and reboot, the target appliance assumes the IP address, hostname, and username/password of the source appliance.

Note Do not restore archived data onto the source appliance. Instead, configure it using a different hostname and IP addresses than originally used (as those now belong to the target appliance).

Select one of the following options to disable or reconfigure the source appliance:

•Disable or Turn Off the Source Appliance. See Shut Down the Appliance via the Console, page 3.

•Reimage the Appliance with Same or Newer Image. To reimage the appliance, see Recovery Management, page 39.

•Reset the Appliance to Factory Defaults. Use the pnreset command (without options) to reset the source appliance to its factory defaults, purging all configuration and event data. For more information, see pnreset, page 38

pnexp Command: Migration Specific

From the pnexp command prompt, you can access time and disk space required for a data export, review the size of the database and the data therein, start and stop the export of configuration data, event data, or both, and check the status of an ongoing export. To access the pnexp command prompt, use the pnexp command at the pnadmin prompt:

pnexp

Command History

Release
Modification

4.3.1

This command was introduced in the Local Controller and Global Controller version 4.x trains.

4.3.4

Support for exporting to a SFTP server was added.


Syntax Description

help

Displays a list of valid subcommands.

quit | exit

Quit and exit the pnexp command. Return to the pnadmin command prompt.

status

Display the status of the current data export operation.

log {all | recent}

Show all or recent data exporting log entries.

data

Displays the number of events, report results, statistics, and incidents in the database.

config

Displays the number of devices, reports, and rules in the database. This command should be used as a point of comparison once the configuration is imported into the target appliance. Compare with the output of the pnimp config command.

stop

Stop the data export operation.

esti_time [MM/DD/YY:HH]

Estimates how much time and storage is required to export the event data that was received by MARS after a specified start time—only the events received after that time are migrated. If the last argument is not specified, then the estimate is based on all event data in the database.

Note The data export tool ignores data that was previously archived for the MARS Appliance. Each time the command is run, it writes data to a new NFS directory regardless whether data has already been archived.

export {config | data | all} {remote-path} [MM/DD/YY:HH]

Export MARS configuration data ({config}), or events/reports/statistics/incidents data ({data}), or both ({all}) to the specified NFS or SFTP remote server path ({remote-path}). If the last optional argument is given, only data received after that time will be exported.

•Example export to NFS server: 

export all 10.1.1.1:/mars/archive 02/28/07:00

The remote-path value identifies the IP address of the remote server plus the top-level archive folder on the remote server; it does not identify a specific archive date. The value format is [sftp:[<username>@]] IP_address:FolderPath . If sftp is not specified, a NFS server path is assumed.

•Example config only export to a NFS server: 

export config 10.1.1.1:/archive

•Example data only export to a SFTP server: 

export data sftp:10.1.1.1:/archive

If you export event data to an NFS server, the specified NFS path value must not match the archive path used by the source appliance. The pnexp command creates the proper archive folder under this path.

Note Only the start date is specified, the end date is always the current time (when event receiving is stopped).


Usage Guidelines

Use the pnexp command to prepare and export configuration and event data from MARS Appliance running 4.x as separate data so you can import either or both on a MARS Appliance running 5.x software. When the export operation begins, that MARS Appliance stops receiving events until the exporting process completes.

Caution Once the export operation begins, event data published to this appliance is lost, as is any event data that is not already written to the database. Follow the instructions provided in Different Appliance Data Migration Work Flow to avoid losing event data.

The configuration export runs in the foreground displaying its status and errors immediately, where as event data export runs in the background. Use the log {all | recent} command to view the running status log for event data export.

The event export part of this operation can take a long time, as the export speed ranges between 6,000 and 30,000 events per second depending on the appliance model. Event data is exported in the following order: report result, statistics, incident and firing events, and event session. If the remote NFS server becomes unavailable during a lengthy export operation, the pnexp program attempts to remount the server. For event data export, logs are written to the /log/export.log file.

Examples

The following example specifies that the MARS Appliance should export the configuration data to the NFS archive found at 192.168.3.138:/storage/mars_migration: 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export config 192.168.3.138:/storage/mars_migration

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes

!!! The exported config data is saved under sub-directory of 
192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Exporting config data now

Dumping configuration data, may take a while ...

Configuration dump finished.

Configdump to 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 finished 
successfully.

The following example specifies that the MARS Appliance should export the event data corresponding to the configuration data in the previous example: 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> export data 192.168.3.138:/storage/mars_migration 05/01/07:0

WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes


Estimated total number of events to export: 1401080357

Estimated time to export events: 12 hours 58 minutes

Estimated space for exported events: 66809 MB


Do you wish to continue (yes/no): yes

!!! The exported event data is saved at 
192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10

!!! Stopping CS-MARS processes ...

!!! Restarting oracle ...

!!! Exporting data in background now, enter 'status' or 'log' to view data exporting 
status and/or logs.

The following example shows the expected output of the pnexp log command: 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> log

!!! Enter 'Ctrl-C' to quit displaying log


Sep  4 23:10:33.860 2008@LM_INFO@Thread 1024:Joining worker threads

Sep  4 23:10:34.225 2008@LM_INFO@Thread 1024:Total number of events exported: 1401080357

Sep  4 23:10:34.236 2008@LM_INFO@Thread 1024:EXPORTING EVENT SESSIONS COMPLETED!

Sep  4 23:10:34.332 2008@LM_INFO@Thread 1024:WAITING FOR THE DATA MOVER THREAD TO FINISH!

Sep  4 23:15:48.556 2008@LM_INFO@Thread 1026:Exiting data mover thread

Sep  4 23:15:48.560 2008@LM_INFO@Thread 1024:DATA EXPORTING COMPLETED!

Tip Use the log all command to determine where the archives are saved. This path information is required by the pnimp command. 

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:START DATA EXPORTING...

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:Parameter: nfs_path = 
192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10

Sep  4 11:25:21.293 2008@LM_INFO@Thread 1024:Parameter: event_start_time = 05/01/07:0

Sep  4 11:25:21.395 2008@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchive

Sep  4 11:25:22.677 2008@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...

The following example displays the number of devices, reports, and rules in the database, which is used to verify the pnimport config results. 

[pnadmin]$ pnexp


Enter 'help' for a list of valid commands, 'exit' or 'quit' to exit.

pnexp> config

Num of devices: 42482

Num of interfaces: 51284

Num of networks: 86

Num of network groups: 3

Num of reports: 253

Num of report groups: 31

Num of rules: 1261

Num of rule groups: 16

Num of users: 30

Num of user groups: 5

Related Commands

Command
Description

pnimp Command: Migration Specific

Import configuration and event data into a MARS Appliance running version 5.3.1 or later.


pnimp Command: Migration Specific

From the pnimp command prompt, you can access time required for a data import, review the size of the event data set on the NFS server, start and stop the import of configuration data or event data, and check the status of an ongoing import. To access the pnimp command prompt, use the pnimp command at the pnadmin prompt:

pnimp

Command History