Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Export management logs directly from NetScaler to Splunk

April 5, 2024
Contributed by: 
C

You can now export management logs (non-packet engine logs) on a category basis such as shell, access, and nsmgmt logs from NetScaler to industry standard log aggregator platforms such as Splunk. Using the visualization tools at Splunk, you can get meaningful insights about the exported data.

There are multiple ways to export management logs from NetScaler to Splunk. You can either configure Splunk as an HTTP server or a syslog server. In the HTTP server configuration, you can use the HTTP event collector to send management logs over HTTP (or HTTPS) directly to the Splunk platform from your NetScaler. In the syslog server configuration, management logs are sent as syslog payloads from NetScaler to Splunk.

Export management logs to Splunk configured as an HTTP server

To configure the export of management logs you must perform the following steps:

  1. Configure an HTTP event collector on Splunk.
  2. Create a collector service and a time series analytics profile on NetScaler.

Configure an HTTP event collector on Splunk

You can forward audit logs to Splunk by configuring an HTTP event collector.

For information on how to configure the HTTP event collector, see the Splunk documentation.

Once you have configured the HTTP event collector, copy the authentication token and save it for reference. You need to specify this token while configuring the analytics profile on NetScaler.

Configure a time series analytics profile on NetScaler using the CLI

Do the following to export NetScaler management logs to Splunk.

  1. Create a collector service for Splunk.

    add service <collector> <splunk-server-ip-address> <protocol> <port>

    Example:

    add service splunk_service 10.102.34.155 HTTP 8088

    In this configuration:

    • ip-address: Splunk server IP address.
    • collector-name: Name of the collector.
    • protocol: Specify the protocol as HTTP or HTTPS
    • port: Port number.

  2. Create a time series analytics profile.

    add analytics profile `profile-name` -type time series -managementlog <management-log-type> -collectors `collector-name` -analyticsAuthToken `auth-tocken`-analyticsEndpointContentType `Application/json` -analyticsEndpointMetadata `meta-data-for-endpoint` -analyticsEndpointUrl `endpoint-url`

    Example:

     add analytics profile audit_profile -type timeseries -managementlog ACCESS -collectors splunk -analyticsAuthToken "Splunk 1234-5678-12345" -analyticsEndpointContentType "application/json" -analyticsEndpointMetadata "{\"sourcetype\":\"logs-and-events-directly-from-netscaler\", \"source\":\"test\",\"event\":"} -analyticsEndpointUrl "/services/collector/event"

    In this configuration:

    • managementlog: Types of management logs that you must export. The following options are available:
      • ALL: Includes all categories of management and host logs.
      • SHELL: Includes bash.log and sh.log.
      • Access: Includes logs such as auth.log, nsvpn.log, vpndebug.log, httpaccess.log,httperror.log, httpaccess-vpn.log, and httperror-vpn.log.
      • NSMGMT: Includes ns.log and notice.log.
      • NONE: None of the logs are exported.

    • analyticsAuthToken: Specify the authentication token to be included in the authorization header with the prefix “Splunk” while sending logs to Splunk. This token is the authentication token created on the Splunk server while configuring the HTTP event collector.

    • analyticsEndpointContentType: Format of the logs.

    • analyticsEndpointMetadata: Meta data that is endpoint specific.

    • analyticsEndpointUrl: Location in the endpoint to export logs.

    Note:

    You can modify the time series analytics profile parameters using the set analytics profile command.

  3. Verify the analytics profile configuration using the show analytics profile command.

    # show analytics profile splunkexport
1)    Name: audit_profile
      Collector: splunk
      Profile-type: timeseries
            Output Mode: avro
            Metrics: DISABLED
              Schema File: schema.json
              Metrics Export Frequency: 30
            Events: DISABLED
            Auditlog: DISABLED
            Serve mode: Push
       Authentication Token: <auth-tocken> 
       Endpoint URL: /services/collector/event
       Endpoint Content-type: Application/json
       Endpoint Metadata: Event:
       Reference Count: 0
       Managementlog: ACCESS

Once the configuration is successful, the management logs are sent as HTTP payloads to Splunk and you can view it on the Splunk application user interface.

Configure a time series analytics profile on NetScaler using the GUI

Perform the following steps:

  1. Create a collector service.
    1. Navigate to Traffic Management > Load Balancing > Services and click Add.
    2. On the Load Balancing Service page, enter the details in the required fields, click OK and then click Done.

  2. Create a time series analytics profile.

    1. Navigate to System > Profiles > Analytics Profiles and click Add.

    2. On the Create Analytics Profile page, provide the following details:

      1. Enter a name for the profile.
      2. From the Collectors list, select the service that you created.
      3. Select a TIME SERIES from the Type list.
      4. Enter the Analytics Auth Token that you received from Splunk with the prefix “Splunk”.
      5. Enter the details for Analytics Endpoint URL, Analytics Endpoint Content Type, and Analytics Endpoint Metadata.
      6. Select the Management Logs that you want to export and also the Output Mode in which you want to export.
      7. Click Create.

Export management logs to Splunk configured as a syslog server

To configure the export of management logs, you must perform the following steps:

  1. Configure the syslog port on Splunk.
  2. Create an audit syslog action on NetScaler with the management log option.
  3. Create a syslog audit policy with the syslog action.
  4. Bind the syslog audit policy with the system global entity to enable logging of all NetScaler system events.

Configure Splunk as an external syslog server

You can forward management logs to Splunk by configuring an external syslog server on Splunk.

For information on how to configure the syslog port, see the Splunk documentation. Once you have configured the syslog port, save it for reference. You need to specify this port while configuring the audit syslogaction on NetScaler.

Configure syslog audit action

To configure syslog audit action on NetScaler using CLI, run the following command:

    add audit syslogAction <name> \(<serverIP> \[-serverPort <port>] -logLevel <logLevel> ... \[-managementlog <managementlog> ...] ... \[-managementloglevel <managementloglevel> ...]\[-transport \( TCP | UDP )])

Example:

    add audit syslogAction test 10.106.186.102 -serverPort 514 -logLevel ALL -managementlog SHELL NSMGMT -managementloglevel ALL -transport TCP

In this configuration:

  • name: Name of the syslog action
  • serverIP: IP address of the syslog server.
  • serverPort: Port on which the syslog server accepts connections.
  • logLevel: Audit log level.
  • managementlog: Types of management logs that you must export.
  • managementloglevel: Management log levels that you want to set for export.
  • transport: The transport type used to send audit logs to the syslog server.

Note:

When management logs is enabled, the syslogAction configuration supports only server IP address and port configuration. Domain Based Service (DBS) and load balancing virtual server name configurations are not supported.

For load balancing management logs exported across multiple external syslog servers (for example, Splunk syslog servers or endpoints), you can use the following sample configuration:

add service syslog_server <server_ip> UDP <port>

add service syslog_server1 1.3.4.4 UDP 514

add service syslog_server2 1.3.4.5 UDP 514

add lb vserver lb1 UDP <lb_vip> <lb_port>

bind lb vserver lb1 syslog_server1

bind lb vserver lb1 syslog_server2

In syslogAction, configure the following:

add syslogAction sys1 <server_ip> -serverPort <server_port> -transport UDP -loglevel <loglevel>

add syslogAction sys1 lb_vip -serverPort lb_port -transport UDP -loglevel <loglevel>

To configure syslog audit action on NetScaler using the GUI, perform the following steps:

  1. Navigate to System > Auditing > Syslog > Server tab and click Add.
  2. On the Create Auditing Server page, provide the following details:
    1. Enter a name for the Syslog server.
    2. Select Server IP from the Server Type list and enter the syslog server IP address and port.
    3. Choose the required log levels from the Log Levels, Management Logs and Management Log Levels sections.
  3. Click Create.

Configure syslog audit policy

To configure a syslog audit policy using CLI, run the following command:

    add audit syslogPolicy <name> TRUE <syslogAction>

Example:

    add audit syslogPolicy test-policy TRUE test

To configure a syslog audit policy using the GUI, perform the following steps:

  1. Navigate to System > Auditing > Syslog > Policies tab and click Add.
  2. On the Create Auditing Syslog Policy page, enter a name, select Advanced Policy, and then select the audit syslog server that you created from the Server list.

Bind audit log policy

To bind the syslog audit log policy to the bind point SYSTEM_GLOBAL using CLI, run the following command:

    bind audit syslogGlobal <policyname> -globalBindType SYSTEM_GLOBAL

Example:

    bind audit syslogGlobal test-policy -globalBindType SYSTEM_GLOBAL

To bind the syslog audit log policy globally using the GUI, run the following command:

  1. Navigate to System > Auditing > Syslog > Policies tab and select the syslog audit policy that you created.
  2. Right-click on the selected syslog audit policy and click Advanced Policy Global Bindings.
  3. Select the syslog audit policy that you created from the Select Policy list.
  4. Enter the priority in the Priority field.
  5. Select SYSTEM_GLOBAL from the Global Bind Type field and click Bind.
  6. On the Syslog Auditing page, select the syslog audit policy and click Done.

Once the configuration is successful, the management logs are sent as syslog payloads to Splunk and you can view it on the Splunk application user interface.

Additional information

This section provides more information on the three types of logs specified in this topic:

  • shell logs: Includes bash.log and sh.log.
  • access logs: Includes httpaccess.log,httperror.log,httpaccess-vpn.log, httperror-vpn.log, vpndebug.log, nsvpn.log, and auth.log.
  • nsmgmt logs: Includes notice.log, and ns.log (only includes non-packet engine logs).
Export management logs directly from NetScaler to Splunk
April 5, 2024
Contributed by: 
C
April 5, 2024
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.