Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Policy tracing

October 24, 2024
Contributed by: 
C

Policy tracing in NetScaler allows you to monitor and troubleshoot policies in real time. It helps you see which policies are checked during a transaction and what actions are taken based on those checks. This feature enables you to get a better understanding of how policies work and find ways to boost your application’s performance.

Some of the benefits of this feature are as follows:

  • Troubleshooting issues: When you experience issues with application behavior, policy tracing helps pinpoint which policies were applied or skipped.
  • Validation of policy configurations: Before deploying changes, tracing can validate that new policies operate as expected within the existing workflows.
  • Performance monitoring: Tracking which policies are frequently evaluated can help optimize performance by identifying redundant or conflicting policies.

Policy tracing using the CLI

The following commands enable you to manage the policy tracing process.

To start policy tracing, use the following command:

start policy tracing -filterExpr <expr> [-protocolType <protocolType>] [-captureSSLHandshakePolicies <yes/no>]
<!--NeedCopy-->
  • <expr>: This filter expression specifies the conditions under which tracing data is collected. Data is collected only when the expression evaluates to True, and it also clears any previously stored tracing data. By default, data collection occurs only for the HTTP protocol. If users want to collect data for other protocols, they must select the appropriate protocol type.
  • [-protocolType <protocolType>]: (Optional) Specify the protocol type if other than HTTP.
  • [-captureSSLHandshakePolicies <yes/no>]: (Optional) Specify whether to capture SSL handshake policies.

Example:

start policy tracing -filterExpr "client.ip.src.eq(10.102.102.222)" -protocolType HTTP -captureSSLHandshakePolicies yes
<!--NeedCopy-->

To stop policy tracing, use the following command:

stop policy tracing
<!--NeedCopy-->

To display policy tracing data, use the following command:

show policy tracing [-httpTransactionId <string>] [-detail (brief | all)]
<!--NeedCopy-->

This command displays the data collected from each PE and node. If no parameters are specified, all available data is fetched. When an httpTransactionId is provided, only the data related to that specific ID is displayed. If you set the detail level to “brief,” only high-level metadata is shown. This output includes the client and destination IP addresses, and a unique transaction ID generated internally for identification.

Policy Tracing Output

In the example tracing record, policies and features are listed in the order they’re evaluated. For example, in trace record #1, the features are evaluated in the following order on the request side:

  1. Content Switching
  2. URL Transform
  3. BOT Management
  4. AppFw (Application Firewall)
  5. Responder
  6. Caching
  7. Rewrite
  8. Load Balancing
  9. Compression

In the example, outputs indicate the following:

  • “Request Responder: resp_pol_1, resp_pol_2”:

    • For the Responder feature, actions are taken for two policies: resp_pol_1 and resp_pol_2.
    • resp_pol_1 is evaluated first, followed by resp_pol_2.

  • “Request Rewrite”:

    • The rewrite feature is evaluated on the request side that is when the packet goes from the client to NetScaler.
    • Conversely, “Response Rewrite” means that the rewrite feature is evaluated on the response side that is when the packet goes from NetScaler to the client.

  • “Request AppFw: No policy is evaluated to true”:

    No Application Firewall (AppFw) policy is evaluated to true during the request.

  • “Request Responder: resp_pol_3 (undef)”:

    • For the Responder feature, the resp_pol_3 policy raised an undefined (undef) status for the URL “/second_request”.
    • No policy is applied and no action is taken for the responder feature.

To clear policy tracing data, use the following command:

clear policy tracing
<!--NeedCopy-->

This command frees up memory by removing collected tracing data. It makes sure that system resources aren’t wasted on storing outdated tracing data.

Policy tracing
October 24, 2024
Contributed by: 
C
October 24, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.