Running the Nslog Server | Citrix Systems CITRIX NETSCALER 9.3

Chapter 3 Audit Logging

You are prompted to enter the information for the following parameters:

NSIP: Specifies the IP address of the NetScaler appliance, for example, 10.102.29.1.

Userid: Specifies the user name, for example, nsroot.

Password: Specifies the password, for example, nsroot.

If you add multiple NetScaler IP addresses (NSIP), and later you do not want to log all of the NetScaler appliance event details, you can delete the NSIPs manually by removing the NSIP statement at the end of the auditlog.conf file. For a high availability (HA) setup, you must add both primary and secondary NetScaler IP addresses to auditlog.conf by using the audserver command. Before adding the IP address, make sure the user name and password exist on the system.

Verifying the NSLOG Server Configuration File

Check the configuration file (audit log.conf ) for syntax correctness to enable logging to start and function correctly.

To verify configuration, at a command prompt, type the following command:

audserver -verify -f <directorypath>\auditlog.conf

<directorypath>: Specifies the path to the configuration file (audit log.conf).

Running the NSLOG Server

To start audit server logging

Type the following command at a command prompt:

audserver -start -f <directorypath>\auditlog.conf

<directorypath>: Specifies the path to the configuration file (audit log.conf).

To stop audit server logging that starts as a background process in FreeBSD or Linux

Type the following command:

audserver -stop

To stop audit server logging that starts as a service in Windows

Type the following command:

88

Image 88

Citrix Systems CITRIX NETSCALER 9.3 manual Running the Nslog Server, Verifying the Nslog Server Configuration File

Contents

Citrix NetScaler Administration Guide Copyright and Trademark Notice Page Page Contents Snmp Vii Audit Logging Web Server Logging 105 Advanced Configurations Contents Web Interface AppFlow Reporting Tool Contents Xvi This Preface Formatting Conventions for NetScaler DocumentationFormatting Conventions Meaning Boldface Convention Documentation Available on the NetScaler ApplianceTo view the documentation NetScaler Documentation Feedback Getting Service and SupportTo provide feedback at the Knowledge Center home Preface Authentication and Authorization Topics Configuring User Accounts Configuring Users and GroupsShow system user Example Parameters for configuring a user account Password PasswordTimeout CLI Idle Session Timeout Secs UserName User Name To create a user group by using the NetScaler command line Configuring User GroupsShow system group Example Show system group groupName Example Parameters for configuring a user group Show system group groupNameGroupName Group Name UserName Built-in Command Policies Configuring Command PoliciesCLI Prompt CLI Idle Session Timeout Secs Creating Custom Command Policies Built-in Command Policies Policy name AllowsExcept show runningconfig, show Runningconfig, and sh gslb Matches these commands Command specification regular expression Parameters for configuring a command policy Sh system cmdPolicy ExamplePolicyname Action Binding Command Policies to Users and Groups Parameters for binding a command policy to a user Sh system user userName ExampleSh system user userName Priority Parameters for binding a command policy to a group Sh system group groupName ExampleSh system group groupName GroupName Resetting the Default Administrator nsroot Password To reset the nsroot password Example of a User Scenario Fsck /dev/ad0s1a Mount /dev/ad0s1a /flash Configuration steps Sample Values for Creating Entities Field Configuring External User Authentication Configuring Ldap Authentication Examples of Bind Distinguished Name Ldap server Examples of Base Distinguished Name Ldap server Base DNBind DN Authentication Type, select LDAP. Next to Server, click New Determining attributes in the Ldap directory Choosing Radius authentication protocols Configuring Radius AuthenticationAuthentication Type, select Radius Configuring IP address extraction Configuring NT4 Authentication Configuring TACACS+ AuthenticationAuthentication Type, select Tacacs Authentication Type, select NT4 Authentication and Authorization Snmp Importing MIB Files to the Snmp Manager and Trap Listener Enabling or Disabling an Snmp Alarm Enable snmp alarm alarm name Sh snmp alarm alarm name Configuring Alarms To configure an Snmp alarm by using the command lineParameters for configuring Snmp alarms Severity To configure Snmp alarms by using the configuration utility Configuring TrapsTo add an Snmp trap by using the NetScaler command line Parameters for configuring Snmp traps To configure Snmp Traps by using the configuration utility Enabling Unconditional Snmp Trap Logging Configuring the NetScaler for Snmp v1 and v2 Queries Specifying an Snmp ManagerParameters for unconditional Snmp trap logging SnmpTrapLogging Snmp Trap Logging To add an Snmp manager by using the NetScaler command line Show snmp manager Parameters for configuring an Snmp manager IPAddress To add an Snmp manager by using the configuration utility Parameters for configuring an Snmp community string Specifying an Snmp CommunitySh snmp community Permissions Configuring an Snmp Alarm for Throughput or PPS Configuring Snmp Alarms for Rate LimitingCommunity String*-communityName Show snmp alarm PF-RL-RATE-THRESHOLD Show snmp alarm PF-RL-PPS-THRESHOLD ThresholdValueNormalValue State Configuring Snmp Alarm for Dropped Packets Alarm Threshold-thresholdValue Normal Threshold-normalValue Configuring the NetScaler for SNMPv3 Queries Parameters for configuring an Snmp alarm for dropped packets Setting the Engine ID Configuring a View To set the engine ID by using the NetScaler command lineParameters for setting the engine ID To set the engine ID by using configuration utility Parameters for configuring an Snmp view Configuring a GroupTo add an Snmp group by using the NetScaler command line Configuring a User Parameters for configuring an Snmp groupTo configure a user by using the NetScaler command line SecurityLevel Parameters for configuring an Snmp user Citrix NetScaler Administration Guide Snmp Audit Logging Audit Logging Configuring Audit Servers Configuring the NetScaler Appliance for Audit LoggingShow audit syslogAction name Parameters for configuring auditing servers Show audit nslogAction nameServerIP ServerPort Log levels defined To configure an auditing server action Configuring Audit PoliciesTo configure a Syslog policy by using the command line Parameters for configuring audit policies To configure an Nslog policy by using the command lineRule To configure an audit server policy Binding the Audit Policies GloballyParameters for binding the audit policies globally Name* name Server* action Configuring Policy-Based Logging Configuring an Audit Message ActionTo globally bind the audit policy Pre Requisites StringBuilderExpr BypassSafetyCheckLogtoNewnslog Installing and Configuring the Nslog Server Binding Audit Message Action to a Policy Supported Platforms for the Nslog Server Operating system Installing Nslog Server on the Linux Operating SystemSoftware requirements Installing Nslog Server on the FreeBSD Operating System Pkginfo grep NSaudserver Pkgdelete NSaudserver To install Nslog server on a Windows operating system On the system, where you have downloaded the Nslog package Nslog Server Command Options To uninstall the Nslog server on a Windows operating systemAudserver -remove Audserver -stop To add the IP addresses of the NetScaler appliance Audserver -remove Specifies Running the Nslog Server Verifying the Nslog Server Configuration FileTo start audit server logging Creating Filters Customizing Logging on the Nslog ServerTo create a filter Specifying Log Properties Default Settings for the Log Properties Sample Configuration File audit.conf Following is a sample configuration file Web Server Logging Configuring the NetScaler Appliance for Web Server Logging Enabling or Disabling Web Server Logging Modifying the Default Buffer Size Parameter for modifying the buffer sizeSh weblogparam Example Buffer Size To modify the buffer size by using the configuration utility Supported Platforms for the Nswl Client Operating system Hardware requirements Installing Nswl Client on a Solaris Operating SystemCp pathtocd/Utilities/weblog/Solaris/NSweblog.tar /tmp Installing Nswl Client on a Linux Operating System Cd /tmpTar xvf NSweblog.tar Pkginfo grep NSweblog To view the installed Web server logging files Installing Nswl Client on a FreeBSD Operating SystemTo get more information about the NSweblog RPM file Pkgdelete NSweblog Installing Nswl Client on a Mac OS Operating SystemCp pathtocd/Utilities/weblog/macos/NSweblog.tgz /tmp Installing Nswl Client on a Windows Operating System To install the Nswl client on a Windows system Installing Nswl Client on an AIX Operating System To uninstall the Nswl client on a Windows systemCp pathtocd/Utilities/weblog/AIX/NSweblog.rpm /tmp Rpm -i NSweblog.rpm Nswl Client Command Options Nswl Command Options Nswl command Specifies To add the Nsip address of the NetScaler appliance Adding the IP Addresses of the NetScaler ApplianceNswl -addns -f directorypath \log.conf Verifying the Nswl Configuration File To verify the configuration in the Nswl configuration fileRunning the Nswl Client Customizing Logging on the Nswl Client System Parameters for Creating a Filter Specifies On OFF To create a filter for a virtual server LogFormat Ncsa Understanding the Ncsa and W3C Log Formats Ncsa Common Log Format W3C Extended Log Format Ncsa Common Log Format Argument Specifies Directives EntriesDirective Descriptions Fields IdentifiersPrefix Descriptions Specifies Examples W3C Extended Log Format Identifiers No Prefix Required Description Creating a Custom Log Format Creating a Custom Log Format by Using the Nswl LibraryField Description To create the custom log format by using the Nswl Library Creating a Custom Log Format Manually Sample Configuration File Creating Apache Log Formats Ncsa Arguments for Defining a Custom Log Format 11.Custom Log Format Argument Specifies Foobari Foobaro Formatt Time Format Definition 12.Time Format Definition Argument Specifies Argument Specifies 123 Web Server Logging 124 Advanced Configurations To add an NTP server by using the NetScaler command line Configuring Clock SynchronizationShow ntp server Example Parameters for configuring an NTP server ServerNameMinpoll Maxpoll Enable ntp sync Disable ntp sync Configuring Clock Synchronization ManuallyStarting or Stopping the NTP Daemon Show ns config Example Usr/sbin/ntpd -c /nsconfig/ntp.conf -l /var/log/ntpd.logViewing the System Date and Time Configuring TCP Window Scaling Show ns tcpParam Example Parameters for configuring window scalingWSVal Configuring Selective Acknowledgment Enabled Clearing the Configuration To enable Sack by using the Configuration Utility Parameters for clearing a configuration To clear a configuration by using the configuration utilityViewing the Http Band Statistics Level ReqBandSize RespBandSize Configuring Http Profiles To modify the band range by using the configuration utilityTo add an Http profile by using the NetScaler command line Built-in Http Profiles Built-in profile Description Parameters for adding an Http profile To add an Http profile by using the configuration utility Configuring TCP ProfilesBuilt-in TCP Profiles Built-in profile Description To add a TCP profile by using the NetScaler command line Parameters for creating a TCP profile To add a TCP profile by using the configuration utility Specifying a TCP Buffer Size Example Parameters for setting the TCP buffer size in a TCP profile BufferSize Parameters for specifying the MSS value in a TCP profile Specifying the MSS Value in a TCP ProfileMss Learn MSS for VServer LearnVsvrMSS Advanced Configurations 148 Web Interface How Web Interface Works Prerequisites Installing the Web Interface Web Interface tar file path Configuring the Web InterfaceJRE tar file path Parameters for configuring Web interface sites Gateway Direct Mode Authentication PointAccess Gateway URL Port Configuring a Web Interface Site for LAN Users Using Http XML Service AddressesXML Service Port Transport A Web Interface Site Configured for LAN Users Using Http Site Type Published Resource Type Kiosk Mode Virtual Server Protocol select Https IP Address Port Add service WILoopbackService 127.0.0.1 Http Configuring a Web Interface Site for LAN Users Using Https A Web Interface Site Configured for LAN Users Using Https 160 161 Add lb vserver Httpswi SSL 10.102.29.3 Configuring a Web Interface Site for Remote Users Using Agee A Web Interface Site Configured for Remote Users Using Agee 165 166 AppFlow How AppFlow Works NetScaler Flow Sequence Flow Records Templates Configuring the AppFlow Feature To specify a collector by using the NetScaler command line Enabling or Disabling the AppFlow FeatureSpecifying a Collector Configuring an AppFlow Action To remove a collector by using the NetScaler command lineTo specify a collector by using the configuration utility Parameters for specifying a collector Collectors Parameters for configuring an AppFlow actionComment Configuring an AppFlow Policy Show appflow policy name Parameters for configuring an AppFlow policy Rule Action To add an expression by using the Add Expression dialog box Http Binding an AppFlow Policy Show appflow global Parameters for binding an AppFlow policy GotoPriorityExpressionInvoke Invoke flag LabelType LabelName Enabling AppFlow for Virtual Servers Click Apply Changes Enabling AppFlow for a Service Setting the AppFlow Parameters AppFlow Parameters HttpCookie HttpRefererHttpMethod HttpHost Reporting Tool To invoke the Reporting tool Using the Reporting ToolWorking with Reports Using Built-in Reports Creating and Deleting Reports Modifying the Time Interval Time Intervals Time interval Displays Setting the Data Source and Time Zone Exporting and Importing Custom Reports Adding a Chart Working with ChartsModifying a Chart Viewing a Chart To change the graph type of a chart To view numeric data for a graph To change the color and graph type of a data set To export chart data to Excel Deleting a ChartExamples Stopping and Starting the Data Collection Utility Limits on Entity Numbers Retrieved by nscollect Entity name To stop nscollect To start nscollect on the local systemEntity name Limit Netscaler/nscollect stop To start nscollect on the remote system Netscaler/nscollect start