Citrix Systems CITRIX NETSCALER 9.3 Customizing Logging on the NSLOG Server, Creating Filters

Citrix NetScaler Administration Guide

audserver -stopservice

Customizing Logging on the NSLOG Server

You can customize logging on the NSLOG server by making additional modifications to the NSLOG server configuration file (log.conf). Use a text editor to modify the log.conf configuration file on the server system.

To customize logging, use the configuration file to define filters and log properties.

wLog filters. Filter log information from a NetScaler appliance or a set of NetScaler appliances.

wLog properties. Each filter has an associated set of log properties. Log properties define how to store the filtered log information.

Creating Filters

You can use the default filter definition located in the configuration file (audit log.conf ), or you can modify the filter or create a new filter. You can create more than one log filter.

Note: For consolidated logging, if a log transaction occurs for which there is no filter definition, the default filter is used (if it is enabled.) The only way you can configure consolidated logging of all the Citrix NetScaler appliances is by defining the default filter.

To create a filter

At the command prompt, type the following command in the configuration file

(auditlog.conf) :

filter <filterName> [IP <ip>] [NETMASK <mask>] [ON OFF]

<filterName>: Specify the name of the filter (maximum of 64 alphanumeric characters).

<ip>: Specify the IP addresses.

<mask>: Specify the subnet mask to be used on a subnet.

Specify ON to enable the filter to log transactions, or specify OFF to disable the filter. If no argument is specified, the filter is ON

Examples

filter F1 IP 192.168.100.151 ON

To apply the filter F2 to IP addresses 192.250.100.1 to 192.250.100.254:

filter F2 IP 192.250.100.0 NETMASK 255.255.255.0 ON

89