ADC

Audit logging

August 1, 2023

Contributed by:

Important

Citrix recommends you to update a SYSLOG or NSLOG configuration only during maintenance or downtime. If you update a configuration after creating a session, the changes are not applied to the existing session logs.

Auditing is a methodical examination or review of a condition or situation. The audit logging feature enables you to log the NetScaler states and status information collected by various modules. The log information can be in the kernel and in the user-level daemons. For audit logging, you can use the SYSLOG protocol, the native NSLOG protocol, or both.

SYSLOG is a standard protocol for logging. It has two components:

SYSLOG auditing module. Runs on the NetScaler appliance.
SYSLOG server. Runs on the underlying FreeBSD operating system (OS) of the NetScaler appliance or on a remote system.

SYSLOG uses a user data protocol (UDP) for data transfer.

Similarly, the native NSLOG protocol has two components:

NSLOG auditing module. Runs on the NetScaler appliance.
NSLOG server. Runs on the underlying FreeBSD OS of the NetScaler appliance or on a remote system.

NSLOG uses TCP for data transfer.

When you run a SYSLOG or NSLOG server, it connects to the NetScaler appliance. The NetScaler appliance then starts sending all the log information to the SYSLOG or NSLOG server. And the server filters the log entries before storing them in a log file. An NSLOG or SYSLOG server receives log information from more than one NetScaler appliance. The NetScaler appliance sends log information to more than one SYSLOG server or NSLOG server.

If multiple SYSLOG servers are configured, the NetScaler appliance sends its SYSLOG events and messages to all the configured external log servers. It results in storing redundant messages and makes monitoring difficult for system administrators. To address this issue, the NetScaler appliance offers load balancing algorithms. The appliance can load balance the SYSLOG messages among the external log servers for better maintenance and performance. The supported load balancing algorithms include RoundRobin, LeastBandwidth, CustomLoad, LeastPackets, and AuditlogHash.

Note

The NetScaler appliance can send audit log messages up to 16 KB to an external SYSLOG server.

The log information that a SYSLOG or NSLOG server collects from a NetScaler appliance is stored in a log file in the form of messages. These messages typically contain the following information:

The IP address of a NetScaler appliance that generated the log message.
A time stamp
The message type
The predefined log levels (Critical, Error, Notice, Warning, Informational, Debug, Alert, and Emergency)
The message information

To configure audit logging, you first configure the audit modules on the NetScaler appliance. The appliance involves creating audit policies and specifying the NSLOG server or SYSLOG server information. You then install and configure the SYSLOG or the NSLOG server on the underlying FreeBSD OS of the NetScaler appliance or on a remote system.

Note

SYSLOG is an industry standard for logging program messages, and various vendors provide support. The documentation does not include SYSLOG server configuration information.

The NSLOG server has its own configuration file (auditlog.conf). You can customize logging on the NSLOG server system by making extra modifications to the configuration file (auditlog.conf).

Note

ICMP access to Syslog server is mandatory if syslog server is used as FQDN under Syslog Action in the network. If ICMP access is blocked in the environment, configure it as load balanced Syslog server and set the value of the healthMonitor parameter in the set service command to NO. For configuring ICMP, see Load balancing SYSLOG servers

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Audit logging

August 1, 2023

Contributed by:

August 1, 2023

Contributed by:

Audit logging

In this article