Cisco MARS Install And Setup Manual page 171

Appendix A Command Reference
Usage Guidelines Use the pnexp command to prepare and export configuration and event data from MARS Appliance
running 4.x as separate data so you can import either or both on a MARS Appliance running 5.x
software. When the export operation begins, that MARS Appliance stops receiving events until the
exporting process completes.
Caution Once the export operation begins, event data published to this appliance is lost, as is any event data that
is not already written to the database. Follow the instructions provided in
page -2
The configuration export runs in the foreground displaying its status and errors immediately, where as
event data export runs in the background. Use the log {all | recent} command to view the running status
log for event data export.
The event export part of this operation can take a long time, as the export speed ranges between 6,000
and 30,000 events per second depending on the appliance model. Event data is exported in the following
order: report result, statistics, incident and firing events, and event session. If the remote NFS server
becomes unavailable during a lengthy export operation, the pnexp program attempts to remount the
server. For event data export, logs are written to the
Examples The following example specifies that the MARS Appliance should export the configuration data to the
NFS archive found at 192.168.3.138:/storage/mars_migration:
pnexp> export config 192.168.3.138:/storage/mars_migration
WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes
!!! The exported config data is saved under sub-directory of
192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10
!!! Stopping CS-MARS processes ...
!!! Exporting config data now
Dumping configuration data, may take a while ...
Configuration dump finished.
Configdump to 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10 finished
successfully.
The following example specifies that the MARS Appliance should export the event data corresponding
to the configuration data in the previous example:
pnexp> export data 192.168.3.138:/storage/mars_migration 05/01/07:0
WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes
Estimated total number of events to export: 1401080357
Estimated time to export events: 12 hours 58 minutes
Estimated space for exported events: 66809 MB
Do you wish to continue (yes/no): yes
!!! The exported event data is saved at
192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10
!!! Stopping CS-MARS processes ...
!!! Restarting oracle ...
!!! Exporting data in background now, enter 'status' or 'log' to view data exporting
status and/or logs.
Use the log all command to determine where the archives are saved. This path information is required
Tip
by the pnimp command.
OL-14672-01
to avoid losing event data.
Data Migration Work Flow,
file.
/log/export.log
Install and Setup Guide for Cisco Security MARS
pnexp
A-33