ADC

Audit log support for admin partitions

September 21, 2020

Contributed by:

On a partitioned Citrix ADC appliance, for enhanced data security, you can configure audit logging in an administrative partition by using advanced policies. For example, you might want to view logs (states and status information) of a specific partition that has multiple users accessing different sets of features on the basis of their levels of authorization in the partition.

Points to remember

The audit logs generated from the partition will be stored as a single log file (/var/log/ns.log).
You must configure the audit log server’s (syslog or nslog) subnet address as the source IP address in the partition for sending the audit-log messages.
The default partition uses the NSIP as the source IP address for the audit log messages by default.
You can display the audit-log message by using the “show audit messages” command.

For information on audit-log configuration, see Configuring the NetScaler Appliance for Audit Logging.

Configuring audit logging in partitioned Citrix ADC appliance

Complete the following tasks to configure audit logging in an administrative partition.

Configure partition subnet IP address. An IPv4 SNIP address of an administrative partition.
Configure audit-log (syslog and nslog) action. An Audit action is a collection of information that specifies the messages to be logged and how to log the messages on the external log server.
Configure audit-log (syslog and nslog) policies. Audit-log policies define log messages for the source partition to the syslog or nslog server.
Bind audit-log policy to sysGlobal and nsGlobal entity. You must bind an audit-log policy to a system global entity.
Review audit-log statistics. Display the audit-log statistics and evaluate the configuration.

To configure the partition’s subnet IP address by using the command line interface

At the command prompt, type:

add ns ip <ip address> <subnet mask>

To configure a syslog action by using the command line interface

At the command prompt, type:

add audit syslogAction <name> <serverIP> \[-serverPort <port>] -logLevel <logLevel> \[-dateFormat \(MMDDYYYY | DDMMYYYY )] \[-transport \( TCP | UDP )]

To configure an nslog action by using the command line interface

At the command prompt, type:

add audit nslogAction <name> <serverIP> \[-serverPort <port>] -logLevel <logLevel> \[-dateFormat \(MMDDYYYY | DDMMYYYY )]

To configure syslog audit-log policies by using the command line interface

At the command prompt, type:

add audit syslogpolicy syslog-pol1 true audit-action1

To configure nslog audit-log policies by using the command line interface.

At the command prompt, type:

add audit nslogpolicy nslog-pol1 true audit-action1

To bind audit-log policy to syslogGlobal entity by using the command line interface.

bind audit syslogglobal -policyName <name> -priority <priority_integer> -globalBindType SYSTEM_GLOBAL

To bind audit-log policy to nslogGlobal entity by using the command line interface.

At the command prompt, type:

bind audit nslogglobal -policyName <name> -priority <priority_integer> -globalBindType SYSTEM_GLOBAL

To display audit-log statistics by using the command line interface.

At the command prompt, type:

stat audit -detail

Example

add ns ip 10.102.1.1 255.255.255.0
add audit syslogAction syslog_action1 10.102.1.2 –logLevel INFORMATIONAL –dateFormat MMDDYYYY –transport UDP
add audit syslogpolicy syslog-pol1 true syslog_action1
bind audit syslogglobal –policyName syslog-pol1 –priority 1 –globalBindType SYSTEM_GLOBAL

Configuring audit-log by using the Citrix ADC GUI

Storing logs

When SYSLOG or NSLOG server collects log information from all partitions, it is stored as log messages in ns.log file. The log messages contain the following information:

Partition Name.
The IP address.
A time stamp.
The message type
The predefined log levels (Critical, Error, Notice, Warning, Informational, Debug, Alert, and Emergency)
The message information.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Audit log support for admin partitions

September 21, 2020

Contributed by:

September 21, 2020

Contributed by:

Audit log support for admin partitions

Points to remember

Configuring audit logging in partitioned Citrix ADC appliance

Example

Configuring audit-log by using the Citrix ADC GUI

Storing logs

In this article