ADC

Audit authenticated sessions

March 18, 2025

Contributed by:

C S

You can configure NetScaler to keep a log of all the events that are triggered in an authenticated session. Using the events log, you can audit state and status information, to see the history for users in chronological order.

To keep a log of all the events triggered in an authenticated session, define an audit policy that specifies the following:

Log type. The logs can be stored remotely (syslog) or locally on NetScaler (nslog).
Rule. The conditions on which the logs are stored.
Action. Details of the log server and other details for creating the log entries.

This audit policy can be configured at different levels: user-level, group-level, authentication, authorization, and auditing virtual server, and global system level. The policies configured at the user-level have the highest priority.

Note

This topic details steps for using syslog. Make necessary changes to use nslog.

To configure syslog auditing by using the CLI

Configure the audit server with the relevant log settings.

ns-cli-prompt> add audit syslogAction <name> <serverIP> …
Configure the audit policy by associating the audit server.

ns-cli-prompt> add audit syslogPolicy <name> <rule> <action>
Associate the audit policy with one of the following entities:
- Bind the policy to a specific user.
  
  ns-cli-prompt> bind aaa user <userName>-policy <policyname> …
- Bind the policy to a specific group.
  
  ns-cli-prompt> bind aaa group <groupName>-policy <policyname> …
- Bind the policy to an authentication, authorization, and auditing virtual server.
  
  ns-cli-prompt> bind authentication vserver <name> -policy <policyname> …
- Bind the policy globally to NetScaler.
  
  ns-cli-prompt> bind tm global -policyName <policyname> …

To configure syslog auditing by using the GUI

Configure the audit server and policy.

Navigate to Security > AAA - Application Traffic > Policies > Auditing > Syslog, and configure the server and the policy in the relevant tabs.
Associate the audit policy with one of the following:
- Bind the audit policy to a specific user.
  
  Navigate to Security > AAA - Application Traffic > Users, and associate the audit policy with the relevant user.
- Bind the audit policy to a specific group.
  
  Navigate to Security > AAA - Application Traffic > Groups, and associate the audit policy with the relevant group.
- Bind the audit policy to an authentication, authorization, and auditing virtual server.
  
  Navigate to Security > AAA - Application Traffic > Virtual Servers, and associate the audit policy with the relevant virtual server.
- Bind the audit policy globally to NetScaler.
  
  Navigate to Security > AAA - Application Traffic > Policies > Auditing > Syslog or Nslog, select the audit policy, and click Action > Global Bindings to bind the policy globally.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Audit authenticated sessions

March 18, 2025

Contributed by:

C S

Audit authenticated sessions

To configure syslog auditing by using the CLI

To configure syslog auditing by using the GUI

In this article