Feedback
Table Of Contents
Cisco Security MARS Command Reference 6.x—Commands A through V
Cisco Security MARS Command Reference 6.x—Commands A through V
Revised: September 16, 2008, OL-16551-01Command Summary
Table 1-1 summarizes all commands available on the MARS Appliance. Refer to the full description of commands that you are not familiar with before using them.
Note
For MARS Releases prior to 6.0.1, the command reference is a chapter of the Install and Setup guide. This command reference documents only commands found in MARS Release 6.x.
Commands
This section describes the Cisco Security Monitoring, Analysis, and Response System commands. Command names are case sensitive.
?
Use the ? command to list available commands and command syntax.
?
Syntax Description
This command has no arguments or keywords.
Examples
The following example displays all available commands and their brief descriptions:
[pnadmin]$ ?Commands are:? - Print list of available commandsarp - Display/manipulate/store the arp tabledate - Set/show datediskusage - Report filesystem disk space usagedns - Add/remove/show domain name resolving serversdnssuffix - Add/remove/show domain name suffixes search pathdomainname - Set/show domain nameexit - Switch to standard mode/Logoutgateway - Show/set default gatewayhelp - Print list of available commandshostname - Set/show host namehotswap - hot add or remove diskifconfig - Configure/store network interfacemodel - Display the model info of CS-MARSnetstat - Show network statisticsnslookup - Look up the IP address or domain namentp - Synchronize system clock with ntp serverspasswd - Change passwordping - Ping a hostpnimp - Import Gen-1 box's configuration and events into this MARSpnexp - Export database content including configuration, eventspnlog - Show system log/ set log levelpndbusage - Show database usage infopnreset - reset the whole box to factory defaultspnrestore - restore system configuration and datapnstart - Start CS-MARS applicationspnstatus - Show running status of CS-MARS applicationspnstop - Stop CS-MARS applicationspnupgrade - System upgraderaidstatus - Display the status of disksreboot - Reboot Systemroute - Configure/store routing tablesshow - Show inventory and health monitoring informationshutdown - Shutdown system--More--(72%)<snip>
The following example displays the syntax of the unlock command:
[pnadmin]$ unlock ?Usage:unlock -aunlock {-l|-g|-b} userRelated Commands
Displays brief description of specified command
-h
Many commands support the -h keyword (a.k.a. option) to display syntax usage
arp
The arp command relates to the ARP cache on the MARS Appliance. You can view the list of mappings, clear an entry, or add a new mapping.
To display the current entries in the ARP cache, enter:
arp
To display the cached entries for a specific host, enter:
arp [-evn] [-H type] [-i if_local] -a [hostname]
To add a host to the cache, enter one of the following commands:
arp [-v] [-H type] [-i if_local] -s hostname hw_addr [netmask] pub
arp [-v] [-H type] [-i if_local] -s hostname hw_addr [temp]
arp [-v] [-H type] [-i if_loca] -Ds hostname if_dest [netmask] pub
To delete a host from the cache, enter:
arp [-v] [-i if_local] -d hostname [pub | nopub]
Syntax Description
Usage Guidelines
In all places where a hostname is expected, you can alternatively enter an IP address in dotted-decimal notation.
As a special case for compatibility the order of the hostname and the hardware address can be exchanged.
Each complete entry in the ARP cache is marked with the C flag. Permanent entries are marked with M and published entries have the P flag.
Note
MARS Appliance.Examples
To permanently add an arp cache entry for a management host (marsgui) reachable from eth1, enter:
arp -v -H ether -i eth1 -s marsgui 00:05:9A:3C:78:00 pubTo remove the entry defined above, enter:
arp -v i eth1 -d marsgui nopub
date
To display or set the system date, use the date command.
date [newdate]
Syntax Description
no keyword
Default. Displays the date in the mm/dd/yy format (for example, 04/28/08)
newdate
Sets the MARS clock date in the format mm/dd/yyyy or mm/dd/yy.
Usage Guidelines
Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than 30 minutes, you should restart your appliance to ensure that all processes synchronize using the new time.
Examples
The following example displays the current date:
[pnadmin]$ date06/25/07The following example changes the current date to March 12, 2008:
[pnadmin]$ date 03/12/2008[pnadmin]$ date03/12/2008diskusage
To display the disk space available on all partitions, use the diskusage command.
diskusage
Syntax Description
There are no keywords, options, or arguments.
Usage Guidelines
Displays amount of disk space available on all partitions in the MARS Appliance
For all MARS Appliance models, the Oracle database has three partitions:
•
•
•
If any of these partitions reaches 99% capacity, the Oracle database will experience operational issues.
The size of the data partition (/u02) varies based on the model:
•
•
•
•
Examples
To display the disk usage for all partitions in the MARS Appliance, enter the following command:
diskusageThe following is sample output for a MARS 100, as noted by the size of the /u02 partition:
Filesystem Size Used Avail Use% Mounted on/dev/sda3 20G 5.7G 13G 31% //dev/sda1 129M 14M 108M 12% /boot/dev/sda5 20G 4.8G 13G 26% /opt/dev/sda6 20G 130M 18G 1% /log/dev/sda7 29G 134M 27G 1% /pnarchive/dev/sda8 20G 2.7G 16G 14% /u01/dev/sda9 9.8G 2.2G 7.2G 23% /u03/dev/sda10 565G 15G 522G 3% /u02none 1005M 0 1005M 0% /dev/shmdns
To display or specify the IP addresses of the Domain Name Services (DNS) servers that the MARS Appliance should use to resolve IP addresses into hostnames, use the dns command.
dns [primary] [secondary] [tertiary]
Syntax Description.
Usage Guidelines
If the DNS configuration is changed from the web interface, you must perform a pnstop and then a pnstart operation for the new DNS information to be used by the MARS Appliance. For information on performing these two operations, see Stop Appliance Services via the Console and Start Appliance Services via the Console in the Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X
Examples
The following example displays the current DNS server entries:
[pnadmin]$ dnsPrimary DNS : 10.1.1.1Secondary DNS :Tertiary DNS :The following example sets the primary DNS server to 192.168.101.3 and the secondary DNS server to 192.168.102.5, enter:
[pnadmin]$ dns 192.168.101.3 192.168.102.5[pnadmin]$ dnsPrimary DNS :192.168.101.3Secondary DNS :192.168.102.5Tertiary DNS :The following example removes the secondary DNS server set in the previous example (192.168.102.5):
[pnadmin]$ dns 192.168.101.3[pnadmin]$ dnsPrimary DNS : 192.168.101.3Secondary DNS :Tertiary DNS :dnssuffix
To display, add, or remove the DNS search paths associated with the adapters in the MARS Appliance, use the dnssuffix command.
dnssuffix [add | del] searchpath
Syntax Description
Examples
To display the current DNS search path, enter:
dnssuffixTo add example.com to the search path, enter:
dnssuffix add example.comTo remove example.com from the search path, enter:
dnssuffix del example.comdomainname
To set or show the DNS domain of the MARS Appliance, use the domainname command.
domainname [domain]
Syntax Description
no keyword
Displays the current domain value if defined. Otherwise, it returns a blank line.
domain
Sets the MARS domain name to the specifed domain value.
Examples
To display the current domain name, enter:
domainnameThe following command sets the domain name to example.com:
domainname example.comethtool
Use the ethtool command to display or change settings on an ethernet device.
ethtool [option_letter] {ethX} [option_parameters]
where X is the number of the ethernet port (For example, eth0 or eth1).
Command History
Syntax Description
Usage Guidelines
Enter ethtool without keywords or options to see the listing of supported parameters on MARS.
Examples
The following example displays the current parameters of the MARS Ethernet interface 0 (eth0):
[pnadmin]$ ethtool eth0Settings for eth0:Supported ports: [ TP ]Supported link modes: 10baseT/Half 10baseT/Full100baseT/Half 100baseT/Full1000baseT/FullSupports auto-negotiation: YesAdvertised link modes: 10baseT/Half 10baseT/Full100baseT/Half 100baseT/Full1000baseT/FullAdvertised auto-negotiation: YesSpeed: 100Mb/sDuplex: FullPort: Twisted PairPHYAD: 0Transceiver: internalAuto-negotiation: onSupports Wake-on: umbgWake-on: gCurrent message level: 0x00000007 (7)Link detected: yes[pnadmin]$The following example sets eth0 to 100 Mb/s, full duplex, with no autonegotiation:
ethtool -s eth0 speed 100 duplex full autoneg off
Related Commands
exit
To log out of the system, use the exit command.
exit
Syntax Description
This command has no arguments or keywords.
Examples
The following command logs you out of the system:
exitexpert
To enable expert debugging mode on the MARS Appliance, use the expert command.
expert
Syntax Description
There are no keywords, options, or arguments.
Usage Guidelines
This command prompts the user to provide authentication credentials to enable the expert debugging mode. Only authorized Cisco support personnel can properly authenticate.
The expert command, undocumented before the 4.1.3, is for exclusive use by Cisco to aid in debugging customer issues that require direct access to the internal data store of the MARS Appliance. You may further restrict access to the expert command by setting the customer portion of the expert mode password via the passwd expert command. This command removes the default expert mode password set on the appliance from the factory.
While you can use the passwd expert command to restrict access to the expert command, only authorized Cisco support personnel are able to access the expert debugging mode of an appliance.
Examples
The following example
[pnadmin]$ expertPassword:Related Commands
Changes the customer portion of the password associated with expert debugging mode of the appliance,
fips
To intialize, zeroize, or to check the status of the CS-MARS FIPS PCI Card, use the fips command.
fips [init | zeroize | status]
Command History
Syntax Description
Usage Guidelines
The fips command is active only for the CS-MARS 110R appliance equipped with the CS-MARS FIPS PCI Card.
Use the fips init command to activate the FIPS PCI Card, after which all cryptographic functions normally performed by the MARS operating system for Java security, SSH, SSL and TLS are offloaded to the FIPS PCI Card. The tamper-evident coating on the FIPS PCI Card, its encryption algorithms, and its security methods, conform to United States Government Federal Information Processing Standard FIPS 140-2 Level 2. The initialization process requires that three Smart Cards be initialized too, but the Smart Cards are not used in any subsequent MARS operations. After FIPS initialization, the MARS operates exactly as before, but with the following exceptions:
•
•
•
To manually destroy the FIPS cryptographic keys on the FIPS PCI Card, use the fips zeroize command. The zeroize option forces a reboot, and restablishes standard MARS encryptions. The zeroize option makes recovery of the FIP cryptographic keys impossible. After issuing a fips zeroize command, you must reinitialize the FIPS PCI Card to generate new FIPS keys and to reestablish FIPS 140-2 Level 2 security. The ability to manually destroy the cryptographic keys is a FIPS requirement. A fips init command zeroizes the FIPS PCI Card as part of the initialization process.
Use the fips status command to display the current operating status and version numbers of the
FIPS PCI Card and its supporting software. The "Module #1" section refers to the physical FIPS PCI Card. The "Server" section refers to software that controls communication between MARS applications and the FIPS PCI Card. The server runs as a daemon on MARS. The FIPS security is in place when both the server and module (FIPS PCI Card) modes are operational. For more information on the CS-MARS FIPS PCI Card, see the CS-MARS FIPS PCI CARD Quick Install document at the following URL:http://www.cisco.com/en/US/docs/security/security_management/cs-mars/fru/fipsfru.html
Use the show inventory command to verify that the FIPS PCI Card is physically installed. Use the model command to verify that the FIPS PCI Card is initialized (It is initialized when the model is CS-MARS-100RF).
Examples
The following show inventory command example verifies that the FIPS PCI Card is installed.
[pnadmin]$ show inventoryNAME: "Chassis", DESCR: "CS-MARS-110 Local Controller"PID: CS-MARS-110, VID: V01, SN: M1100000011FIPS HSM: nCipher nShield 500e, SN: 4F06-81E7-8838<snip>The following model command example shows the MARS model number as CS-MARS-110RF after intialization of the FIPS PCI Card (changed from model CS-MARS-110R):
[pnadmin]$ modelCS-MARS-110RFThe following example shows the output of fips status command.
[pnadmin]$ fips statusServer:enquiry reply flags noneenquiry reply level Sixserial number 4F06-81E7-8838mode operationalversion 2.36.16speed index 544rec. queue 442..642level one flags Hardware HasTokensversion string 2.36.16cam12, 2.33.82cam1 built on Mar 06 2008 15:55:03checked in 00000000482ab2dd Wed May 14 02:37:33 2008level two flags nonemax. write size 8192level three flags KeyStoragelevel four flags OrderlyClearUnit HasRTC HasNVRAM HasNSOPermsCmd ServerHasPollCmds FastPollSlotList HasSEE HasKLF HasShareACL HasFeatureEnable HasFileOp HasPCIPush HasKernelInterface HasLongJobs ServerHasLongJobs AESModuleKeys NTokenCmds JobFragmentation LongJobsPreferred Type2Smartcardmodule type code 0product name nFast serverdevice nameEnquirySix version 4impath kx groupsfeature ctrl flags nonefeatures enabled noneversion serial 0remote server port 9004Module #1:enquiry reply flags noneenquiry reply level Sixserial number 4F06-81E7-8838mode operationalversion 2.33.82speed index 544rec. queue 9..152level one flags Hardware HasTokensversion string 2.33.82cam1 built on Mar 06 2008 15:55:03checked in 0000000047d0118d Thu Mar 6 07:45:17 2008level two flags nonemax. write size 8192level three flags KeyStoragelevel four flags OrderlyClearUnit HasRTC HasNVRAM HasNSOPermsCmd ServerHasPollCmds FastPollSlotList HasSEE HasKLF HasShareACL HasFeatureEnable HasFileOp HasPCIPush HasKernelInterface HasLongJobs ServerHasLongJobs AESModuleKeys NTokenCmds JobFragmentation LongJobsPreferred Type2Smartcardmodule type code 7product name nC1003P/nC3023P/nC3033Pdevice name #1 nFast PCI device, bus 12, slot 0.EnquirySix version 5impath kx groups DHPrime1024feature ctrl flags LongTermfeatures enabled StandardKMversion serial 24rec. LongJobs queue 8SEE machine type PowerPCSXFRelated Commands
gateway
To show or set the default gateway to be used by the MARS Appliance, use the gateway command.
gateway [address]
Syntax Description
no keyword
Displays the current gateway setting, if defined. Otherwise, it displays no value.
address
Changes the default gateway address to the specified value. Use decimal notation.
Examples
To display the current default gateway address used by the appliance, enter:
gatewayTo set the default gateway address to 192.168.101.1, enter:
gateway 192.168.101.1help
The help command displays a complete list of commands that are available at the serial console.
help [name]
Usage Guidelines
no keyword
Displays the full list of commands that are available and their corresponding brief description.
name
Identifies the command for which you want to see the brief description.
Examples
The following example displays a list of available commands:
[pnadmin]$ ?Commands are:? - Print list of available commandsarp - Display/manipulate/store the arp tabledate - Set/show datediskusage - Report filesystem disk space usagedns - Add/remove/show domain name resolving serversdnssuffix - Add/remove/show domain name suffixes search pathdomainname - Set/show domain nameexit - Switch to standard mode/Logoutgateway - Show/set default gatewayhelp - Print list of available commandshostname - Set/show host namehotswap - hot add or remove diskifconfig - Configure/store network interfacemodel - Display the model info of CS-MARSnetstat - Show network statisticsnslookup - Look up the IP address or domain namentp - Synchronize system clock with ntp serverspasswd - Change passwordping - Ping a hostpnimp - Import Gen-1 box's configuration and events into this MARSpnexp - Export database content including configuration, eventspnlog - Show system log/ set log levelpndbusage - Show database usage infopnreset - reset the whole box to factory defaultspnrestore - restore system configuration and datapnstart - Start CS-MARS applicationspnstatus - Show running status of CS-MARS applicationspnstop - Stop CS-MARS applicationspnupgrade - System upgraderaidstatus - Display the status of disksreboot - Reboot Systemroute - Configure/store routing tablesshow - Show inventory and health monitoring informationshutdown - Shutdown system--More--(72%)<snip>
The following example displays just the brief description of the netstat command:
[pnadmin]$ help netstatCommands are:netstat - Show network statisticsRelated Commands
Displays a complete list of available commands or usage of specific commands
-h
Many commands support the -h keyword (a.k.a. option) to display syntax usage
hostname
To set or show the hostname of the MARS Appliance, use the set hostname command.
hostname [hostname]
Syntax Description
no keyword
Displays the current hostname value, if defined. Otherwise, it displays no value.
hostname
Identifies the value to which the hostname for the MARS Appliance should be set.
Usage Guidelines
Changing the hostname requires that the appliance reboot. This reboot will occur automatically after your change the hostname. However, you are prompted to verify the hostname change. To cancel the hostname change without rebooting, enter no at the Hostname change will cause the system to reboot. Do you want to proceed? prompt.
Examples
This command sets the MARS Appliance name to csmars1:
hostname csmars1To see the current hostname, enter:
hostnamehotswap
Use the hotswap command to remove and add hard drives to MARS Appliances with RAID arrays and to determine the physical layout of the hard drives. A hotswap remove and add command sequence must be executed before a hard drive is physically removed from or added to the RAID array.
hotswap list all
hotswap{add | remove} disk
Command History
Syntax Description
Usage Guidelines
To hotswap a hard drive is to replace the hard drive without powering down or rebooting the appliance.
For MARS Appliances 100, 100E, 200, GCM, and GC, the valid disk arguments range from 1 to 8.
For MARS Appliances 110, 110R, 210, GC2R, and GC2, the valid disk arguments range from 0 to 5.
For the MARS Appliance 55 the valid disk arguments are 0 and 1.
To hotswap a hard drive, execute hotswap remove disk, replace the hard drive in the slot designated by disk, then execute hotswap add disk. Check the operational status of the hard drive and the RAID array with the raidstatus command.
Whenever a hotswap remove disk command is executed, the hard drive in that slot is removed from the array and another must be added to restore full redundancy to the RAID array.
If the wrong disk value is entered, that hard drive is dropped from the RAID array, but can be rebuilt into the array without physically removing and inserting the hard drive by executing a hotswap add disk command. It can take up to 300 minutes for a single hard drive to be rebuilt into the RAID array.
For more information on RAID hotswapping procedures, see the chapter, "System Maintenance" in the User Guide for Cisco Security MARS Local Controller at the following URL:
Examples
In the following example, a hard drive is hotswapped in slot 5 of a MARS 210. The hard drive status is verified with the raidstatus command:
[pnadmin]$ version5.3.2 (2702)[pnadmin]$ hotswap list allHardware RAID is found with 6 disks!Disks available to be hotswapped:|==============|==============|==============|| PD 1 | PD 3 | PD 5 ||--------------|--------------|--------------|| PD 0 | PD 2 | PD 4 ||==============|==============|==============|[pnadmin]$ hotswap remove 5Adapter: 0: EnclId-14 SlotId-5 state changed to OffLine.Disk 5 can now be safely removed from the system.[pnadmin]$ raidstatusAdapter Information:-------------------------------------------------------Product Name : Intel(R) RAID Controller SROMBSAS18EFirmware Version : 1.03.00-0211BIOS Version : MT30Adapter RaidType Status Stripe Size Cache---------------------------------------------------------------a0 Raid-10 Degraded 64kB 2097151MB EnabledPD Status Size & Block ModelSerial#--------------------------------------------------------------------------------p0 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09EEZp1 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09CQTp2 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD094KYp3 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD08NZXp4 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09EWPp5 Offline 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD06AQ2[pnadmin]$ hotswap add 5Started rebuild progress on device(Encl-14 Slot-5)Disk 5 has been successfully added to RAID[pnadmin]$ raidstatusAdapter Information:-------------------------------------------------------Product Name : Intel(R) RAID Controller SROMBSAS18EFirmware Version : 1.03.00-0211BIOS Version : MT30Adapter RaidType Status Stripe Size Cache---------------------------------------------------------------a0 Raid-10 Degraded 64kB 2097151MB EnabledPD Status Size & Block ModelSerial#--------------------------------------------------------------------------------p0 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09EEZp1 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09CQTp2 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD094KYp3 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD08NZXp4 Online 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD09EWPp5 Rebuild 715404MB [0x575466f0 Sectors] ATA ST3750640NS E3QD06AQ2Rebuild Progress on Device at Enclosure 14, Slot 5 Completed 17% in 32 Minutes.Related Commands
Displays the status of the RAID array and of the individual HDDs.
Displays information on chassis, hard drives and power supplies
ifconfig
To display or modify the current IP address and network mask pairs associated with the network interfaces installed in the MARS Appliance, use the ifconfig command.
ifconfig {eth0 | eth1} ip_address netmask
Syntax Description
Usage Guidelines
For more information on the physical placement of eth0 versus eth1, see the corresponding appliance model under Physical Descriptions—MARS 25R, 25, 55, 110R, 110, 210, GC2R, and GC2 or Physical Descriptions—MARS 20R, 20, 50, 100E, 200, GCm, and GC, in the Cisco Security MARS Hardware Installation and Maintenance Guide, 6.X.
For MARS Appliances 110, 110R, 210, GC2R, and GC2, eth0 is the integrated NIC 1, eth1 is the integrated NIC 2; eth2 and eth4 are unsupported.
Examples
To display the current interface address settings, enter:
ifconfigTo set the IP address of eth1 to 192.168.101.2/32, enter:
ifconfig eth1 192.168.101.2 255.255.255.255Related Commands
model
Use the model command to display the model name of the MARS Appliance.
model
Syntax Description
There are no keywords
Examples
The following displays the model information about the MARS Appliance:
[pnadmin]$ modelmars50localstandard[pnadmin]$netstat
Use the netstat commands to display the status of network connections on either TCP, UDP, RAW or UNIX sockets.
netstat [-h] [-r] [-v] [-V]
Syntax Description
Usage Guidelines
By default, the netstat command only displays status on active sockets that are not in the LISTEN state (that is, connections to active processes).The MARS netstat command is a partial implementation of the LINUX version.
nslookup
Look up the IP address or domain name using its counterpart. This command launches an interactive console that displays information that you can use to diagnose Domain Name System (DNS) infrastructure. Before using this tool, you should be familiar with how DNS works.
Syntax Description
nslookup puts you into interactive command mode. To quit the command mode and return to the command prompt, enter exit.
ntp
Use ntp server to identify the primary and secondary NTP server with which the appliance should synchronize. To force a synchronization with the NTP server, use ntp sync. To disable the use of ntp by this appliance, use ntp disable.
ntp server [ntp_server1] [ntp_server2]
ntp sync
ntp disable
Syntax Description
Usage Guidelines
The Network Time Protocol (NTP) synchronizes the clocks of computers across a network. By specifying an NTP server, you are instructing the appliance to contact that server to retrieve appropriate time settings. Synchronized times is especially important to MARS, because timestamp information provided by the reporting devices (and the appliance itself) is critical to accurate reconstruction of what transpires on the network.
Note
Warning
Examples
To specify that 192.168.101.5 and 192.168.103.21 are your primary and secondary NTP servers, respectively, enter:
ntp server 192.168.101.5 192.168.103.21To force a synchronization between the MARS Appliance and the NTP servers you have identified, enter:
ntp syncTo disable NTP synchronization, enter:
ntp disableRelated Commands
Displays and configures the MARS timeclock
Displays and configures the MARS timezone setting
passwd
To change the password of the system administrative account (pnadmin) associated with the appliance, use the passwd command.
passwd [new_pword]
Syntax Description
no keyword
Generates a prompt to enter a new system administrative password.
new_pword
Generates a prompt to enter a new system administrative password.
Usage Guidelines
Examples
To change the system administrative account password to Ou812o, enter:
[pnadmin]$ passwdNew password: <Ou812o>Retype new password: <Ou812o>[pnadmin]$passwd expert
To change the customer portion of the password associated with expert debugging mode of the appliance, use the passwd expert command.
passwd expert [new_pword]
While you can use the passwd expert command to restrict access to the expert command, only authorized Cisco support personnel are able to access the expert debugging mode of an appliance.
See also expert.
Syntax Description
no keyword
Begins change password dialog
new_pword
Sets the password to which you want to set the expert mode password.
Examples
To change the customer portion of the password associated with expert mode of the appliance to Ou812o, enter:
[pnadmin]$ passwd expertNew password: <Ou812o>Retype new password: <Ou812o>[pnadmin]$Related Commands
ping
To send ICMP echo_request packets for diagnosing basic network connectivity between the appliance and a network host, use the ping command.
ping [-LRUbdnqrvV] [-c count] [-i interval] [-w wait] [-p pattern] [-s packetsize] [-t ttl] [-I if_addr] [-T option] [-Q tos] host
Syntax Description
Usage Guidelines
This is standard LINUX implementation of the PING command.
Use Ctrl+C or ^C to stop the output of this command and return to the command prompt.
Note
pndbusage
To display the percentage of total storage space used by the database, use the pndbusage command:
pndbusage
Syntax Description
There are no keyword, options or arguments for this command.
Usage Guidelines
This command displays the percentage used within the current partition, as well as specifies whether additional partitions are available. If no unused partitions exist, the command identifies which partition will be purged, provides an approximate schedule for when that purge will occur, and specifies the date range and total number of events scheduled to be purged.
Examples
Two possible outputs exist for this command:
•
Current partition started on <start date> and uses<number>% of its available capacity.Switching to next partition is estimated for <estimated switching date><number> empty partitions are available for storage.•
Current partition started on <start date> and uses<number>% of its available capacity.Switching to next partition is estimated for <estimated switching date><number> events, received between <purge start date> and <purge end date> will be purged.In this case, the third line indicates the data that will be purged on the <estimated switching date>.
Indents are displayed as shown above.
pnexp
Use the pnexp configuration mode to determine the time and disk space requirements for a data export, to review the size of the database and the data characteristics, to start and stop the export of configuration data, event data, or both, and to check the status of an ongoing export. To access the pnexp configuration mode, enter the pnexp command at the [pnadmin]$ prompt:
pnexp
Command History
Syntax Description
Usage Guidelines
Use the pnexp command to prepare and export configuration and event data from a MARS Appliance running 4.x, or 5.x as separate data so you can import either or both on a MARS Appliance running 6.x software. When the export process begins, that MARS Appliance stops receiving events until the export process completes.
Caution
Note
The configuration export runs in the foreground displaying its status and errors immediately, where as event data export runs in the background. Use the log {all | recent} command to view the running status log for event data export.
The event export part of this operation can take a long time, as the export speed ranges between 6,000 and 30,000 events per second depending on the appliance model. Event data is exported in the following order: report result, statistics, incident and firing events, and event session. If the remote NFS server becomes unavailable during a lengthy export operation, the pnexp program attempts to remount the server. For event data export, logs are written to the /log/export.log file.
To exit pnexp configuration mode, enter exit at the pnexp> prompt.
For detailed explanations on data export, import, and migration, see the document, Migrating Data from Cisco Security MARS 4.x to 6.0.1, at the following URL:
Examples
The following example specifies that the MARS Appliance should export the configuration data to the NFS archive found at 192.168.3.138:/storage/mars_migration:
pnexp> export config 192.168.3.138:/storage/mars_migrationWARNING: this will stop CS-MARS, do you wish to continue (yes/no): yes!!! The exported config data is saved under sub-directory of 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10!!! Stopping CS-MARS processes ...!!! Exporting config data nowDumping configuration data, may take a while ...Configuration dump finished.Configdump to 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10 finished successfully.The following example specifies that the MARS Appliance should export the event data corresponding to the configuration data in the previous example:
pnexp> export data 192.168.3.138:/storage/mars_migration 05/01/07:0WARNING: this will stop CS-MARS, do you wish to continue (yes/no): yesEstimated total number of events to export: 1401080357Estimated time to export events: 12 hours 58 minutesEstimated space for exported events: 66809 MBDo you wish to continue (yes/no): yes!!! The exported event data is saved at 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10!!! Stopping CS-MARS processes ...!!! Restarting oracle ...!!! Exporting data in background now, enter 'status' or 'log' to view data exporting status and/or logs.
Tip
Sep 4 11:25:21.293 2007@LM_INFO@Thread 1024:START DATA EXPORTING...Sep 4 11:25:21.293 2007@LM_INFO@Thread 1024:Parameter: nfs_path = 192.168.3.138:/storage/mars_migration/LC-220_2007-09-04-11-25-10Sep 4 11:25:21.293 2007@LM_INFO@Thread 1024:Parameter: event_start_time = 05/01/07:0Sep 4 11:25:21.395 2007@LM_INFO@Thread 1024:Trying to mount /mnt/pnarchiveSep 4 11:25:22.677 2007@LM_INFO@Thread 1024:EXPORTING REPORT RESULTS ...Related Commands
Import configuration and event data into a MARS Appliance running version 5.3.1 or later.
pnimp
From the pnimp command prompt, you can access time required for a data import, review the size of the event data set on the NFS server, start and stop the import of configuration data or event data, and check the status of an ongoing import. To access the pnimp command prompt, use the pnimp command at the pnadmin prompt:
pnimp
Command History
Syntax Description
Usage Guidelines
Use the pnimp command to import configuration and event data generated from a MARS Appliance running 4.3.6 or 5.x into a MARS Appliance running 6.x software. The import operation does not affect event processing; in other words, the received events are processed upon arrival. However, it does affect the web interface and the query and report features may experience long delays and missing event or session data.
Tip
Note
The configuration import runs in the foreground displaying its status and errors immediately, where as event data export runs in the background. Use the log {all | recent} command to view the running status log for event data import.
Recent data is imported first. If an NFS-related problem results in a file not being imported properly, the pnimp import program halts and logs an error to the /log/migrationrestore.log file.
The next time the import operation is started, you are prompted whether to retry the last failed file. If no, the import operation continues with the next file. If another problem occurs, for example, a file corruption, that prevents a file from being imported, pnimp import generates a log similar to "file es_334_...gz is imported with error!" and continue with the next file.
When the import operation completes, the Local Controller begins to rebuild the RAW message indices. You can use the web interface although keyword query will remain slow until the indices are rebuilt.
For detailed explanations on data export, import, and migration, see the document, Migrating Data from Cisco Security MARS 4.x to 6.0.1, at the following URL:
Examples
The following example specifies that the MARS Appliance should import the configuration data from the NFS archive found at 192.168.3.138/storage/mars_migration/:
[pnadmin]$ pnimpEnter 'help' for a list of valid commands, 'exit' or 'quit' to exit.pnimp> import config 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 09/04/07The most recent configuration archive from 4.3.5 release or later found on the NFS server was created at 2008-09-04-11-25-10. Because events received after the config archive was created may not be imported correctly later on when you try to import event data, so if possible, you should always use 'pnexp' to export a fresh copy of configuration from the Gen-1 MARS box before trying this command.Do you wish to continue (yes/no) : yesWARNING: this operation will overwrite current MARS box's configurations (both system and DB) and reboot the machine. After reboot, current MARS box will take over the IP address, hostname and MARS username/password of the MARS box from which the config archive was exported, please make sure there will be no IP address conflict.Do you wish to continue (yes/no): yes!!! Stopping CS-MARS processes ...Invoking binary config importing procedure ...Recreating the database schema.Importing data into database ...Configuration data binary import done.Configrestore succeeded!!!! Updating system settings ...Broadcast message from root (pts/5) (Wed Jun 13 15:23:46 2008):The system is going down for reboot NOW![pnadmin]$The following example specifies that the MARS Appliance should import the event data corresponding to the configuration data in the previous example:
pnadmin]$ pnimpEnter 'help' for a list of valid commands, 'exit' or 'quit' to exit.pnimp> import data 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10 01/01/07Last imported configuration archive is from 192.168.3.138:/storage/mars_migration/LC-220_2008-09-04-11-25-10/2008-09-04/CF/cf-4318-431 _2008-09-04-11-25-10.pna created at 2008-09-04-11-25-10. Because events received after the config archive was created may not be imported correctly, you should import a latest copy of configuration from the Gen-1 MARS box before trying this command if possible.Do you wish to continue (yes/no): yesTotal number of days with data : 5Total number of event archives to import: 89Total number of report result archives to import: 1Total number of statistics archives to import: 4Total number of incident archives to import: 3Estimated time to import all events: 2 hours 1 minutesDo you wish to continue (yes/no): yes!!! Importing data in background now, enter 'status' or 'log' to view data importing status and/or logs.pnimp>The following example displays the number of devices, reports, and rules in the migration data set. This command is run after the configuration is imported into the target appliance:pnadmin]$ pnimpEnter 'help' for a list of valid commands, 'exit' or 'quit' to exit.pnimp> configNum of devices: 42482Num of interfaces: 51284Num of networks: 86Num of network groups: 3Num of reports: 253Num of report groups: 31Num of rules: 1261Num of rule groups: 16Num of users: 30Num of user groups: 5Related Commands
Export configuration and event data from a MARS Appliance running version 4.x (4.3.1 or later).
pnlog
To set the logging level, to view log information at the console, or to email log files, use the pnlog commands. This command can specify the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance. Click on the pnlog command below to display its reference page.
pnlog mailto
To send an email with the log files appended, use the pnlog mailto command. set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.
pnlog mailto {[smtp_server] [sender] [recipient]}
Syntax Description
Usage Guidelines
pnlog mailto {[smtp_server] [sender] [recipient]}
The pnlog mailto command is an alternative to sending a Feedback e-mail with the log files attached. It sends an e-mail from sender to recipient using smtp_server. The e-mail contains debugging information. These logs contain the logs specified above.
Examples
To send e-mail to bob@exmple.com from admin@example.com using the 192.168.101.5 mail server, enter:
pnlog mailto 192.168.101.5 admin@example.com bobc@example.comRelated Commands
pnlog scpto
pnlog scpto user@server:directory
Syntax Description
Usage Guidelines
Examples
Related Commands
Sends e-mail with log files attached
Sets verbosity level of MARS logs
Displays logfiles
pnlog setlevel
To set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.
pnlog setlevel {trace | debug | info | warning | error | critical}
pnlog setlevel cpdebug [ 0-9]
Syntax Description
no keyword
Displays command usage information.
trace
debug
info
warning
error
critical
setlevel debug
setlevel info
setlevel warning
setlevel error
setlevel critical
cpdebug [ 0-9]
Usage Guidelines
The pnlog setlevel command specifies how verbose the logs generated by the MARS Appliance services are, with trace being the most verbose and critical being the least. The default level is info. Unless you are actively debugging an issue, Cisco recommends that you use the default value. The trace and debug options should be used only on the advice of Cisco TAC. Setting a level of critical shows only the critical events, while setting a level of warning shows all warning or higher events (in other words, it shows warning, error, and critical events). The CLI sets a global output level while the web interface allows you to change this setting for each service (use pnstatus to view the list of services). You can access this setting in the web interface by selecting Admin > System Maintenance > Set Runtime Logging Levels.
pnlog setlevel cpdebug { 0 | 3 | 9 }
The pnlog setlevel cpdebug command sets the output level of the CheckPoint discovery process. You must specify one of three levels: 0, 3, or 9, where 0 disables Check Point debug logging, 3 enables all OPSEC debug logs, and 9 enables all CPMI debug logs. This command is used together with pnlog show cpdebug command to study the raw output of CheckPoint Discovery (CPMI) and CheckPoint Log (LEA) sessions. Cisco recommends the use of 9 for debugging and 0 when not actively debugging.
Examples
To set the log level of the MARS Appliance services to debug, enter.
pnlog setlevel debugTo set the log level of the CheckPoint discovery process to debug, enter:
pnlog setlevel cpdebug 9Related Commands
pnlog show
To set the logging level or to view log information at the console, use the pnlog command. This command specifies the logging level of the MARS services, as well as the CheckPoint CPMI and LEA logs received by the MARS Appliance.
pnlog show {gui | backend | cpdebug}
Syntax Description
Usage Guidelines
pnlog show {gui | backend | cpdebug}
The pnlog show command provides running output of a particular logfile at the console. You can view one of three logfiles: the GUI logs, the backend logs (shows logs for the processes that the pnstatus command reports on), and CheckPoint debug logs. Press Ctrl+C to stop the output of this command.
When using cpdebug, you must set the pnlog setlevel cpdebug value to 3 or 9, as the default value of 0 turns off all CPE debug messages.
pnlog setlevel cpdebug { 0 | 3 | 9 }
The pnlog setlevel cpdebug command sets the output level of the CheckPoint discovery process. You must specify one of three levels: 0, 3, or 9, where 0 disables Check Point debug logging, 3 enables all OPSEC debug logs, and 9 enables all CPMI debug logs. This command is used together with pnlog show cpdebug command to study the raw output of CheckPoint Discovery (CPMI) and CheckPoint Log (LEA) sessions. Cisco recommends the use of 9 for debugging and 0 when not actively debugging.
Examples
To set the log level of the CheckPoint discovery process to debug, enter:
pnlog setlevel cpdebug 9Related Commands
pnreset
To restore the appliance to the factory default settings (except for the pnadmin account) or to reset a Local Controller to standalone mode, use the pnreset command:
pnreset {-h} | {-g} | {-o} | {-j} | {-s}
Syntax Description
Command History
4.1.0
This command was introduced with -g, -h, -o, and -j options.
4.2.2
The -s option was introduced.
Usage Guidelines
The pnreset Command Without Options
The pnreset command restores the appliance to factory settings by deleting system configuration and event data stored in the appliance database. This reset process can take between 30 and 60 minutes to complete, depending on the model of the appliance. The pnreset command does not reset the password that you have defined for the Administrator (pnadmin) account. To reset the password to factory defaults, you must re-image the appliance using the Recovery DVD.
The pnreset command does not re-image the MARS Appliance. You should reimage the appliance when receiving a new appliance not running the most current version of the software or when you need to restore the administrator password to the factory default. For more information on reimaging, refer to Recovery Management, in the Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X.
Before entering the pnreset command without an option, disconnect the appliance from the network by unplugging the Ethernet cables from the appliance. Disconnecting from the network ensures that the cursor will return from the command upon completion. You must run pnreset without an option using a direct console connection, not an ssh console or other network-based connection. This requirement does not apply to pnreset when used with one of the options. For more information on console connections, see Establishing a Console Connection in the Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X.
Caution
The -g Option
The -g option should be used only when a Global Controller recovery is required. The -g option keeps the Global Controller connectivity information on the Local Controller intact, enabling the Local Controller to reconnect as soon as the Global Controller is restored. To purge Global Controller information from the Local Controller, use the -s option.
The pnreset -g command clears the global inspection rules and global user accounts from the Local Controller, which prepares the Local Controller to be managed by the reimaged Global Controller. It does not remove the global user groups; instead they are renamed (appended with a date) and converted to local user groups. You can edit or delete these empty groups after the reset. Because user groups are often used as recipients for rule notifications, they are not deleted to avoid invalidating the Action definition of such rules.
The -o Option
Resets the tnsnames.ora file to factory defaults. The tnsnames.ora file is required for the Oracle client to connect to Oracle server. If MARS does not pull logs from the Oracle client, this option should never be used. If the tnsnames.ora file contains invalid data, MARS may be unable to connect to its internal Oracle database. This option should only be used when errors indicated that MARS has failed to setup an external Oracle server, errors are reported during that setup, and the pnstatus command fails to execute due to these connectivity issues.
Caution
The -j Option
Resets the web server scheduler depending on the Local Controller's running mode. A restart of web server is enforced.
The -s Option
The -s option (4.2.2 and more recent) resets a Local Controller to Standalone mode from Monitor mode when the Global Controller cannot completely uncouple from (that is, delete) a Local Controller because of an unreliable network connection. It removes the same data as the -g option, removes the Global Controller connectivity data from the Local Controller, and removes the default Global Controller zone information. Use this option in the following cases:
•
•
•
Note
Examples
To restore the MARS Appliance to the factory defaults, enter:
pnresetTo prepare for a Global Controller reset or recovery, enter the following command on each Local Controller monitored by the Global Controller:
pnreset -gTo remove the Global Controller communication information and reset a Local Controller to standalone mode, enter the following command on the target Local Controller:
pnreset -s
Note
Related Commands
Displays the status of each module running as part of the MARS application.
Upgrades the software running on the MARS Appliance.
pnrestore
The pnrestore command restores data that has been archived using a network attached storage (NAS) device. You can specify the archival settings from the GUI using Admin > System Maintenance > Data Archiving (see Configure the Data Archive Setting for the MARS Appliance). For more information on the archive file structure and how the archive works, see Configuring and Performing Appliance Data Backups. For more guidance on restoring, see Guidelines for Restoring.
Note
Using the pnrestore command, you can restore three types of data:
•
Note
•
•
Note
To restore archived appliance data, use the pnrestore command:
pnrestore -m 1 -p NFSSeverIP:/archive_path -t start_time
—or—
pnrestore -m 2 -p NFSSeverIP:/archive_path -t start_time
—or—
pnrestore -m 3 -r 1 -p NFSSeverIP:/archive_path -t start_time [-e end_time -s NFSSeverIP:/stagingAreaPath]
—or—
pnrestore -m 4-r 1 -p NFSSeverIP:/archive_path -t start_time [-e end_time -s NFSSeverIP:/stagingAreaPath]
—or—
pnrestore -m 5
Command History
4.1.1
Mode 5 appears (-m 5 option).
5.2.4
End time (-e), stage path area (-s), and -r 1 options appear.
Syntax Description
No keyword or option
Displays the command's usage guidelines.
-m
Restoring mode. Three modes are available: 1 (default), 2, or 5. The mode determines what type of data is restored and from where the data is restored. Table 1-2 identifies what data is restored for each option.
Note
-h
Displays the detailed command's usage guidelines.
-t
Restores the data dated from this time through the most current archive date. Use mm/dd/yy:hh format. This option is required when you select mode r 2.
-e
(5.2.4 and later) Used in conjunction with -t and -s, this parameter allows you to specify the end time (endTime) of the data restore range. Used to restore a past range of data.
-s
(5.2.4 and later) Used in conjunction with -t and -s, this parameter allows you to specify the path (stagePath) on the NFS server to which to copy the range of data. This option is used to create a staging area from which you can restore a past range of data.
-p
Name of the directory where the archived data is stored. You must identify the NFS server by IP address, separated by a :/ and then the pathname NFSSeverIP:/archive_path.
Where NFSSeverIP is the value specified in the Remote Host IP field and archive_path is the value specified in the Remote Path field in the settings found in the web interface at Admin > System Maintenance > Data Archiving. For more information on these settings, see Configure the Data Archive Setting for the MARS Appliance.
-r 1
(5.2.4 and later) Used in conjunction with modes 3 and 4 only. Skips restoring the OS binary; instead only the configuration and dynamic data is restored. Because the version used to write out the archive for a particular time slice may predate the version most recently stored on the NFS server, these modes prevent MARS from overwriting the OS installed in the appliance to read the specified time slice's data.
Table 1-2 pnrestore Mode Description
1 (default)
Yes
Yes
Partial1
2
Yes
Yes
Yes
3 -r 1
No
Yes
No
4 -r 1
No
Yes
Yes
5
No
Yes2
No
1 The incident and event data associated with cases is restored; however, other dynamic data is not.
2 Mode 5 restores data from a local configuration file on the MARS Appliance, not an NFS server.
Examples
You can use the restore feature to complete different restoring tasks, such as:
•
pnrestore -m 5•
pnrestore -m 2 -p 192.168.1.1:/archive/CS_MARS1 -t 01/02/06:0•
For example, if you only want to copy the OS and the system configuration data, you should use mode 1 of the restore command. For example in the CLI menu of the new appliance, enter:
pnrestore -m 1 -p NFSSeverIPOfOldBox:/archive/CS_MARS1
Caution
•
Note
For example, if you want to stage data between 10/01/06 and 11/01/06 to the corresponding directory under the stageAreaPath directory, enter:
pnrestore -t 10/01/06:00 -e 11/01/06:00 -p nfsIp:/archive -s nfsIp:/stageAreaPath•
pnrestore -m 4 -r 1 -t 10/01/06:00 -e 11/01/06:00 -p 10.1.1.1:/archive -s 10.1.10.15:/stagingAreapnstart
To manually start the MARS application running on the appliance from the serial console, use the pnstart command.
pnstart
Syntax Description
This command has no arguments or keywords.
Examples
The following command starts the MARS application running on the appliance:
pnstartpnstatus
To show the status of each module running as part of the MARS application from the serial console, use the pnstatus command.
pnstatus
Note
All services should be running on a Local Controller. However, a Global Controller only has four services running: autoupdate, graphgen, pnarchiver, and superV—all other services are stopped.
Syntax Description
This command has no arguments or keywords.
Examples
The following example displays the status of each module running on the MARS Appliance:
[pnadmin]$ version6.0.1 (2955) 30[pnadmin]$ pnstatusModule State UptimeDbIncidentLoaderSrv RUNNING 90-16:14:33KeywordQuerySrv RUNNING 90-16:14:35autoupdate RUNNING 90-16:14:34csdam RUNNING 90-16:14:35csiosips RUNNING 90-16:14:33csips RUNNING 90-16:14:35cswin RUNNING 90-16:14:33device_monitor RUNNING 90-16:14:34discover RUNNING 85-21:08:50graphgen RUNNING 05:15:45pnarchiver RUNNING 90-16:14:36pndbpurger RUNNING 90-16:14:35pnesloader RUNNING 90-16:14:36pnmac RUNNING 90-16:14:36pnparser RUNNING 74-13:09:55process_event_srv RUNNING 49-17:54:26process_inlinerep_srv RUNNING 90-16:14:35process_postfire_srv RUNNING 90-16:14:36process_query_srv RUNNING 90-16:14:36securesyslog RUNNING 90-16:14:36superV RUNNING 90-16:14:36pnstop
To stop the MARS application running on the appliance from the serial console, use the pnstop command.
pnstop
Syntax Description
This command has no arguments or keywords.
Examples
The following command stops the MARS application running on the appliance:
pnstoppnupgrade
To upgrade the software image running on the MARS Appliance, use the pnupgrade command. The pnupgrade command is not easily decipherable when presented in standard Cisco IOS command syntax; For this command page, it is parsed into more decipherable components.
pnupgrade [options] {url}
Syntax Description
Usage Guidelines
The pnupgrade command is executed from an SSH or a console connection. If the SSH session terminates during the upgrade, the upgrade continues uninterrupted.
The pnupgrade command can load an image file stored on the following media:
•
•
See the Cisco Security MARS Initial Configuration and Upgrade Guide, 6.X, Checklist for Upgrading the Appliance Software, for details on obtaining upgrade images and preparing the Internal Upgrade Server.
The procedure to upgrade MARS from the CLI is at the following URL:
The supported transport protocols are FTP, HTTPS, and HTTP. The CD-ROM and DVD methods access the MARS DVD drive.
For the FTP, HTTPS, and HTTP methods, you can configure a specific port number instead of relying on the default port number for that service.
You can also specify a login and password as part of the URL syntax instead of using the -u option.
Note
Table 1-3 discusses usage guidelines for some of the pnupgrade options.
Upgrade Log File
The pnupgrade -l command displays a log of each step that was performed during the most recent upgrade. This log file can identify which steps failed or hung in a failed upgrade attempt.
Image Management Troubleshooting
If the upgrade is done with the GUI, any errors encountered are prominently displayed in the Upgrade Status Logs section.
For CLI upgrade errors, check the pnupgrade -l log file first. Cisco TAC can check for the existence of any other failed upgrade log files with the expert password.
For Global Controller and Local Controller image management problems, make sure that the status for each Local Controller status is "Active." If it is not "Active," then go to Admin -> LC Management for more troubleshooting information.
Examples
The following example displays the upgrade log file:
[pnadmin]$pnupgrade -l
The following example specifies username "aladdin" and password "opensesame" to authenticate to the HTTPS Internal Upgrade Server "10.1.1.2" using default port numbers. The upgrade package is retrieved from the "/packages" directory:
[pnadmin]$pnupgrade -u aladdin:opensesame https://10.1.1.2/packages/csmars-6.0.1.2747.zipThe following example specifies no timeout during the upgrade and port 8080 of the HTTP Internal Upgrade Server, with no authentication:
[pnadmin]$pnupgrade -n http://pnadmin@10.1.1.1:8080/csmars-6.0.1.4168.zipThe following example specifies the username "ybother" without a password to authenticate to the HTTPS Internal Upgrade Server using default port numbers. The upgrade package is retrieved from the "/packages" directory:
[pnadmin]$pnupgrade -u ybother https://10.2.3.8/packages/csmars-6.0.1-2424.zipThe following example specifies the proxy server "myproxy" to retrieve the upgrade file from the default directory of the Internal Upgrade Server "10.1.1.1" using HTTP on default ports (both proxy and Internal Upgrade Server). The username "myname" and password "mypass" authenticate to the proxy server; The login "me" with no password authenticates to the Internal Upgrade Server:
[pnadmin]$pnupgrade -x myproxy -U myname:mypass http://me@10.1.1.1/csmars-6.0.1-2428.zipThe following example performs an upgrade from the MARS DVD drive:
[pnadmin]$pnupgrade cdrom://csmars-6.0.1-2168.zipThe following example demonstrates the -d option with an upgrade package that requires a MARS reboot:
[pnadmin]$pnupgrade -d https://mylogin:mypasswd@10.1.2.1/upgrade/packages/csmars-6.0.1.3016.zipCSMARS Upgrade...........[7370]Loading..................[csmars-6.0.1.3016.zip]User.................[mylogin]Protocol.............[https]Host.................[10.1.2.1]Path.................[upgrade/packages/csmars-6.0.1.3016.zip]Modified.............[Wed, 30 Jul 2008 05:05:49 GMT]Size.................[318541040]######################################################################## 100.0%Upgrade..................[pnmars]From.................[6.0.1.3000.30]To...................[6.0.1.3016.30]Strip Meta Data..........[csmars-6.0.1.3016.zip][Alert][confirm_upgrade/98]: reboot after upgrade is completed./dev/hda1 has gone 28 times of booting without being checked, will be checked at the coming reboot.An estimated 1 minute increase of booting time will occur at the coming reboot.fsck will be required on 1 partition at next reboot.Continue upgrade? yes/[no]Related Commands
pnlog mailto
Sends a Feedback e-mail with the log files attached.
Predicts the duration of the file system check that will occur if the Cisco Security MARS is rebooted.
predictfsck
To predict the duration of the file system check that will occur if the Cisco Security MARS is rebooted, enter the predictfsck command.
predictfsck
Syntax Description
There are no keywords or arguments for this command.
Usage Guidelines
If a user installs an upgrade package that requires a reboot, a file system check (FSCK) is run after the reboot. The predictfsck command predicts the duration of the required FSCK.
Examples
The following examples display predictfsck output for a Cisco Security MARS that requires a file system check upon reboot.
[pnadmin]$ predictfsck/dev/hda1 has gone 74 times of booting without being checked, will be checked at the coming reboot.An estimated 1 minute increase of booting time will occur at the coming reboot.fsck will be required on 1 partition at next reboot.The following examples display predictfsck output for a Cisco Security MARS that does not require a file system check upon reboot.
[pnadmin]$ predictfsckfsck will not be required at next reboot.[pnadmin]$Related Commands
raidstatus
To view the status of the RAID array and of the individual hard drives, use the raidstatus command.
raidstatus
Syntax Description
This command has no arguments or keywords.
Command History
4.2.1
This command introduced for Generation 1 hardware
5.2.4
This command was introduced for Generation 2 hardware
5.3.2
Support for the MARS 55 was added.
Usage Guidelines
The raidstatus command is used with the hotswap command to replace component hard drives of the MARS Appliance Raid array.
For information on RAID hotswapping procedures and hard drive alerts, see the chapter, "Hardware Maintenance Task" in the Cisco Security MARS Hardware Installation and Maintenance Guide 6.X at the following URL:
Examples
Raidstatus Examples for 55, 110R, 110, 210, GC2R and GC2
The following example displays a MARS 55 with a failed hard drive:
[pnadmin]$ raidstatusRAID Controller Information:-------------------------------------------------------Product Name : Intel Embedded Server RAID TechnologyDriver Version : 05.08yController Type : SATAAdapter Raid Type Status Stripe Size------------------------------------------------------a0 Raid 1 Degraded 64 KB 476772 MBPort Status Size Model Serial # Write Cache--------------------------------------------------------------------------0 Online 476772 MB HDS725050KLA360 KRVN0AZBH5R3LJ Enabled1 Failed 476772 MB HDS725050KLA360 KRVN0AZBH5R8RJ EnabledIn the following example, the MARS 210 RAID array is fully operational and redundant, that is, adapter a0 Raid-10 status is optimal, and all of the hard drives are online.
[pnadmin]$ raidstatusAdapter Information:-------------------------------------------------------Product Name : Intel(R) RAID Controller SROMBSAS18EFirmware Version : 1.03.00-0211BIOS Version : MT30Adapter RaidType Status Stripe Size Cache---------------------------------------------------------------a0 Raid-10 Optimal 64kB 2097151MB EnabledPD Status Size & Block Model Serial#-----------------------------------------------------------------------------------------p0 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E CQD017CETp1 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02EMYp2 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02ELSp3 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02D0Ap4 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD01T1Pp5 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02BZ7In the following example, the MARS 210 RAID array is shown degraded because hard drive 3 (p3) has failed. The RAID array is functional, but not fully redundant because the p2+p3 RAID 1 pair is compromised.
[pnadmin]$ raidstatusAdapter Information: -------------------------------------------------Product Name : Intel(R) RAID Controller SROMBSAS18EFirmware Version : 1.03.00-0211BIOS Version : MT30Adapter RaidType Status Stripe Size Cache-------------------------------------------------------------------------------a0 Raid-10 Optimal 64kB 2097151MB EnabledPD Status Size & Block Model Serial#-----------------------------------------------------------------------------------------p0 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E CQD017CETp1 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02EMYp2 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02ELSp3 Failed 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02D0Ap4 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD01T1Pp5 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02BZ7In the following example, hard drive 3 has been replaced with the hotswap command, and is being rebuilt into the the MARS 210 Raid Array. The Array remains degraded until p3 has Online status. The progress message at the bottom shows percentage complete and time elapsed in the rebuild process.
[pnadmin]$ raidstatusAdapter Information: C3QD02C0K-------------------------------------------------------Product Name : Intel(R) RAID Controller SROMBSAS18EFirmware Version : 1.03.00-0211BIOS Version : MT30Adapter RaidType Status Stripe Size Cache---------------------------------------------------------------a0 Raid-10 Degraded 64kB 2097151MB EnabledPD Status Size & Block Model Serial#-----------------------------------------------------------------------------------------p0 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E CQD017CETp1 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02EMYp2 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02ELSp3 Rebuild 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02C0Kp4 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD01T1Pp5 Online 715404MB [0x575466f0 Sectors] ATA ST3750640AS E C3QD02BZ7Rebuild Progress on Device at Enclosure 20, Slot 2 Completed 71% in 279 Minutes.
Raidstatus Examples for MARS 50, 100, 100e, 200, GC and GCm
Example 1-1 displays the output of the raidstatus command executed on a Local Controller 200. Table 1-4 describes the output fields.
Example 1-1 Example of raidstatus CLI Command Output for a Local Controller 200
[PNADMIN]$ raidstatusCONTROLLER: C0-------------DRIVER: 1.02.00.037MODEL: 7506-8FW: FE7X 1.05.00.068BIOS: BE7X 1.08.00.048MONITOR: ME7X 1.01.00.040SERIAL #: L14104A5090383PCB: REV4PCHIP: 1.30-66ACHIP: 3.20# OF UNITS: 1UNIT 0: RAID 10 931.54 GB ( 1953580032 BLOCKS): REBUILDING (75%)# OF PORTS: 8PORT 0: WDC WD2500JB-19GVA0 WD-WCAL73129135 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 1: WDC WD2500JB-19GVA0 WD-WCAL73291174 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 2: WDC WD2500JB-19GVA0 WD-WCAL73157538 232.88 GB (488397168 BLOCKS): OK(NO UNIT)PORT 3: WDC WD2500JB-98GVA0 WD-WMAL72243570 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 4: WDC WD2500JB-00GVA0 WD-WCAL73883655 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 5: WDC WD2500JB-19GVA0 WD-WCAL73290905 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 6: WDC WD2500JB-98GVA0 WD-WCAL73693347 232.88 GB (488397168 BLOCKS): OK(UNIT 0)PORT 7: WDC WD2500JB-98GVA0 WD-WMAL72244432 232.88 GB (488397168 BLOCKS): OK(UNIT 0)UNIT /C0/U0---------------------STATUS: REBUILDINGUNIT TYPE: RAID 10STRIPE SIZE: 64KSIZE: 931.54 GB (1953580032 BLOCKS)# OF SUBUNITS: 4SUBUNIT 0: RAID 1: OKSUBUNIT 0: CBOD: OKPHYSICAL PORT: 7LOGICAL PORT: 0SUBUNIT 1: CBOD: OKPHYSICAL PORT: 4LOGICAL PORT: 1SUBUNIT 1: RAID 1: REBUILDING (1%)SUBUNIT 0: CBOD: DEGRADEDPHYSICAL PORT: 6LOGICAL PORT: 0SUBUNIT 1: CBOD: OKPHYSICAL PORT: 3LOGICAL PORT: 1SUBUNIT 2: RAID 1: DEGRADEDSUBUNIT 0: CBOD: OKPHYSICAL PORT: 5LOGICAL PORT: 0SUBUNIT 1: CBOD: OKPHYSICAL PORT: 0LOGICAL PORT: 1SUBUNIT 3: RAID 1: OKSUBUNIT 0: CBOD: OKPHYSICAL PORT: 1LOGICAL PORT: 0SUBUNIT 1: CBOD: OKPHYSICAL PORT: 0LOGICAL PORT: 1
Related Commands
Specifies that a designated hard drive is to be removed or added to a RAID array.
Displays information on chassis, hard drives and power supplies
reboot
To reboot the MARS Appliance from the serial console, use the reboot command.
reboot
Caution
Syntax Description
This command has no arguments or keywords.
Examples
The following command reboots the appliance:
rebootRelated Commands
Predicts the duration of the file system check that will occur if the Cisco Security MARS is rebooted.
route
The route command manipulates the MARS Appliance's IP routing tables. Its primary use is to set up static routes to specific hosts or networks via an interface after it has been configured with the ifconfig command.
When the add or del options are used, the route command modifies the routing tables. Without these options, the route command displays the current contents of the routing tables.
To list the kernel routing tables, enter:
route [-nNve] [-FC]
To add a route to the routing table, enter:
route [-v] [-FC] add [-net | -host] target [netmask] [gateway] [metric N] [mss M] [window W] [irtt I] [reject] [mod] [dyn] [reinstate] [[dev] inf_local]
To delete a route from the routing table, enter:
route [-v] [-FC] del [-net | -host] target [netmask] [gateway] [metric N] [[dev] inf_local]
To display detailed usage syntax for the command, enter:
route -h
To display version/author information and exit, enter:
route -V
Syntax Description
Usage Guidelines
The route command is a standard Linux command.
script
Use the restricted script command mode to execute provided script:
script [-b] program
Syntax Description
Command History
4.3.1
This command was introduced in the 4.3.1 release.
5.3.1
This command was introduced in the 5.3.1 release.
Usage Guidelines
The following scripts are available from the restricted script command mode:
•
Examples
The following example gathers high level statistics about the MARS Appliance's configuration and topology.
[pnadmin]$ script get_mars_summary_info.shCollecting MARS summary info from the DB in HTML formatStarted at Fri Sep 14 05:50:10 PDT 2007Use 'pnlog mailto' command to include it in the logsThis may take several minutes to complete. Use Ctrl+C in case you need to interrupt.Completed at Fri Sep 14 05:50:10 PDT 2007[pnadmin]$show healthinfo
To display the operational status of key components in the appliance use the show healthinfo command.
show healthinfo
Syntax Description
There are no arguments or keywords for this command.
Command History
5.2.4
This command was introduced for the MARS 25R, 25, 55, 110R, 110, 210, GC2R, and GC.
6.0.1
This command was introduced for the MARS 20, 50, 100E, 100, 200, GCM, and GC.
Usage Guidelines
The show healthinfo command displays the operational status of critical components, such as fans, CPUs, hard drives, Ethernet interfaces, power supplies, backup battery units, memory usage, and the operating system.
Power Supply
In the command output for Power Supply, PS1 is the lower power supply, PS2 is the upper power supply. In normal operation, PS1 supplies most of the power requirements, and PS2 is the redundant power supply.
Ethernet Card Status
In the command output for Ethernet, eth0 is integrated NIC 1, eth1 is integrated NIC 2; eth2 and eth3 are not supported.
Raid Battery Backup Unit
In the command output for BBU, the relative state of charge is directly proportional to the battery backup time (100%charge = 72hours ).
For more information on RAID BBU and power supply procedures, see the chapter, "Hardware Maintenance Tasks—MARS 55, 110R, 110, 210, GC2R, and GC2" in the Cisco Security MARS Hardware Installation and Maintenance Guide, 6.X at the following URL:
Examples
The following example dispays the health monitoring information on a MARS 110.
[pnadmin]$ show healthinfoCPU Information:Processor Vendor ID Model CPU(MHZ)0 GenuineIntel Intel(R) Xeon(R) CPU 5130 @ 2.00GHz 1995.0241 GenuineIntel Intel(R) Xeon(R) CPU 5130 @ 2.00GHz 1995.0242 GenuineIntel Intel(R) Xeon(R) CPU 5130 @ 2.00GHz 1995.0243 GenuineIntel Intel(R) Xeon(R) CPU 5130 @ 2.00GHz 1995.024Memory Information:MemTotal: 4137832 kB MemFree: 18812 kBFan ID RPM Status----------------------------------Fan 1 7052 RPM okFan 2 7611 RPM okFan 3 7095 RPM okFan 4 7568 RPM okFan 5 10416 RPM okFan 6 9610 RPM okCPU Temperature Status--------------------------------CPU1 VRD Temp 0x00 okCPU2 VRD Temp 0x00 okCPU1 Vcc OOR 0x00 okCPU2 Vcc OOR 0x00 okPower Supply Value Status----------------------------------------PS1 AC Current 2.36 Amps okPS2 AC Current 0.12 Amps okPS1 +12V Current 21 Amps okPS2 +12V Current 0 Amps okPS1 +12V Power 248 Watts okPS2 +12V Power 0 Watts okPS1 Status 0x01 okPS2 Status 0x09 okEthernet card statuseth0 is upeth1 is upeth2 is downeth3 is downFlash driver is OnlineBBU information :Relative state of charge : 93 %Full charge capacity : 920 mAhRemain capacity : 858 mAhOS information :Linux SJ-LC-17 2.6.9-42.0.2.ELsmp #1 SMP Thu Aug 17 18:00:32 EDT 2006 i686 i686 i386 GNU/LinuxThe following example dispays the health monitoring information on a MARS 20.
Related Commands
Displays or modifies the IP address and network mask of the network interfaces.
Displays identifying details of essential components in the appliance.
show inventory
To display an inventory and serial numbers, of essential components in the MARS Appliance, use the show inventory command.
show inventory
Syntax Description
There are no arguments or keywords for this command.
Command History
5.2.4
This command was introduced for the MARS 25R, 25, 55, 110R, 110, 210, GC2R, and GC.
6.0.1
This command was introduced for the MARS 20, 50, 100E, 100, 200, GCM, and GC.
Usage Guidelines
The show inventory command displays the part identification string (PID) and serial numbers of the chassis, hard drives, RAID battery backup unit, and power supplies.
Examples
The following example displays the inventory of a MARS 110 Local Controller:
[pnadmin]$ show inventoryNAME: "Chassis", DESCR: "CS-MARS-110 Local Controller"PID: CS-MARS-110, VID: V01, SN: M1100000027RAID Information:NAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG02GFHNAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG00KH4NAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG02GCHNAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG02GE4NAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG02GHJNAME: "Hard Disk Drive", DESCR: "Barracuda ES - Serial ATA II - 3.0Gps - 500GB"PID: CS-MARS-S500-HD, VID: , SN: 5QG02GGVRAID Battery Backup Unit Information:NAME: "Battery", DESCR: "MARS110/210/GC2 RAID Controller Back-Up Battery"PID: CS-MARS-X10-BB, VID: , SN: 313Power Supply Information:NAME: "Power supply", DESCR: "MARS110/210/GC2 Power Supply Module"PID: CS-MARS-D750-PS, VID: , SN: DLD0636022220NAME: "Power supply", DESCR: "MARS110/210/GC2 Power Supply Module"PID: CS-MARS-D750-PS, VID: , SN: DLD0621008449The following example displays the inventory of a MARS 20:
[pnadmin]$ show inventoryNAME: "Chassis", DESCR: "CS-MARS-20 Local Controller"PID: CS-MARS-20, VID: , SN: 003048832C34Related Commands
shutdown
To shut down and power-off the MARS appliance from the serial console, use the shutdown command.
shutdown
Syntax Description
This command has no arguments or keywords.
Usage Guidelines
To turn on the appliance after executing the shutdown command, you must have physical access to it. For more information, see Powering on the Appliance and Verifying Hardware Operation in the "Cisco Security MARS Hardware Installation and Maintenance Guide 6.X"
Caution
Examples
The following example shuts down the MARS appliance:
[pnadmin]$ shutdownRelated Commands
Predicts the duration of the file system check that will occur if the Cisco Security MARS is rebooted.
snmpwalk
The snmpwalk command loads an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information.
To use snmpwalk, enter:
snmpwalk [options] agent [objectID]
Syntax Description
Usage Guidelines
snmpwalk command options
-h, --help display this help message
-H display configuration file directives understood
-v 1|2c|3 specifies SNMP version to use
-V, --version display package version number
-c COMMUNITY set the community string
General communication options
-r RETRIES set the number of retries
-t TIMEOUT set the request timeout (in seconds)
Debugging
-d dump input/output packets in hexadecimal
-D TOKEN[,...] turn on debugging output for the specified TOKENs
(ALL gives extremely verbose debugging output)
General options
-m MIB[:...] load given list of MIBs (ALL loads everything)
-M DIR[:...] look in given list of directories for MIBs
-P MIBOPTS Toggle various defaults controlling MIB parsing:
u: allow the use of underlines in MIB symbols
c: disallow the use of "--" to terminate comments
d: save the DESCRIPTIONs of the MIB objects
e: disable errors when MIB symbols conflict
w: enable warnings when MIB symbols conflict
W: enable detailed warnings when MIB symbols conflict
R: replace MIB symbols from latest module
-O OUTOPTS Toggle various defaults controlling output display:
a: print all strings in ascii format
b: do not break OID indexes down
e: print enums numerically
E: escape quotes in string indices
f: print full OIDs on output
n: print OIDs numerically
q: quick print for easier parsing
Q: quick print with equal-signs
s: print only last symbolic element of OID
S: print MIB module-id plus last element
t: print timeticks unparsed as numeric integers
T: print human-readable text along with hex strings
u: print OIDs using UCD-style prefix suppression
U: don't print units
v: print values only (not OID = value)
x: print all strings in hex format
X: extended index format
-I INOPTS Toggle various defaults controlling input parsing:
b: do best/regex matching to find a MIB node
r: do not check values for range/type legality
R: do random access to OID labels
h: don't apply DISPLAY-HINTs
u: top-level OIDs must have '.' prefix (UCD-style)
-C APPOPTS Set various application specific behaviours:
p: print the number of variables found
i: include given OID in the search range
c: do not check returned OIDs are increasing
ssh
To access the SSH client that resides on the appliance, use the ssh command.
ssh [-1246AaCfghkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec] [-D port]
[-e escape_char] [-F configfile] [-i identity_file] [-L port:host:hostport] [-l login_name]
[-m mac_spec] [-o option] [-p port] [-R port:host:hostport] [-S ctl]
[user@hostname command]Syntax Description
Usage Guidelines
For further information on SSH usage, please see SSH Communications Security Corporation documentation at the following URL:
http://www.ssh.com/support/documentation/online/ssh/winhelp/
or open source command references, such as OpenBSD command references:
http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion=1
sslcert
To generate a new self-signed SSL certificate and reboot the JBoss Application Server use the sslcert command:
sslcert
Syntax Description
There are no kewords, arguments or options for this command.
Usage Guidelines
To use this command, you will be prompted to provide the following information:
•
•
•
•
•
•
The sslcert command launches an interactive program that collects the information required to generate a certificate. You are prompted to verify that you want to generate a new self-signed certificate. Enter YES to begin the interview process that will collect the data required to generate the certificate. Enter NO to cancel without generating a new certificate.
With the FIPS PCI Card installed and initialized, you must reboot after executing an sslcert command.
Examples
The following command generates a new self-signed certificate:
[pnadmin]$ sslcertSslcert command will generate a new ssl certificate and restart jboss.Please type YES if you want to proceed: YESWhat is the common name of this device? (CN)[Unknown]: hostnameWhat is the name of your organizational unit? (OU)[Unknown]: testWhat is the name of your organization? (O)[Unknown]: cisco.comWhat is the name of your City or Locality? (L)[Unknown]: San JoseWhat is the name of your State or Province? (SP)[Unknown]: CAWhat is the two-letter country code for this unit? (C)[Unknown]: USCertificate stored in file <server.cert>Certificate was added to keystoreRestarting jboss ... OKRelated Commands
ssllist
Use the ssllist command to display the list of ssl certificates that exist in your keystore.
ssllist
Syntax Description
There are no arguments or keywords for this command.
Command History
5.2.4
This command was introduced in the 5.2.4 release.
6.0.1
This command was introduced for the MARS 20R, 20, 50, 100E, 100, 200, GCM, and GC.
Examples
The following command lists the SSL certificates of a MARS 200:
[pnadmin]$ ssllistKeystore type: jksKeystore provider: SUNYour keystore contains 1 entryserver, Jun 18, 2008, trustedCertEntry,Certificate fingerprint (MD5): D8:13:9B:9A:1F:DB:E8:E6:CB:D1:D8:D3:AF:64:D0:75Related Commands
syslogrelay setcollector
To set, change, or clear the IP address of a host to which the Local Controller forwards the syslog messages it receives, use the syslogrelay setcollector command.
syslogrelay {setcollector | unsetcollector} ip_address
Command History
4.3.1
This command was introduced in the 4.X release train.
5.3.1
This command was introduced in the 5.X release train.
Syntax Description
Usage Guidelines
The syslogrelay setcollector command allows you to specify the IP address of the syslog server to which syslog messages should be forwarded. This command must be used in conjunction with the syslogrelay src command, which designates the reporting devices for which syslog messages should be forwarded.
Examples
The following example specifies that the Local Controller should forward the syslog messages to 192.168.1.25, which is the designated address of the collector.
[pnadmin]$ syslogrelay setcollector 192.168.1.25The following example changes the address of the collector defined in the previous example.[pnadmin]$ syslogrelay setcollector 192.168.1.26syslogrelay setcollector 192.168.1.26Changing collector ip from 192.168.1.25 to 192.168.1.26. Continue? [y/n]:The following example clears the address of the collector defined in the previous example, effectively disabling the syslog relay feature until a new collector address is set.
[pnadmin]$ syslogrelay unsetcollector 192.168.1.26Related Commands
syslogrelay src
To add to, remove from, or clear the lists of sources (reporting devices) for which the Local Controller forwards the syslog messages it receives to the collector, use the syslogrelay src command.
syslogrelay src {include | exclude} {ANY | ip_address1, . . . ip_address10}
syslogrelay src reset
Command History
4.3.1
This command was introduced in the 4.X release train.
5.3.1
This command was introduced in the 5.X release train.
Syntax Description
Usage Guidelines
The syslogrelay src command designates the set of reporting devices for which the Local Controller forwards the syslog messages it receives to the collector. You can exclude all addresses, defining the few exceptions for which the syslog messages should be forwarded; or you can enable all addresses, and define the exceptions that should not be forwarded.
The ANY token cannot be used simultaneously in both the include and exclude lists. If the value is set on one list, and you apply it to the other list, it is removed from the first.
The syslogrelay src include ANY command indicates that all syslog messages received by MARS be relayed to the configured collector, excepting those that originate from the addresses configured as exclusions. If exclusions are configured, the following prompt appears:
One or more device ip addresses are currently excluded. Proceed further? [y/n]:
Enter y to retain the current exclusions and forward the syslog messages of from all other reporting devices, or enter n to cancel.
The syslogrelay src exclude ANY command indicates that all syslog messages received by MARS should not be forwarded to the configured collector, excepting those that originate from addresses configured as inclusions. If inclusions are configured, the following prompt appears:
One or more device ip addresses are currently included. Proceed further? [y/n]:
Enter y to retain the current inclusions and prevent the forwarding of syslog messages from all other devices, or enter n to cancel.
Examples
The following example specifies that the Local Controller should forward the syslog messages it receives from any reporting device to the collector (as long as the source IP address of the message is not in the source exclude list).
[pnadmin]$ syslogrelay src include ANYThe following example specifies that the Local Controller should not forward the syslog messages it receives from 192.168.1.1 or 192.168.2.1 to the collector.
[pnadmin]$ syslogrelay src exclude 192.168.1.1, 192.168.2.1The following example clears the source include and exclude lists of all values:.
[pnadmin]$ syslogrelay src resetOne or more device ip addresses are currently configured. Proceed further?[yes/no]: yesRelated Commands
syslogrelay list
To display the IP addresses of the reporting devices to which the Local Controller forwards the syslog messages as well as the IP address of the collector to which they are sent, use the syslogrelay list command.
syslogrelay list [all | collector | src]
Command History
4.3.1
This command was introduced in the 4.X release train.
5.3.1
This command was introduced in the 5.X release train.
Syntax Description
Usage Guidelines
Using the syslogrelay list command, you can verify the list of addresses in the include and exclude lists. If a reporting device device appears in the include list, the Local Controller forwards any syslog messages that it receives from that device to the syslog collector. The exclude list identifies the IP addresses for which the Local Controller does not forward the syslog messages. The collector identifies the IP address to which the specified syslog messages are forwarded. This address represents a syslog server or other collector as defined in RFC 3164: The BSD syslog Protocol.
If the collector address is not set, the syslogrelay feature is disabled.
Examples
The following example displays the t syslog relay configuration.
[pnadmin]$ syslogrelay list all[Collector]192.168.1.1[Inclusions]ANY[Exclusions]192.168.2.1182.168.3.1Related Commands
sysstatus
To view the current CPU activities, enter:
sysstatus -hvbcisqS -d delay -p pid -n iterations
Syntax Description
Usage Guidelines
The sysstatus command is a system-defined alias for the Linux top command, which displays and updates information about the top CPU processes. It provides a real-time view of the processor activity. It lists the most CPU-intensive tasks on the system, and can provide an interactive interface for manipulating processes. It can sort the tasks by CPU usage, memory usage, and runtime.
If you execute the command and you do not select the batch mode option, you are running in an interactive environment. In this environment, you can interact with the output as follows:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
tcpdump
Tcpdump prints to the console the headers of packets on a network interface that match the boolean expression. Exit with Ctrl+C.
tcpdump [-adeflnNOpqRStuvxX] [-c count] [ -i interface ] [ -s snaplen ] [ -T type ] [ -U user ] [ expression ]
Syntax Description
Usage Guidelines
Ctrl+C exists the tcpdump screen.
Note
telnet
The telnet command is used to communicate with another host using the TELNET protocol. In this mode, it accepts and executes the commands listed below. If it is invoked with arguments, it performs an open command with those arguments.
telnet [-8] [-E] [-L] [-S tos] [-a] [-c] [-d] [-e char] [-l user] [-n tracefile] [-b hostalias ] [-r] [hostname [port]]
Syntax Description
Usage Guidelines
For more information on this command and its use, please refer to a Linux command reference or man page.
time
To display the current time, enter:
time
To set the time to 11:15 p.m., enter:
time [hh:mm:ss]
Syntax Description
hh:mm:ss Identifies the time in hh:mm:ss format, where hh is 01-24, mm is 00-59 and ss is 00-59.
Usage Guidelines
Time changes on the appliance are immediate, which can affect active incident correlation. If you change the time by greater than one half hour, you should restart your appliance to ensure that all processes synchronize using the new time.
Examples
The following example displays the current time of a MARS 200:
[pnadmin]$ time17:04:40The following example changes the time to 11:15 p.m., enter:
[pnadmin]$ timezone 23:15:00[pnadmin]$ time23:15:00Related Commands
identifies the primary and secondary NTP server with which the appliance should synchronize.
Displays and configures the MARS timezone setting
timezone
To display the current timezone setting, enter:
timezone
To set a new timezone, enter:
timezone set
When configuring a Global Controller\Local Controller hierarchy, you should ensure that all the Local Controllers are set to the same timezone as the reporting devices that they are monitoring.
Note
Syntax Description
set Displays a menu system that allows you to select the appropriate timeszone based on continent/country/region or using the POSIX TZ format.
Examples
The following example displays the current time of a MARS 200:
[pnadmin]$ timezone17:04:40PDT -0700The following example sets the timezone to Pacific time:
[[pnadmin]$ timezone setPlease identify a location so that time zone rules can be set correctly.Please select a continent or ocean.1) Africa2) Americas3) Antarctica4) Arctic Ocean5) Asia6) Atlantic Ocean7) Australia8) Europe9) Indian Ocean10) Pacific Ocean11) none - I want to specify the time zone using the Posix TZ format.#? 2Please select a country.1) Anguilla 27) Honduras2) Antigua & Barbuda 28) Jamaica3) Argentina 29) Martinique4) Aruba 30) Mexico5) Bahamas 31) Montserrat6) Barbados 32) Netherlands Antilles7) Belize 33) Nicaragua8) Bolivia 34) Panama9) Brazil 35) Paraguay10) Canada 36) Peru11) Cayman Islands 37) Puerto Rico12) Chile 38) St Barthelemy13) Colombia 39) St Kitts & Nevis14) Costa Rica 40) St Lucia15) Cuba 41) St Martin (French part)16) Dominica 42) St Pierre & Miquelon17) Dominican Republic 43) St Vincent18) Ecuador 44) Suriname19) El Salvador 45) Trinidad & Tobago20) French Guiana 46) Turks & Caicos Is21) Greenland 47) United States22) Grenada 48) Uruguay23) Guadeloupe 49) Venezuela24) Guatemala 50) Virgin Islands (UK)25) Guyana 51) Virgin Islands (US)26) Haiti#? 47Please select one of the following time zone regions.1) Eastern Time2) Eastern Time - Michigan - most locations3) Eastern Time - Kentucky - Louisville area4) Eastern Time - Kentucky - Wayne County5) Eastern Time - Indiana - most locations6) Eastern Time - Indiana - Daviess, Dubois, Knox & Martin Counties7) Eastern Time - Indiana - Starke County8) Eastern Time - Indiana - Pulaski County9) Eastern Time - Indiana - Crawford County10) Eastern Time - Indiana - Switzerland County11) Central Time12) Central Time - Indiana - Perry County13) Central Time - Indiana - Pike County14) Central Time - Michigan - Dickinson, Gogebic, Iron & Menominee Counties15) Central Time - North Dakota - Oliver County16) Central Time - North Dakota - Morton County (except Mandan area)17) Mountain Time18) Mountain Time - south Idaho & east Oregon19) Mountain Time - Navajo20) Mountain Standard Time - Arizona21) Pacific Time22) Alaska Time23) Alaska Time - Alaska panhandle24) Alaska Time - Alaska panhandle neck25) Alaska Time - west Alaska26) Aleutian Islands27) Hawaii#? 21The following information has been given:United StatesPacific TimeTherefore TZ='America/Los_Angeles' will be used.Local time is now: Fri Apr 27 17:12:09 PDT 2008.Universal Time is now: Sat Apr 28 00:12:09 UTC 2008.Is the above information OK?1) Yes2) No#? 1) Yes2) No#? 1Restarting jboss: OKStopping SuperV: OKStarting SuperV: OKRelated Commands
Specifies the primary and secondary NTP servers with which the appliance should synchronize.
Displays and configures the MARS timeclock
traceroute
To display the network route that packets take to reach a specified host, enter:
traceroute [-dFInrvx] [-g gateway] [-i iface] [-f first_ttl]
[-m max_ttl] [ -p port] [-q nqueries] [-s src_addr] [-t tos]
[-w waittime] [-z pausemsecs] host [packetlen]Syntax Description
Usage Guidelines
Traces the route that IP packets take from the MARS appliance to another host on a network by listing the intermediate gateways that the packet traverses to reach the host.
Traceroute displays the IP address and hostname (if possible) of the gateways along the route taken by the packets. Traceroute is used as a network debugging tool. If you are having network connectivity problems, traceroute will help you diagnose where the trouble might exist along the route.
Use the traceroute command to discover the routes that packets take, when traveling to their destination.Specify a hostname or an IP address as an argument to this command.
This command works by taking advantage of the error messages generated by routers when a datagram exceeds its time-to-live (TTL) value.
The traceroute command starts by sending probe datagrams with a TTL value of one. This causes the first router to discard the probe datagram and send back a "time-exceeded" error message. The trace command sends three probes at each TTL level and displays the round-trip time for each.
The traceroute command sends out one probe at a time. Each outgoing packet may result in one of the following messages:
A "time-exceeded" error message - This indicates that an intermediate router has seen and discarded the probe, when the TTL was decremented to zero.
A "destination-unreachable" error message - This indicates that the destination node has received the probe and discarded it because it did not have a route to the destination.
An "*" - If a timeout occurs before a response comes in, an asterisk (*) is displayed.
An "invalid-port" error message - This indicates that the destination node received the trace message, which was addressed to an invalid port.
The traceroute command terminates when the destination is reached, when the maximum TTL is exceeded, or when the user interrupts the trace with the <Ctrl>-<Shift>-6 sequence.
unlock
Use the unlock command to restore access to the MARS Appliance GUI for all or specified user accounts after login failures.
unlock {-a }| {{-l | -g | -b } login_name}
Command History
Syntax Description
Usage Guidelines
For both Local or AAA authentication methods, GUI access is prevented (locked) for an account upon login failure, which occurs when a specified number of incorrect password entries are made for a single login name. The administrator GUI access can be locked like any other account.
The CLI access through the console or through SSH is never locked. The unlock CLI command can unlock GUI access for some or all accounts.
Unlocking is not replicated through Global Controller-Local Controller communications, it applies only to the local appliance. An account locked on a Global Controller does not replicate the locked status to global accounts on Local Controllers. A global account locked on two different appliances must be unlocked manually on each appliance.
For more information on account locking and login failure, see the section, "Information About Authenticating MARS User Accounts with External AAA Servers" at the following URL:
http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/authen.html#wp431897Examples
The following example unlocks GUI access for a local account with the login name bleistiftansatz:
[pnadmin]$ unlock -l bleistiftansatzRelated Commands
Changes the password of the system administrative account (pnadmin) associated with the appliance.
version
To display the version of the MARS software running on the appliance, use the version command.
version
Syntax Description
This command has no arguments or keywords.
Usage Guidelines
The version number appears in the following format: major.minor.patch (build no.) data package
The data and binary upgrade can be packaged and upgraded separately.
Examples
The following command displays the software version running on a MARS 200:
[pnadmin]$ version6.0.1 (2980) 30
