Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configuring Citrix ADC appliance for audit logging

August 20, 2024
Contributed by: 
C C

Warning:

Classic policy expressions and its usage are deprecated (discouraged from use but still supported) from Citrix ADC 12.0 build 56.20 onwards and as an alternative, Citrix recommends you to use advanced policies. For more information, see Advanced Policies.

Auditing module allows logging of all states and status information from different modules so that an administrator can see event history in the chronological order. The main components of an Audit framework are ‘audit action’ and ‘audit policy’. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. The audit policies use the Classic Policy Engine’(CPE) framework to link ‘audit action’ to ‘bind entities’ or Progress Integration (PI) framework to link ‘audit action’ to ‘system global bind entities’.

The policy frameworks differ from each other in the way the audit log policies are bound to the global entities. Previously, the audit module supported only classic expression but now it supports both classic and advanced policy expressions. Currently, using the advanced expression you can bind audit log policies only to System global entities.

Note

When you bind a policy to global entities, you must bind it to a system global entity of the same expression type. For example, you can’t bind a classic policy to an advanced global entity or bind an advanced policy to a classic global entity.

Configuring audit log policies in a classic policy expression

Configuring audit logging in classic policy consists of the following steps:

  1. Configuring an audit log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, SYSLOG uses a user data protocol (UDP) for data transfer and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the Citrix ADC appliance to store the logs. After the buffer limit is reached, the logs are sent to the SYSLOG server.
  2. Configuring audit log policy. You can configure either SYSLOG policies to log messages to a SYSLOG server or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule that is set to true or ns_true for the messages to be logged, and a SYSLOG or NSLOG action.
  3. Binding audit log policies to global entities. You must globally bind the audit log policies to global entities such SYSTEM, VPN, Citrix ADC AAA and so on. You can do it to enable logging of all Citrix ADC system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.

Each of these steps is explained in the following sections.

Configuring audit log action

Configure SYSLOG action in an advanced policy infrastructure by using the CLI.

Note

The Citrix ADC appliance allows you to configure only one SYSLOG action to SYSLOG server IP address and port. The appliance does not allow you to configure multiple SYSLOG actions to the same server IP address and port.

A syslog action contains a reference to a syslog server. It specifies which information to log and mentions how to log that information.

At the command prompt, type the following commands to set the parameters and verify the configuration:

-  add audit syslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )]`
-  show audit syslogAction [<name>]

<!--NeedCopy-->

Configure NSLOG action in an advanced policy infrastructure by using the CLI.

An ns log action contains a reference to an ns log server. It specifies which information to log and mentions how to log that information.

At the command prompt, type the following commands to set the parameters and verify the configuration:

-  add audit nslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )]
-  show audit nslogAction [<name>]
<!--NeedCopy-->

Configuring audit log policies

Configure audit log Policies in classic policy infrastructure by using the CLI.

At the command prompt, type:

add audit syslogpolicy <name> <-rule> <action>
add audit nslogpolicy <name> <-rule> <action>
<!--NeedCopy-->

Binding audit syslog policies to audit syslog global

Bind audit log policy in advanced policy framework by using the CLI.

At the command prompt, type:

bind audit syslogGlobal <policyName> [-globalBindType <globalBindType]

unbind audit syslogGlobal <policyName>[-globalBindType <globalBindType>]

Bind audit log policy in classic policy framework by using the CLI.

At the command prompt, type:

bind systemglobal <policy Name> <Priority>

unbind systemglobal <policy Name> <Priority>

Configuring audit log policies using advanced policy expression

Configuring audit logging in advanced policy consists of the following steps:

  1. Configuring an audit log action. You can configure an audit action for different servers and for different log levels. ‘Audit action’ describes Audit Server configuration information whereas ‘audit policy’ links a bind entity to an ‘audit action’. By default, SYSLOG uses a user data protocol (UDP) for data transfer and NSLOG uses only TCP to transfer log information to the log servers. TCP is more reliable than UDP for transferring complete data. When using TCP for SYSLOG, you can set the buffer limit on the Citrix ADC appliance to store the logs. After the buffer limit is reached, the logs are sent to the SYSLOG server.
  2. Configuring audit log policy. You can configure either SYSLOG policies to log messages to a SYSLOG server or NSLOG policy to log messages to an NSLOG server. Each policy includes a rule that is set to true or ns_true for the messages to be logged, and a SYSLOG or NSLOG action.
  3. Binding audit log policies to global entities. You must globally bind the audit log policies to the SYSTEM global entity to enable logging of all Citrix ADC system events. By defining the priority level, you can set the evaluation order of the audit server logging. Priority 0 is the highest and is evaluated first. The higher the priority number, the lower is the priority of evaluation.

Note

The Citrix ADC appliance evaluates all the policies that are bind to true.

Configuring audit log action

Configure syslog action in an advanced policy infrastructure by using the CLI.

At the command prompt, type the following commands to set the parameters and verify the configuration:

add audit syslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-transport ( TCP | UDP )]
show audit syslogAction [<name>]
<!--NeedCopy-->

Configure NSLOG action in advanced policy infrastructure by using the CLI.

At the command prompt, type the following commands to set the parameters and verify the configuration:

add audit nslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> [-dateFormat ( MMDDYYYY | DDMMYYYY )]
show audit nslogAction [<name>]
<!--NeedCopy-->

Configuring audit log policies

Add a syslog audit action by using the CLI.

At the command prompt, type:

add audit syslogAction <name> (<serverIP> | ((<serverDomainName>[-domainResolveRetry <integer>]) | -lbVserverName <string>))[-serverPort <port>] -logLevel <logLevel>[-dateFormat <dateFormat>] [-logFacility <logFacility>][-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )]  [-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] [-subscriberLog ( ENABLED | DISABLED )][-transport ( TCP | UDP )] [-tcpProfileName <string>][-maxLogDataSizeToHold
<!--NeedCopy-->

Example

add audit syslogaction audit-action1 10.102.1.1 -loglevel INFORMATIONAL -dateformat MMDDYYYY
add audit nslogAction nslog-action1 10.102.1.3 -serverport 520 -loglevel INFORMATIONAL -dateFormat MMDDYYYY
add audit syslogpolicy syslog-pol1 ns_true audit-action1
add audit nslogPolicy nslog-pol1 ns_true nslog-action1
bind system global nslog-pol1 -priority 20
<!--NeedCopy-->

Add a ns log audit action by using the CLI.

At the command prompt, type:

add audit nslogAction <name> (<serverIP> | (<serverDomainName>[-domainResolveRetry <integer>])) [-serverPort <port>]       -logLevel <logLevel> ... [-dateFormat <dateFormat>][-logFacility <logFacility>] [-tcp ( NONE | ALL )][-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )][-userDefinedAuditlog ( YES | NO )][-appflowExport ( ENABLED | DISABLED )] [-lsn ( ENABLED | DISABLED )][-alg ( ENABLED | DISABLED )] [-subscriberLog ( ENABLED | DISABLED )]`
<!--NeedCopy-->

Binding audit log policies to global entities

Bind syslog audit log policy in advanced policy framework by using the CLI.

At the command prompt, type:

bind audit syslogGlobal <policyName> [-globalBindType <globalBindType

unbind audit syslogGlobal <policyName>[-globalBindType <globalBindType>]

Configuring audit log policy by using the GUI

  1. Navigate to Configuration > System > Auditing > Syslog.
  2. Select Servers tab.
  3. Click Add.
  4. In the Create Auditing Server page, populate the relevant fields, and click Create.
  5. To add the policy, select the Policies tab, and click Add.
  6. In the Create Auditing Syslog Policy page, populate the relevant fields, and click Create.
  7. To bind the policy globally, select Advanced Policy Global Bindings from the drop-down list. Select the best_syslog_policy_ever policy. Click Select.
  8. From the drop-down list, select the bind point as SYSTEM_GLOBAL and click Bind, and then click Done.  

Configuring policy-based logging

You can configure policy-based logging for rewrite and responder policies. Audit messages are then logged in a defined format when the rule in a policy evaluates to TRUE. To configure policy-based logging, you configure an audit-message action that uses default syntax expressions. To specify the format of the audit messages, and associate the action with a policy. The policy can be bound either globally or to a load balancing or content switching virtual server. You can use audit-message actions to log messages at various log levels, either in syslog format only or in both syslog and new nslog formats.

Prerequisites

  • User Configurable Log Messages (userDefinedAuditlog) option is enabled for when configuring the audit action server to which you want to send the logs in a defined format.  
  • The related audit policy is bound to the system global.

Configuring an audit message action

You can configure audit message actions to log messages at various log levels. You can do it either in syslog format only or in both syslog and new nslog formats. Audit-message actions use expressions to specify the format of the audit messages.

Create an audit message action by using the CLI

At the command prompt, type:

add audit messageaction <name> <logLevel> <stringBuilderExpr> [-logtoNewnslog (YES|NO)] [-bypassSafetyCheck (YES|NO)]
<!--NeedCopy-->

add audit messageaction log-act1 CRITICAL '"Client:"+CLIENT.IP.SRC+" accessed "+HTTP.REQ.URL' -bypassSafetyCheck YES
<!--NeedCopy-->

Configure an audit message action by using the GUI

Navigate to System > Auditing > Message Actions, and create the audit message action.

Binding audit message action to a policy

After you’ve created an audit message action, you must bind it to a rewrite or responder policy. For more information about binding log message actions to a rewrite or responder policy, see Rewrite or Responder.

Configure Audit Server

You can configure a SYSLOG audit server on a Citrix ADC appliance.

Configure SYSLOG through Citrix GUI

Configure the SYSLOG audit server, complete the following steps:

Note:

These instructions are applicable to a stand-alone Citrix ADC appliance.

  1. Sign into Citrix ADC and navigate to System > Auditing > Syslog.
  2. In Servers tab, click Add.
  3. In the Create Auditing Server page, set the following parameters:
    1. Auditing Type. Name of the auditing server type, example SYSLOG.
    2. Name. Provide a name to the SYSLOG type auditing server.
    3. Server Type. Select a server type from the drop-down list.
    4. IP Address. Provide an IP address for the SYSLOG server.
    5. Port. Provide the server port number.
    6. Log Levels. Select an audit log level which specifies the events to be logged.
    7. Log Facility. Select a log facility that is assigned to the log message. Log facility values are numbers 0 to 7 (LOCAL0 through LOCAL7). Each number indicates where a specific message originated from, such as the Citrix ADC itself, the VPN, or the external.
    8. Date format. Select the format in which the date must appear in the log message.
    9. Time Zone. Select the time zone for date and timestamps in the log message.
    10. TCP Logging. Select this option to log TCP messages globally.
    11. ACL Logging. Select this option to log access control list messages.
    12. User Configurable Log Messages. Select this option to log user configurable log message globally.
    13. AppFlow Logging. Select this option to export log messages to AppFlow collectors.
    14. Large Scale NAT Logging. Select this option to log lsn information.
    15. ALG messaging Logging. Select this option to log ALG information.
    16. Subscriber Logging. Select this option to log subscriber’s session event information.
    17. DNS. Select this option to log DNS related SYSLOG messages.
    18. SSL interception. Select this option to log SSL Interception event information.
    19. URL Filtering. Select this option to log URL filtering event information.
    20. Content Inspection Logging. Select this option to log content inspection events for ICAP or IPS integration at the global level.
  4. Net Profile. Select a network profile. The SNIP configured in the network profile is as source IP when sending log messages.
  5. Transport Type. Select a transport type for sending audit log messages to a syslog server. The default type is UDP.
  6. Transport Profile. Add a transport profile whose settings are to be applied to the audit server information to tune the TCP connection parameters.
  7. Max Log Data Size to hold. Provide the maximum size of log data that can be held in the NSB chain of server information.
  8. Click Create.

For information about SYSLOG parameters, see the Audit SyslogParams command reference page.

Configuring Citrix ADC appliance for audit logging
August 20, 2024
Contributed by: 
C C
August 20, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.